Merge remote-tracking branch 'origin/main'

README.md

@@ -4,7 +4,9 @@ Weatherreporter is a Go CLI that turns normalized weather data into
 human-facing Markdown reports.
 
 It produces a Markdown report at an operator-owned destination and can upload
-the completed output through Distributor.
+the completed output through Distributor. It can also compare explicitly
+selected Promptkit profiles against one shared prepared report and publish a
+local comparison bundle.
 
 ## Quickstart
 
@@ -14,14 +16,16 @@ weatherreporter generate today
 
 Configure a Weather API endpoint first; see the
 [configuration reference](docs/config.md). The report is written to
-`today.md` in the current directory; use `--out` to choose another destination.
-See the [CLI reference](docs/cli.md) and [operations guide](docs/operations.md)
-for command and operating details.
+`today.md` in the current directory when `output.directory` is not configured.
+Set that configuration value for an ordinary publication directory, or use
+`--out` for one command. See the [CLI reference](docs/cli.md) and [operations
+guide](docs/operations.md) for command and operating details.
 
 ## Documentation
 
 - [CLI reference](docs/cli.md)
 - [Configuration reference](docs/config.md)
 - [Operations guide](docs/operations.md)
+- [Comparison bundle contract](docs/integrations/comparison-bundle.md)
 - [Development guide](docs/development.md)
 - [Architecture policy](docs/policy/architecture.md)

cmd/weatherreporter/main.go

@@ -3,14 +3,29 @@ package main
 import (
 	"context"
 	"fmt"
+	"io"
 	"os"
+	"os/signal"
+	"syscall"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/cli"
 )
 
 func main() {
-	if err := cli.Run(context.Background(), os.Args[1:], os.Stdout, os.Stderr); err != nil {
+	if err := runCommand(os.Args[1:], os.Stdout, os.Stderr, cli.Run); err != nil {
 		fmt.Fprintf(os.Stderr, "weatherreporter: %v\n", err)
 		os.Exit(1)
 	}
 }
+
+func runCommand(args []string, stdout, stderr io.Writer, runner func(context.Context, []string, io.Writer, io.Writer) error) error {
+	return runCommandWithSignalContext(args, stdout, stderr, runner, signal.NotifyContext)
+}
+
+type signalContextFunc func(context.Context, ...os.Signal) (context.Context, context.CancelFunc)
+
+func runCommandWithSignalContext(args []string, stdout, stderr io.Writer, runner func(context.Context, []string, io.Writer, io.Writer) error, signalContext signalContextFunc) error {
+	ctx, stop := signalContext(context.Background(), os.Interrupt, syscall.SIGTERM)
+	defer stop()
+	return runner(ctx, args, stdout, stderr)
+}

cmd/weatherreporter/main_test.go

@@ -0,0 +1,36 @@
+package main
+
+import (
+	"context"
+	"errors"
+	"io"
+	"os"
+	"syscall"
+	"testing"
+)
+
+func TestRunCommandBuildsCancelableSignalContext(t *testing.T) {
+	var signals []os.Signal
+	stopped := false
+	signalContext := func(parent context.Context, requested ...os.Signal) (context.Context, context.CancelFunc) {
+		signals = append([]os.Signal(nil), requested...)
+		ctx, cancel := context.WithCancel(parent)
+		cancel()
+		return ctx, func() {
+			stopped = true
+		}
+	}
+
+	err := runCommandWithSignalContext(nil, io.Discard, io.Discard, func(ctx context.Context, _ []string, _, _ io.Writer) error {
+		return ctx.Err()
+	}, signalContext)
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("runCommandWithSignalContext() error = %v, want context cancellation", err)
+	}
+	if len(signals) != 2 || signals[0] != os.Interrupt || signals[1] != syscall.SIGTERM {
+		t.Fatalf("requested signals = %#v, want Interrupt and SIGTERM", signals)
+	}
+	if !stopped {
+		t.Fatal("signal context stop function was not called")
+	}
+}

cmd/weatherreporter/main_unix_test.go

@@ -0,0 +1,58 @@
+//go:build unix
+
+package main
+
+import (
+	"context"
+	"errors"
+	"io"
+	"os"
+	"syscall"
+	"testing"
+	"time"
+)
+
+func TestRunCommandCancelsActionContextOnSignal(t *testing.T) {
+	for _, tt := range []struct {
+		name   string
+		signal os.Signal
+	}{
+		{name: "Interrupt", signal: os.Interrupt},
+		{name: "Terminate", signal: syscall.SIGTERM},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			started := make(chan struct{})
+			done := make(chan error, 1)
+			go func() {
+				done <- runCommand(nil, io.Discard, io.Discard, func(ctx context.Context, _ []string, _, _ io.Writer) error {
+					close(started)
+					<-ctx.Done()
+					return ctx.Err()
+				})
+			}()
+
+			select {
+			case <-started:
+			case <-time.After(time.Second):
+				t.Fatal("runner did not receive an action context")
+			}
+
+			process, err := os.FindProcess(os.Getpid())
+			if err != nil {
+				t.Fatalf("FindProcess() error = %v", err)
+			}
+			if err := process.Signal(tt.signal); err != nil {
+				t.Fatalf("Signal(%v) error = %v", tt.signal, err)
+			}
+
+			select {
+			case err := <-done:
+				if !errors.Is(err, context.Canceled) {
+					t.Fatalf("runCommand() error = %v, want context cancellation", err)
+				}
+			case <-time.After(time.Second):
+				t.Fatal("interrupt did not cancel the action context")
+			}
+		})
+	}
+}

docs/cli.md

@@ -1,7 +1,8 @@
 # Weatherreporter CLI
 
-`weatherreporter` generates Markdown weather reports and runs report batches.
-It has no command for inspecting prior runs or application-owned state.
+`weatherreporter` generates Markdown weather reports, runs report batches, and
+compares explicitly selected Promptkit profiles against one prepared report. It
+has no command for inspecting prior runs or application-owned state.
 
 ## Shortest Useful Command
 
@@ -9,9 +10,10 @@ It has no command for inspecting prior runs or application-owned state.
 weatherreporter generate today
 ```
 
-The command uses the configured Weather API and writes an atomically replaced
-`today.md` in the current directory. See the [configuration reference](config.md)
-to supply the required Weather API endpoint.
+The command uses the configured Weather API and atomically writes `today.md`.
+With no configured output directory, it writes in the current directory. See
+the [configuration reference](config.md) to supply the required Weather API
+endpoint and choose an ordinary output directory.
 
 ## Commands And Usage
 
@@ -24,6 +26,7 @@ weatherreporter generate tomorrow [--config PATH] [--units VALUE] [--tz NAME] [-
 weatherreporter generate hourly [--config PATH] [--units VALUE] [--tz NAME] [--out PATH] [--llm-debug-dir PATH] [--quiet]
 weatherreporter run morning [--config PATH] [--units VALUE] [--tz NAME] [--out-dir PATH] [--llm-debug-dir PATH] [--quiet]
 weatherreporter run evening [--config PATH] [--units VALUE] [--tz NAME] [--out-dir PATH] [--llm-debug-dir PATH] [--quiet]
+weatherreporter compare REPORT --profile PROFILE --profile PROFILE [--config PATH] [--units VALUE] [--tz NAME] [--date YYYY-MM-DD] [--out-dir PATH] [--replace] [--llm-debug-dir PATH] [--quiet]
 ```
 
 `weatherreporter --version` prints the version embedded in the executable.
@@ -36,32 +39,48 @@ builds report `development`.
 | `generate today` | Accepts an optional `--date YYYY-MM-DD`; without it, the current local date in the effective report timezone is used. Its default filename is `today.md`. |
 | `generate tomorrow` | Uses the next local civil day and writes `tomorrow.md` by default. |
 | `generate hourly` | Covers the next six hours in the effective report timezone and writes `hourly.md` by default. It does not accept `--date`, `--hours`, or `--duration`. |
-| `run morning` and `run evening` | Run their defined report batches and write each selected report beneath the current directory unless `--out-dir` selects another directory. `--out` is not accepted. |
+| `run morning` and `run evening` | Run their defined report batches beneath the configured output directory, or the current directory when none is configured. `--out-dir` selects another directory. `--out` is not accepted. |
+| `compare REPORT` | Accepts `daily`, `today`, `tomorrow`, or `hourly`. It requires at least two distinct, nonblank `--profile` values in their supplied order. Daily requires `--date`; Today accepts it optionally; Tomorrow and Hourly do not accept it. |
 
 `generate` accepts the four report command names shown above. `run` accepts
-only `morning` and `evening`. Batch membership and notification ordering are
-described in the [operations guide](operations.md).
+only `morning` and `evening`. `compare` always requires explicit profile
+selection: `promptkit.profile` is not used as a comparison default. Batch
+membership and notification ordering are described in the
+[operations guide](operations.md).
 
 ## Output, Errors, And Quiet Mode
 
-For `generate`, the default output is the report's filename in the current
-directory. `--out PATH` selects one output file instead. A relative path is
-resolved from the current directory; an absolute path is used as given. For a
-batch, the equivalent default is the current directory and `--out-dir PATH`
-selects its output directory. Successful summaries always report the resulting
-absolute `outputPath` values.
+For `generate`, the report's default filename is placed beneath
+`output.directory` when configured, otherwise the current directory. `--out
+PATH` selects one complete output file instead. A relative path is resolved
+from the current directory; an absolute path is used as given. For a batch,
+the configured directory has the same role and `--out-dir PATH` selects its
+output directory instead. For `compare`, `--out-dir PATH` selects one exact
+bundle directory; otherwise the report-derived comparison directory is placed
+beneath the configured directory or current directory. `--replace` is required
+to replace an existing nonempty recognized comparison bundle. See the
+[configuration reference](config.md) for the field's validation and path rules
+and the [comparison bundle contract](integrations/comparison-bundle.md) for the
+bundle format.
 
 Outputs are written atomically. A generation, rendering, write, or cancellation
 failure before publication leaves an existing destination unchanged. A
 notification failure occurs after publication, so the newly written output
 remains available.
 
-Action commands (`generate` and `run`) write a JSON summary to stdout unless
-`--quiet` is set. `run` also writes compact per-report and batch status lines
-to stderr. A pre-run error, such as an invalid flag, missing required argument,
-or configuration-load failure, produces no partial JSON summary. When an
-action fails after it has produced a result, its summary has `"status": "failed"`
-and an `error` field.
+`SIGINT` and `SIGTERM` cancel an active action. Weatherreporter lets that
+cancellation reach the action before exiting; when the action has a result, it
+emits the usual failed summary and exits nonzero. A canceled batch retains any
+reports that were already published, marks interrupted and unstarted reports
+as `canceled`, skips batch notification, and identifies cancellation separately
+from report failures.
+
+Action commands (`generate`, `run`, and `compare`) write a JSON summary to
+stdout unless `--quiet` is set. `run` also writes compact per-report and batch
+status lines to stderr. A pre-run error, such as an invalid flag, missing
+required argument, or configuration-load failure, produces no partial JSON
+summary. When an action fails after it has produced a result, its summary has
+`"status": "failed"` and an `error` field.
 
 `--quiet` is supported by action commands only. It suppresses action summaries
 and routine batch status output; it does not suppress command errors.
@@ -103,26 +122,66 @@ The `total`, `succeeded`, and `failed` counters describe report items only, so
 a failed batch notification can leave `failed` at `0` while the top-level
 notification and action status are `failed`.
 
+When cancellation stops a batch, the summary also includes a nonzero
+`canceled` count. Canceled reports have `"status": "canceled"`; they are not
+included in `failed`, and the action still has failed status and exits nonzero.
+
 Without `--quiet`, batch status lines use this form:
 
 ```text
 report=today status=succeeded output="/srv/weather/reports/today.md"
-batch=morning total=2 succeeded=2 failed=0
+batch=morning total=2 succeeded=2 failed=0 canceled=0
 ```
 
+### Compare Summary
+
+A comparison summary contains these fields in this order: `command`,
+`comparisonId`, `reportId`, `reportName`, `promptId`, `promptVersion`,
+`promptHash`, `status`, `startedAt`, `finishedAt`, `timezone`, `validPeriod`,
+`outputDirectory`, `manifestPath`, `dataPackagePath`, `total`, `succeeded`,
+`failed`, `results`, and optional `error`. Published artifact paths and each
+successful `results[].reportPath` are absolute. `results` preserves the
+supplied profile order and each item contains `position`, `profileId`, optional
+`backendId`, `modelName`, `status`, optional `validationStatus`, optional
+`reportPath`, optional `llmDebugPath`, and optional safe `error`.
+
+The comparison status is `succeeded` only when every selected profile succeeds
+and the bundle is published. Individual profile failures still publish a
+complete partial bundle and return a failed command result. Cancellation or a
+failure before publication omits the artifact paths and returns a safe
+top-level error; the resolved `outputDirectory` and finalized timestamp remain
+when available. The safe error includes only a category and message: aggregate
+and unclassified application failures use `application`; cancellation uses
+`canceled`; deadlines use `deadline_exceeded`; prompt execution uses its
+published Promptkit category; destination failures use `destination_<kind>`;
+and committed cleanup failures use `publication_cleanup` with a message that
+states whether a complete prior bundle, partial remnants, or no prior bundle
+remains, or that recovery state could not be inspected. It does not expose
+provider diagnostics, filesystem causes, or recovery paths. See the
+[comparison bundle contract](integrations/comparison-bundle.md) for durable
+artifact fields and failure invariants.
+
+If the bundle is published but cleanup of its replaced prior bundle fails, the
+summary still includes the published artifact paths and has status `failed`.
+Its JSON error is `publication_cleanup`; the returned command error identifies
+a recovery path only when cleanup left a sibling behind. Only a reported
+complete prior bundle is a rollback artifact.
+
 ## Flag Reference
 
 | Flag | Accepted by | Meaning |
 | --- | --- | --- |
-| `-h`, `--help` | top level | Show help. |
+| `-h`, `--help` | top level, `compare` | Show help without loading configuration or contacting a provider. |
 | `--config PATH` | all commands | Load `PATH` instead of `/usr/local/etc/weatherreporter/config.yml`. |
-| `--units VALUE` | `generate`, `run` | Override `weather_api.units` for this command. |
-| `--tz NAME` | `generate`, `run` | Override `weather_api.timezone` for this command. |
-| `--out PATH` | every `generate` command | Write the report to this file instead of its current-directory default. |
-| `--llm-debug-dir PATH` | every `generate` and `run` command | Write requested sensitive prompt diagnostics under this absolute path. |
-| `--out-dir PATH` | `run morning`, `run evening` | Write batch reports beneath this directory instead of the current directory. |
-| `--quiet` | `generate`, `run` | Suppress action summaries and routine batch status output. |
-| `--date YYYY-MM-DD` | `generate daily`, `generate today` | Required for Daily; optional for Today. |
+| `--units VALUE` | `generate`, `run`, `compare` | Override `weather_api.units` for this command. |
+| `--tz NAME` | `generate`, `run`, `compare` | Override `weather_api.timezone` for this command. |
+| `--out PATH` | every `generate` command | Write the report to this complete file destination instead of the configured or current-directory default. |
+| `--llm-debug-dir PATH` | every `generate`, `run`, and `compare` command | On Unix hosts, write requested sensitive prompt diagnostics under this absolute path. Other hosts fail closed when the flag is requested. |
+| `--profile PROFILE` | `compare` | Select one explicit profile. Repeat at least twice with distinct, nonblank IDs. |
+| `--out-dir PATH` | `run morning`, `run evening`, `compare` | Write batch reports beneath this directory, or select the exact comparison directory. |
+| `--replace` | `compare` | Authorize replacement of a recognized nonempty comparison bundle. |
+| `--quiet` | `generate`, `run`, `compare` | Suppress all action summaries and routine batch status output. |
+| `--date YYYY-MM-DD` | `generate daily`, `generate today`, `compare daily`, `compare today` | Required for Daily; optional for Today. |
 
