Document Weatherreporter v0.11.0

README.md

@@ -14,9 +14,10 @@ weatherreporter generate today
 
 Configure a Weather API endpoint first; see the
 [configuration reference](docs/config.md). The report is written to
-`today.md` in the current directory; use `--out` to choose another destination.
-See the [CLI reference](docs/cli.md) and [operations guide](docs/operations.md)
-for command and operating details.
+`today.md` in the current directory when `output.directory` is not configured.
+Set that configuration value for an ordinary publication directory, or use
+`--out` for one command. See the [CLI reference](docs/cli.md) and [operations
+guide](docs/operations.md) for command and operating details.
 
 ## Documentation
 

docs/cli.md

@@ -9,9 +9,10 @@ It has no command for inspecting prior runs or application-owned state.
 weatherreporter generate today
 ```
 
-The command uses the configured Weather API and writes an atomically replaced
-`today.md` in the current directory. See the [configuration reference](config.md)
-to supply the required Weather API endpoint.
+The command uses the configured Weather API and atomically writes `today.md`.
+With no configured output directory, it writes in the current directory. See
+the [configuration reference](config.md) to supply the required Weather API
+endpoint and choose an ordinary output directory.
 
 ## Commands And Usage
 
@@ -36,7 +37,7 @@ builds report `development`.
 | `generate today` | Accepts an optional `--date YYYY-MM-DD`; without it, the current local date in the effective report timezone is used. Its default filename is `today.md`. |
 | `generate tomorrow` | Uses the next local civil day and writes `tomorrow.md` by default. |
 | `generate hourly` | Covers the next six hours in the effective report timezone and writes `hourly.md` by default. It does not accept `--date`, `--hours`, or `--duration`. |
-| `run morning` and `run evening` | Run their defined report batches and write each selected report beneath the current directory unless `--out-dir` selects another directory. `--out` is not accepted. |
+| `run morning` and `run evening` | Run their defined report batches beneath the configured output directory, or the current directory when none is configured. `--out-dir` selects another directory. `--out` is not accepted. |
 
 `generate` accepts the four report command names shown above. `run` accepts
 only `morning` and `evening`. Batch membership and notification ordering are
@@ -44,12 +45,14 @@ described in the [operations guide](operations.md).
 
 ## Output, Errors, And Quiet Mode
 
-For `generate`, the default output is the report's filename in the current
-directory. `--out PATH` selects one output file instead. A relative path is
-resolved from the current directory; an absolute path is used as given. For a
-batch, the equivalent default is the current directory and `--out-dir PATH`
-selects its output directory. Successful summaries always report the resulting
-absolute `outputPath` values.
+For `generate`, the report's default filename is placed beneath
+`output.directory` when configured, otherwise the current directory. `--out
+PATH` selects one complete output file instead. A relative path is resolved
+from the current directory; an absolute path is used as given. For a batch,
+the configured directory has the same role and `--out-dir PATH` selects its
+output directory instead. Successful summaries always report the resulting
+absolute `outputPath` values. See the [configuration reference](config.md) for
+the field's validation and path rules.
 
 Outputs are written atomically. A generation, rendering, write, or cancellation
 failure before publication leaves an existing destination unchanged. A
@@ -118,9 +121,9 @@ batch=morning total=2 succeeded=2 failed=0
 | `--config PATH` | all commands | Load `PATH` instead of `/usr/local/etc/weatherreporter/config.yml`. |
 | `--units VALUE` | `generate`, `run` | Override `weather_api.units` for this command. |
 | `--tz NAME` | `generate`, `run` | Override `weather_api.timezone` for this command. |
-| `--out PATH` | every `generate` command | Write the report to this file instead of its current-directory default. |
+| `--out PATH` | every `generate` command | Write the report to this complete file destination instead of the configured or current-directory default. |
 | `--llm-debug-dir PATH` | every `generate` and `run` command | Write requested sensitive prompt diagnostics under this absolute path. |
-| `--out-dir PATH` | `run morning`, `run evening` | Write batch reports beneath this directory instead of the current directory. |
+| `--out-dir PATH` | `run morning`, `run evening` | Write batch reports beneath this directory instead of the configured or current-directory default. |
 | `--quiet` | `generate`, `run` | Suppress action summaries and routine batch status output. |
 | `--date YYYY-MM-DD` | `generate daily`, `generate today` | Required for Daily; optional for Today. |
 

docs/config.md

@@ -81,6 +81,30 @@ Missing directories, unreadable files, subdirectories, symlinks, non-regular
 files, and invalid names fail configuration loading. Put only secret values in
 this directory, never in the YAML file.
 
+### `output`
+
+`output.directory` selects the ordinary operator-owned publication directory
+for both individual reports and batches.
+
+| Field | Default | Rules |
+| --- | --- | --- |
+| `directory` | empty | An omitted or empty value uses the invocation working directory. A nonempty value must contain at least one non-whitespace character. |
+
+The configured value is preserved while configuration loads: it is not cleaned,
+made absolute, inspected, created, or expanded through environment variables or
+a home-directory shortcut. At execution, an absolute directory is used as
+given; a relative directory resolves from the invocation working directory, not
+from the configuration file's location. A missing directory is created when a
+report is successfully published. An existing non-directory or an uninspectable
+path fails output preflight before prompt inspection, weather collection, or
+publication.
+
+For one `generate` command, `--out` is a complete file destination and takes
+precedence over `output.directory`. For `run`, `--out-dir` takes precedence.
+Those explicit flags do not inspect or rebase beneath the configured directory.
+See the [CLI reference](cli.md) for command selection and the [operations
+guide](operations.md) for publication and failure handling.
+
 ### `notify.distributor`
 
 Distributor notification is disabled by default. Its fields are:

docs/internal/app-orchestration.md

@@ -4,7 +4,7 @@
 
 ## Single-Report Flow
 
-`GenerateDetailed` resolves the requested report and output destination, then initializes an optional explicit debug writer. It validates the exact Promptkit prompt and selected profile before collecting weather data. The resolved profile, backend, and model are carried in the active result.
+`GenerateDetailed` resolves the requested report and output destination before initializing an optional explicit debug writer. An explicit output file wins; otherwise the configured output directory is used, falling back to the captured working directory. It validates the exact Promptkit prompt and selected profile before collecting weather data. The resolved profile, backend, and model are carried in the active result.
 
 The workflow builds facts, a module snapshot, briefing metadata, and the YAML prompt package in memory. It executes Promptkit, validates the returned generated text, builds a render context, and renders Markdown. `fileutil` atomically writes the completed Markdown to the selected output path. Only after that write succeeds does single-report notification run.
 
@@ -12,7 +12,7 @@ Failures return an active partial result with safe identity, profile, warning, v
 
 ## Batches
 
-`RunBatchDetailed` captures one output directory, creates at most one explicit debug writer, and uses one executor. Before collection it validates the prompt and profile candidates for the selected batch. It collects once, calculates the data-dependent plan, then validates and retains the final output path for every planned report before invoking the same generation core sequentially.
+`RunBatchDetailed` selects an explicit output directory first, otherwise the configured directory and then the captured working directory. It does this before creating at most one explicit debug writer or validating prompt and profile candidates for the selected batch. It collects once, calculates the data-dependent plan, then validates and retains the final output path for every planned report before invoking the same generation core sequentially.
 
 Each item has an independent result. A failed item does not stop later items; successful items retain their published output paths. Per-report notification is suppressed during a batch. Batch notification runs only after every planned report has published successfully. It is skipped when any item failed. Batch result counters count report items only; a batch notification failure is represented by the top-level notification result and still produces a failed batch outcome.
 

docs/internal/cli.md

@@ -4,7 +4,7 @@
 
 The root `--version` flag reports the build version supplied by `internal/buildinfo`. Tagged release builds replace its development default at link time.
