Reconcile reliable execution documentation

docs/internal/observation.md

@@ -4,9 +4,9 @@
 aggregation, measured phase totals, and synchronous metadata event delivery.
 Its event values and callback type live in `internal/domain` so internal
 requests can carry them without depending on the recorder package. The
-recorder currently supplies run IDs to the runner and receives attempt and
-retry-delay measurements from the generation coordinator. Run lifecycle
-instrumentation for ordinary `Run` runs at the facade and runner boundaries.
+recorder supplies run IDs to the runner and receives attempt and
+retry-delay measurements from the generation coordinator. Ordinary `Run`
+lifecycle instrumentation spans the facade and runner boundaries.
 Prepared execution starts only after its private payload is atomically claimed;
 the facade receives that invocation's recorder privately and emits the terminal
 event after public error mapping. Failed claims and preparation emit nothing.
@@ -17,6 +17,12 @@ callback. The caller supplies normalized failure metadata; the recorder never
 parses an error string or receives provider bodies, credentials, headers, or
 other content. Events are values with no mutable containers. Callback panics
 propagate to the caller.
+Per-operation callbacks are ordered and synchronous; different operations may
+invoke the same callback concurrently. The recorder marks each measured phase's
+end before delivery, so callback work does not inflate provider duration.
+Terminal phase durations sum measured phases, while wall duration may also
+include preparation, validation, and callbacks. Panics do not promise a
+terminal event.
 
 Attempt usage is known when its explicit presence bit is true. For legacy
 injected clients without presence metadata, nonzero counts are known and