 Distributor notification is configured through `notify.distributor`; there are
 no Distributor-specific CLI flags. See the [configuration reference](config.md).
@@ -135,4 +194,5 @@ weatherreporter generate today --out ./reports/today.md
 weatherreporter generate hourly --out /srv/weather/hourly.md
 weatherreporter generate today --llm-debug-dir /var/tmp/weatherreporter-debug
 weatherreporter run morning --out-dir ./reports --llm-debug-dir /var/tmp/weatherreporter-debug
+weatherreporter compare daily --date 2026-05-29 --profile weather-light --profile weather-balanced --out-dir ./comparison-daily-2026-05-29
 ```

docs/config.md

@@ -45,7 +45,7 @@ All omitted fields use their built-in defaults.
 
 | Field | Default | Rules |
 | --- | --- | --- |
-| `base_url` | empty | Absolute Weather API URL. Required for collection and generation. |
+| `base_url` | empty | Absolute HTTP(S) Weather API URL. Required for collection and generation. |
 | `timeout` | `10s` | Must be greater than zero. |
 | `precision` | `0` | Must be zero or greater. Sent as the Weather API precision query value. |
 | `units` | `us` | Required Weather API units query value; `--units` overrides it for one command. |
@@ -53,7 +53,11 @@ All omitted fields use their built-in defaults.
 | `format` | `json` | Required and must be `json`. |
 
 Timezone values may be IANA names, configured aliases such as `Chicago` and
-`Stl`, US timezone abbreviations, or UTC offsets such as `-5` and `+09:30`.
+`Stl`, US timezone abbreviations, or signed UTC offsets such as `-5`, `+0930`,
+and `+09:30`. Numeric offsets require a sign, one or two hour digits, and an
+optional two-digit minute component with or without a colon. Hours must be
+from `00` through `23`, minutes from `00` through `59`, so the largest accepted
+offset magnitude is `23:59`.
 
 ### `location`
 
@@ -72,8 +76,10 @@ The prompt-facing location timezone is derived from the effective
 ### `secrets`
 
 `secrets.directory` defaults to empty, which disables secret loading. When it
-is set, every regular file directly in that directory is loaded after the file
-and command-line overrides. A file basename must match
+is set, every regular file directly in that directory is staged after the file
+and command-line overrides, then applied only after the complete configuration
+has validated successfully. A rejected load leaves the existing environment
+unchanged. A file basename must match
 `[A-Za-z_][A-Za-z0-9_]*`; it becomes an environment variable name, and the
 file contents replace any existing value. One trailing LF or CRLF is removed.
 
@@ -81,6 +87,32 @@ Missing directories, unreadable files, subdirectories, symlinks, non-regular
 files, and invalid names fail configuration loading. Put only secret values in
 this directory, never in the YAML file.
 
+### `output`
+
+`output.directory` selects the ordinary operator-owned publication directory
+for individual reports, batches, and the default parent of comparison bundles.
+
+| Field | Default | Rules |
+| --- | --- | --- |
+| `directory` | empty | An omitted or empty value uses the invocation working directory. A nonempty value must contain at least one non-whitespace character. |
+
+The configured value is preserved while configuration loads: it is not cleaned,
+made absolute, inspected, created, or expanded through environment variables or
+a home-directory shortcut. At execution, an absolute directory is used as
+given; a relative directory resolves from the invocation working directory, not
+from the configuration file's location. A missing directory is created when a
+report is successfully published. An existing non-directory or an uninspectable
+path fails output preflight before prompt inspection, weather collection, or
+publication.
+
+For one `generate` command, `--out` is a complete file destination and takes
+precedence over `output.directory`. For `run`, `--out-dir` takes precedence.
+For `compare`, `--out-dir` selects its exact bundle directory; without it, the
+comparison's report-derived directory is placed beneath `output.directory`.
+Those explicit flags do not inspect or rebase beneath the configured directory.
+See the [CLI reference](cli.md) for command selection and the [operations
+guide](operations.md) for publication and failure handling.
+
 ### `notify.distributor`
 
 Distributor notification is disabled by default. Its fields are:
@@ -88,7 +120,7 @@ Distributor notification is disabled by default. Its fields are:
 | Field | Default | Rules when notification is enabled |
 | --- | --- | --- |
 | `enabled` | `false` | Activates Distributor notification validation. |
-| `endpoint` | `https://distributor.example.com` | Must be an absolute URL. |
+| `endpoint` | `https://distributor.example.com` | Must be an absolute HTTP(S) base URL with a host and no userinfo, query, or fragment. A path prefix is allowed. |
 | `token_env` | `DISTRIBUTOR_UPLOAD_TOKEN` | Must name a valid environment variable. |
 | `timeout` | `30s` | Must be greater than zero. |
 | `failure_policy` | `error` | Must be `error`. |
@@ -103,6 +135,14 @@ Distributor notification is disabled by default. Its fields are:
 The upload token is read from the environment variable named by `token_env`.
 Use `secrets.directory` when a file-backed secret is appropriate.
 
+When notification is enabled, Weatherreporter validates the Distributor endpoint
+before prompt inspection, weather collection, or output publication. Use an
+HTTP(S) base URL such as `https://distributor.example.com/archive`; do not put
+credentials, a query string, or a fragment in the endpoint.
+
+When notification is enabled, each rendered single-report pipeline ID, bundle
+ID, and idempotency key must contain at least one non-whitespace character.
+
 Single-report bundle templates accept `location_id`, `report_id`, `run_id`,
 `artifact_group`, `batch_output_name`, `valid_start_date`, `valid_end_date`,
 `valid_start_time`, `valid_end_time`, `valid_start_stamp`, `valid_end_stamp`,
@@ -135,18 +175,21 @@ output selection, and failure handling.
 
 `missing_source.default` defaults to `warn` and accepts `error`, `warn`, or
 `none`. `missing_source.sources` optionally overrides that policy by source.
-Hourly forecast data is required for generated reports. Supported optional
-source keys are `observations`, `current`, `narrative`, `alerts`, `discussion`,
-`weather_story`, and `spc_convective_outlooks`.
+Hourly forecast data is required for generated reports and cannot have a
+source-specific policy. Supported optional source keys are `observations`,
+`current`, `narrative`, `alerts`, `discussion`, `weather_story`, and
+`spc_convective_outlooks`; any other key is rejected.
 
 ### `promptkit`
 
 Promptkit configuration selects the executor and prompt/profile checks for
-every `generate` and `run` command. A top-level `scriptorium:` configuration
+every `generate`, `run`, and `compare` command. A top-level `scriptorium:` configuration
 key is rejected with a migration error; it is not translated or ignored.
 
 Prompt debug capture has no YAML setting. Use `--llm-debug-dir PATH` on an
-individual `generate` or `run` command when explicitly needed.
+individual `generate`, `run`, or `compare` command when explicitly needed.
+See [optional prompt debug capture](operations.md#optional-prompt-debug-capture)
+for platform availability, security, and retention requirements.
 
 | Field | Default | Rules |
 | --- | --- | --- |
@@ -187,13 +230,21 @@ derivation. Every item needs `name`, `start`, and `end`; start and end use
 (`06:00`–`10:00`), `midday` (`10:00`–`15:00`), `afternoon`
 (`15:00`–`17:00`), and `evening` (`17:00`–`24:00`).
 
+Names remain display text, but each name must have a distinct canonical
+identity. Canonicalization trims whitespace, lowercases letters, and collapses
+punctuation and whitespace to underscores; for example, `Morning`,
+`morning!`, and `morning` conflict. Planning recognizes the canonical
+identities `morning`, `afternoon`, `evening`, and `overnight` regardless of
+their display capitalization or punctuation.
+
 ### `reports`
 
 `reports` optionally overrides a report's ordered deterministic modules and
 Distributor path templates. Omit a report entry to retain its defaults.
 
-Supported report keys are `daily`, `today`, `tomorrow`, and `hourly`; hyphens
-and underscores are equivalent.
+Supported report keys are `daily`, `today`, `tomorrow`, and `hourly`. Keys are
+trimmed, case-folded to lowercase, and normalize hyphens to underscores before
+lookup.
 
 Each report entry can contain:
 

docs/development.md

@@ -21,14 +21,15 @@ boundaries and invariants.
 | Adding, changing, reviewing, or deleting tests | [Testing policy](policy/testing.md) and focused package tests | The policy defines risk-based sufficiency, durable test boundaries, doubles, and test-maintenance criteria. |
 | CLI commands, flags, output, quiet mode, or command wiring | [CLI reference](cli.md) and [CLI internals](internal/cli.md) | The reference owns the user contract; the internal guide owns command composition and output flow. |
 | Configuration fields, defaults, loading, overrides, validation, or secrets | [Configuration reference](config.md), [architecture policy](policy/architecture.md), and tests under `internal/config` | These separate the user-visible contract, architectural rules, and executable behavior. |
-| Top-level generation, batch, collection, output publication, or notification workflow | [App orchestration internals](internal/app-orchestration.md) | It owns workflow ordering, output publication, failure propagation, and orchestration invariants. |
+| Top-level generation, batch, comparison, collection, output publication, or notification workflow | [App orchestration internals](internal/app-orchestration.md), [comparison execution internals](internal/comparison-execution.md), and [comparison publication internals](internal/comparison-publication.md) | They own workflow ordering, concurrent profile execution, output publication, failure propagation, and orchestration invariants. |
 | Weather API transport, source envelopes, source warnings, or collection | [Weather API integration](integrations/weatherapi.md), [weather-data internals](internal/weather-data.md), and [collection internals](internal/collect.md) | These separate the external contract, normalized source facts, and app-facing collection behavior. |
 | Forecast periods, weather derivation, collected facts, or derived facts | [Forecast derivation internals](internal/forecast-derivation.md) and [fact contracts](internal/facts.md) | They own deterministic derivation and the fact boundaries used by reports. |
 | Report definitions, valid periods, report IDs, output naming, or batch composition | [Report registry internals](internal/report-registry.md) and [app orchestration internals](internal/app-orchestration.md) | Report definitions own selection and period rules; orchestration owns execution. |
 | Module IDs, module composition, briefing values, or prompt-facing exports | [Module contract internals](internal/module.md), [module builder internals](internal/briefing.md), and [prompt-input internals](internal/prompt-input.md) | These own module contracts, value construction, and the curated prompt-package boundary. |
-| Prompt execution, profiles, prompt inputs, or result handling | `internal/promptexec`, the Promptkit adapter, and [prompt-input internals](internal/prompt-input.md) | These separate the executor contract and input construction. |
+| Prompt execution, profiles, prepared report inputs, or result handling | `internal/promptexec`, the Promptkit adapter, [prepared report internals](internal/prepared-report.md), and [prompt-input internals](internal/prompt-input.md) | These separate the executor contract, immutable preparation, and input construction. |
+| Durable comparison bundles or their compatibility | [Comparison bundle contract](integrations/comparison-bundle.md) and [comparison publication internals](internal/comparison-publication.md) | The integration document owns the external schema; internals own how it is published. |
 | Generated-text schemas, validation, render contexts, templates, or Markdown rendering | [Generated-text internals](internal/generatedtext.md), [report-template internals](internal/reporttemplate.md), and [report template guide](templates.md) | These own structured text, renderer implementation, and the maintainer-facing template surface. |
-| Output destinations, atomic publication, prompt diagnosis, or legacy cleanup | [Operations guide](operations.md) and [App orchestration internals](internal/app-orchestration.md) | Operations owns operator workflows; app internals owns the implementation boundary. |
+| Output destinations, atomic publication, prompt diagnosis, or legacy cleanup | [Operations guide](operations.md), [App orchestration internals](internal/app-orchestration.md), and [comparison publication internals](internal/comparison-publication.md) | Operations owns operator workflows; internals own implementation boundaries. |
 | Distributor bundles, uploads, notification results, or failures | [Distributor adapter internals](internal/distributor-adapter.md), [Distributor integration contracts](integrations/distributor/), and [operations guide](operations.md) | These separate adapter behavior, external contracts, and operational lifecycle. |
 | Maintained example configuration | [Configuration reference](config.md) and files under `examples/` | The reference owns field meaning; examples own complete copyable files. |
 | Release preparation, tagging, publication, or verification | [Release procedure](release.md) | It owns version selection, release-note preparation, candidate validation, tag publication, CI behavior, and post-publication checks. |
@@ -44,7 +45,8 @@ present before introducing a new package or abstraction.
 | --- | --- |
 | `cmd/weatherreporter` | Binary entry point. |
 | `internal/cli` | Command parsing, flags, help, output, and command wiring. |
-| `internal/app` | Stateless generation, batches, collection coordination, output publication, and notification. |
+| `internal/app` | Stateless generation, batches, comparisons, collection coordination, output publication, and notification. |
+| `internal/comparison` | Comparison identities, logical bundles, guarded destinations, and atomic bundle publication. |
 | `internal/config` | Configuration defaults, loading, precedence, secrets, and validation. |
 | `internal/adapters` | Weather API, Promptkit, and Distributor boundaries. |
 | `internal/weatherdata`, `internal/forecast`, `internal/facts` | Normalized source facts and deterministic derivation. |

docs/integrations/comparison-bundle.md

@@ -0,0 +1,103 @@
+# Comparison Bundle Contract
+
+A comparison bundle is the durable, flat artifact produced when one report is
+executed with multiple explicit Promptkit profiles. This document is the
+canonical contract for consumers of those bundles. Command invocation and JSON
+action summaries belong to the [CLI reference](../cli.md); destination handling
+and retention belong to the [operations guide](../operations.md).
+
+## Version And Layout
+
+The current and only supported manifest schema version is
+`weatherreporter.comparison.v1`. A bundle directory contains exactly these
+regular, non-symlinked files:
+
+```text
+comparison.json
+data-package.yml
+NN-profile-slug.md
+```
+
+`comparison.json` is the manifest and `data-package.yml` is the exact YAML
+input supplied to every selected profile. There is one Markdown file for each
+successful result and none for failed results. `NN` is the one-based selected
+profile position, zero padded to at least two digits (and widened only when
+needed for 100 or more profiles). The profile slug preserves ASCII letters,
+digits, `-`, and `_`; each run of other characters becomes one `-`; edge `-`
+and `_` characters are removed; the value is capped at 64 bytes; and an empty
+slug becomes `profile`. Logical profile IDs remain authoritative in the
+manifest.
+
+All manifest paths are basenames relative to the bundle root. They never use
+path separators, `.` or `..`. The CLI reports absolute paths only after a
+bundle has been published.
+
+## Manifest Schema
+
+The manifest is UTF-8 JSON, encoded as two-space-indented JSON with one
+trailing newline. Its fields appear in this order:
+
+```text
+schemaVersion, comparisonId, startedAt, finishedAt, reportId, validPeriod,
+timezone, promptId, promptVersion, promptHash, dataPackage, total, succeeded,
+failed, results
+```
+
+`validPeriod` contains `start` and `end`; it is a nonempty half-open period.
+`dataPackage` contains `path` (always `data-package.yml`) and `sha256` (the
+lowercase, 64-character SHA-256 digest of that file's exact bytes). `results`
+is in the explicit profile-selection order. Its result-object fields appear in
+this order:
+
+```text
+position, profileId, backendId, modelName, status, validationStatus,
+reportPath, error
+```
+
+`startedAt` and `finishedAt` are nonzero UTC timestamps, and the latter is not
+earlier than the former. `validPeriod` retains its resolved time offset.
+`reportId`, `timezone`, prompt identity, model name, and comparison ID are
+nonblank. `promptHash` and `dataPackage.sha256` are lowercase SHA-256 digests.
+
+## Result Invariants
+
+`total` is at least two and equals the number of results. Positions are
+contiguous from one, profile IDs are distinct and nonblank, and
+`succeeded + failed == total`.
+
+A successful result has `status: "succeeded"`, `validationStatus: "passed"`,
+a `reportPath` exactly equal to the canonical `NN-profile-slug.md` filename for
+its position, total, and logical profile ID, and no `error`. A failed result has
+`status: "failed"`, no `reportPath`, and an `error` object with nonblank
+`category` and `message`. Its validation status is absent, `failed`, or
+`skipped`. Error messages are valid UTF-8 and no longer than 1,024 bytes.
+`backendId` and `validationStatus` are omitted when unavailable.
+
+Every successful Markdown file is declared by exactly one successful result.
+The directory contains no extra entries. Consumers can therefore verify the
+data-package digest and the full manifest-to-file mapping without scanning a
+larger workspace.
+
+## Compatibility And Sensitivity
+
+Weatherreporter recognizes a replaceable bundle only when it exactly satisfies
+the current version, schema, file set, file types, relative-path rules, and
+data-package digest. JSON field names are case-sensitive canonical names and a
+field may appear only once in each manifest object. It rejects unknown,
+case-variant, or duplicate fields; multiple JSON values; extra entries;
+symlinks; and future or otherwise unsupported versions. Treat a bundle that
+fails recognition as an ordinary directory, not as a compatible bundle.
+
+When replacing a recognized bundle, cancellation observed before the new
+bundle is installed preserves the prior bundle rather than committing the
+replacement.
+
+Cleanup of a prior bundle occurs only after its replacement is committed and
+does not affect the new bundle's compatibility. A cleanup error may identify a
+complete recovery bundle, partial remnants, no remaining sibling, or an
+uninspectable state; this operational state is not recorded in the manifest.
+
+The manifest contains safe operational provenance, but `data-package.yml` and
+the generated Markdown can contain sensitive weather or location context. Do
+not assume these artifacts are safe for public distribution. Handle retention,
+access, and deletion according to the [operations guide](../operations.md).

docs/integrations/distributor/api.md

@@ -8,8 +8,10 @@ and [operations guide](../../operations.md).
 
 ## Upload Admission
 
-Weatherreporter uses an absolute HTTP(S) endpoint as a base URL. The client
-posts a gzip-compressed source bundle to:
+Weatherreporter uses an absolute HTTP(S) endpoint with a host as a base URL.
+It allows a path prefix but rejects userinfo, query strings, and fragments
+before local report work begins. The client posts a gzip-compressed source
+bundle to:
 
 ```text
 POST /v1/pipelines/<pipeline_id>/upload
@@ -23,11 +25,16 @@ A successful response is `202 Accepted` with JSON containing `run_id` and
 `status`. Acceptance means Distributor staged and validated the source bundle;
 it does not mean downstream destinations have published it.
 
-The adapter requires a pipeline ID, bundle ID, idempotency key, and at least one
-source-file mapping before calling Distributor. It reads the bearer token from
+The adapter requires nonblank pipeline ID, bundle ID, and idempotency key, plus
+at least one source-file mapping, before calling Distributor. It reads the bearer token from
 the configured environment variable and redacts that value from errors. Request
 construction and timeout handling belong to the [Distributor adapter](../../internal/distributor-adapter.md).
 
+Weatherreporter reads at most 1 MiB from each Distributor response. An
+oversized response fails notification with a stable local diagnostic. Normal
+Weatherreporter results retain upload and status identity but do not repeat
+Distributor response bodies, status reports, or remote error text.
+
 ## Idempotency
 
 Distributor scopes idempotency to the token, pipeline ID, and key. Keys must be

docs/integrations/distributor/pkg-upload.md

@@ -6,10 +6,14 @@ attempt and calls `UploadFiles`, followed by `Status` for the accepted run.
 
 ## Client And Upload
 
-The adapter constructs the client with the configured endpoint, bearer token,
-and an HTTP client whose timeout is the configured Distributor timeout. It
-passes no custom retry options, so the pinned client's defaults apply: three
-attempts, 100 ms base delay, and one-second maximum delay.
+The adapter constructs the client with the prevalidated HTTP(S) endpoint,
+bearer token, and an HTTP client whose timeout is the configured Distributor
+timeout. The endpoint may include a path prefix but never userinfo, a query, or
+a fragment. It passes no custom retry options, so the pinned client's defaults
+apply: three attempts, 100 ms base delay, and one-second maximum delay.
+The adapter bounds every response to 1 MiB before handing it to the pinned
+client. A response above that boundary is rejected as a local overflow rather
+than decoding or retaining a prefix.
 
 For each notification, Weatherreporter calls `UploadFiles` with:
 
@@ -38,8 +42,9 @@ adapter translates it to its own conflict error without exposing the token.
 The adapter then calls `Status` for the accepted run. A terminal `failed`
 status is a notification failure. A status lookup failure or a timeout before a
 terminal status remains attached to the otherwise accepted upload as diagnostic
-status information. Polling cadence, final failure handling, and redaction are
-internal behavior documented in the
+status information. Normal diagnostics use local status classifications; they
+do not expose remote response text or the status report. Polling cadence, final
+failure handling, and redaction are internal behavior documented in the
 [Distributor adapter](../../internal/distributor-adapter.md) and
 [application orchestration](../../internal/app-orchestration.md).
 

docs/integrations/promptkit.md

@@ -16,7 +16,7 @@ The `~` prefix is part of each OpenRouter rolling-alias model ID. The embedded p
 
 ## Selection And Active Execution
 
-Before weather collection, Weatherreporter validates the exact prompt version, output contract, and selected profile. A nonblank `promptkit.profile` selects one profile ID for every report in the command; otherwise the prompt's declared default selects it. Promptkit resolves the selected definition in this order:
+Before weather collection, Weatherreporter validates the report's exact generated-text report/schema/template catalog binding, prompt version and hash, output contract, and selected profile. Active profiles must resolve a nonblank backend and model identity. A nonblank `promptkit.profile` selects one profile ID for every report in the command; otherwise the prompt's declared default selects it. Promptkit resolves the selected definition in this order:
 
 1. explicit in-memory profiles used by an embedding consumer or test;
 2. the configured `profile_file` or `profile_dir`;
@@ -27,8 +27,34 @@ A source falls through only when the selected ID is absent. Each source supplies
 
 Profiles that require a direct API key are unsupported; a profile that reports `APIKeyEnv` requires a nonblank value in that environment variable. Active results retain the selected logical profile ID and resolved backend and model. Ordinary errors, summaries, logs, and outputs exclude endpoints, credentials, rendered messages, schemas, request bodies, response bodies, and complete parameter maps.
 