 
-For each `generate` or `run` action, `Runner` constructs one project-owned Promptkit executor after configuration loads. It captures an absolute working directory, resolves a relative output override against it, and passes the working directory, resolved override, and any `--llm-debug-dir` request to the app. With no override, the app derives the report filename in that working directory. `run` uses the same resolution rule for `--out-dir`.
+For each `generate` or `run` action, `Runner` constructs one project-owned Promptkit executor after configuration loads. It captures an absolute working directory, resolves only a relative explicit output override against it, and passes the working directory, loaded configuration, resolved override, and any `--llm-debug-dir` request to the app. The raw configured fallback remains in the configuration for app-owned destination selection. `run` uses the same explicit-resolution rule for `--out-dir`.
 
 The CLI dispatches only generation and batch actions. It has no persisted-run or inspection dispatch. Summaries include report identity, status, output path, effective profile/backend/model, source warnings, validation, requested debug path, and notification result when available. They intentionally exclude prompt input, raw generated text, render context, endpoints, credentials, and full Distributor payloads. A failed action with a partial result still emits its safe summary before its error is returned.
 

docs/operations.md

@@ -13,12 +13,20 @@ After configuring a Weather API endpoint, generate one report:
 weatherreporter generate today
 ```
 
-The command writes `today.md` in the current directory. Choose a different
-operator-owned file with `--out`; a relative path is resolved from the current
-directory and an absolute path is used directly. Weatherreporter renders in
-memory and atomically replaces the selected destination only after generation
-and rendering succeed. It does not create a default workspace, metadata,
-receipts, or intermediate output files.
+With no configured output directory, the command writes `today.md` in the
+current directory. Set `output.directory` to use one ordinary publication
+directory for reports, or choose a one-command operator-owned file with
+`--out`; a relative path is resolved from the current directory and an absolute
+path is used directly. The explicit flag takes precedence over the configured
+directory. Weatherreporter renders in memory and atomically replaces the
+selected destination only after generation and rendering succeed. It does not
+create a default workspace, metadata, receipts, or intermediate output files.
+
+A missing configured directory is created only as part of successful report
+publication. If its existing path is not a directory or cannot be inspected,
+the command stops before prompt inspection or weather collection, leaving any
+existing report unchanged. See the [configuration reference](config.md) for the
+field definition and validation rules.
 
 Before a destination is published, provider, validation, rendering, write, and
 cancellation failures leave an existing report unchanged. A notification
@@ -36,7 +44,9 @@ Run a scheduled batch with an explicit output directory when appropriate:
 weatherreporter run morning --out-dir ./reports
 ```
 
-Without `--out-dir`, batch reports are written beneath the current directory.
+Without `--out-dir`, batch reports are written beneath `output.directory` when
+configured, otherwise the current directory. The explicit directory applies
+only to that command and takes precedence over the configured fallback.
 Morning runs Today, Tomorrow, and every eligible dated Daily Report; evening
 runs Tomorrow and the same eligible Daily Reports. Eligible Daily dates begin
 after tomorrow and require complete hourly coverage for their local civil day.

docs/policy/architecture.md

@@ -62,6 +62,8 @@ directly.
   pre-publication failure, including cancellation observed immediately before
   publication, does not replace an existing destination; a notification failure
   does not remove a newly published output.
+- Configuration or explicit CLI input selects that operator-owned destination;
+  it does not create an application-owned state boundary.
 - Distributor uploads use only the published Markdown output, never a scan of
   local files. Single notification follows publication; batch notification
   follows publication of every selected report. Batch counters describe report

docs/releases/v0.10.1.md

@@ -0,0 +1,33 @@
+# Weatherreporter v0.10.1
+
+This release repairs release validation after the `v0.10.0` pipeline failed in
+its privileged build container. Application behavior is unchanged from
+`v0.10.0`.
+
+## Summary
+
+The unreadable-secret configuration test now verifies that its process is
+actually subject to file permission bits before asserting that a mode-`000`
+file cannot be read. This keeps the test meaningful for ordinary users while
+allowing the release suite to run correctly in privileged containers.
+
+## Compatibility
+
+This patch release makes no changes to Weatherreporter's CLI, configuration,
+report output, integrations, prompts, profiles, or operating behavior. It is
+fully compatible with `v0.10.0`.
+
+## Upgrade
+
+No special operator action is required. Use `v0.10.1` in place of `v0.10.0`;
+the `v0.10.0` tag remains immutable, but its failed pipeline did not publish
+release binaries.
+
+## Changes
+
+- Made the unreadable-secret test capability-aware when the test process can
+  bypass filesystem permission bits.
+- Preserved the production contract that genuinely unreadable secret files
+  fail configuration loading.
+- Restored portable release validation in Woodpecker's privileged Go
+  container.

docs/releases/v0.11.0.md

@@ -0,0 +1,37 @@
+# Weatherreporter v0.11.0
+
+This release adds a configurable default publication directory for generated
+weather reports.
+
+## Summary
+
+Operators can now set `output.directory` once for both individual reports and
+scheduled batches. Explicit `--out` and `--out-dir` destinations continue to
+take precedence, while installations that omit the setting retain the existing
+current-directory behavior.
+
+## Compatibility
+
+This release is additive and compatible with `v0.10.1`. Existing configuration
+files, commands, report filenames, Promptkit behavior, and Distributor
+notification behavior remain valid and unchanged.
+
+## Upgrade
+
+No special action is required. To use the new default destination, configure
+`output.directory` as described in the [configuration
+reference](../config.md). Existing deployments may continue using the current
+working directory or explicit CLI output flags.
+
+## Changes
+
+- Added strict configuration loading and validation for the optional
+  `output.directory` field.
+- Applied the configured directory consistently to `generate` and `run`, with
+  explicit CLI destinations retaining highest precedence.
+- Preserved relative-path handling, absolute result paths, atomic publication,
+  cancellation safety, and Distributor notification ordering.
+- Strengthened output preflight so existing non-directory paths, uninspectable
+  paths, and dangling symlink components fail before expensive report work.
+- Updated the [CLI reference](../cli.md) and [operations
+  guide](../operations.md) for the new destination-selection behavior.

docs/roadmap/profile-comparison.md

@@ -0,0 +1,397 @@
+# LLM Profile Comparison Roadmap
+
+Status: Accepted; unimplemented.
+
+## Purpose
+
+Prompt development currently requires separate Weatherreporter invocations to
+compare several LLM profiles. Those invocations may collect different weather
+snapshots or rebuild inputs at different times, making model output harder to
+compare and slowing prompt iteration.
+
+Weatherreporter should provide a first-class `compare` command that resolves
+one report, prepares one exact data package, executes the same prompt and data
+package concurrently through several explicitly selected Promptkit profiles,
+and publishes a self-contained local comparison bundle.
+
+An illustrative invocation is:
+
+```sh
+weatherreporter compare daily \
+  --date 2026-08-24 \
+  --profile weather-light \
+  --profile weather-balanced \
+  --profile weather-deep
+```
+
+This is a prompt-development workflow, not an automated model evaluator. Its
+output gives a maintainer consistent evidence for human comparison without
+assigning scores or selecting a winner.
+
+## Prerequisite
+
+Configurable output directories are implemented. Profile comparison must reuse
+the current [configuration reference](../config.md) and [operations
+guide](../operations.md) rather than introduce a second destination policy.
+
+## User Intent
+
+The command is intended for deliberate evaluation of multiple profiles,
+including sets of eight to twelve candidate models. Concurrency is part of the
+feature, not a future optimization. Promptkit should retain ownership of
+backend-specific capacity, while Weatherreporter owns comparison-wide
+coordination, cancellation, deterministic results, and artifact publication.
+
+Every profile must receive byte-for-byte identical prompt input. Weather data,
+derived facts, modules, prompt metadata, and serialized YAML must not be
+recollected or rebuilt separately for individual profiles.
