Harden backend contracts and documentation

docs/internal/runner.md

@@ -18,10 +18,11 @@ and override semantics consumed by the runner.
 
 `Runner` coordinates narrow internal interfaces for prompt definitions,
 profiles, backend resolution, artifacts, rendering, model generation, and
-validation. The root engine supplies an immutable built-in backend registry.
-Schema documents are loaded through the validator's optional schema-loader
-interface. An output repairer can be injected internally, but the ordinary
-runner constructor does not enable one.
+validation. The root engine supplies one immutable registry containing the
+built-in backend and validated consumer additions. Schema documents are loaded
+through the validator's optional schema-loader interface. An output repairer
+can be injected internally, but the ordinary runner constructor does not
+enable one.
 
 Each invocation carries its state in request, prepared-run, and result values.
 The runner has no durable run or session store.
@@ -53,6 +54,10 @@ apply in that order. A profile requiring a direct key clears an inherited
 backend environment name unless the request supplies its own name. Secret
 values remain excluded from serialized metadata.
 
+The registry is read-only after engine construction. Concurrent `Prepare` and
+`Run` calls resolve independent defensive backend values and keep all
+invocation state local.
+
 ## Run Flow
 
 `Run` calls `Prepare` rather than maintaining a second preparation path. It