-Promptkit receives the YAML data package as an inline input and returns structured JSON that Weatherreporter validates before rendering its own Markdown template. Safe active provenance remains in memory. Content-rich diagnostics are opt-in through `--llm-debug-dir`; see [operations](../operations.md) for retention and permissions.
+Promptkit receives the YAML data package as an inline input and returns structured JSON that Weatherreporter validates before rendering its own Markdown template. Before accepting that JSON, Weatherreporter requires exactly one preparation callback and reconciles its prompt/profile/backend/model and rendered/input hashes with the inspected identity and completed result. The callback output contract and completed validation must use the report's expected JSON Schema mode and path. The package contains only reviewed prompt-facing warning summaries, never source transport or provenance details. Safe active provenance remains in memory. Content-rich diagnostics are opt-in through `--llm-debug-dir`; see [operations](../operations.md) for retention and permissions.
 
-The generated-text schemas require `summary`, `forecast_discussion`, and `precipitation_timing`, and reject additional properties. Prompts return an empty string for `precipitation_timing` when the deterministic package contains no precipitation windows.
+When capture is enabled, its preparation artifact projects a provider endpoint
+to its scheme and host and retains only reviewed execution settings. Provider
+extras and URL user information, paths, queries, and fragments are omitted.
+Capture storage remains confined to the operator-selected debug root; an unsafe
+filesystem path causes the requested execution to fail. Host availability and
+operator handling are documented in the
+[operations guide](../operations.md#optional-prompt-debug-capture).
+
+## Comparison Execution
+
+For `compare`, Weatherreporter validates the report's generated-text catalog
+binding, one exact prompt, and every explicitly selected profile before weather
+collection. It prepares one deterministic YAML
+data package, retains immutable copies of the report inputs, and executes every
+profile against the same exact data-package bytes. Each profile remains an
+independent Promptkit execution: one provider, provenance, or validation failure does not
+stop its peers, while caller cancellation applies to every in-flight execution.
+
+Weatherreporter starts selected profile executions concurrently and does not
+add an application-level concurrency limit. Promptkit owns backend capacity and
+any profile or backend concurrency policy. A shared Weatherreporter executor
+must safely accept those concurrent `Execute` calls. The durable comparison output and
+its compatibility rules are defined by the
+[comparison bundle contract](comparison-bundle.md); the user-facing command
+contract is in the [CLI reference](../cli.md).
+
+The generated-text schemas require `summary`, `forecast_discussion`, and `precipitation_timing`, and reject additional properties. Promptkit results are accepted only when their raw JSON is at most 64 KiB; the adapter drops larger results before copying them into Weatherreporter's execution values or debug artifacts. The validator also limits total generated prose to 20,000 characters, with 4,000-character summary and timing fields, a 12,000-character Hourly discussion, and at most 12 day-style paragraphs of 4,000 characters each. Prompts return an empty string for `precipitation_timing` when the deterministic package contains no precipitation windows.
 
 Prompt/profile configuration and the maintained local override example are owned by the [configuration reference](../config.md). Adapter construction and mapping are documented in the [Promptkit adapter internals](../internal/promptkit-adapter.md).

docs/integrations/weatherapi.md

@@ -9,24 +9,29 @@ are documented in [Weather data internals](../internal/weather-data.md) and
 
 ## Base URL And Requests
 
-`weather_api.base_url` must be an absolute URL. Weatherreporter joins each
-endpoint path to the configured base URL path, so a service hosted under a path
-prefix must keep that prefix available. Requests use `GET` and carry the
+`weather_api.base_url` must be an absolute HTTP(S) URL. Weatherreporter joins
+each endpoint path to the configured base URL path, so a service hosted under a
+path prefix must keep that prefix available. Requests use `GET` and carry the
 configured timeout on every HTTP attempt.
 
 Every request sends `format` and, except where noted below, `units`. The
 configured format must be `json`.
 
-Before retrieving sources, Weatherreporter warms up
-`/conditions/current` with the same `format`, `units`, and `precision` query
-parameters used for current conditions. The warmup only requires a readable
-2xx response; its body is not decoded. Failure after its internal retry budget
-stops the fetch before source requests begin.
+Before retrieving sources, Weatherreporter requests `/conditions/current` with
+the same `format`, `units`, and `precision` query parameters used for current
+conditions. After a readable 2xx response, it retains that response for the
+normal current-conditions source step rather than making a second identical
+request. Failure after the readiness request's internal retry budget stops the
+fetch before source requests begin.
 
 ## Endpoints And Query Parameters
 
-The adapter makes one source request for each endpoint after a successful
-warmup, subject to retry on transient failures.
+The adapter makes one source request for each endpoint, subject to retry on
+transient failures. A successful readiness request supplies the current
+conditions source response. The remaining independent source requests run
+concurrently, then their results are processed in the source order shown below.
+This keeps source provenance, missing-source policy, and surfaced errors
+deterministic regardless of response order.
 
 | Source | Endpoint | Query parameters | Availability |
 | --- | --- | --- | --- |
@@ -57,14 +62,15 @@ An absent `data` member is treated as a missing source. For ordinary sources,
 `data: null` is also missing. The active-alert exception is listed above: its
 explicit `null` payload represents an empty alert result.
 
-Hourly forecast data must be present and contain at least one `period`; a
-missing, malformed, or empty hourly product fails collection. The remaining
-sources follow the configured missing-source policy. Under `error`, collection
-fails; under `warn`, the source is omitted and an inspectable warning is
-recorded; under `none`, the source is omitted without a warning. A per-source
-policy overrides the default. See [Configuration](../config.md) for policy
-settings and [Weather data internals](../internal/weather-data.md) for recorded
-source metadata.
+Hourly forecast data must be present and contain at least one `period`. Every
+hourly period needs nonzero `startTime` and `endTime` values, with `endTime`
+after `startTime`; a missing, malformed, empty, or invalidly bounded hourly
+product fails collection. The remaining sources follow the configured
+missing-source policy. Under `error`, collection fails; under `warn`, the
+source is omitted and an inspectable warning is recorded; under `none`, the
+source is omitted without a warning. A per-source policy overrides the default.
+See [Configuration](../config.md) for policy settings and [Weather data
+internals](../internal/weather-data.md) for recorded source metadata.
 
 Malformed top-level JSON envelopes and HTTP failures are direct request errors.
 Malformed `data` for an optional source follows its missing-source policy.
@@ -138,9 +144,10 @@ It does not retry other HTTP statuses, malformed envelopes, missing data, or
 payload decoding failures. A canceled context also stops an in-progress retry
 delay.
 
-The adapter reads at most 10 MiB from one response body. A non-2xx response,
-request construction failure, read failure, or decode failure includes endpoint
-context in its error.
+The adapter accepts response bodies up to 10 MiB and rejects larger bodies
+before decoding. A non-2xx response reports its relative endpoint and status,
+without including upstream response text. Request construction, response-limit,
+read, and decode failures include endpoint context in their errors.
 
 Retry counts and delays are adapter behavior rather than Weather API request
 parameters. Do not depend on a particular attempt count when implementing the

docs/internal/app-orchestration.md

@@ -1,21 +1,66 @@
 # Application Orchestration Internals
 
-`internal/app` owns stateless report generation, batch execution, atomic output publication, and notification coordination after `internal/cli` has parsed arguments and loaded configuration. The user contract is owned by the [CLI reference](../cli.md) and [operations guide](../operations.md).
+`internal/app` owns stateless report generation, batch execution, comparison
+orchestration, atomic output publication, and notification coordination after
+`internal/cli` has parsed arguments and loaded configuration. The user contract
+is owned by the [CLI reference](../cli.md) and [operations guide](../operations.md).
 
 ## Single-Report Flow
 
-`GenerateDetailed` resolves the requested report and output destination, then initializes an optional explicit debug writer. It validates the exact Promptkit prompt and selected profile before collecting weather data. The resolved profile, backend, and model are carried in the active result.
+`GenerateDetailed` resolves the requested report and output destination before initializing an optional explicit debug writer. An explicit output file wins; otherwise the configured output directory is used, falling back to the captured working directory. Output preflight validates the final filename, permits only an absent or regular final destination, and validates the bounded same-directory temporary form without creating a missing parent. It then validates the report's generated-text catalog binding, exact Promptkit prompt, and selected profile before collecting weather data. The resolved profile, backend, and model are carried in the active result.
 
-The workflow builds facts, a module snapshot, briefing metadata, and the YAML prompt package in memory. It executes Promptkit, validates the returned generated text, builds a render context, and renders Markdown. `fileutil` atomically writes the completed Markdown to the selected output path. Only after that write succeeds does single-report notification run.
+The workflow builds facts, a module snapshot, briefing metadata, and the YAML prompt package in memory. It executes Promptkit only against the inspected prompt and profile, reconciles the preparation callback and completed result with that identity and the prepared report schema, validates the returned generated text, builds a render context, and renders Markdown. `fileutil` writes the completed Markdown through a same-directory temporary file, rechecks the final destination and context after close and immediately before the atomic rename. Only after that write succeeds does single-report notification run.
 
 Failures return an active partial result with safe identity, profile, warning, validation, debug, and output information when available. After rendering and immediately before publication, the workflow checks for cancellation or deadline expiry. Any failure before publication leaves an existing destination unchanged. A notification failure retains the newly published output.
 
 ## Batches
 
-`RunBatchDetailed` captures one output directory, creates at most one explicit debug writer, and uses one executor. Before collection it validates the prompt and profile candidates for the selected batch. It collects once, calculates the data-dependent plan, then validates and retains the final output path for every planned report before invoking the same generation core sequentially.
+`RunBatchDetailed` selects an explicit output directory first, otherwise the configured directory and then the captured working directory. It does this before creating at most one explicit debug writer or validating generated-text catalog, prompt, and profile candidates for the selected batch. It collects once, calculates the data-dependent plan, then validates and retains the final output path for every planned report before invoking the same generation core sequentially.
 
 Each item has an independent result. A failed item does not stop later items; successful items retain their published output paths. Per-report notification is suppressed during a batch. Batch notification runs only after every planned report has published successfully. It is skipped when any item failed. Batch result counters count report items only; a batch notification failure is represented by the top-level notification result and still produces a failed batch outcome.
 
+Cancellation and deadline expiry stop the sequential loop before another report
+starts. Completed report results and published paths remain successful; the
+interrupted and unstarted planned reports have `canceled` status and are counted
+separately from failed reports. The batch notification result records that
+delivery was skipped, and the returned error retains the original context cause
+for callers and CLI projection.
+
+## Comparisons
+
+`CompareDetailed` validates ordered explicit profile IDs, resolves the report,
+and preflights the exact bundle destination before initializing optional prompt
+debugging, prompt inspection, or collection. It then validates the report's
+generated-text catalog binding, inspects the one prompt and every selected
+profile, collects once, and delegates shared report
+construction to the prepared-report flow. It does not accept a notifier.
+
+Once the destination is resolved, the partial result retains its absolute
+output directory even when later preflight, debug initialization, inspection,
+collection, or preparation fails. Every initialized result is finalized with a
+finished timestamp. If prompt inspection succeeds before a later profile
+inspection fails, the partial result retains the resolved prompt ID, version,
+and hash. Artifact paths are added only after publication commits.
+
+The comparison execution core starts each inspected profile independently,
+keeps results in selection order, and waits for all started work. Every profile
+reconciles its callback and completion provenance before its JSON can be
+rendered. Independent profile failures are recorded and do not stop peers; a
+completed profile failure remains recorded if cancellation happens later.
+Context cancellation marks only unfinished or cancellation-terminated work and
+prevents publication. Details of
+prepared values, execution and debugging, and publication are documented in [prepared report
+internals](prepared-report.md), [comparison execution
+internals](comparison-execution.md), and [comparison publication
+internals](comparison-publication.md).
+
+When publication has committed its new bundle, application results contain the
+absolute manifest, data-package, and successful report paths even if removal of
+the previous sibling backup then fails. That cleanup failure is still returned
+as an operational error rather than treating the new bundle as unpublished;
+the returned error identifies the observed recovery state and includes a path
+only when cleanup left a sibling behind.
+
 ## Boundaries And Verification
 
 The package does not parse flags, load YAML, implement transport, construct provider SDKs, or define report-period policy. Prompt, profile, weather, and Distributor implementations remain behind project-owned contracts.

docs/internal/briefing.md

@@ -10,7 +10,10 @@ snapshot, construct YAML, invoke Promptkit, or render a report.
 
 Every `ModuleDefinition` declares an ID, stanza name, default option value,
 required collected and derived facts, supported report IDs, missing-data
-behavior, duplicate policy, builder, and optional prompt exporter.
+behavior, duplicate policy, builder, and optional prompt exporter. The
+briefing-owned fact-requirement vocabulary supplies each prerequisite's stable
+identity, category, and availability predicate; registry construction rejects
+unknown requirements and requirements listed under the wrong category.
 
 `BuildModule` first verifies the requested module, report compatibility, and
 option shape. It then applies the declared missing-data behavior:
@@ -32,29 +35,60 @@ discussion, and weather story. Derived builders shape daily and daypart
 summaries, precipitation timing, outdoor windows, and the report-specific
 Daily, Today, and Tomorrow planning values.
 
+The daily summary preserves generic feels-like values as
+`apparent_temperature_max_f`; it does not label them as a heat index. Daypart
+temperature phrases retain below-zero meaning, including through temperature
+trends that cross zero. Outdoor windows add a 25-point risk penalty and an
+explicit reason for each snow, ice, or fog indicator. Equal scores retain input
+order for both best and worst windows.
+
 The module registry preserves rich values for templates and snapshots while
 curating prompt exports where needed. In particular, source warnings are a
 metadata summary, checked-empty alerts and SPC outlooks remain distinct from
 missing sources, and prompt-safe SPC values omit geometry and other
 template-only or source details. The complete module composition is in
 [module internals](module.md); fact derivation is in [fact contracts](facts.md).
+Alert digests are built from selected alert items and source provenance, not a
+provider response envelope.
 
-`area_forecast_discussion` accepts an optional typed section filter. Planning
-modules are report-specific: `daily_planning` supports Daily,
+Derived daypart-summary maps use the forecast package's canonical daypart
+identity and reject any collision instead of replacing an earlier value.
+Planning applies the same identity when recognizing morning, afternoon,
+evening, and overnight windows; display labels remain separate and preserve
+configured text with rune-safe first-letter capitalization.
+
+The embedded SPC background-definition asset records its authoritative sources,
+source update dates, and maintainer review schedule. Its categorical
+`official_description` values transcribe the [SPC convective-outlook risk
+table](https://www.spc.noaa.gov/about/outlooks/); its Conditional Intensity
+Group entries follow the [SPC conditional-intensity
+reference](https://www.spc.noaa.gov/exper/conditional-intensity-information).
+`plain_language` values are Weatherreporter summaries. Weatherreporter
+maintainers review the asset annually and whenever either source changes.
+
+`area_forecast_discussion` accepts an optional typed section filter. Accepted
+typed option pointers are normalized to the declared value type before builder
+execution. Planning modules are report-specific: `daily_planning` supports Daily,
 `today_planning` supports Today, and `tomorrow_planning` supports Tomorrow.
 
 ## Missing data and boundaries
 
 Optional current conditions, narrative products, discussions, and weather
-stories may be omitted. Required derived modules fail when their declared facts
+stories may be omitted. A weather story is usable only when it has non-blank
+displayable content (title, description, alternate text, or download URL) or a
+valid start/end period; otherwise collection applies its optional-source policy
+and the module is omitted. Required derived modules fail when their declared facts
 are unavailable. Empty alert and outlook runs can still produce checked-empty
 modules. SPC discussion is omitted unless a retained categorical outlook meets
 the package's severity criterion and matching discussion text exists.
 
-Effective units, timezone, and location context arrive in `ModuleContext` from
-configuration and resolved report metadata. Field defaults are owned by
-[configuration](../config.md), and prompt-package layout is owned by
-[prompt input](prompt-input.md).
+`ModuleContext` carries the effective units, timezone, location context, and
+prepared identity. Report preparation creates that one `PreparedIdentity` for
+the shared report identity, timing, configuration context, and source warnings
+before module construction. The metadata module projects its matching fields
+from that value and retains its prompt-safe shape. Field defaults are owned by
+[configuration](../config.md), and prompt-package layout is owned by [prompt
+input](prompt-input.md).
 
 ## Verification and invariants
 

docs/internal/cli.md

@@ -4,11 +4,17 @@
 
 The root `--version` flag reports the build version supplied by `internal/buildinfo`. Tagged release builds replace its development default at link time.
 
-For each `generate` or `run` action, `Runner` constructs one project-owned Promptkit executor after configuration loads. It captures an absolute working directory, resolves a relative output override against it, and passes the working directory, resolved override, and any `--llm-debug-dir` request to the app. With no override, the app derives the report filename in that working directory. `run` uses the same resolution rule for `--out-dir`.
+The executable derives its action context from `SIGINT` and `SIGTERM` and
+passes it to `Runner.Run`. Signal cancellation therefore uses the same action,
+summary, and error paths as other context cancellation.
 
-The CLI dispatches only generation and batch actions. It has no persisted-run or inspection dispatch. Summaries include report identity, status, output path, effective profile/backend/model, source warnings, validation, requested debug path, and notification result when available. They intentionally exclude prompt input, raw generated text, render context, endpoints, credentials, and full Distributor payloads. A failed action with a partial result still emits its safe summary before its error is returned.
+For each `generate`, `run`, or `compare` action, `Runner` constructs one project-owned Promptkit executor after request preflight and configuration loading. It captures an absolute working directory, resolves only a relative explicit output override against it, and passes the working directory, loaded configuration, resolved override, and any `--llm-debug-dir` request to the app. The raw configured fallback remains in the configuration for app-owned destination selection. `run` uses the same explicit-resolution rule for `--out-dir`.
 