+
+Comparison bundles are explicitly requested, operator-owned development
+outputs. They are not Weatherreporter state, are never read implicitly by a
+later run, and do not weaken the ordinary stateless execution model.
+
+## Command Contract
+
+The command form is:
+
+```text
+weatherreporter compare REPORT [options]
+```
+
+`REPORT` accepts the implemented generated-text reports: `daily`, `today`,
+`tomorrow`, and `hourly`. Report-date behavior matches `generate`: `daily`
+requires `--date`, `today` may accept an explicit date or use the current local
+date, and the remaining report types retain their existing period policies.
+
+The command accepts the applicable common generation options, including
+`--config`, `--units`, `--tz`, `--date`, `--llm-debug-dir`, and `--quiet`, plus:
+
+- repeatable `--profile PROFILE_ID` selections;
+- `--out-dir PATH` for the exact comparison-bundle directory; and
+- `--replace` to authorize guarded replacement of a recognized existing
+  comparison bundle.
+
+At least two distinct, nonblank profile IDs are required. Their command-line
+order is significant and is preserved in filenames, summaries, and
+`comparison.json`. Duplicate profile IDs are rejected rather than silently
+deduplicated or executed twice.
+
+Profiles are always explicit for this command. `promptkit.profile` does not add
+or replace a comparison selection, but all other effective Promptkit settings,
+profile-source precedence, local backend configuration, credential lookup, and
+profile overrides remain in force.
+
+The initial feature has no Weatherreporter-specific concurrency flag or
+artificial profile-count ceiling. The explicit profile list bounds the
+comparison, and Promptkit owns capacity enforcement for each selected backend.
+
+## Preparation And Execution Invariants
+
+A comparison has this logical lifecycle:
+
+1. Parse and validate the report, date, profile list, configuration, output
+   destination, and replacement authorization.
+2. Resolve the report definition, valid period, prompt identity, and default
+   output name once.
+3. Inspect the exact prompt once and preflight every selected profile,
+   including its effective backend, model, and required credential
+   availability, before weather collection.
+4. Collect weather data exactly once.
+5. Build collected and derived facts, the module snapshot, briefing metadata,
+   and the prompt data package exactly once.
+6. Marshal the data package to one immutable YAML byte sequence exactly once.
+7. Execute the exact prompt version concurrently for every selected profile,
+   passing the same immutable YAML bytes to every execution.
+8. Validate and render each profile result independently from the shared
+   deterministic inputs.
+9. Assemble results in requested-profile order and publish one coherent
+   comparison bundle.
+
+This lifecycle describes the required end-state behavior rather than an
+implementation-stage sequence.
+
+No profile execution may cause recollection, report re-resolution, module
+rebuilding, or data-package remarshalling. Prompt execution may perform
+Promptkit-owned validation or repair behavior, but Weatherreporter does not
+retry a failed comparison execution independently.
+
+## Concurrency And Cancellation
+
+Weatherreporter starts one execution for each preflighted profile and permits
+them to run concurrently through one shared, concurrency-safe Promptkit
+executor. Promptkit's engine-local backend pools remain authoritative for
+backend concurrency and waiting capacity. Profiles routed to a limited local
+backend therefore respect its configured limit, while profiles routed to
+other backends may proceed independently.
+
+Weatherreporter must not add a second semaphore that obscures or overrides
+Promptkit's backend policy. It must safely coordinate goroutine lifecycles,
+result collection, debug callbacks, and output assembly without data races.
+
+One profile failure does not cancel its peers. Provider, capacity, validation,
+and rendering failures are recorded for that profile while other executions
+continue. Cancellation or deadline expiration of the comparison command is
+propagated to every outstanding execution, prevents new publication, and is
+joined without leaking goroutines.
+
+Completion order must not affect filenames, manifest order, CLI summaries, or
+error aggregation. Those outputs always follow the original `--profile`
+order.
+
+## Output Destination
+
+Without `--out-dir`, Weatherreporter derives a comparison directory from the
+resolved report's existing default Markdown filename by removing `.md` and
+prefixing `comparison-`:
+
+| Report output | Comparison directory |
+| --- | --- |
+| `today.md` | `comparison-today/` |
+| `tomorrow.md` | `comparison-tomorrow/` |
+| `hourly.md` | `comparison-hourly/` |
+| `daily-2026-08-24.md` | `comparison-daily-2026-08-24/` |
+
+The derived directory is created beneath `output.directory` when configured,
+or beneath the present working directory otherwise. An explicit `--out-dir`
+is the exact bundle directory, resolves relative to the present working
+directory when necessary, and overrides `output.directory` completely.
+
+All destination selection and validation completes before weather collection.
+The resolved comparison directory is returned in the command's structured
+result.
+
+## Comparison Bundle
+
+A successful three-profile comparison has a flat layout:
+
+```text
+comparison-daily-2026-08-24/
+├── comparison.json
+├── data-package.yml
+├── 01-weather-light.md
+├── 02-weather-balanced.md
+└── 03-weather-deep.md
+```
+
+`data-package.yml` contains the exact YAML bytes passed to every Promptkit
+execution. It is written once and its SHA-256 digest is recorded in the
+manifest.
+
+Each report filename begins with its one-based, zero-padded selection position
+and a filesystem-safe representation of the requested logical profile ID. The
+safe representation must not permit absolute paths, traversal, separators, or
+control characters. The manifest retains the exact case-sensitive profile ID,
+so filename normalization never becomes the authority for profile identity.
+
+`comparison.json` is the authoritative index for the bundle. It uses an
+explicit schema version and records safe comparison information including:
+
+- comparison identity and start and finish timestamps;
+- report ID, resolved valid period, and effective timezone;
+- prompt ID, version, and inspected prompt hash;
+- the relative data-package filename and SHA-256 digest;
+- total, succeeded, and failed profile counts; and
+- one ordered result per requested profile containing the exact profile ID,
+  resolved backend and model, relative report filename when present,
+  execution and validation status, and safe error information when failed.
+
+The manifest and normal command summary must not contain credentials, provider
+request bodies, raw model output, rendered prompts, schemas, provider
+endpoints, or other content-rich diagnostics. The explicit data package and
+generated reports contain the development material the user requested and
+must be handled as operator-owned potentially sensitive output.
+
+## Failure And Publication Policy
+
+Failure before concurrent execution, including invalid profiles, missing
+credentials, collection failure, preparation failure, or unsafe destination,
+publishes no comparison bundle and performs no model calls where the failure
+is discoverable during preflight.
+
+After execution begins, Weatherreporter waits for every non-cancelled profile.
+If one or more profiles fail, it still publishes a coherent partial bundle
+containing `data-package.yml`, every successfully rendered report, and a
+manifest describing all successes and failures. It then returns a non-zero
+exit status. A failed profile has no report file unless a future contract
+explicitly introduces a separately named diagnostic artifact.
+
+Bundle contents are staged outside the destination and published only after
+the manifest is complete. Ordinary publication accepts only an absent or empty
+target directory. A nonempty existing directory fails without modification
+unless `--replace` is present.
+
+`--replace` may replace only the exact resolved target and must reject broad or
+unsafe targets such as a filesystem root, the present working directory, a
+symlink, or an unrecognized nonempty directory. A recognized prior bundle must
+contain a valid Weatherreporter comparison manifest. Replacement publishes the
+new complete or coherent partial bundle as a unit, prevents stale reports from
+the prior comparison from surviving, and preserves or restores the prior
+bundle if the final replacement operation fails.
+
+An interrupted or cancelled comparison does not replace an existing bundle.
+Temporary staging artifacts are cleaned up on ordinary failure and
+cancellation without scanning or modifying unrelated directories.
+
+## Prompt Debugging
+
+The existing `--llm-debug-dir` mechanism remains available. Concurrent
+comparison executions require distinct, deterministic debug identities that
+include the comparison and exact profile selection so callbacks cannot collide
+or overwrite another profile's artifacts.
