Document stateless output operations

docs/policy/architecture.md

@@ -10,9 +10,10 @@ package inventory; focused documents in `docs/internal/` own implementation deta
 
 Weatherreporter is a deterministic weather-report CLI. It collects normalized
 weather data, derives facts and modules, builds a curated YAML data package,
-compares prior snapshots, executes exact-version Promptkit prompts, validates
-structured generated prose, and renders repository-owned Markdown. Completed
-managed Markdown may be uploaded through Distributor.
+executes exact-version Promptkit prompts, validates structured generated prose,
+and renders repository-owned Markdown in memory. Completed Markdown is
+atomically published to an operator-owned output destination and may then be
+uploaded through Distributor.
 
 The supported report products are Daily, Today, Tomorrow, and Hourly. A batch
 collects once, validates its complete candidate prompt/profile set before
@@ -25,14 +26,12 @@ after every planned report succeeds.
 - `internal/cli` owns command parsing, help, summaries, and one executor
   construction per action.
 - `internal/config` owns defaults, loading, validation, and secret loading.
-- `internal/app` owns workflow order, partial results, and notification
-  coordination through project-owned contracts.
+- `internal/app` owns in-memory workflow order, partial results, atomic output
+  publication, and notification coordination through project-owned contracts.
 - Deterministic domain packages own weather derivation, report periods, modules,
   generated-text validation, and template contexts.
 - `internal/adapters/weatherapi`, `internal/adapters/promptkit`, and
   `internal/adapters/distributor` own their external dependency mechanics.
-- `internal/state` owns workspace paths, V2 metadata, atomic persistence, and
-  read-only inspection.
 
 Dependency-specific Promptkit types remain inside its adapter. The application
 does not parse flags, construct provider clients, or render provider output
@@ -41,28 +40,29 @@ directly.
 ## Prompt Execution Invariants
 
 - Prompts receive curated module packages, never unbounded raw weather payloads.
-- Every execution inspects the exact prompt version and output contract before
+- Every execution validates the exact prompt version and output contract before
   collection. The selected profile is configured explicitly or declared by the
   prompt; unsupported direct-key profiles and missing reported credentials fail
   before collection.
-- Prepared execution persists safe preparation provenance before provider work.
-  Completed execution persists safe execution provenance; raw output is
-  validated before template rendering.
+- Prompt and profile validation completes before weather collection. Raw output
+  is validated before template rendering.
 - Generated text fills defined prose slots only. Deterministic facts remain
   authoritative and repository-owned templates produce all managed Markdown.
 - Sensitive rendered prompts, schemas, input bodies, provider endpoints, and
-  credentials never enter normal metadata, summaries, logs, or workspace
-  artifacts. They are written only to an explicit secure debug root when
-  requested.
+  credentials never enter normal summaries or logs. They are written only to
+  an explicit secure debug root when requested.
 
-## State, Notification, And Testing Invariants
+## Output, Notification, And Testing Invariants
 
-- Managed writes are atomic where practical and stay beneath the configured
-  workspace root. Reached artifacts remain inspectable after later failures.
-- New records use `weatherreporter.metadata.v2`; V1 records remain readable for
-  inspection compatibility.
-- Distributor uploads use only the managed Markdown report, never output copies
-  or workspace scans. Notification follows report and final metadata success.
+- Normal execution is stateless: it keeps weather data, prompt input, generated
+  text, and render context in memory and creates no application-owned durable
+  state.
+- Markdown writes are atomic at an operator-selected destination. A
+  pre-publication failure does not replace an existing destination; a
+  notification failure does not remove a newly published output.
+- Distributor uploads use only the published Markdown output, never a scan of
+  local files. Single notification follows publication; batch notification
+  follows publication of every selected report.
 - Default tests are deterministic, offline, and use Promptkit/provider fakes
   rather than live provider calls. See the [testing policy](testing.md).