-CLI code owns no report policy, weather collection, output publication, provider execution, or notification policy. Focused checks:
+The CLI dispatches generation, batch, and comparison actions. It has no persisted-run or inspection dispatch. Generation and batch summaries include report identity, status, output path, effective profile/backend/model, source warnings, validation, requested debug path, and notification result when available. Comparison summaries retain their ordered profile results and published bundle paths when available. All summaries intentionally exclude prompt input, raw generated text, render context, endpoints, credentials, and full Distributor payloads. A failed action with a partial result still emits its safe summary before its error is returned unless `--quiet` is set.
+
+CLI code owns report-date flag acceptance and date resolution, but not report
+composition, weather collection, output publication, provider execution, or
+notification policy. Focused checks:
 
 ```sh
 go test ./internal/cli

docs/internal/collect.md

@@ -1,43 +1,36 @@
 # Collection Internals
 
-`internal/collect` is the application-facing boundary for collecting the
+`internal/collect` is the small application-facing boundary that obtains one
 normalized Weather API bundle. The external HTTP contract belongs in the
-[Weather API integration guide](../integrations/weatherapi.md); normalized data
-semantics belong in [weather-data internals](weather-data.md).
+[Weather API integration guide](../integrations/weatherapi.md); normalized
+source values belong in [weather-data internals](weather-data.md).
 
 ## Contract
 
-`Run` accepts a `context.Context` and a `Request` containing effective
-`config.Config`. It constructs the Weather API adapter from that configuration,
-calls `FetchBundle`, and returns `Result{Bundle: *weatherdata.Bundle}`.
+`Run` receives a context and effective configuration in `Request`. It creates
+the Weather API adapter, calls `FetchBundle`, and returns the adapter's
+normalized bundle in `Result`. Adapter construction errors are wrapped as
+weather-collection setup errors and fetch errors as bundle-collection errors.
 
-The package wraps adapter construction failures as weather-collection setup
-errors and fetch failures as bundle-collection errors. It does not retry,
-persist, select reports, derive facts, build modules, invoke Promptkit, or
-notify Distributor.
+The package neither chooses reports nor derives facts, builds modules, invokes
+Promptkit, writes files, or sends notifications. Request scheduling, endpoint
+retrieval, response limits, and source-level warnings belong to the Weather
+API adapter and its integration contract.
 
-## Application Composition
+## Application Use
 
-`internal/app` owns the narrow `Collector` interface used by workflow tests;
-the production implementation delegates to `collect.Run`. Generation, batch
-execution, and explicit bundle fetching all use this boundary. Application
-orchestration rejects a nil collector result or a nil bundle before report work
-can continue.
+`internal/app` owns the `Collector` interface used by report workflows and
+tests. Its default implementation delegates to `collect.Run`; callers may
+substitute a collector at that boundary. Application orchestration owns
+collection timing, reuse across a workflow, and the handling of nil collection
+results. See [app orchestration internals](app-orchestration.md) for that
+flow.
 
-Single-report generation and a batch each collect once. A batch passes the same
-normalized collection to planning and to every report it generates. Collection
-failure prevents later workflow work for that request.
+## Verification
 
-## Boundaries And Invariants
+Focused package tests cover a successful fetch and wrapping failures from
+adapter construction and bundle retrieval:
 
-Collection owns adapter creation and retrieval of one normalized bundle. It
-must not make report, period, batch, prompt, module, filesystem, or notification
-decisions.
-
-- App-facing Weather API collection always passes through this package.
-- The returned value is normalized source data, not facts or prompt input.
-- Context cancellation is passed to the Weather API adapter.
-- Errors retain whether setup or fetching failed.
-
-Focused tests are in `internal/collect/collect_test.go`; orchestration use is
-also covered by `internal/app/app_test.go`.
+```sh
+go test ./internal/collect
+```

docs/internal/comparison-execution.md

@@ -0,0 +1,32 @@
+# Comparison Execution Internals
+
+The comparison execution core receives an already prepared report and an
+already inspected, ordered profile list. It initializes an outcome for every
+selected profile, launches each started profile in its own goroutine, and
+waits for every started goroutine before returning. Results retain the supplied
+selection order even though execution completes in an arbitrary order.
+
+Every profile uses the exact inspected prompt identity and a private copy of
+the same prepared data package. Provider, generated-text validation, rendering,
+or debug-write failure becomes that profile's safe failed outcome and does not
+cancel its peers. The shared executor must support those concurrent `Execute`
+calls. The application deliberately imposes no additional semaphore: Promptkit
+owns backend capacity. A profile failure completed before a later cancellation
+remains its original safe outcome; cancellation or a deadline marks only
+unfinished or cancellation-terminated outcomes as skipped or failed, joins work,
+and prevents bundle publication.
+
+When debugging is enabled, each execution receives a deterministic reference
+derived from the comparison identity, ordered profile position, and safe
+profile slug. This keeps concurrent captures separate. The debug writer itself
+owns secure-root validation and file permissions. It safely creates shared
+missing ancestors during concurrent writes, then rejects symlink and non-
+directory components. Operational retention and sensitivity are documented in
+the [operations guide](../operations.md). This secure writer is enabled only on
+Unix hosts; comparison fails before execution when another host requests debug
+capture.
+
+The output result and its safe errors are converted into the durable contract
+only by comparison publication. See [comparison publication
+internals](comparison-publication.md) and the external [comparison bundle
+contract](../integrations/comparison-bundle.md).

docs/internal/comparison-publication.md

@@ -0,0 +1,47 @@
+# Comparison Publication Internals
+
+`internal/comparison` separates the logical bundle from filesystem mechanics.
+The application builds a validated manifest, exact shared data-package bytes,
+and only the Markdown files for successful profiles. The durable layout,
+schema, and compatibility rules are owned by the [comparison bundle
+contract](../integrations/comparison-bundle.md).
+
+Recognition first token-validates the manifest's object fields, rejecting
+unknown, case-variant, and duplicate names before decoding its typed schema.
+Manifest validation derives each successful report filename from its ordered
+position, total profile count, and logical profile ID; logical-bundle and
+filesystem validation then require that exact path and file set.
+
+Destination planning is read-only. It requires an exact absolute target that
+is neither the filesystem root nor the working directory, rejects unsafe
+symlinks and non-directories, accepts a missing or empty directory, and permits
+replacement only for a recognized current bundle. Publication rechecks the
+destination namespace and type immediately before it writes a private sibling
+staging directory. For replacement, it moves the prior bundle to a private
+sibling backup, fully reauthorizes that moved entry, checks for cancellation,
+and restores it if cancellation or installing the new bundle prevents
+replacement. If guarded restoration fails, the error retains the prior bundle's
+recovery path.
+
+Planning also validates the final component and the bounded fixed names used
+for private staging and backup siblings. A destination that cannot form those
+names is rejected before publication creates a missing parent directory; a
+maximum-length valid destination remains usable because transaction siblings do
+not incorporate its basename.
+
+The new bundle is committed only after the staged directory has been installed
+at the target. From that point its artifact paths are authoritative: a failure
+to remove the retained sibling backup does not roll back the new bundle.
+After a cleanup failure, publication inspects the sibling without masking the
+original filesystem cause. Its inspectable cleanup result distinguishes a
+complete recognized recovery bundle, partial remnants, an absent sibling, or
+an uninspectable state. A recovery path is reported only when something
+remains; only a complete recognized bundle is suitable for rollback recovery.
+
+The application preflights before prompt inspection and collection. Publication
+performs its transaction-boundary checks and final moved-destination
+authorization before installation. A cancellation or any failure before the
+commit leaves the prior destination untouched. Completed bundles include
+partial profile results; comparison publication never coordinates Distributor
+notification. Operator-facing lifecycle and cleanup are in the
+[operations guide](../operations.md).

docs/internal/distributor-adapter.md

@@ -13,7 +13,9 @@ the token, an optional timeout, and an injectable upstream-client factory.
 `New` validates its configuration before creating the adapter. For each upload,
 the adapter reads the token from the configured environment variable and builds
 the upstream client with that endpoint, token, and an HTTP client whose timeout
-matches the local positive timeout.
+matches the local positive timeout. Its transport reads at most 1 MiB from any
+Distributor response before the pinned client decodes it; an oversized response
+is a distinct local failure and does not trigger an extra upload attempt.
 
 The upstream client is an implementation dependency, not a source of
 application configuration: retry ownership, pipeline selection, path
@@ -43,20 +45,26 @@ persist notification artifacts.
 An accepted upload is followed by one status request. When a timeout is
 configured, a nonterminal result is polled until `succeeded` or `failed`, or
 until the context ends. The translated `UploadResult` contains the run ID,
-status, and `RunStatus`, including pipeline ID, lifecycle timestamps, report,
-and remote error details.
+status, and `RunStatus`, including pipeline ID and lifecycle timestamps.
+Remote response bodies, status reports, and remote error text are not retained
+in normal results. HTTP failures retain a local typed status-code and
+retryability classification; conflicts retain the local idempotency-conflict
+type.
 
 Status lookup or polling errors are preserved in `UploadResult.StatusError` so
-the caller can report an accepted-but-unconfirmed delivery. A terminal failed
-run returns that result and an error. Upload failures return no result. Upstream
+the caller can report an accepted-but-unconfirmed delivery, using a bounded
+repository-owned diagnostic rather than remote text. A terminal failed run
+returns that result and an error. Upload failures return no result. Upstream
 idempotency conflicts become the local `IdempotencyConflictError`, which adds
 endpoint, pipeline, bundle, idempotency, and file-path context while redacting
 the token.
 
 ## Verification
 
-Focused tests cover configuration validation, request mapping, timeouts and
-polling, status translation, conflict handling, and token redaction:
+Focused tests cover configuration validation, request mapping, response size
+boundaries, safe diagnostics, timeouts and polling, status translation, conflict
+handling, and token redaction. A local HTTP server exercises the production
+upload and status boundary:
 
 ```sh
 go test ./internal/adapters/distributor

docs/internal/facts.md

@@ -16,6 +16,9 @@ story, and convective outlook data. Source provenance and warnings are copied
 into their own slices so downstream consumers can inspect data completeness
 without treating it as an ordinary weather fact.
 
+Alert facts retain individual alert payloads for period selection together with
+their copied source provenance; they do not retain a provider response envelope.
+
 A nil bundle produces an empty collected value. Collection itself, missing
 source policy, and source hashes are outside this package.
 
@@ -26,6 +29,8 @@ uses half-open period overlap to select hourly, narrative, daily, and alert
 data; it also derives precipitation timing. Convective outlooks are retained
 only when their valid interval overlaps the report period, with discussions
 kept for represented outlook days. Both collections are sorted deterministically.
+It rejects collected hourly data with a precipitation probability outside the
+finite 0 through 100 percentage domain before constructing derived facts.
 
 Report identity controls the summary shape:
 
@@ -37,6 +42,8 @@ Report identity controls the summary shape:
 `DaypartSummaries` is collected from the resulting daily summaries.
 The detailed grouping, daypart-window, and alert rules are owned by
 [forecast derivation](forecast-derivation.md).
+Daily alert overlaps remain scoped to the civil day, while overnight daypart
+summaries retain alerts that overlap their complete next-day window.
 
 ## Missing data and failures
 

docs/internal/forecast-derivation.md

@@ -2,60 +2,46 @@
 
 `internal/forecast` deterministically selects and summarizes normalized
 forecast data. It has no transport, filesystem, CLI, subprocess, or report
-registry dependency. Its summaries are consumed by
-[fact contracts](facts.md) and later module builders.
+registry dependency. The report-scoped caller is [fact
+contracts](facts.md), which owns the choice of data required by each report.
 
-## Period and daypart semantics
+## Daily Derivation
 
-Selections use `timeutil.Period` half-open overlap: a value is selected only
-when both intervals share time. `BuildDailySummary` creates one local civil
-day; `BuildPeriodDailySummaries` intersects every local civil day with the
-requested period, preserving partial first and last days.
+`BuildDailySummary` builds one summary for one local civil day. The facts
+layer calls it for Daily, Today, and Tomorrow reports; it does not provide a
+multi-day or arbitrary-period summary constructor. `timeutil.Period` supplies
+the shared half-open overlap rule used while selecting source values.
 
-`ResolveDayparts` converts each configured name, start clock, and end clock
-into a local window. An end clock at or before its start clock wraps into the
-next civil day. The daypart and timezone defaults are defined in the
-[configuration reference](../config.md), not here.
+`ResolveDayparts` turns configured local clock ranges into windows. A range
+whose end is not after its start continues into the next civil day. The
+available daypart and timezone settings are defined in the
+[configuration reference](../config.md).
 
-## Deterministic summaries
+The summary keeps selected hourly and narrative values, the discussion,
+source warnings and provenance, alert overlaps, and one summary for each
+resolved daypart. Daypart summaries derive their measurements, conditions,
+weather indicators, and precipitation timing from normalized forecast
+periods. `BuildPrecipTiming` is also available to the facts layer for a
+report's selected hourly periods.
 
-`BuildDailySummary` requires an hourly run with at least one period. It adds
-the selected narrative periods, discussion, alert overlaps, source provenance,
-source warnings, and one `DaypartSummary` per resolved window. A daypart keeps
-its selected hourly periods and derives temperature and apparent-temperature
-ranges, timed precipitation and wind maxima, dominant and notable conditions,
-and weather indicators.
+## Boundaries And Failures
 
-Indicators are deterministic checks over normalized values and condition text:
-heat, cold, and wind use package-owned numeric cutoffs; snow, ice, fog, and
-wind text are detected from the forecast description. `BuildPrecipTiming`
-sorts periods, records the maximum and first precipitation, groups contiguous
-periods at or above its package-owned probability threshold, and records
-thunder mentions.
+Daily-summary construction requires a bundle with hourly forecast data,
+valid precipitation probabilities, and valid daypart definitions. Optional
+normalized products remain absent when unavailable. Invalid alerts are ignored
+while valid overlaps are selected for the relevant day or daypart window.
 
-Alert overlap parsing supports the normalized alert payload's available timing
-fields. Unparseable alerts and invalid intervals are ignored; valid overlaps
-are clipped to the requested period and ordered by alert start time.
+Thresholds, text classification, unit normalization, and alert selection are
+package implementation rules. Report identity, period selection, and the
+resulting derived-fact shape are owned by [fact contracts](facts.md); external
+source semantics are owned by [weather-data internals](weather-data.md).
 
-## Missing data and failures
+## Verification
 
-Empty selections yield empty summary fields rather than generated prose.
-Direct daily or period-summary calls fail when their required bundle, valid
-period, hourly data, or daypart definitions are invalid. A nil location uses
-UTC when these APIs are called directly. Optional narrative, discussion, and
-alerts remain absent when their normalized products are absent.
-
-Forecast thresholds used for brief indicators and precipitation timing are
-implementation rules.
-
-## Verification and invariants
-
-Focused tests cover local civil days, clipped periods, daypart resolution,
-summary metrics, precipitation windows, threshold helpers, and alert overlap:
+Focused `internal/forecast` tests exercise daily and overnight dayparts,
+summary derivation, invalid precipitation data, precipitation timing, and
+alert overlap handling. `internal/facts` tests cover the report-scoped caller:
 
 ```sh
-go test ./internal/forecast ./internal/timeutil
+go test ./internal/forecast ./internal/facts
 ```
-
-The package preserves normalized inputs as inspectable structured values and
-never decides report identity, delivery, or presentation wording.

docs/internal/generatedtext.md

@@ -9,9 +9,10 @@ maintainer-facing context fields belong to [report templates](../templates.md).
 ## Catalog and validation
 
 The Daily, Today, Tomorrow, and Hourly report definitions each use structured
-generated text. `LookupDefinition` rejects unknown schema or template IDs and
-unsupported schema/template pairs before the run begins. A handler validates raw JSON, returns a typed
-value and canonical normalized JSON, loads its canonical schema through
+generated text. `LookupDefinition` requires the exact report, schema, and
+template triple and rejects unknown IDs, unsupported pairs, and a pair that
+belongs to another report before the run begins. A handler validates and
+normalizes raw JSON into a typed value, loads its canonical schema through
 `internal/promptassets`, builds a render context, and renders through
 `internal/reporttemplate`.
 
@@ -19,23 +20,44 @@ Daily, Today, and Tomorrow use a day-style value with required trimmed summary
 and one or more nonblank discussion paragraphs. Hourly requires trimmed summary
 and a single trimmed discussion string. Every form also requires the
 `precipitation_timing` field; an empty string means there is no supported timing
-prose to render. Typed decoding rejects missing required fields and unknown JSON
-fields; no general-purpose JSON Schema engine is used at runtime.
+prose to render. Typed decoding requires the exact lowercase JSON field names,
+rejects missing, duplicate, case-variant, and unknown fields, and checks field
+shapes; no general-purpose JSON Schema engine is used at runtime.
+
+The validator accepts at most 64 KiB of raw JSON before it allocates typed
+values. Its JSON Schemas and typed checks limit `summary` and
+`precipitation_timing` to 4,000 characters each. Hourly
+`forecast_discussion` is limited to 12,000 characters. Day-style discussion
+accepts at most 12 paragraphs of at most 4,000 characters each. Across all
+prose fields, one report may contain at most 20,000 characters. These bounds
+apply before trimming, filtering, normalization, and template rendering.
+
+Malformed JSON and field values return short, content-safe errors. They name
+only canonical fields where useful and never echo provider values or unknown
+field names. The Promptkit adapter also drops an oversized provider result
+before copying it into execution or debug state; direct executor implementations
+receive the same enforcement in this package.
 
 ## Render contexts
 
-The catalog's report-specific builders receive briefing metadata, a rich module
-snapshot, collected facts, derived facts, and the matching validated generated
-text. They decode the module stanzas needed by the template and build typed
-Daily, Today, Tomorrow, or Hourly contexts. Context construction validates
-metadata and periods, preserves rich module values, and uses ordered slices for
-template iteration rather than maps.
+The catalog's report-specific builders receive the prepared report identity, a
+rich module snapshot, derived facts needed to order dayparts, and the matching
+validated generated text. They require the identity's report ID to match the
+selected builder. When the optional metadata stanza is present, every shared
+identity field must agree with that prepared authority before context
+construction continues. Builders then decode the module stanzas needed by the
+template and build typed Daily, Today, Tomorrow, or Hourly contexts. Contexts
+expose only display-ready report values, generated prose, and module values;
+they do not expose complete collected or derived fact bundles. Ordered slices
+remain the template iteration surface rather than maps.
 