+
+Debug writing must be concurrency-safe and retain the existing permission,
+redaction, explicit-opt-in, and path-containment guarantees. Debug artifacts
+remain separate from the comparison bundle; the bundle does not implicitly
+enable full Promptkit diagnostics.
+
+## Notification Policy
+
+Profile comparisons never invoke Distributor notification, even when
+notification is enabled in the effective configuration. Comparison reports
+are local development artifacts rather than ordinary report publications.
+
+Adding comparison publication or upload behavior would require a separate
+accepted feature scope and explicit operator authorization.
+
+## Architectural End State
+
+Application orchestration exposes a reusable prepared-report boundary that
+contains the resolved report, shared collected and derived facts, module
+snapshot, briefing metadata, generated-text handler, render inputs, and exact
+serialized data package. That boundary is immutable during concurrent profile
+execution.
+
+Ordinary `generate` behavior continues to prepare once and execute once.
+`compare` prepares once and executes many without duplicating the generation
+workflow or calling `GenerateDetailed` in a loop. Shared preparation,
+profile-specific Promptkit execution, structured-output validation, rendering,
+and artifact publication remain distinct responsibilities.
+
+The Promptkit adapter remains the only owner of dependency-specific types and
+engine calls. The CLI owns parsing and user-facing summaries. The configuration
+package owns configuration. Application orchestration owns comparison order,
+concurrency lifecycle, failure aggregation, and bundle publication. Domain,
+prompt-input, generated-text, and template packages retain their existing
+deterministic contracts.
+
+## Scope
+
+The completed feature includes:
+
+- the `compare` CLI command for every implemented generated-text report;
+- repeatable explicit profile selection and validation;
+- configured and CLI output-directory integration after the prerequisite
+  feature lands;
+- one-time report resolution, collection, deterministic preparation, and YAML
+  serialization;
+- concurrent execution through one Promptkit executor with backend capacity
+  respected;
+- independent validation and rendering with deterministic ordered results;
+- the flat, versioned comparison-bundle contract;
+- safe filename derivation and data-package hashing;
+- coherent partial-result publication and non-zero failure behavior;
+- guarded whole-bundle replacement through `--replace`;
+- comparison-aware, concurrency-safe optional prompt debugging;
+- explicit suppression of Distributor notification;
+- structured normal and quiet-mode CLI behavior consistent with existing
+  commands;
+- focused race-safe tests across configuration, CLI, application,
+  Promptkit-adapter, rendering, and filesystem boundaries; and
+- updates to every affected canonical user, operator, architecture,
+  integration, and internal document.
+
+## Compatibility
+
+The feature is additive. Existing `generate` and `run` commands, report
+definitions, profile defaults, configuration, output filenames, notification
+behavior, and exit contracts remain unchanged.
+
+The comparison manifest and bundle layout begin as versioned contracts. They
+do not become inputs accepted by Weatherreporter, and no backward-compatible
+replay or long-term archive guarantee is implied beyond identifying the schema
+used to interpret a produced bundle.
+
+## Testing Expectations
+
+Tests should provide durable coverage for:
+
+- report and date parsing consistent with `generate`;
+- rejection of fewer than two profiles, blanks, and duplicates;
+- inspection of the exact prompt and every profile before collection;
+- no collection or model execution after a preflight failure;
+- exactly one weather collection and one preparation for several profiles;
+- byte-for-byte identical data-package input in every execution;
+- observable concurrent execution through a concurrency-safe fake executor;
+- respect for Promptkit-owned backend capacity in an assembled adapter test
+  where that integration adds distinct confidence;
+- deterministic filenames, manifest order, summaries, and errors under varied
+  completion order;
+- continuation and coherent partial publication after one profile fails;
+- cancellation propagation, goroutine completion, and preservation of an
+  existing destination;
+- destination precedence and each derived default directory;
+- safe filename handling for unusual valid profile IDs;
+- absent, empty, occupied, symlinked, unsafe, recognized, and unrecognized
+  replacement targets;
+- removal of stale prior report files during authorized whole-bundle
+  replacement;
+- exact package digest and manifest/result consistency;
+- concurrency-safe, non-colliding opt-in debug artifacts; and
+- absence of Distributor calls for complete and partial comparisons.
+
+Concurrency and replacement behavior require race-enabled and consequential
+failure-path coverage. Tests must remain deterministic, offline, credential
+free, and independent of real Promptkit providers or machine-specific paths.
+
+## Documentation End State
+
+Once implemented, the [CLI reference](../cli.md) owns command syntax, flags,
+summary, and exit behavior. The [operations guide](../operations.md) owns the
+bundle lifecycle, replacement procedure, sensitivity guidance, and practical
+prompt-comparison workflow. The [architecture policy](../policy/architecture.md)
+owns the statelessness, concurrency, notification, and publication invariants.
+
+The [Promptkit integration guide](../integrations/promptkit.md) should describe
+the consumer-visible multi-profile execution boundary without duplicating
+Promptkit's backend-capacity reference. App orchestration, prompt input,
+generated text, prompt debugging, and any new bundle implementation details
+belong in focused documents under `docs/internal/`.
+
+Current-state documentation must not describe profile comparison as available
+until the implementation lands.
+
+## Non-Goals
+
+This roadmap does not introduce:
+
+- automatic model scoring, ranking, recommendation, or winner selection;
+- semantic or textual diff generation between reports;
+- repeated sampling of one profile or statistical evaluation;
+- prompt or profile editing through Weatherreporter;
+- replaying a saved data package as command input;
+- comparing several report types in one command;
+- Weatherreporter-owned backend concurrency or queue configuration;
+- automatic retries beyond Promptkit's existing execution contract;
+- Distributor upload or other external publication;
+- comparison history, indexing, retention, cleanup schedules, or implicit
+  discovery of prior bundles; or
+- changes to ordinary report content or normal generation behavior.
+
+Any later automated evaluation, replay, sampling, or publication feature
+requires a separate accepted roadmap.
+
+## Completion Criteria
+
+The feature is complete when a maintainer can select several Promptkit
+profiles, have them execute concurrently against one exact prepared report
+package, and receive a safe, flat, deterministic comparison bundle whose
+manifest accurately describes every success and failure. Configured and
+explicit destinations must follow the accepted output policy, replacement must
+never mix or silently destroy unrelated contents, cancellation and partial
+failure must be race-safe, ordinary notification must remain disabled, and all
+affected canonical documentation must describe the implemented behavior.
+
+## Open Questions
+
+None. The scope, prerequisites, user intent, and target behavior required for a
+future staged implementation plan are defined above.

examples/config.yml

@@ -14,6 +14,9 @@ location:
 secrets:
   directory: ""
 
+output:
+  directory: /var/lib/weatherreporter/reports
+
 notify:
   distributor:
     enabled: false

internal/app/app.go

@@ -4,9 +4,7 @@ package app
 import (
 	"context"
 	"fmt"
-	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
 	distributoradapter "gitea.maximumdirect.net/eric/weatherreporter/internal/adapters/distributor"
@@ -251,7 +249,7 @@ func GenerateDetailed(ctx context.Context, req GenerateRequest) (*ReportResult,
 		return nil, err
 	}
 	result := initialReportResult(req, resolved, PromptInspectionResult{})
-	outputPath, err := resolveReportOutputPath(req.WorkingDir, req.OutputPath, resolved)
+	outputPath, err := resolveReportOutputPath(req.WorkingDir, req.OutputPath, req.Config.Output.Directory, resolved)
 	if err != nil {
 		return result, err
 	}
@@ -302,7 +300,7 @@ func RunBatchDetailed(ctx context.Context, req BatchRequest) (*BatchResult, erro
 	if _, err := report.BatchForCommandName(string(req.Batch)); err != nil {
 		return nil, err
 	}
-	outputDir, err := resolveOutputDir(req.WorkingDir, req.OutputDir)
+	outputDir, err := resolveOutputDirWithConfigured(req.WorkingDir, req.OutputDir, req.Config.Output.Directory)
 	if err != nil {
 		return nil, err
 	}
@@ -431,104 +429,6 @@ func batchReportResult(planned plannedBatchReport) BatchReportResult {
 	}
 }
 
-func plannedBatchOutputPath(outputDir string, planned plannedBatchReport) (string, error) {
-	outputName, err := planned.Resolved.OutputName()
-	if err != nil {
-		return "", err
-	}
-	return validateOutputPath(filepath.Join(outputDir, outputName))
-}
-
-func prepareBatchOutputs(outputDir string, plannedReports []plannedBatchReport) error {
-	for index := range plannedReports {
-		outputPath, err := plannedBatchOutputPath(outputDir, plannedReports[index])
-		if err != nil {
-			return err
-		}
-		plannedReports[index].OutputPath = outputPath
-	}
-	return nil
-}
-
-func resolveReportOutputPath(workingDir, override string, resolved report.Resolved) (string, error) {
-	outputName, err := resolved.OutputName()
-	if err != nil {
-		return "", err
-	}
-	return resolveOutputPath(workingDir, override, outputName)
-}
-
-func resolveOutputDir(workingDir, override string) (string, error) {
-	workingDir, err := validateWorkingDir(workingDir)
-	if err != nil {
-		return "", err
-	}
-	if override == "" {
-		return workingDir, nil
-	}
-	if strings.TrimSpace(override) == "" {
-		return "", fmt.Errorf("output directory is required")
-	}
-	directory := override
-	if !filepath.IsAbs(directory) {
-		directory = filepath.Join(workingDir, directory)
-	}
-	directory = filepath.Clean(directory)
-	if info, err := os.Stat(directory); err == nil && !info.IsDir() {
-		return "", fmt.Errorf("output directory %q is not a directory", directory)
-	} else if err != nil && !os.IsNotExist(err) {
-		return "", fmt.Errorf("inspect output directory %q: %w", directory, err)
-	}
-	return directory, nil
-}
-
-func resolveOutputPath(workingDir, override, defaultName string) (string, error) {
-	workingDir, err := validateWorkingDir(workingDir)
-	if err != nil {
-		return "", err
-	}
-	path := override
-	if path == "" {
-		path = defaultName
-	}
-	if strings.TrimSpace(path) == "" {
-		return "", fmt.Errorf("final output path is required")
-	}
-	if !filepath.IsAbs(path) {
-		path = filepath.Join(workingDir, path)
-	}
-	return validateOutputPath(path)
-}
-
-func validateWorkingDir(workingDir string) (string, error) {
-	if strings.TrimSpace(workingDir) == "" {
-		return "", fmt.Errorf("working directory is required")
-	}
-	if !filepath.IsAbs(workingDir) {
-		return "", fmt.Errorf("working directory %q must be absolute", workingDir)
-	}
-	return filepath.Clean(workingDir), nil
-}
-
-func validateOutputPath(path string) (string, error) {
-	if strings.TrimSpace(path) == "" {
-		return "", fmt.Errorf("final output path is required")
-	}
-	path = filepath.Clean(path)
-	if !filepath.IsAbs(path) {
-		return "", fmt.Errorf("final output path %q must be absolute", path)
-	}
-	if filepath.Dir(path) == path {
-		return "", fmt.Errorf("final output path %q must not be a filesystem root", path)
-	}
-	if info, err := os.Stat(path); err == nil && info.IsDir() {
-		return "", fmt.Errorf("final output path %q is a directory", path)
-	} else if err != nil && !os.IsNotExist(err) {
-		return "", fmt.Errorf("inspect final output path %q: %w", path, err)
-	}
-	return path, nil
-}
-
 func ResolveGenerate(req GenerateRequest, now time.Time) (report.Resolved, error) {
 	location, err := timeutil.LoadLocation(req.Config.WeatherAPI.Timezone)
 	if err != nil {

internal/app/batch_generation_test.go

@@ -61,6 +61,100 @@ func TestRunBatchDetailedNotifiesOnlyAfterAllOutputsExist(t *testing.T) {
 	}
 }
 
+func TestRunBatchDetailedUsesDefaultAndConfiguredOutputDirectories(t *testing.T) {
+	tests := []struct {
+		name      string
+		directory func(t *testing.T, workingDir string) string
+		wantDir   func(t *testing.T, workingDir string, configuredDir string) string
+	}{
+		{
+			name: "working directory default",
+			directory: func(_ *testing.T, _ string) string {
+				return ""
+			},
+			wantDir: func(_ *testing.T, workingDir string, _ string) string {
+				return workingDir
+			},
+		},
+		{
+			name: "absolute directory",
+			directory: func(t *testing.T, _ string) string {
+				return filepath.Join(t.TempDir(), "reports")
+			},
+			wantDir: func(_ *testing.T, _ string, configuredDir string) string {
+				return configuredDir
+			},
+		},
+		{
+			name: "relative directory",
+			directory: func(_ *testing.T, _ string) string {
+				return "configured/../reports"
+			},
+			wantDir: func(_ *testing.T, workingDir string, _ string) string {
+				return filepath.Join(workingDir, "reports")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			workingDir := t.TempDir()
+			configuredDir := tt.directory(t, workingDir)
+			cfg := generationDistributorConfig()
+			cfg.Output.Directory = configuredDir
+			bundle := generationBundle(t)
+			bundle.Hourly.Periods = bundle.Hourly.Periods[:1]
+			notifier := &generationNotifier{}
+
+			result, err := RunBatchDetailed(context.Background(), BatchRequest{
+				Config: cfg, Batch: BatchMorning,
+				Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: workingDir,
+				Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{}, Notifier: notifier,
+			})
+			wantDir := tt.wantDir(t, workingDir, configuredDir)
+			if err != nil || result == nil || result.Succeeded != len(result.Reports) || notifier.batchCalls != 1 {
+				t.Fatalf("RunBatchDetailed() result/error/notifier = %#v/%v/%#v", result, err, notifier)
+			}
+			for _, item := range result.Reports {
+				if filepath.Dir(item.OutputPath) != wantDir {
+					t.Fatalf("report output %q, want directory %q", item.OutputPath, wantDir)
+				}
+			}
+			for _, file := range notifier.batchRequest.Files {
+				if filepath.Dir(file.SourcePath) != wantDir {
+					t.Fatalf("notification source %q, want directory %q", file.SourcePath, wantDir)
+				}
+			}
+		})
+	}
+}
+
+func TestRunBatchDetailedExplicitOutputDirectoryIgnoresConfiguredDirectory(t *testing.T) {
+	configuredPath := filepath.Join(t.TempDir(), "not-a-directory")
+	if err := os.WriteFile(configuredPath, []byte("not a directory"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	explicitDir := t.TempDir()
+	cfg := generationDistributorConfig()
+	cfg.Output.Directory = configuredPath
+	bundle := generationBundle(t)
+	bundle.Hourly.Periods = bundle.Hourly.Periods[:1]
+
+	result, err := RunBatchDetailed(context.Background(), BatchRequest{
+		Config: cfg, Batch: BatchMorning,
+		Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputDir: explicitDir,
+		Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{}, Notifier: &generationNotifier{},
+	})
+	if err != nil || result == nil || result.Succeeded != len(result.Reports) {
+		t.Fatalf("RunBatchDetailed() result/error = %#v/%v", result, err)