-Optional source stanzas become nil or fallback context fields. Missing required
-stanzas, type-decoding failures, invalid metadata, or a generated-text type
-that does not match the chosen handler fail before template execution. Prompt
-packages, raw Promptkit output handling, and template asset lookup remain
-outside this package.
+Optional source stanzas become nil or fallback context fields. Today also
+computes whether its ordered dayparts contain a displayable condition so the
+template can render either rows or its explicit no-details fallback. Missing
+required stanzas, type-decoding failures, conflicting identity values, invalid
+metadata, or a generated-text type that does not match the chosen handler fail
+before template execution. Prompt packages, raw Promptkit output handling, and
+template asset lookup remain outside this package.
 
 ## Verification and invariants
 
@@ -48,5 +70,7 @@ go test ./internal/generatedtext
 ```
 
 Generated text supplies prose slots only; deterministic weather facts remain in
-module and fact values. Every report definition must resolve to exactly one
-supported catalog pair.
+module and fact values. The renderer applies its plain-text policy to every
+generated prose insertion, preserving ordinary text and paragraph breaks while
+preventing provider text from creating Markdown or HTML structure. Every report
+definition must resolve to exactly one supported catalog pair.

docs/internal/module.md

@@ -1,6 +1,6 @@
 # Module Contract Internals
 
-`internal/module` defines the stable envelope between report composition,
+`internal/module` defines the envelope between report composition,
 module builders, in-memory snapshots, templates, and prompt packages. It
 does not define a report, execute a builder, or choose prompt-export policy;
 those responsibilities belong to [report registry](report-registry.md) and
@@ -13,8 +13,8 @@ Each `Output` has a module ID, stanza name, rich `Value`, and runtime-only
 otherwise the rich value. This permits custom prompt exports without shrinking
 the template value.
 
-`NewSnapshot` builds the ordered `weatherreporter.modules.v1` snapshot and
-validates it. Its JSON representation contains IDs, stanza names, and rich values only;
+`NewSnapshot` builds and validates the ordered in-memory snapshot. Its JSON
+representation carries a package-owned schema marker, IDs, stanza names, and rich values only;
 `PromptValue` is deliberately excluded. `StanzaValue` decodes a named rich
 stanza into a caller-supplied type, reporting a missing stanza separately from
 a decoding error.
@@ -43,7 +43,8 @@ The registry declares these ordered default compositions:
 The only non-empty default option is the AFD section selection. It accepts a
 `sections` list; omitted or empty selects all available sections. Report
 definitions may narrow it as shown above. Option shape and report compatibility
-are validated by the briefing registry.
+are validated by the briefing registry. Accepted typed option pointers are
+canonicalized to the declared value type before a module builder receives them.
 
 ## Rich and prompt-facing values
 

docs/internal/prepared-report.md

@@ -0,0 +1,37 @@
+# Prepared Report Internals
+
+`internal/app` validates the report's generated-text catalog binding during
+prompt inspection, before collection, and carries the resulting handler into
+`preparedReport` construction after collection. This is the immutable boundary
+shared by ordinary report generation and profile comparison; it is not a
+durable artifact.
+
+Preparation first establishes one `PreparedIdentity` for the report run, report
+and prompt IDs, variant, generation time, units, timezone, valid period,
+location, and source warnings. It passes that identity to the configured module
+snapshot, curated prompt-input package, serialized YAML, generated-text render
+context, and generated-text definition. Each boundary projects only the fields
+it needs from that prepared authority.
+
+Preparation deep-copies mutable facts, snapshots, identity, and data-package
+bytes before returning them. Consumers receive independent copies so one
+execution cannot change another's input or rendering context.
+
+Before accepting generated JSON, the execution boundary reconciles the prepared
+report definition, inspected prompt hash and selected profile identity, the one
+preparation callback, and the completed Promptkit result. The callback and
+completion must agree on prompt, profile, backend, model, and rendered/input
+hashes; the callback output and completed validation must name the prepared
+report's JSON Schema. A mismatch produces no rendered Markdown and leaves
+results with only the inspected safe identity.
+
+Single-report generation executes one prepared profile and publishes its
+Markdown. Comparison prepares once, gives every selected profile the same YAML
+bytes, and only then assembles the resulting logical bundle. The prompt-input
+shape is owned by [prompt-input internals](prompt-input.md); profile execution
+semantics are owned by [Promptkit integration](../integrations/promptkit.md).
+
+Catalog incompatibility stops prompt inspection before weather collection or
+model work. Preparation failure has no publication side effects. Tests for this
+boundary cover catalog-preflight ordering, mutation isolation, byte equality,
+and reuse by both execution paths.

docs/internal/prompt-input.md

@@ -1,27 +1,35 @@
 # Prompt Input Internals
 
-`internal/promptinput` converts report metadata, an ordered module snapshot, and source warnings into the YAML `data_package` supplied inline to Promptkit. It owns the package schema, grouping, serialization, loading, and validation; it does not choose an output destination, collect weather, execute a provider, or retain packages after a command ends.
+`internal/promptinput` turns prepared report metadata and an ordered module
+snapshot into the YAML data package passed to Promptkit. The externally visible
+prompt and inline-input contract is owned by the [Promptkit integration
+guide](../integrations/promptkit.md); preparation of the inputs is owned by
+[prepared report internals](prepared-report.md).
 
 ## Package Construction
 
-`Build` produces `weatherreporter.data_package.v4`. It copies the run ID; report ID, variant, prompt ID, generation time, timezone, local current date, and valid period; ordered briefing stanzas; and source warnings. Prompt input contains no historical comparison section.
+`Build` projects report identity, the report-local current date, source-warning
+summaries, and each snapshot output's prompt-facing value into a package. It
+does not expose source transport or provenance details. The module snapshot
+defines stanza order and selects curated prompt values; the corresponding
+module contracts are documented in [module internals](module.md) and [briefing
+internals](briefing.md).
 
-Briefing is a flat ordered set of stanza values. `Build` uses each output's `DataPackageValue`, so curated prompt exports take precedence and rich values are used only as a fallback. Prompt exports are selected by the [briefing registry](briefing.md), while the rich-versus-prompt contract is in [module internals](module.md).
+`MarshalYAML` validates the package before serializing it. Serialization emits
+the metadata stanza first, then groups the remaining recognized stanzas in the
+package's fixed category order while preserving snapshot order within a
+category. `Validate` enforces the supported schema version, required report
+identity and period values, and a nonempty, complete ordered briefing.
 
-## YAML Ordering And Validation
+This package does not collect weather, choose an output destination, execute a
+provider, or persist data packages. The application passes its in-memory YAML
+to the Promptkit adapter as part of prepared report execution.
 
-Serialization keeps `metadata` directly under `briefing`. Every other known stanza is placed in one category and emitted in category order while preserving its original module order:
+## Verification
 
-| Category | Current stanzas |
-| --- | --- |
-| `applicable_risk_products` | alert digest, SPC convective outlooks |
-| `derived_summaries` | deterministic summaries, precipitation timing, outdoor windows, and planning values |
-| `narrative_products` | narrative forecast, discussions, and weather story |
-| `raw_data` | current conditions and hourly forecast |
-
-`LoadYAML` accepts this layout and reconstructs the flat order and values. It rejects misplaced, duplicate, unknown, or uncategorized stanzas. `Validate` requires the v4 schema version, report identity and period fields, and at least one ordered briefing stanza. `MarshalYAML` and `LoadYAML` validate their result. `Save` remains a reusable atomic-file helper for callers that explicitly need one; normal application execution passes marshalled YAML directly to Promptkit.
-
-Focused tests cover construction, curated exports, category ordering, YAML round trips, invalid layout, validation, and atomic saves:
+Focused tests cover package construction, report-local dates, validation,
+curated snapshot exports, deterministic YAML grouping, and safe source-warning
+projection:
 
 ```sh
 go test ./internal/promptinput

docs/internal/report-registry.md

@@ -1,29 +1,37 @@
 # Report Registry Internals
 
-`internal/report` owns report identities, valid-period resolution, exact prompt identity and version, output names, default module composition, and Distributor path declarations. Public command syntax belongs in the [CLI reference](../cli.md); configuration aliases and overrides belong in the [configuration reference](../config.md).
+`internal/report` owns the in-process registry of report identities and the
+resolution of a report's valid period. Command names and configuration aliases
+belong to the [CLI reference](../cli.md) and [configuration
+reference](../config.md), respectively.
 
-## Definitions And Resolution
+## Registry And Resolution
 
-Each `Definition` declares a stable ID and display name, prompt ID and version, template and generated-text schema IDs, valid-period resolver, default output name, Distributor path templates, module list, and fixed batch eligibility. `Resolved` combines a definition with one valid period and run identity.
+`DefaultRegistry` supplies the maintained definitions. `Lookup` returns a
+definition by its internal ID, while `Resolve` combines it with a request time,
+location, and optional date to produce `Resolved`. The result carries the
+definition, generation time, timezone, and resolved valid period; its metadata
+and output-name helpers keep derived identity values consistent for callers.
 
-| Report ID | Prompt version | Default profile | Period policy | Fixed batch flag | Default output |
-| --- | --- | --- | --- | --- | --- |
-| `daily` | `2.0.0` | `weather-balanced` | Explicit local civil day | Dynamic Daily inclusion is app-owned | `daily-YYYY-MM-DD.md` |
-| `today` | `2.0.0` | `weather-balanced` | Selected or current local civil day | Morning | `today.md` |
-| `tomorrow` | `2.0.0` | `weather-balanced` | Next local civil day | Evening | `tomorrow.md` |
-| `hourly` | `2.0.0` | `weather-light` | Rolling six-hour interval | — | `hourly.md` |
+Definitions carry the internal collaborators needed downstream: prompt and
+template identity, module configuration, output naming, Distributor path
+templates, and fixed batch eligibility. The external prompt contract is owned
+by the [Promptkit integration guide](../integrations/promptkit.md), template
+surface by the [report template guide](../templates.md), and published
+Distributor paths by the [Distributor bundle guide](../integrations/distributor/pkg-bundle.md).
 
-Daily derives its filename from the resolved valid-period start in the effective timezone, so multiple Daily items have distinct destinations. Exact template fields and schema assets belong to [report templates](../templates.md) and [generated-text internals](generatedtext.md). Prompt assets own default profile selection; the registry stores no provider setting.
+`WithModuleOverrides` returns an independently cloned registry with replacement
+module configuration for recognized report IDs. The application owns batch
+planning and data-dependent inclusion; see [app orchestration
+internals](app-orchestration.md).
 
-## Collaborators And Boundaries
+The registry never collects weather data, parses CLI flags, writes output,
+executes Promptkit, or delivers a report.
 
-`DefaultRegistry`, `Lookup`, `Resolve`, and report-name helpers prevent callers from duplicating report identity rules. Registry overrides clone a recognized definition and replace its module list. `DistributorPathTemplates` are consumed by app orchestration; their rendered external bundle-path contract is documented in the [Distributor bundle guide](../integrations/distributor/pkg-bundle.md).
+## Verification
 
-`morning` and `evening` are registry-owned batch names. Fixed flags declare Today and Tomorrow eligibility; app orchestration determines data-dependent Daily membership and the actual batch plan.
-
-The registry never collects weather data, parses CLI flags, writes output, executes Promptkit, or delivers a report.
-
-Focused tests cover definition completeness, command and alias lookup, period resolution, run IDs, output names, composition defaults, and override validation:
+Focused tests protect retained report definitions, period resolution, Daily
+run-ID disambiguation, and rejection of retired command or configuration names:
 
 ```sh
 go test ./internal/report

docs/internal/reporttemplate.md

@@ -28,8 +28,13 @@ failures actionable with template or partial context.
 Top-level templates decide which shared partials they invoke. The current
 partials cover daypart forecast variants, alert digest, and precipitation
 timing. Template code receives curated typed contexts rather than raw data
-packages, and it must not reimplement weather selection or generated-text
-validation.
+packages or complete fact bundles, and it must not reimplement weather
+selection or generated-text validation. Context construction rejects
+report-identity disagreements before template execution. Every generated-prose
+insertion uses the `plainText` helper. It retains ordinary prose and paragraph
+breaks but renders Markdown/HTML syntax, code indentation, and control
+characters as safe text, so the repository templates remain the sole owners of
+report structure.
 
 ## Boundaries and verification
 
@@ -38,8 +43,8 @@ text, construct contexts, resolve report definitions, write state, execute
 Promptkit, or upload reports. It produces Markdown bytes for application
 orchestration to persist.
 
-Focused tests cover template lookup, rendering, partial
-behavior, missing keys, and malformed context:
+Focused tests cover template lookup, rendering, partial behavior, daypart
+fallbacks, missing keys, and malformed context:
 
 ```sh
 go test ./internal/reporttemplate

docs/internal/weather-data.md

@@ -31,6 +31,10 @@ provider endpoint or retry policy from the normalized types. See
 [collection](collect.md) for assembly and
 [report templates](../templates.md) for the values exposed to authors.
 
+An alert run retains its check time and individual alert payloads for overlap
+selection. Its source entry retains provider provenance; the full provider
+envelope is not carried into the normalized bundle.
+
 ## Source provenance
 
 Every checked source is represented by a `Source` entry. The record identifies
@@ -45,6 +49,10 @@ marked missing only when the adapter's missing-source policy treats the
 response or parsing failure as unavailable. The policy itself belongs to the
 [configuration reference](../config.md).
 
+Accepted hourly forecast periods always have nonzero start and end times, with
+the end after the start. Collection rejects a required hourly product that does
+not meet those bounds before it enters downstream derivation.
+
 ## Warning semantics
 
 `SourceWarning` has a source name, stable code, severity, explanatory message,

docs/operations.md

@@ -13,12 +13,20 @@ After configuring a Weather API endpoint, generate one report:
 weatherreporter generate today
 ```
 
-The command writes `today.md` in the current directory. Choose a different
-operator-owned file with `--out`; a relative path is resolved from the current
-directory and an absolute path is used directly. Weatherreporter renders in
-memory and atomically replaces the selected destination only after generation
-and rendering succeed. It does not create a default workspace, metadata,
-receipts, or intermediate output files.
+With no configured output directory, the command writes `today.md` in the
+current directory. Set `output.directory` to use one ordinary publication
+directory for reports, or choose a one-command operator-owned file with
+`--out`; a relative path is resolved from the current directory and an absolute
+path is used directly. The explicit flag takes precedence over the configured
+directory. Weatherreporter renders in memory and atomically replaces the
+selected destination only after generation and rendering succeed. It does not
+create a default workspace, metadata, receipts, or intermediate output files.
+
+A missing configured directory is created only as part of successful report
+publication. If its existing path is not a directory or cannot be inspected,
+the command stops before prompt inspection or weather collection, leaving any
+existing report unchanged. See the [configuration reference](config.md) for the
+field definition and validation rules.
 
 Before a destination is published, provider, validation, rendering, write, and
 cancellation failures leave an existing report unchanged. A notification
@@ -28,6 +36,20 @@ absolute output path and active profile, backend, model, warnings, validation,
 debug, and notification information; see the [CLI reference](cli.md) for its
 exact fields.
 
+Weatherreporter validates the final output filename before prompt inspection or
+weather collection. A valid long filename is published through a short,
+same-directory temporary sibling, so temporary naming does not shorten the
+operator-selected destination. A rejected filename does not create a missing
+parent directory. The final destination itself must be absent or a regular
+file: symlinks, directories, named pipes, sockets, and other special objects
+are rejected before prompt inspection or weather collection. The destination is
+checked again immediately before the atomic replacement; cancellation or a
+deadline at that point leaves the prior report unchanged and skips notification.
+
+`SIGINT` and `SIGTERM` request orderly cancellation of an active action. The
+command lets cancellation and related cleanup finish before it exits; use the
+usual failed result or error to determine whether an output was published.
+
 ## Batch Outputs And Distributor Notification
 
 Run a scheduled batch with an explicit output directory when appropriate:
@@ -36,7 +58,9 @@ Run a scheduled batch with an explicit output directory when appropriate:
 weatherreporter run morning --out-dir ./reports
 ```
 
-Without `--out-dir`, batch reports are written beneath the current directory.
+Without `--out-dir`, batch reports are written beneath `output.directory` when
+configured, otherwise the current directory. The explicit directory applies
+only to that command and takes precedence over the configured fallback.
 Morning runs Today, Tomorrow, and every eligible dated Daily Report; evening
 runs Tomorrow and the same eligible Daily Reports. Eligible Daily dates begin
 after tomorrow and require complete hourly coverage for their local civil day.
@@ -45,7 +69,10 @@ final output destination before executing its first report prompt. A destination
 collision, such as a directory named `tomorrow.md`, stops the batch before any
 report output is created or replaced. After successful validation, each selected
 report processes independently and successful outputs remain available if
-another report fails.
+another report fails. If cancellation or a deadline is observed during the
+sequence, Weatherreporter stops before starting another report. It retains
+already published files, marks interrupted and unstarted reports as canceled in
+the result, and skips batch notification.
 
 When `notify.distributor.enabled` and batch notification are enabled,
 Weatherreporter sends one Distributor upload only after every selected output
@@ -54,14 +81,58 @@ files remain at their selected destinations. A batch notification failure also
 leaves all successfully published report files in place. Distributor source
 files are those operator-owned Markdown outputs; rendered bundle paths and
 delivery status appear in the result, not in a local notification receipt.
+Remote Distributor response text is not included in command output. Instead,
+notification failures use stable local diagnostics while retaining the upload
+and status identities needed to investigate delivery with Distributor.
 Report counters count report items only. A batch notification failure therefore
 returns a failed batch status even when all report counters show success; the
 top-level notification result contains the delivery diagnostic.
 
 For a single report, Distributor notification follows the atomic output write.
-See the [configuration reference](config.md) for pipeline, bundle,
+Enabled notification configuration, including the HTTP(S) endpoint and
+templates, is validated before report processing. A malformed endpoint does not
+collect weather data, generate a report, publish output, or invoke Distributor.
+See the [configuration reference](config.md) for endpoint, pipeline, bundle,
 idempotency-key, and per-report path templates.
 