+	}
+	for _, item := range result.Reports {
+		if filepath.Dir(item.OutputPath) != explicitDir {
+			t.Fatalf("report output %q, want directory %q", item.OutputPath, explicitDir)
+		}
+	}
+}
+
 func TestRunBatchDetailedPreflightsAllOutputPaths(t *testing.T) {
 	bundle := generationBundle(t)
 	bundle.Hourly.Periods = bundle.Hourly.Periods[:1]

internal/app/generation_test.go

@@ -113,6 +113,108 @@ func TestGenerateDetailedPublishesOnlySelectedOutput(t *testing.T) {
 	}
 }
 
+func TestGenerateDetailedUsesConfiguredOutputDirectory(t *testing.T) {
+	tests := []struct {
+		name      string
+		directory func(t *testing.T, workingDir string) string
+		wantDir   func(t *testing.T, workingDir string, configuredDir string) string
+	}{
+		{
+			name: "absolute directory",
+			directory: func(t *testing.T, _ string) string {
+				return filepath.Join(t.TempDir(), "reports")
+			},
+			wantDir: func(_ *testing.T, _ string, configuredDir string) string {
+				return configuredDir
+			},
+		},
+		{
+			name: "relative directory",
+			directory: func(_ *testing.T, _ string) string {
+				return "configured/../reports"
+			},
+			wantDir: func(_ *testing.T, workingDir string, _ string) string {
+				return filepath.Join(workingDir, "reports")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			workingDir := t.TempDir()
+			configuredDir := tt.directory(t, workingDir)
+			cfg := generationDistributorConfig()
+			cfg.Output.Directory = configuredDir
+			bundle := generationBundle(t)
+			notifier := &generationNotifier{}
+
+			result, err := GenerateDetailed(context.Background(), GenerateRequest{
+				Config: cfg, Report: ReportDaily,
+				Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+				WorkingDir: workingDir, Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{}, Notifier: notifier,
+			})
+			wantPath := filepath.Join(tt.wantDir(t, workingDir, configuredDir), "daily-2026-05-29.md")
+			if err != nil || result == nil || result.OutputPath != wantPath || notifier.request.ReportPath != wantPath {
+				t.Fatalf("GenerateDetailed() result/error/notification = %#v/%v/%#v", result, err, notifier.request)
+			}
+			if info, statErr := os.Stat(filepath.Dir(wantPath)); statErr != nil || !info.IsDir() {
+				t.Fatalf("configured output directory info/error = %#v/%v", info, statErr)
+			}
+			if _, statErr := os.Stat(wantPath); statErr != nil {
+				t.Fatalf("output %q: %v", wantPath, statErr)
+			}
+		})
+	}
+}
+
+func TestGenerateDetailedExplicitOutputPathIgnoresConfiguredDirectory(t *testing.T) {
+	configuredPath := filepath.Join(t.TempDir(), "not-a-directory")
+	if err := os.WriteFile(configuredPath, []byte("not a directory"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	explicitPath := filepath.Join(t.TempDir(), "explicit.md")
+	cfg := generationConfig()
+	cfg.Output.Directory = configuredPath
+	bundle := generationBundle(t)
+
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{
+		Config: cfg, Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+		WorkingDir: t.TempDir(), OutputPath: explicitPath, Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{},
+	})
+	if err != nil || result == nil || result.OutputPath != explicitPath {
+		t.Fatalf("GenerateDetailed() result/error = %#v/%v", result, err)
+	}
+	if _, statErr := os.Stat(explicitPath); statErr != nil {
+		t.Fatalf("explicit output %q: %v", explicitPath, statErr)
+	}
+}
+
+func TestGenerateDetailedRejectsConfiguredNonDirectoryBeforeWork(t *testing.T) {
+	configuredPath := filepath.Join(t.TempDir(), "not-a-directory")
+	if err := os.WriteFile(configuredPath, []byte("not a directory"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cfg := generationDistributorConfig()
+	cfg.Output.Directory = configuredPath
+	bundle := generationBundle(t)
+	collector := &generationCollector{bundle: &bundle}
+	executor := &generationExecutor{}
+	notifier := &generationNotifier{}
+
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{
+		Config: cfg, Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+		WorkingDir: t.TempDir(), Collector: collector, Executor: executor, Notifier: notifier,
+	})
+	if err == nil || result == nil || collector.called || executor.promptInspections != 0 || executor.called || notifier.calls != 0 {
+		t.Fatalf("GenerateDetailed() result/error/collector/executor/notifier = %#v/%v/%t/%#v/%#v", result, err, collector.called, executor, notifier)
+	}
+	if data, readErr := os.ReadFile(configuredPath); readErr != nil || string(data) != "not a directory" {
+		t.Fatalf("configured path = %q, error = %v", data, readErr)
+	}
+}
+
 func TestGenerateDetailedReturnsResolvedResultWhenCollectionFails(t *testing.T) {
 	cfg := config.Defaults()
 	cfg.WeatherAPI.Timezone, cfg.Location.ID = "America/Chicago", "home"
@@ -244,14 +346,19 @@ func generationBundlePointer(t *testing.T) *weatherdata.Bundle {
 type generationNotifier struct {
 	err          error
 	batchErr     error
+	calls        int
 	request      NotificationRequest
 	batchRequest batchNotificationRequest
 	batchCalls   int
 }
 
 func (n *generationNotifier) Notify(_ context.Context, request NotificationRequest) (*NotificationResult, error) {
+	n.calls++
 	n.request = request
-	return nil, n.err
+	if n.err != nil {
+		return nil, n.err
+	}
+	return &NotificationResult{Status: "succeeded"}, nil
 }
 
 func (n *generationNotifier) NotifyBatch(_ context.Context, request batchNotificationRequest) (*NotificationResult, error) {

internal/app/output.go

@@ -0,0 +1,163 @@
+package app
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
+)
+
+func plannedBatchOutputPath(outputDir string, planned plannedBatchReport) (string, error) {
+	outputName, err := planned.Resolved.OutputName()
+	if err != nil {
+		return "", err
+	}
+	return validateOutputPath(filepath.Join(outputDir, outputName))
+}
+
+func prepareBatchOutputs(outputDir string, plannedReports []plannedBatchReport) error {
+	for index := range plannedReports {
+		outputPath, err := plannedBatchOutputPath(outputDir, plannedReports[index])
+		if err != nil {
+			return err
+		}
+		plannedReports[index].OutputPath = outputPath
+	}
+	return nil
+}
+
+func resolveReportOutputPath(workingDir, override, configuredDir string, resolved report.Resolved) (string, error) {
+	outputName, err := resolved.OutputName()
+	if err != nil {
+		return "", err
+	}
+	if override != "" {
+		return resolveOutputPath(workingDir, override, outputName)
+	}
+	outputDir, err := resolveOutputDir(workingDir, configuredDir)
+	if err != nil {
+		return "", err
+	}
+	return validateOutputPath(filepath.Join(outputDir, outputName))
+}
+
+func resolveOutputDirWithConfigured(workingDir, override, configuredDir string) (string, error) {
+	directory := configuredDir
+	if override != "" {
+		directory = override
+	}
+	return resolveOutputDir(workingDir, directory)
+}
+
+func resolveOutputDir(workingDir, override string) (string, error) {
+	workingDir, err := validateWorkingDir(workingDir)
+	if err != nil {
+		return "", err
+	}
+	if override == "" {
+		return workingDir, nil
+	}
+	if strings.TrimSpace(override) == "" {
+		return "", fmt.Errorf("output directory is required")
+	}
+	directory := override
+	if !filepath.IsAbs(directory) {
+		directory = filepath.Join(workingDir, directory)
+	}
+	directory = filepath.Clean(directory)
+	if err := preflightOutputDirectory(directory); err != nil {
+		return "", err
+	}
+	return directory, nil
+}
+
+func preflightOutputDirectory(directory string) error {
+	info, err := os.Stat(directory)
+	if err == nil {
+		if !info.IsDir() {
+			return fmt.Errorf("output directory %q is not a directory", directory)
+		}
+		return nil
+	}
+	if !os.IsNotExist(err) {
+		return fmt.Errorf("inspect output directory %q: %w", directory, err)
+	}
+
+	// A missing directory is valid, but os.Stat also reports ErrNotExist for a
+	// dangling symlink. Walk to the first existing component so invalid links
+	// fail preflight instead of being discovered only during publication.
+	for component := directory; ; component = filepath.Dir(component) {
+		componentInfo, componentErr := os.Lstat(component)
+		if componentErr == nil {
+			if componentInfo.Mode()&os.ModeSymlink != 0 {
+				targetInfo, targetErr := os.Stat(component)
+				if targetErr != nil {
+					return fmt.Errorf("inspect output directory %q at %q: %w", directory, component, targetErr)
+				}
+				if !targetInfo.IsDir() {
+					return fmt.Errorf("output directory %q has non-directory path component %q", directory, component)
+				}
+				return nil
+			}
+			if !componentInfo.IsDir() {
+				return fmt.Errorf("output directory %q has non-directory path component %q", directory, component)
+			}
+			return nil
+		}
+		if !os.IsNotExist(componentErr) {
+			return fmt.Errorf("inspect output directory %q at %q: %w", directory, component, componentErr)
+		}
+		if filepath.Dir(component) == component {
+			return fmt.Errorf("inspect output directory %q: no existing directory ancestor", directory)
+		}
+	}
+}
+
+func resolveOutputPath(workingDir, override, defaultName string) (string, error) {
+	workingDir, err := validateWorkingDir(workingDir)
+	if err != nil {
+		return "", err
+	}
+	path := override
+	if path == "" {
+		path = defaultName
+	}
+	if strings.TrimSpace(path) == "" {
+		return "", fmt.Errorf("final output path is required")
+	}
+	if !filepath.IsAbs(path) {
+		path = filepath.Join(workingDir, path)
+	}
+	return validateOutputPath(path)
+}
+
+func validateWorkingDir(workingDir string) (string, error) {
+	if strings.TrimSpace(workingDir) == "" {
+		return "", fmt.Errorf("working directory is required")
+	}
+	if !filepath.IsAbs(workingDir) {
+		return "", fmt.Errorf("working directory %q must be absolute", workingDir)
+	}
+	return filepath.Clean(workingDir), nil
+}
+
+func validateOutputPath(path string) (string, error) {
+	if strings.TrimSpace(path) == "" {
+		return "", fmt.Errorf("final output path is required")
+	}
+	path = filepath.Clean(path)
+	if !filepath.IsAbs(path) {
+		return "", fmt.Errorf("final output path %q must be absolute", path)
+	}
+	if filepath.Dir(path) == path {
+		return "", fmt.Errorf("final output path %q must not be a filesystem root", path)
+	}
+	if info, err := os.Stat(path); err == nil && info.IsDir() {
+		return "", fmt.Errorf("final output path %q is a directory", path)
+	} else if err != nil && !os.IsNotExist(err) {
+		return "", fmt.Errorf("inspect final output path %q: %w", path, err)
+	}
+	return path, nil
+}

internal/app/output_test.go

@@ -0,0 +1,38 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+)
+
+func TestResolveOutputDirRejectsDanglingSymlinkComponents(t *testing.T) {
+	workingDir := t.TempDir()
+	dangling := filepath.Join(workingDir, "dangling")
+	if err := os.Symlink(filepath.Join(workingDir, "missing"), dangling); err != nil {
+		t.Fatal(err)
+	}
+
+	for _, directory := range []string{dangling, filepath.Join(dangling, "reports")} {
+		t.Run(filepath.Base(directory), func(t *testing.T) {
+			if _, err := resolveOutputDir(workingDir, directory); err == nil {
+				t.Fatalf("resolveOutputDir(%q) error = nil, want dangling symlink error", directory)
+			}
+		})
+	}
+}
+
+func TestResolveOutputDirAllowsMissingDirectoryBelowValidSymlink(t *testing.T) {
+	workingDir := t.TempDir()
+	target := t.TempDir()
+	link := filepath.Join(workingDir, "linked")
+	if err := os.Symlink(target, link); err != nil {
+		t.Fatal(err)
+	}
+
+	directory := filepath.Join(link, "reports")
+	got, err := resolveOutputDir(workingDir, directory)
+	if err != nil || got != directory {
+		t.Fatalf("resolveOutputDir() = %q, %v, want %q, nil", got, err, directory)
+	}
+}

internal/cli/run_test.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -50,7 +51,8 @@ func TestResolveRunActionConstructsOneExecutor(t *testing.T) {
 func TestResolveGenerateActionUsesInjectedWorkingDirectoryForOutputOverrides(t *testing.T) {
 	workingDir := t.TempDir()
 	configPath := filepath.Join(t.TempDir(), "config.yml")
-	if err := os.WriteFile(configPath, []byte("weather_api:\n  base_url: https://weather.api.example.com/\n"), 0o600); err != nil {
+	const configuredDirectory = "configured/../reports"
+	if err := os.WriteFile(configPath, []byte("weather_api:\n  base_url: https://weather.api.example.com/\noutput:\n  directory: "+configuredDirectory+"\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	absoluteOutput := filepath.Join(t.TempDir(), "daily.md")
@@ -76,13 +78,76 @@ func TestResolveGenerateActionUsesInjectedWorkingDirectoryForOutputOverrides(t *
 				args = append(args, "--out", scenario.out)
 			}
 			req, _, err := runner.resolveGenerateAction(args)
-			if err != nil || req.WorkingDir != workingDir || req.OutputPath != scenario.want {
+			if err != nil || req.WorkingDir != workingDir || req.OutputPath != scenario.want || req.Config.Output.Directory != configuredDirectory {
 				t.Fatalf("resolveGenerateAction() request/error = %#v/%v", req, err)
 			}
 		})
 	}
 }
 
+func TestResolveActionsPreserveConfiguredOutputDirectoryWithoutAnOverride(t *testing.T) {
+	workingDir := t.TempDir()
+	absoluteDirectory := filepath.Join(t.TempDir(), "reports")
+	for _, configuredDirectory := range []string{"configured/../reports", absoluteDirectory} {
+		t.Run(configuredDirectory, func(t *testing.T) {
+			configPath := filepath.Join(t.TempDir(), "config.yml")
+			contents := "weather_api:\n  base_url: https://weather.api.example.com/\noutput:\n  directory: " + strconv.Quote(configuredDirectory) + "\n"
+			if err := os.WriteFile(configPath, []byte(contents), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			runner := Runner{
+				Clock:      timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 0, 0, 0, time.UTC)},
+				WorkingDir: workingDir,
+				ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+					return &factoryExecutor{}, nil
+				},
+			}
+
+			generateReq, _, generateErr := runner.resolveGenerateAction([]string{"daily", "--date", "2026-05-29", "--config", configPath})
+			if generateErr != nil || generateReq.Config.Output.Directory != configuredDirectory || generateReq.OutputPath != "" {
+				t.Fatalf("resolveGenerateAction() request/error = %#v/%v", generateReq, generateErr)
+			}
+
+			batchReq, _, batchErr := runner.resolveRunAction([]string{"morning", "--config", configPath})
+			if batchErr != nil || batchReq.Config.Output.Directory != configuredDirectory || batchReq.OutputDir != "" {
+				t.Fatalf("resolveRunAction() request/error = %#v/%v", batchReq, batchErr)
+			}
+		})
+	}
+}
+
+func TestResolveRunActionUsesInjectedWorkingDirectoryForOutputOverrides(t *testing.T) {
+	workingDir := t.TempDir()
+	configPath := filepath.Join(t.TempDir(), "config.yml")
+	const configuredDirectory = "configured/../reports"
+	if err := os.WriteFile(configPath, []byte("weather_api:\n  base_url: https://weather.api.example.com/\noutput:\n  directory: "+configuredDirectory+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	absoluteOutput := filepath.Join(t.TempDir(), "reports")