+## Comparison Bundles
+
+Use `compare` when an operator needs to evaluate explicit Promptkit profiles
+against the same report input. The command writes one flat, operator-owned
+bundle directory and never sends a Distributor notification. Command syntax,
+profile validation, JSON output, and exit behavior belong to the
+[CLI reference](cli.md); the durable file contract belongs to the
+[comparison bundle contract](integrations/comparison-bundle.md).
+
+The output destination follows the normal `output.directory` fallback. An
+explicit `--out-dir` takes precedence and names the exact bundle directory,
+not a parent to be combined with another name. The standard names are derived
+from the report output name, such as `comparison-today` and
+`comparison-daily-2026-05-29`; see the [configuration reference](config.md)
+for output-directory resolution.
+
+A comparison bundle contains the shared data package, a manifest, and one
+Markdown file for every successful profile. Treat all of these files as
+potentially sensitive: the data package and generated reports can contain
+location or forecast context. Weatherreporter creates no application-owned
+history, retention store, or cleanup job. Retain, archive, or remove only the
+specific bundle directories your operating policy permits.
+
+The destination is preflighted before prompt inspection and collection, then
+rechecked immediately before an atomic publish. A missing or empty directory
+is usable. A nonempty directory can be replaced only when `--replace` is given
+and it is recognized as a current Weatherreporter comparison bundle; ordinary
+directories, symlinks, and unsafe destinations are rejected. Cancellation and
+all failures before publication preserve an existing bundle, including a
+cancellation observed while a replacement is being prepared. If guarded
+restoration cannot complete, the error names the retained sibling bundle for
+manual recovery. Profile failures are different: the command publishes a
+complete partial bundle, with failed profiles represented in the manifest and
+no Markdown file for those profiles.
+Comparison preflight also checks that private publication siblings can be
+formed. An infeasible destination name is rejected before a missing parent
+directory is created.
+
 ## Local Prompt Profile Override
 
 Hourly normally selects the embedded `weather-light` profile. To use a local
@@ -89,9 +160,24 @@ weatherreporter generate today --llm-debug-dir /var/tmp/weatherreporter-debug
 The directory must be absolute. Requested captures are written with restrictive
 permissions beneath the supplied directory, organized by report and run. They
 can contain rendered prompts and generated output, so limit access to trusted
-operators and remove the captures when they are no longer needed. Normal output,
-summaries, and routine logs omit that sensitive content. Debug capture is never
-created for an ordinary command without `--llm-debug-dir`.
+operators and remove the captures when they are no longer needed. Comparison
+captures additionally identify each selected profile so concurrent executions
+remain distinct. Normal output, summaries, and routine logs omit that sensitive
+content. Debug capture is never created for an ordinary command without
+`--llm-debug-dir`.
+
+Secure prompt debug capture is currently available only on Unix hosts, where
+Weatherreporter can keep every traversal and write anchored to opened directory
+descriptors without following symbolic links. On other platforms, requesting
+`--llm-debug-dir` fails before prompt inspection, weather collection, or
+provider execution; ordinary commands without the flag remain available.
+
+Preparation captures retain only the provider endpoint origin and reviewed
+execution settings. URL user information, paths, queries, fragments, and
+unrecognized provider parameters are omitted.
+
+Capture writes are confined to the requested root and fail if an unsafe
+filesystem component prevents secure artifact creation.
 
 If capture creation or writing fails, the affected run fails rather than
 silently continuing without the requested diagnostics.
@@ -101,8 +187,23 @@ silently continuing without the requested diagnostics.
 Start with the command error and JSON summary. For a report generation failure,
 the selected destination was not replaced; for a notification failure, inspect
 the completed destination and the notification result. For a batch failure,
-use the per-report statuses and retain successful output files. Enable explicit
-debug capture only when content-rich Promptkit diagnostics are necessary.
+use the per-report statuses and retain successful output files. For a comparison
+failure, inspect the published manifest when its path is present: individual
+profile failures retain their safe result and successful Markdown files, while
+cancellation and pre-publication errors leave the prior destination unchanged.
+
+If a replacement commits but cleanup of its prior sibling backup fails, the new
+bundle remains valid and its artifact paths appear in the failed command
+summary. The summary records a safe `publication_cleanup` error that indicates
+whether a complete prior bundle remains, only partial remnants remain, or no
+prior bundle remains; it also identifies when the sibling cannot be inspected.
+The returned command error includes a recovery path only when a sibling remains.
+Preserve a complete recognized recovery bundle until it has been inspected and
+cleaned up manually; partial remnants are not a rollback artifact. Do not
+remove the new bundle to retry cleanup.
+
+Enable explicit debug capture only when content-rich Promptkit diagnostics are
+necessary.
 
 Weatherreporter does not retain runs for later inspection, resume failed work,
 or provide automatic cleanup, archival, remote state, daemon operation, or

docs/policy/architecture.md

@@ -15,6 +15,11 @@ and renders repository-owned Markdown in memory. Completed Markdown is
 atomically published to an operator-owned output destination and may then be
 uploaded through Distributor.
 
+An explicit profile comparison prepares one report input once, executes the
+same exact prompt and data package across selected profiles concurrently, and
+atomically publishes one operator-owned comparison bundle. It remains local:
+it does not create application state or send a Distributor notification.
+
 The supported report products are Daily, Today, Tomorrow, and Hourly. A batch
 collects once, validates its complete candidate prompt/profile set before
 collection, then determines and validates every planned output destination
@@ -29,6 +34,8 @@ planned report succeeds.
 - `internal/config` owns defaults, loading, validation, and secret loading.
 - `internal/app` owns in-memory workflow order, partial results, atomic output
   publication, and notification coordination through project-owned contracts.
+- `internal/comparison` owns comparison identity, durable logical bundle
+  validation, safe destination recognition, and atomic bundle publication.
 - Deterministic domain packages own weather derivation, report periods, modules,
   generated-text validation, and template contexts.
 - `internal/adapters/weatherapi`, `internal/adapters/promptkit`, and
@@ -47,6 +54,9 @@ directly.
   before collection.
 - Prompt and profile validation completes before weather collection. Raw output
   is validated before template rendering.
+- Comparison validates every explicit profile before collection, prepares one
+  immutable report input, and delegates backend capacity to Promptkit rather
+  than adding an application-wide execution limit.
 - Generated text fills defined prose slots only. Deterministic facts remain
   authoritative and repository-owned templates produce all Markdown output.
 - Sensitive rendered prompts, schemas, input bodies, provider endpoints, and
@@ -62,11 +72,23 @@ directly.
   pre-publication failure, including cancellation observed immediately before
   publication, does not replace an existing destination; a notification failure
   does not remove a newly published output.
+- A single-report final destination is either absent or a regular file.
+  Symlinks and special filesystem objects are rejected during preflight and
+  rechecked immediately before the atomic replacement.
+- Configuration or explicit CLI input selects that operator-owned destination;
+  it does not create an application-owned state boundary.
+- Comparison bundles are flat, versioned operator outputs. Their guarded
+  replacement accepts only a recognized current bundle; cancellation and every
+  pre-publication failure preserve a prior bundle, while individual profile
+  failures can publish a complete partial bundle.
 - Distributor uploads use only the published Markdown output, never a scan of
   local files. Single notification follows publication; batch notification
   follows publication of every selected report. Batch counters describe report
   outcomes only; a failed batch notification is represented separately at the
   batch level.
+- Comparison never invokes Distributor notification.
+- Profile comparison supports operator review only: it does not score, rank,
+  select, resample, or replay profile executions.
 - Default tests are deterministic, offline, and use Promptkit/provider fakes
   rather than live provider calls. See the [testing policy](testing.md).
 

docs/releases/v0.11.0.md

@@ -0,0 +1,37 @@
+# Weatherreporter v0.11.0
+
+This release adds a configurable default publication directory for generated
+weather reports.
+
+## Summary
+
+Operators can now set `output.directory` once for both individual reports and
+scheduled batches. Explicit `--out` and `--out-dir` destinations continue to
+take precedence, while installations that omit the setting retain the existing
+current-directory behavior.
+
+## Compatibility
+
+This release is additive and compatible with `v0.10.1`. Existing configuration
+files, commands, report filenames, Promptkit behavior, and Distributor
+notification behavior remain valid and unchanged.
+
+## Upgrade
+
+No special action is required. To use the new default destination, configure
+`output.directory` as described in the [configuration
+reference](../config.md). Existing deployments may continue using the current
+working directory or explicit CLI output flags.
+
+## Changes
+
+- Added strict configuration loading and validation for the optional
+  `output.directory` field.
+- Applied the configured directory consistently to `generate` and `run`, with
+  explicit CLI destinations retaining highest precedence.
+- Preserved relative-path handling, absolute result paths, atomic publication,
+  cancellation safety, and Distributor notification ordering.
+- Strengthened output preflight so existing non-directory paths, uninspectable
+  paths, and dangling symlink components fail before expensive report work.
+- Updated the [CLI reference](../cli.md) and [operations
+  guide](../operations.md) for the new destination-selection behavior.

docs/releases/v0.12.0.md

@@ -0,0 +1,66 @@
+# Weatherreporter v0.12.0
+
+This release completes a repository-wide correctness, security, efficiency,
+test-durability, and documentation audit.
+
+## Summary
+
+Weatherreporter now applies stricter validation and bounded diagnostics across
+its configuration, weather collection, Promptkit, rendering, publication,
+comparison, and Distributor boundaries. Report preparation and execution carry
+one reconciled identity, independent weather sources are collected
+concurrently, and cancellation preserves completed report and comparison
+outcomes.
+
+The release also removes obsolete compatibility surfaces and consolidates
+duplicated implementation and test policy without changing ordinary report
+commands or output identities.
+
+## Compatibility
+
+This release is compatible with `v0.11.0` for ordinary `generate`, `run`, and
+`compare` commands, configuration files, report filenames, comparison bundles,
+and Distributor integration.
+
+Sensitive prompt-debug capture through `--llm-debug-dir` is now supported only
+on Unix hosts. Non-Unix hosts reject an explicit capture request before prompt
+inspection, weather collection, or provider execution because the required
+handle-relative, no-follow filesystem guarantees are unavailable there.
+
+Several unused internal compatibility exports were removed. They were not part
+of the documented CLI, configuration, artifact, or integration contracts.
+
+## Upgrade
+
+No special action is required for ordinary installations. Operators who use
+`--llm-debug-dir` on Windows must run that diagnostic workflow on a Unix host.
+Review any automation that depended on undocumented internal Go APIs removed by
+this release.
+
+## Changes
+
+- Hardened configuration loading, source validation, secrets rollback,
+  endpoint validation, HTTP diagnostics, generated-text limits, prompt-debug
+  redaction, output publication, comparison replacement, and Distributor
+  failure reporting.
+- Reconciled inspected, prepared, callback, and completed Promptkit identity
+  and provenance before accepting generated content.
+- Preserved metric values, civil-day and daypart identity, overnight alerts,
+  precipitation semantics, and Markdown structure across deterministic report
+  preparation and rendering.
+- Collected independent Weather API sources concurrently and reused readiness
+  data while retaining deterministic normalized results.
+- Preserved completed report and comparison failures independently from shared
+  cancellation, stopped unfinished work, and skipped batch notification after
+  cancellation or partial report failure.
+- Made secure prompt-debug traversal descriptor-relative on Unix and fail
+  closed elsewhere. See the [operations
+  guide](../operations.md#optional-prompt-debug-capture).
+- Strengthened default test portability and determinism, including
+  capability-aware symbolic-link fixtures and platform-appropriate process
+  signal coverage.
+- Removed obsolete compatibility helpers, duplicated test ownership, dormant
+  persistence code, and completed audit and implementation roadmaps.
+- Updated the [architecture policy](../policy/architecture.md), [testing
+  policy](../policy/testing.md), and focused internal guides to describe the
+  implemented final state.

docs/roadmap/future.md

@@ -136,6 +136,17 @@ Any distributor enhancement should preserve the adapter boundary:
 weatherreporter selects explicit generated files and submits source bundles,
 while distributor owns destination routing and publication behavior.
 
+## Comparison Profile Diagnostics
+
+Status: Proposed and unimplemented.
+
+Comparison preflight failures could identify the profile being inspected and
+preserve a safe, actionable Promptkit cause, such as a duplicate profile ID,
+instead of reporting only a generic `profile_load` failure. Any improvement
+must continue to omit credentials, endpoints, and other sensitive profile
+values. Regression coverage should include a comparison that mixes built-in
+and configured-directory profiles and a directory containing duplicate IDs.
+
 ## Alternate Runtime Integrations
 
 Status: Proposed and unimplemented.

docs/templates.md

@@ -20,8 +20,9 @@ source:
 | Hourly | `templates/hourly.md.tmpl` (`hourly`) | `hourly` | `weather.hourly_generated_text`; `internal/promptassets/assets/prompts/hourly/` |
 
 The matching schemas and Promptkit definitions are embedded by
-`internal/promptassets`. The generated-text catalog pairs each schema ID with
-its template ID; keep the matching prompt definition aligned with that pair.
+`internal/promptassets`. The generated-text catalog requires each report's
+exact schema/template pair; keep the matching prompt definition aligned with
+that report-specific triple.
 
 Shared partials are under `internal/reporttemplate/templates/partials/`:
 
@@ -46,11 +47,18 @@ from rendering.
   calculations, source selection, or prompt-input shaping to a template.
 - Keep generated prose in `.GeneratedText`; do not restate deterministic facts
   in generated prose merely to compensate for a template change.
+- Render every `.GeneratedText` value through `plainText`. It preserves prose
+  and paragraph breaks while escaping Markdown and HTML syntax, removing code
+  indentation, and replacing control characters. Never interpolate generated
+  prose directly: repository templates alone own headings, lists, links, and
+  other Markdown structure.
 - When changing the generated-prose contract, update the matching prompt,
   schema, validator, render context, and template together. The validation and
   catalog rules are owned by [Generated Text internals](internal/generatedtext.md).
 - Use `.Modules.Dayparts` for ordered daypart output. Do not range over
-  `.Modules.DerivedDaypartSummaries`, which is a map.
+  `.Modules.DerivedDaypartSummaries`, which is a map. The Today partial uses
+  `.Modules.HasDaypartDetails` to ensure its heading has either rows or the
+  explicit no-details fallback.
 
 Minimal optional-value pattern:
 
@@ -66,7 +74,7 @@ Minimal list pattern:
 
 ```gotemplate
 {{ range .GeneratedText.ForecastDiscussion }}
-{{ . }}
+{{ plainText . }}
 {{ end }}
 ```
 
@@ -79,6 +87,7 @@ Templates have these helpers in addition to Go template built-ins:
 | `hasRelevantAlerts` | an alert-digest value or pointer | its `Relevant` slice is nonempty |
 | `hasEnhancedOrHigherSPCRisk` | an SPC outlook value or pointer | its `RiskDigest` contains an Enhanced, Moderate, or High Risk entry |
 | `isEnhancedOrHigherSPCRisk` | one SPC risk-digest entry | its `LabelText`, or fallback `RiskLabel`, is Enhanced, Moderate, or High Risk |
+| `plainText` | a generated prose string | a readable plain-text rendering that preserves paragraph breaks without allowing dynamic Markdown or HTML structure |
 
 For example, the alert partial uses the first two functions to decide whether
 to render the section:
@@ -91,7 +100,7 @@ to render the section:
 
 ## Render Context
 
-Every rendered template receives one typed context with these five top-level
+Every rendered template receives one typed context with these three top-level
 fields:
 
 | Field | Purpose |
@@ -99,12 +108,6 @@ fields:
 | `.Report` | Display labels and canonical report timing metadata. |
 | `.GeneratedText` | Validated prose supplied by Promptkit. |
 | `.Modules` | Deterministic, typed values prepared for Markdown rendering. |
-| `.Collected` | Normalized upstream facts for advanced use. |
-| `.Derived` | Shared calculated facts for advanced use. |
-
-`.Collected` and `.Derived` are available for an exceptional display need, but
-they are lower-level contracts. Keep reusable weather derivation in Go and use
-the module surface for normal template work.
 
 ### Report Metadata
 
@@ -126,13 +129,15 @@ It is not a source for deterministic weather facts.
 
 | Field | Hourly type | Daily, Today, and Tomorrow type | Notes |
 | --- | --- | --- | --- |
-| `.GeneratedText.Summary` | `string` | `string` | Required. |
-| `.GeneratedText.ForecastDiscussion` | `string` | `[]string` | Required; range over the day-style paragraph slice. |
-| `.GeneratedText.PrecipitationTiming` | `string` | `string` | Required field; an empty string represents no supported prose. The precipitation partial uses nonempty prose only when deterministic windows exist. |
+| `.GeneratedText.Summary` | `string` | `string` | Required; at most 4,000 characters. |
+| `.GeneratedText.ForecastDiscussion` | `string` | `[]string` | Required; Hourly permits 12,000 characters. Day-style values permit up to 12 paragraphs of 4,000 characters each. |
+| `.GeneratedText.PrecipitationTiming` | `string` | `string` | Required field, at most 4,000 characters; an empty string represents no supported prose. The precipitation partial uses nonempty prose only when deterministic windows exist. |
 
 The JSON schema rejects unknown properties and defines the required fields, but
 the schema body and validation behavior are documented in [Generated Text
-internals](internal/generatedtext.md).
+internals](internal/generatedtext.md). All validated generated prose together
+is limited to 20,000 characters, so template edits can rely on a bounded prose
+surface.
 