+	for _, scenario := range []struct {
+		name string
+		out  string
+		want string
+	}{
+		{name: "relative", out: "reports/../published", want: filepath.Join(workingDir, "published")},
+		{name: "absolute", out: absoluteOutput, want: absoluteOutput},
+	} {
+		t.Run(scenario.name, func(t *testing.T) {
+			runner := Runner{
+				Clock:      timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 0, 0, 0, time.UTC)},
+				WorkingDir: workingDir,
+				ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+					return &factoryExecutor{}, nil
+				},
+			}
+			req, _, err := runner.resolveRunAction([]string{"morning", "--config", configPath, "--out-dir", scenario.out})
+			if err != nil || req.WorkingDir != workingDir || req.OutputDir != scenario.want || req.Config.Output.Directory != configuredDirectory {
+				t.Fatalf("resolveRunAction() request/error = %#v/%v", req, err)
+			}
+		})
+	}
+}
+
 func TestRunActionReturnsFailureForBatchNotificationFailure(t *testing.T) {
 	configPath := filepath.Join(t.TempDir(), "config.yml")
 	if err := os.WriteFile(configPath, []byte("weather_api:\n  base_url: https://weather.api.example.com/\n"), 0o600); err != nil {

internal/config/config.go

@@ -25,6 +25,7 @@ type Config struct {
 	WeatherAPI    WeatherAPIConfig        `yaml:"weather_api"`
 	Location      LocationConfig          `yaml:"location"`
 	Secrets       SecretsConfig           `yaml:"secrets"`
+	Output        OutputConfig            `yaml:"output"`
 	Notify        NotifyConfig            `yaml:"notify"`
 	MissingSource MissingSourceConfig     `yaml:"missing_source"`
 	Promptkit     PromptkitConfig         `yaml:"promptkit"`
@@ -51,6 +52,10 @@ type SecretsConfig struct {
 	Directory string `yaml:"directory"`
 }
 
+type OutputConfig struct {
+	Directory string `yaml:"directory"`
+}
+
 type NotifyConfig struct {
 	Distributor DistributorNotifyConfig `yaml:"distributor"`
 }

internal/config/config_test.go

@@ -4,6 +4,7 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -37,6 +38,9 @@ func TestDefaults(t *testing.T) {
 	if cfg.Secrets.Directory != "" {
 		t.Fatalf("Secrets.Directory = %q, want empty", cfg.Secrets.Directory)
 	}
+	if cfg.Output.Directory != "" {
+		t.Fatalf("Output.Directory = %q, want empty", cfg.Output.Directory)
+	}
 	if cfg.Notify.Distributor.Enabled {
 		t.Fatalf("Notify.Distributor.Enabled = true, want false")
 	}
@@ -78,6 +82,120 @@ func TestDefaults(t *testing.T) {
 	}
 }
 
+func TestOutputDirectoryLoading(t *testing.T) {
+	tests := []struct {
+		name      string
+		yaml      string
+		wantValue string
+		wantErr   string
+	}{
+		{
+			name:      "omitted",
+			yaml:      "{}\n",
+			wantValue: "",
+		},
+		{
+			name: "explicit empty",
+			yaml: `
+output:
+  directory: ""
+`,
+			wantValue: "",
+		},
+		{
+			name: "absolute path",
+			yaml: `
+output:
+  directory: /var/lib/weatherreporter/reports
+`,
+			wantValue: "/var/lib/weatherreporter/reports",
+		},
+		{
+			name: "relative path",
+			yaml: `
+output:
+  directory: reports/../published
+`,
+			wantValue: "reports/../published",
+		},
+		{
+			name: "whitespace only",
+			yaml: `
+output:
+  directory: "  \t  "
+`,
+			wantErr: "output.directory",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg, err := LoadFile(writeConfig(t, tt.yaml))
+			if tt.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+					t.Fatalf("LoadFile() error = %v, want %q", err, tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("LoadFile() error = %v", err)
+			}
+			if cfg.Output.Directory != tt.wantValue {
+				t.Fatalf("Output.Directory = %q, want %q", cfg.Output.Directory, tt.wantValue)
+			}
+		})
+	}
+}
+
+func TestOutputDirectoryValidationIsConsistentForLoadedAndConstructedConfigs(t *testing.T) {
+	tests := []struct {
+		name      string
+		directory string
+		wantErr   string
+	}{
+		{name: "empty"},
+		{name: "absolute path", directory: "/var/lib/weatherreporter/reports"},
+		{name: "relative path", directory: "reports/../published"},
+		{name: "whitespace only", directory: " \t ", wantErr: "output.directory"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			yaml := "output:\n  directory: " + strconv.Quote(tt.directory) + "\n"
+			_, loadErr := LoadFile(writeConfig(t, yaml))
+
+			cfg := Defaults()
+			cfg.Output.Directory = tt.directory
+			validateErr := Validate(cfg)
+
+			if (loadErr == nil) != (validateErr == nil) {
+				t.Fatalf("LoadFile() error = %v, Validate() error = %v", loadErr, validateErr)
+			}
+			if tt.wantErr != "" {
+				if loadErr == nil || !strings.Contains(loadErr.Error(), tt.wantErr) {
+					t.Fatalf("LoadFile() error = %v, want %q", loadErr, tt.wantErr)
+				}
+				if validateErr == nil || !strings.Contains(validateErr.Error(), tt.wantErr) {
+					t.Fatalf("Validate() error = %v, want %q", validateErr, tt.wantErr)
+				}
+			}
+		})
+	}
+}
+
+func TestOutputDirectoryRejectsUnknownFields(t *testing.T) {
+	_, err := LoadFile(writeConfig(t, `
+output:
+  location: reports
+`))
+	if err == nil {
+		t.Fatal("LoadFile() error = nil, want strict decoding error")
+	}
+	if !strings.Contains(err.Error(), "field location not found") {
+		t.Fatalf("LoadFile() error = %q, want output field rejection", err.Error())
+	}
+}
+
 func TestLoadExampleConfig(t *testing.T) {
 	cfg, err := LoadFile(filepath.Join("..", "..", "examples", "config.yml"))
 	if err != nil {
@@ -96,6 +214,9 @@ func TestLoadExampleConfig(t *testing.T) {
 	if cfg.Location.ID != "home" || cfg.Location.Name != "Brentwood" || cfg.Location.Region != "St. Louis Metro" {
 		t.Fatalf("Location = %#v, want example location", cfg.Location)
 	}
+	if cfg.Output.Directory != "/var/lib/weatherreporter/reports" {
+		t.Fatalf("Output.Directory = %q, want maintained example value", cfg.Output.Directory)
+	}
 	if cfg.Notify.Distributor.PipelineIDTemplate != "weatherreporter.{report_id}" {
 		t.Fatalf("PipelineIDTemplate = %q, want example pipeline template", cfg.Notify.Distributor.PipelineIDTemplate)
 	}
@@ -1674,6 +1795,9 @@ func TestLoadSecretsRejectsInvalidDirectoryEntries(t *testing.T) {
 				t.Cleanup(func() {
 					_ = os.Chmod(path, 0o600)
 				})
+				if _, err := os.ReadFile(path); err == nil {
+					t.Skip("test process can read files without permission bits")
+				}
 			},
 			wantErr: "read secret file",
 		},

internal/config/defaults.go

@@ -21,6 +21,9 @@ func Defaults() Config {
 		Secrets: SecretsConfig{
 			Directory: "",
 		},
+		Output: OutputConfig{
+			Directory: "",
+		},
 		Notify: NotifyConfig{
 			Distributor: DistributorNotifyConfig{
 				Enabled:                false,

internal/config/validate.go

@@ -15,6 +15,9 @@ func Validate(cfg Config) error {
 	if err := validateReportDistributorPathOverrides(cfg); err != nil {
 		return err
 	}
+	if cfg.Output.Directory != "" && strings.TrimSpace(cfg.Output.Directory) == "" {
+		return fmt.Errorf("output.directory must not be blank when configured")
+	}
 	if cfg.WeatherAPI.BaseURL != "" {
 		parsed, err := url.Parse(cfg.WeatherAPI.BaseURL)
 		if err != nil || parsed.Scheme == "" || parsed.Host == "" {