 ### Deterministic Module Values
 
@@ -141,8 +146,9 @@ Module pointers can be nil when their source or policy permits omission.
 
 | Module field | Available in |
 | --- | --- |
-| `.Modules.Metadata`, `.Modules.CurrentConditions`, `.Modules.HourlyForecast`, `.Modules.PrecipTiming`, `.Modules.AlertDigest`, `.Modules.SPCConvectiveOutlooks`, `.Modules.AreaForecastDiscussion`, `.Modules.SPCConvectiveDiscussion`, `.Modules.WeatherStory` | All four contexts |
+| `.Modules.CurrentConditions`, `.Modules.HourlyForecast`, `.Modules.PrecipTiming`, `.Modules.AlertDigest`, `.Modules.SPCConvectiveOutlooks`, `.Modules.AreaForecastDiscussion`, `.Modules.SPCConvectiveDiscussion`, `.Modules.WeatherStory` | All four contexts |
 | `.Modules.DerivedDailySummary`, `.Modules.DerivedDaypartSummaries`, `.Modules.Dayparts` | Daily, Today, Tomorrow |
+| `.Modules.HasDaypartDetails` | Today |
 | `.Modules.OutdoorWindows`, `.Modules.DailyPlanning` | Daily |
 | `.Modules.TodayPlanning` | Today |
 | `.Modules.TomorrowPlanning` | Tomorrow |

examples/config.yml

@@ -14,6 +14,9 @@ location:
 secrets:
   directory: ""
 
+output:
+  directory: /var/lib/weatherreporter/reports
+
 notify:
   distributor:
     enabled: false

go.mod

@@ -7,9 +7,8 @@ require gopkg.in/yaml.v3 v3.0.1
 require (
 	gitea.maximumdirect.net/eric/distributor v0.5.0
 	gitea.maximumdirect.net/eric/promptkit v0.5.0
+	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2
+	golang.org/x/sys v0.45.0
 )
 
-require (
-	github.com/santhosh-tekuri/jsonschema/v6 v6.0.2 // indirect
-	golang.org/x/text v0.14.0 // indirect
-)
+require golang.org/x/text v0.14.0 // indirect

internal/adapters/distributor/client.go

@@ -2,10 +2,12 @@
 package distributor
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
 	"fmt"
+	"io"
 	"net/http"
 	"os"
 	"strings"
@@ -22,6 +24,7 @@ type Client struct {
 	TokenEnv        string
 	Timeout         time.Duration
 	newUploadClient uploadClientFactory
+	pollWait        func(context.Context, time.Duration) error
 }
 
 type UploadRequest struct {
@@ -107,6 +110,10 @@ type runStatus struct {
 
 const statusPollInterval = 250 * time.Millisecond
 
+const maxDistributorResponseBytes int64 = 1 << 20
+
+var errDistributorResponseTooLarge = fmt.Errorf("distributor response exceeds the %d-byte limit", maxDistributorResponseBytes)
+
 func New(cfg config.DistributorNotifyConfig) *Client {
 	return newClient(cfg, newDistributorUploadClient)
 }
@@ -120,6 +127,7 @@ func newClient(cfg config.DistributorNotifyConfig, factory uploadClientFactory)
 		TokenEnv:        cfg.TokenEnv,
 		Timeout:         cfg.Timeout,
 		newUploadClient: factory,
+		pollWait:        waitForPoll,
 	}
 }
 
@@ -201,7 +209,12 @@ func (c *Client) Upload(ctx context.Context, req UploadRequest) (UploadResult, e
 		Status:       result.Status,
 		UploadStatus: result.Status,
 	}
-	status, statusErr := waitForRunStatus(runCtx, uploadClient, result.RunID, c.Timeout > 0)
+	pollWait := c.pollWait
+	if pollWait == nil {
+		pollWait = waitForPoll
+	}
+	status, statusErr := waitForRunStatus(runCtx, uploadClient, result.RunID, c.Timeout > 0, pollWait)
+	status = sanitizeRunStatus(status)
 	if status.RunID != "" || status.Status != "" {
 		uploadResult.RunStatus = &RunStatus{
 			RunID:      status.RunID,
@@ -218,7 +231,7 @@ func (c *Client) Upload(ctx context.Context, req UploadRequest) (UploadResult, e
 		}
 	}
 	if statusErr != nil {
-		uploadResult.StatusError = redactTokenString(statusErr.Error(), token)
+		uploadResult.StatusError = safeDistributorDiagnostic(statusErr, token).Error()
 		return uploadResult, nil
 	}
 	if status.Status == "failed" {
@@ -227,19 +240,15 @@ func (c *Client) Upload(ctx context.Context, req UploadRequest) (UploadResult, e
 	return uploadResult, nil
 }
 
-func waitForRunStatus(ctx context.Context, client uploadClient, runID string, poll bool) (runStatus, error) {
+func waitForRunStatus(ctx context.Context, client uploadClient, runID string, poll bool, wait func(context.Context, time.Duration) error) (runStatus, error) {
 	status, err := client.Status(ctx, runID)
 	if err != nil || terminalRunStatus(status.Status) || !poll {
 		return status, err
 	}
 
 	for {
-		timer := time.NewTimer(statusPollInterval)
-		select {
-		case <-ctx.Done():
-			timer.Stop()
-			return status, fmt.Errorf("distributor run %q did not reach terminal status before timeout: %w", runID, ctx.Err())
-		case <-timer.C:
+		if err := wait(ctx, statusPollInterval); err != nil {
+			return status, fmt.Errorf("distributor run %q did not reach terminal status before timeout: %w", runID, err)
 		}
 
 		next, err := client.Status(ctx, runID)
@@ -253,6 +262,17 @@ func waitForRunStatus(ctx context.Context, client uploadClient, runID string, po
 	}
 }
 
+func waitForPoll(ctx context.Context, interval time.Duration) error {
+	timer := time.NewTimer(interval)
+	defer timer.Stop()
+	select {
+	case <-ctx.Done():
+		return ctx.Err()
+	case <-timer.C:
+		return nil
+	}
+}
+
 func terminalRunStatus(status string) bool {
 	return status == "succeeded" || status == "failed"
 }
@@ -261,10 +281,52 @@ type distributorUploadClient struct {
 	client *distributorupload.Client
 }
 
+type boundedResponseTransport struct {
+	base  http.RoundTripper
+	limit int64
+}
+
+func (t boundedResponseTransport) RoundTrip(req *http.Request) (*http.Response, error) {
+	base := t.base
+	if base == nil {
+		base = http.DefaultTransport
+	}
+	response, err := base.RoundTrip(req)
+	if err != nil {
+		return nil, err
+	}
+	defer response.Body.Close()
+
+	data, err := io.ReadAll(io.LimitReader(response.Body, t.limit+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(data)) > t.limit {
+		return nil, errDistributorResponseTooLarge
+	}
+	response.Body = io.NopCloser(bytes.NewReader(data))
+	response.ContentLength = int64(len(data))
+	return response, nil
+}
+
+type RemoteResponseError struct {
+	StatusCode int
+	Retryable  bool
+}
+
+func (e *RemoteResponseError) Error() string {
+	if e == nil || e.StatusCode == 0 {
+		return "distributor request failed"
+	}
+	return fmt.Sprintf("distributor request failed with HTTP status %d", e.StatusCode)
+}
+
 func newDistributorUploadClient(endpoint, token string, timeout time.Duration) (uploadClient, error) {
-	httpClient := (*http.Client)(nil)
+	httpClient := &http.Client{
+		Transport: boundedResponseTransport{base: http.DefaultTransport, limit: maxDistributorResponseBytes},
+	}
 	if timeout > 0 {
-		httpClient = &http.Client{Timeout: timeout}
+		httpClient.Timeout = timeout
 	}
 	client, err := distributorupload.NewClient(distributorupload.ClientOptions{
 		Endpoint:   endpoint,
@@ -306,7 +368,7 @@ func (c distributorUploadClient) Status(ctx context.Context, runID string) (runS
 	if err != nil {
 		return runStatus{}, err
 	}
-	return runStatus{
+	return sanitizeRunStatus(runStatus{
 		RunID:      status.RunID,
 		PipelineID: status.PipelineID,
 		Status:     status.Status,
@@ -315,7 +377,7 @@ func (c distributorUploadClient) Status(ctx context.Context, runID string) (runS
 		FinishedAt: status.FinishedAt,
 		Report:     append(json.RawMessage(nil), status.Report...),
 		Error:      status.Error,
-	}, nil
+	}), nil
 }
 
 type uploadErrorContext struct {
@@ -331,7 +393,7 @@ type uploadErrorContext struct {
 func wrapUploadError(err error, ctx uploadErrorContext) error {
 	var conflict *distributorupload.IdempotencyConflictError
 	isConflict := errors.As(err, &conflict)
-	err = redactToken(err, ctx.Token)
+	err = safeDistributorDiagnostic(err, ctx.Token)
 	if isConflict {
 		return &IdempotencyConflictError{
 			Err: fmt.Errorf("upload distributor bundle %q to pipeline %q at endpoint %q with idempotency key %q from sources %q as bundle paths %q: idempotency conflict: %w", ctx.BundleID, ctx.PipelineID, ctx.Endpoint, ctx.IdempotencyKey, ctx.SourcePaths, ctx.BundlePaths, err),
@@ -340,6 +402,31 @@ func wrapUploadError(err error, ctx uploadErrorContext) error {
 	return fmt.Errorf("upload distributor bundle %q to pipeline %q at endpoint %q with idempotency key %q from sources %q as bundle paths %q: %w", ctx.BundleID, ctx.PipelineID, ctx.Endpoint, ctx.IdempotencyKey, ctx.SourcePaths, ctx.BundlePaths, err)
 }
 
+func safeDistributorDiagnostic(err error, token string) error {
+	if err == nil {
+		return nil
+	}
+	if errors.Is(err, errDistributorResponseTooLarge) {
+		return errDistributorResponseTooLarge
+	}
+	if errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) {
+		return redactToken(err, token)
+	}
+	var httpErr *distributorupload.HTTPError
+	if errors.As(err, &httpErr) {
+		return &RemoteResponseError{StatusCode: httpErr.StatusCode, Retryable: httpErr.Retryable}
+	}
+	return errors.New("distributor request failed")
+}
+
+func sanitizeRunStatus(status runStatus) runStatus {
+	status.Report = nil
+	if status.Error != "" {
+		status.Error = "distributor reported a failed run"
+	}
+	return status
+}
+
 func uploadSourcePaths(files []UploadFile) []string {
 	paths := make([]string, 0, len(files))
 	for _, file := range files {

internal/adapters/distributor/client_http_test.go

@@ -0,0 +1,310 @@
+package distributor
+
+import (
+	"archive/tar"
+	"compress/gzip"
+	"context"
+	"errors"
+	"fmt"
+	"io"
+	"net/http"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
+)
+
+const oversizedRemoteDiagnostic = "REMOTE-DIAGNOSTIC"
+
+func TestUploadUsesProductionHTTPBoundary(t *testing.T) {
+	const token = "test-upload-token"
+	var uploadCalls, statusCalls int
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		switch {
+		case r.Method == http.MethodPost && r.URL.Path == "/prefix/v1/pipelines/weather/upload":
+			uploadCalls++
+			if got := r.Header.Get("Authorization"); got != "Bearer "+token {
+				t.Fatalf("authorization = %q", got)
+			}
+			if got := r.Header.Get("Idempotency-Key"); got != "bundle-key" {
+				t.Fatalf("idempotency key = %q", got)
+			}
+			if got := r.Header.Get("Content-Type"); got != "application/gzip" {
+				t.Fatalf("content type = %q", got)
+			}
+			verifyUploadedArchive(t, r.Body, "daily/report.md", "report body")
+			w.Header().Set("Content-Type", "application/json")
+			w.WriteHeader(http.StatusAccepted)
+			_, _ = io.WriteString(w, `{"run_id":"run-123","status":"accepted"}`)
+		case r.Method == http.MethodGet && r.URL.Path == "/prefix/runs/run-123":
+			statusCalls++
+			if got := r.Header.Get("Authorization"); got != "Bearer "+token {
+				t.Fatalf("authorization = %q", got)
+			}
+			w.Header().Set("Content-Type", "application/json")
+			_, _ = io.WriteString(w, `{"run_id":"run-123","pipeline_id":"weather","status":"succeeded","report":{"detail":"REMOTE-DETAIL"}}`)
+		default:
+			t.Fatalf("unexpected request %s %s", r.Method, r.URL.Path)
+		}
+	}))
+	defer server.Close()
+
+	client := productionClient(t, server.URL+"/prefix", token)
+	result, err := client.Upload(context.Background(), productionUploadRequest(t))
+	if err != nil || uploadCalls != 1 || statusCalls != 1 || result.RunID != "run-123" || result.Status != "succeeded" || result.UploadStatus != "accepted" || result.RunStatus == nil || result.RunStatus.PipelineID != "weather" || len(result.RunStatus.Report) != 0 {
+		t.Fatalf("result/error/calls = %#v/%v/%d/%d", result, err, uploadCalls, statusCalls)
+	}
+}
+
+func TestUploadClassifiesRemoteHTTPDiagnostics(t *testing.T) {
+	const token = "test-upload-token"
+	const remote = oversizedRemoteDiagnostic
+	for _, tt := range []struct {
+		name   string
+		handle func(http.ResponseWriter, *http.Request)
+		check  func(t *testing.T, result UploadResult, err error)
+	}{
+		{
+			name: "upload failure",
+			handle: func(w http.ResponseWriter, r *http.Request) {
+				if r.Method != http.MethodPost {
+					t.Fatalf("method = %s", r.Method)
+				}
+				w.WriteHeader(http.StatusBadRequest)
+				_, _ = io.WriteString(w, `{"error":"REMOTE-DIAGNOSTIC","retryable":true}`)
+			},
+			check: func(t *testing.T, _ UploadResult, err error) {
+				t.Helper()
+				var remoteErr *RemoteResponseError
+				if err == nil || !errors.As(err, &remoteErr) || remoteErr.StatusCode != http.StatusBadRequest || !remoteErr.Retryable {
+					t.Fatalf("error = %T %v", err, err)
+				}
+			},
+		},
+		{
+			name: "status failure",
+			handle: func(w http.ResponseWriter, r *http.Request) {
+				if r.Method == http.MethodPost {
+					w.WriteHeader(http.StatusAccepted)
+					_, _ = io.WriteString(w, `{"run_id":"run-123","status":"accepted"}`)
+					return
+				}
+				w.WriteHeader(http.StatusInternalServerError)
+				_, _ = io.WriteString(w, remote)
+			},
+			check: func(t *testing.T, result UploadResult, err error) {
+				t.Helper()
+				if err != nil || result.Status != "accepted" || result.StatusError != "distributor request failed with HTTP status 500" {
+					t.Fatalf("result/error = %#v/%v", result, err)
+				}
+			},
+		},
+		{
+			name: "failed run",
+			handle: func(w http.ResponseWriter, r *http.Request) {
+				if r.Method == http.MethodPost {
+					w.WriteHeader(http.StatusAccepted)
+					_, _ = io.WriteString(w, `{"run_id":"run-123","status":"accepted"}`)
+					return
+				}
+				_, _ = io.WriteString(w, `{"run_id":"run-123","status":"failed","error":"REMOTE-DIAGNOSTIC","report":{"detail":"REMOTE-DIAGNOSTIC"}}`)
+			},
+			check: func(t *testing.T, result UploadResult, err error) {
+				t.Helper()
+				if err == nil || result.Status != "failed" || result.RunStatus == nil || result.RunStatus.Error != "distributor reported a failed run" || len(result.RunStatus.Report) != 0 {
+					t.Fatalf("result/error = %#v/%v", result, err)
+				}
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			server := httptest.NewServer(http.HandlerFunc(tt.handle))
+			defer server.Close()
+			result, err := productionClient(t, server.URL, token).Upload(context.Background(), productionUploadRequest(t))
+			tt.check(t, result, err)
+			for _, value := range []string{fmt.Sprint(result), fmt.Sprint(err)} {
+				if strings.Contains(value, remote) || strings.Contains(value, token) {
+					t.Fatalf("normal diagnostic leaked remote value: %q", value)
+				}
+			}
+		})
+	}
+}
+
+func TestUploadBoundsHTTPResponses(t *testing.T) {
+	for _, tt := range []struct {
+		name       string
+		response   func(size int) string
+		statusCode int
+		statusBody func(size int) string
+		check      func(t *testing.T, result UploadResult, err error, overflow bool)
+	}{
+		{
+			name: "accepted response",
+			response: func(size int) string {
+				return paddedJSON(t, `{"run_id":"run-123","status":"accepted","detail":"REMOTE-DIAGNOSTIC"}`, size)
+			},
+			statusBody: func(_ int) string {
+				return `{"run_id":"run-123","status":"succeeded"}`
+			},
+			check: func(t *testing.T, result UploadResult, err error, overflow bool) {
+				t.Helper()
+				if overflow {
+					if !errors.Is(err, errDistributorResponseTooLarge) || result.RunID != "" {
+						t.Fatalf("overflow result/error = %#v/%v", result, err)
+					}
+					return
+				}
+				if err != nil || result.Status != "succeeded" {
+					t.Fatalf("bounded result/error = %#v/%v", result, err)
+				}
+			},
+		},
+		{
+			name: "status report",
+			response: func(_ int) string {
+				return `{"run_id":"run-123","status":"accepted"}`
+			},
+			statusBody: func(size int) string { return statusReportBody(t, size) },
+			check: func(t *testing.T, result UploadResult, err error, overflow bool) {
+				t.Helper()
+				if overflow {
+					if err != nil || result.Status != "accepted" || result.StatusError != errDistributorResponseTooLarge.Error() {
+						t.Fatalf("overflow result/error = %#v/%v", result, err)
+					}
+					return
+				}
+				if err != nil || result.Status != "succeeded" || result.RunStatus == nil || len(result.RunStatus.Report) != 0 {
+					t.Fatalf("bounded result/error = %#v/%v", result, err)
+				}
+			},
+		},
+		{
+			name:       "error response",
+			response:   func(size int) string { return repeatedToLength(oversizedRemoteDiagnostic, size) },
+			statusCode: http.StatusBadRequest,
+			check: func(t *testing.T, result UploadResult, err error, overflow bool) {
+				t.Helper()
+				if overflow {
+					if !errors.Is(err, errDistributorResponseTooLarge) || result.RunID != "" {
+						t.Fatalf("overflow result/error = %#v/%v", result, err)
+					}
+					return
+				}
+				var remoteErr *RemoteResponseError
+				if !errors.As(err, &remoteErr) || remoteErr.StatusCode != http.StatusBadRequest {
+					t.Fatalf("bounded result/error = %#v/%v", result, err)
+				}
+			},
+		},
+	} {
+		for _, overflow := range []bool{false, true} {
+			t.Run(tt.name+"/"+map[bool]string{false: "limit", true: "over-limit"}[overflow], func(t *testing.T) {
+				size := int(maxDistributorResponseBytes)
+				if overflow {
+					size++
+				}
+				var uploadCalls int
+				server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+					if r.Method == http.MethodPost {
+						uploadCalls++
+						statusCode := tt.statusCode
+						if statusCode == 0 {
+							statusCode = http.StatusAccepted
+						}
+						w.WriteHeader(statusCode)
+						_, _ = io.WriteString(w, tt.response(size))
+						return
+					}
+					_, _ = io.WriteString(w, tt.statusBody(size))
+				}))
+				defer server.Close()
+
+				result, err := productionClient(t, server.URL, "test-upload-token").Upload(context.Background(), productionUploadRequest(t))
+				tt.check(t, result, err, overflow)
+				if strings.Contains(fmt.Sprint(result), oversizedRemoteDiagnostic) || strings.Contains(fmt.Sprint(err), oversizedRemoteDiagnostic) {
+					t.Fatalf("result/error leaked oversized response detail: %#v/%v", result, err)
+				}
+				if uploadCalls != 1 {
+					t.Fatalf("upload calls = %d, want one", uploadCalls)
+				}
+			})
+		}
+	}
+}
+
+func productionClient(t *testing.T, endpoint, token string) *Client {
+	t.Helper()
+	cfg := config.Defaults().Notify.Distributor
+	cfg.Endpoint = endpoint
+	cfg.Timeout = 0
+	t.Setenv(cfg.TokenEnv, token)
+	return New(cfg)
+}
+
+func productionUploadRequest(t *testing.T) UploadRequest {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "report.md")
+	if err := os.WriteFile(path, []byte("report body"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return UploadRequest{
+		PipelineID: "weather", BundleID: "bundle", IdempotencyKey: "bundle-key",
+		Files:     []UploadFile{{SourcePath: path, BundlePath: "daily/report.md"}},
+		CreatedAt: time.Date(2026, 6, 7, 12, 0, 0, 0, time.UTC),
+	}
+}
+
+func verifyUploadedArchive(t *testing.T, body io.Reader, wantPath, wantContents string) {
+	t.Helper()
+	reader, err := gzip.NewReader(body)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer reader.Close()
+	archive := tar.NewReader(reader)
+	for {
+		header, err := archive.Next()
+		if errors.Is(err, io.EOF) {
+			break
+		}
+		if err != nil {
+			t.Fatal(err)
+		}
+		if header.Name != wantPath {
+			continue
+		}
+		contents, err := io.ReadAll(archive)
+		if err != nil || string(contents) != wantContents {
+			t.Fatalf("archive file contents/error = %q/%v", contents, err)
+		}
+		return
+	}
+	t.Fatalf("archive did not contain %q", wantPath)
+}
+
+func paddedJSON(t *testing.T, value string, size int) string {
+	t.Helper()
+	if len(value) > size {
+		t.Fatalf("JSON length = %d, exceeds requested size %d", len(value), size)
+	}
+	return value + strings.Repeat(" ", size-len(value))
+}
+
+func statusReportBody(t *testing.T, size int) string {
+	t.Helper()
+	const prefix = `{"run_id":"run-123","pipeline_id":"weather","status":"succeeded","report":"`
+	const suffix = `"}`
+	if len(prefix)+len(suffix) > size {
+		t.Fatalf("status response exceeds requested size %d", size)
+	}
+	return prefix + repeatedToLength(oversizedRemoteDiagnostic, size-len(prefix)-len(suffix)) + suffix
+}
+
+func repeatedToLength(value string, size int) string {
+	return strings.Repeat(value, size/len(value)+1)[:size]
+}

internal/adapters/distributor/client_test.go

@@ -45,8 +45,8 @@ func TestUploadUsesConfiguredClientAndFiles(t *testing.T) {
 	if result.RunID != "run-123" || result.Status != "succeeded" || result.UploadStatus != "accepted" {
 		t.Fatalf("result = %#v, want accepted run", result)
 	}
-	if result.RunStatus == nil || result.RunStatus.PipelineID != "reports" || !strings.Contains(string(result.RunStatus.Report), "replace_older") {
-		t.Fatalf("RunStatus = %#v, want parsed run report", result.RunStatus)
+	if result.RunStatus == nil || result.RunStatus.PipelineID != "reports" || len(result.RunStatus.Report) != 0 {
+		t.Fatalf("RunStatus = %#v, want safe status details", result.RunStatus)
 	}
 	if factory.endpoint != cfg.Endpoint {
 		t.Fatalf("factory endpoint = %q, want %q", factory.endpoint, cfg.Endpoint)
@@ -242,13 +242,14 @@ func TestUploadPollsUntilTerminalStatus(t *testing.T) {
 		},
 	}
 	client := newClient(cfg, factory.newClient)
+	client.pollWait = func(context.Context, time.Duration) error { return nil }
 
 	result, err := client.Upload(context.Background(), validUploadRequest())
 	if err != nil {
 		t.Fatalf("Upload() error = %v", err)
 	}
-	if result.Status != "succeeded" || result.RunStatus == nil || !strings.Contains(string(result.RunStatus.Report), "replace_older") {
-		t.Fatalf("result = %#v, want terminal succeeded status with run report", result)
+	if result.Status != "succeeded" || result.RunStatus == nil || len(result.RunStatus.Report) != 0 {
+		t.Fatalf("result = %#v, want terminal succeeded status without remote report", result)
 	}
 	if factory.client.statusCalls != 2 {
 		t.Fatalf("status calls = %d, want 2", factory.client.statusCalls)
@@ -298,8 +299,8 @@ func TestUploadFailsWhenDistributorRunFailed(t *testing.T) {
 	if err == nil {
 		t.Fatal("Upload() error = nil, want failed distributor run error")
 	}
-	if result.RunStatus == nil || result.RunStatus.Status != "failed" || !strings.Contains(string(result.RunStatus.Report), "failed") {
-		t.Fatalf("result = %#v, want failed run status report", result)
+	if result.RunStatus == nil || result.RunStatus.Status != "failed" || len(result.RunStatus.Report) != 0 || result.RunStatus.Error != "distributor reported a failed run" {
+		t.Fatalf("result = %#v, want safe failed run status", result)
 	}
 	if strings.Contains(err.Error(), "secret-token") || strings.Contains(result.RunStatus.Error, "secret-token") {
 		t.Fatalf("error/result leaked token: err=%q result=%#v", err.Error(), result)

internal/adapters/promptkit/adapter.go

@@ -9,6 +9,7 @@ import (
 	"time"
 
 	promptkit "gitea.maximumdirect.net/eric/promptkit"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/generatedtext"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptassets"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
 )
@@ -23,6 +24,7 @@ type Config struct {
 }
 
 // Adapter owns one Promptkit engine and its opaque prepared execution handles.
+// It supports concurrent Execute calls on the shared executor.
 type Adapter struct {
 	engine *promptkit.Engine
 }
@@ -193,6 +195,17 @@ func executionValue(value *promptkit.RunResult, captureDebug bool) *promptexec.E
 		value.Validation.SchemaPath,
 		value.Validation.Errors,
 	)
+	rawOutput := []byte(nil)
+	if len(value.RawOutput) <= generatedtext.MaxGeneratedTextBytes {
+		rawOutput = []byte(value.RawOutput)
+	} else {
+		validation = promptexec.NewValidation(
+			promptexec.ValidationFailed,
+			string(value.Validation.Mode),
+			value.Validation.SchemaPath,
+			[]string{"generated output exceeds the configured size limit"},
+		)
+	}
 	execution := &promptexec.Execution{
 		RunID:              value.RunID,
 		PromptID:           value.PromptID,
@@ -215,11 +228,11 @@ func executionValue(value *promptkit.RunResult, captureDebug bool) *promptexec.E
 		EndedAt:    value.EndTime,
 		Duration:   value.Duration,
 		Validation: validation,
-		RawOutput:  []byte(value.RawOutput),
+		RawOutput:  rawOutput,
 	}
 	if captureDebug {
 		execution.Debug = &promptexec.ExecutionDebug{
-			RawOutput:             append([]byte(nil), value.RawOutput...),
+			RawOutput:             append([]byte(nil), rawOutput...),
 			ValidationDiagnostics: append([]string(nil), validation.Diagnostics...),
 		}
 	}
@@ -247,13 +260,12 @@ func copyInputHashes(values map[string]string) map[string]string {
 
 func marshalDebugParameters(value promptkit.ExecutionTarget) []byte {
 	parameters := struct {
-		Temperature     float64        `json:"temperature"`
-		MaxTokens       int            `json:"max_tokens"`
-		TopP            float64        `json:"top_p"`
-		TimeoutSeconds  int            `json:"timeout_seconds"`
-		ServiceTier     string         `json:"service_tier"`
-		ReasoningEffort string         `json:"reasoning_effort"`
-		ExtraParams     map[string]any `json:"extra_params"`
+		Temperature     float64 `json:"temperature"`
+		MaxTokens       int     `json:"max_tokens"`
+		TopP            float64 `json:"top_p"`
+		TimeoutSeconds  int     `json:"timeout_seconds"`
+		ServiceTier     string  `json:"service_tier"`
+		ReasoningEffort string  `json:"reasoning_effort"`
 	}{
 		Temperature:     value.Temperature,
 		MaxTokens:       value.MaxTokens,
@@ -261,7 +273,6 @@ func marshalDebugParameters(value promptkit.ExecutionTarget) []byte {
 		TimeoutSeconds:  value.TimeoutSeconds,
 		ServiceTier:     value.ServiceTier,
 		ReasoningEffort: value.ReasoningEffort,
-		ExtraParams:     value.ExtraParams,
 	}
 	data, _ := json.Marshal(parameters)
 	return data

internal/adapters/promptkit/adapter_test.go

@@ -12,6 +12,7 @@ import (
 	"time"
 
 	promptkit "gitea.maximumdirect.net/eric/promptkit"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/generatedtext"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
 )
 
@@ -22,6 +23,7 @@ type fakeClient struct {
 	calls    int
 	requests []promptkit.GenerateRequest
 	block    bool
+	started  chan struct{}
 }
 
 type recordingReader struct {
@@ -44,9 +46,13 @@ func (client *fakeClient) Generate(ctx context.Context, request promptkit.Genera
 	client.calls++
 	client.requests = append(client.requests, request)
 	block := client.block
+	started := client.started
 	response := client.response
 	err := client.err
 	client.mu.Unlock()
+	if started != nil {
+		started <- struct{}{}
+	}
 	if block {
 		<-ctx.Done()
 		return nil, ctx.Err()
@@ -54,6 +60,36 @@ func (client *fakeClient) Generate(ctx context.Context, request promptkit.Genera
 	return response, err
 }
 
+func TestExecuteSupportsConcurrentCalls(t *testing.T) {
+	client := &fakeClient{response: validResponse(), block: true, started: make(chan struct{}, 2)}
+	adapter := newTestAdapter(t, client)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	executionErrors := make(chan error, 2)
+	for range 2 {
+		go func() {
+			_, err := adapter.Execute(ctx, testExecuteRequest(), nil)
+			executionErrors <- err
+		}()
+	}
+	for range 2 {
+		select {
+		case <-client.started:
+		case <-time.After(5 * time.Second):
+			t.Fatal("timed out waiting for concurrent Promptkit calls")
+		}
+	}
+	cancel()
+	for range 2 {
+		if err := <-executionErrors; promptexec.CategoryOf(err) != promptexec.Canceled {
+			t.Fatalf("Execute() error/category = %v/%q", err, promptexec.CategoryOf(err))
+		}
+	}
+	if client.callCount() != 2 {
+		t.Fatalf("provider calls = %d, want 2", client.callCount())
+	}
+}
+
 func (client *fakeClient) callCount() int {
 	client.mu.Lock()
 	defer client.mu.Unlock()
@@ -316,6 +352,30 @@ func TestExecuteCapturesSensitiveDebugOnlyWhenRequested(t *testing.T) {
 	}
 }
 
+func TestMarshalDebugParametersOmitsProviderExtras(t *testing.T) {
+	const marker = "private-debug-marker"
+	parameters := string(marshalDebugParameters(promptkit.ExecutionTarget{
+		Temperature:     0.2,
+		MaxTokens:       400,
+		TopP:            0.9,
+		TimeoutSeconds:  30,
+		ServiceTier:     "flex",
+		ReasoningEffort: "high",
+		ExtraParams: map[string]any{
+			"access-key": marker,
+			"signature":  marker,
+		},
+	}))
+	if strings.Contains(parameters, marker) || strings.Contains(parameters, "extra_params") {
+		t.Fatalf("debug parameters leaked provider extras: %s", parameters)
+	}
+	for _, want := range []string{`"temperature":0.2`, `"max_tokens":400`, `"top_p":0.9`, `"timeout_seconds":30`, `"service_tier":"flex"`, `"reasoning_effort":"high"`} {
+		if !strings.Contains(parameters, want) {
+			t.Fatalf("debug parameters missing safe value %q: %s", want, parameters)
+		}
+	}
+}
+
 func TestExecuteCallbackFailurePreventsGeneration(t *testing.T) {
 	client := &fakeClient{response: validResponse()}
 	adapter := newTestAdapter(t, client)
@@ -340,6 +400,23 @@ func TestExecuteReturnsCompletedValidationRejection(t *testing.T) {
 	}
 }
 
+func TestExecuteDropsOversizedGeneratedOutput(t *testing.T) {
+	client := &fakeClient{response: &promptkit.GenerateResponse{Content: strings.Repeat("x", generatedtext.MaxGeneratedTextBytes+1)}}
+	adapter := newTestAdapter(t, client)
+	request := testExecuteRequest()
+	request.CaptureDebug = true
+	result, err := adapter.Execute(context.Background(), request, nil)
+	if err != nil {
+		t.Fatalf("Execute() error = %v", err)
+	}
+	if result == nil || result.Validation.Status != promptexec.ValidationFailed || len(result.RawOutput) != 0 || result.Debug == nil || len(result.Debug.RawOutput) != 0 {
+		t.Fatalf("execution = %#v", result)
+	}
+	if len(result.Validation.Diagnostics) != 1 || result.Validation.Diagnostics[0] != "generated output exceeds the configured size limit" {
+		t.Fatalf("diagnostics = %#v", result.Validation.Diagnostics)
+	}
+}
+
 func TestExecuteClassifiesOperationalFailures(t *testing.T) {
 	tests := []struct {
 		name     string
@@ -431,6 +508,7 @@ func TestNewValidatesConfiguration(t *testing.T) {
 }
 
 func TestLocalBackendAndMissingCredentialBehavior(t *testing.T) {
+	t.Setenv("WEATHERREPORTER_TEST_MISSING_KEY", "")
 	profiles := testProfileDirectory(t, `id: local-profile
 backend: local
 model: local-model

internal/adapters/weatherapi/client.go

@@ -7,6 +7,7 @@ import (
 	"crypto/sha256"
 	"encoding/hex"
 	"encoding/json"
+	"errors"
 	"fmt"
 	"io"
 	"net/http"
@@ -14,24 +15,28 @@ import (
 	"path"
 	"strconv"
 	"strings"
+	"sync"
 	"time"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
-	"gitea.maximumdirect.net/eric/weatherreporter/internal/fileutil"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
 )
 
 const (
 	convectiveOutlooksEndpoint  = "/outlooks/convective"
-	sourceSPCConvectiveOutlooks = "spc_convective_outlooks"
+	currentConditionsEndpoint   = "/conditions/current"
+	sourceSPCConvectiveOutlooks = config.MissingSourceSPCConvectiveOutlooks
 
-	defaultWarmupEndpoint  = "/conditions/current"
+	defaultWarmupEndpoint  = currentConditionsEndpoint
 	defaultWarmupAttempts  = 3
 	defaultWarmupDelay     = time.Second
 	defaultFetchAttempts   = 2
 	defaultFetchRetryDelay = time.Second
+	maxResponseBodyBytes   = 10 << 20
 )
 
+var errResponseBodyTooLarge = errors.New("response exceeds 10 MiB limit")
+
 type Client struct {
 	baseURL       *url.URL
 	httpClient    *http.Client
@@ -75,6 +80,9 @@ func New(cfg config.Config, opts ...Option) (*Client, error) {
 	if err != nil || baseURL.Scheme == "" || baseURL.Host == "" {
 		return nil, fmt.Errorf("weather_api.base_url must be an absolute URL")
 	}
+	if !strings.EqualFold(baseURL.Scheme, "http") && !strings.EqualFold(baseURL.Scheme, "https") {
+		return nil, fmt.Errorf("weather_api.base_url must use http or https")
+	}
 
 	timeout := cfg.WeatherAPI.Timeout
 	if timeout <= 0 {
@@ -106,49 +114,32 @@ func New(cfg config.Config, opts ...Option) (*Client, error) {
 }
 
 func (c *Client) FetchBundle(ctx context.Context) (*weatherdata.Bundle, error) {
-	if err := c.warmup(ctx); err != nil {
+	warmup, err := c.warmup(ctx)
+	if err != nil {
 		return nil, err
 	}
 
 	fetchedAt := c.now()
 	builder := bundleBuilder{
-		client:    c,
-		bundle:    &weatherdata.Bundle{FetchedAt: fetchedAt},
-		fetchedAt: fetchedAt,
+		client: c,
+		bundle: &weatherdata.Bundle{FetchedAt: fetchedAt},
 	}
 
-	if err := builder.fetchObservation(ctx); err != nil {
-		return nil, err
-	}
-	if err := builder.fetchCurrent(ctx); err != nil {
-		return nil, err
-	}
-	if err := builder.fetchHourly(ctx); err != nil {
-		return nil, err
-	}
-	if err := builder.fetchNarrative(ctx); err != nil {
-		return nil, err
-	}
-	if err := builder.fetchAlerts(ctx); err != nil {
-		return nil, err
-	}
-	if err := builder.fetchDiscussion(ctx); err != nil {
-		return nil, err
-	}
-	if err := builder.fetchWeatherStory(ctx); err != nil {
-		return nil, err
-	}
-	if err := builder.fetchSPCConvectiveOutlooks(ctx); err != nil {
-		return nil, err
+	for _, acquired := range builder.acquireSources(ctx, warmup) {
+		if err := ctx.Err(); err != nil {
+			return nil, fmt.Errorf("fetch weather API sources: %w", err)
+		}
+		if err := builder.mergeSource(acquired); err != nil {
+			return nil, err
+		}
 	}
 
 	return builder.bundle, nil
 }
 
 type bundleBuilder struct {
-	client    *Client
-	bundle    *weatherdata.Bundle
-	fetchedAt time.Time
+	client *Client
+	bundle *weatherdata.Bundle
 }
 
 type sourceRequest struct {
@@ -165,14 +156,81 @@ type fetchedSource struct {
 	source weatherdata.Source
 }
 
-func (b *bundleBuilder) fetchObservation(ctx context.Context) error {
+type warmupResponse struct {
+	endpoint   string
+	requestURL *url.URL
+	body       []byte
+	fetchedAt  time.Time
+}
+
+type sourceAcquisition struct {
+	request    sourceRequest
+	fetched    fetchedSource
+	err        error
+	warmup     warmupResponse
+	usesWarmup bool
+}
+
+func (b *bundleBuilder) acquireSources(ctx context.Context, warmup warmupResponse) []sourceAcquisition {
+	sources := []sourceAcquisition{
+		{request: sourceRequest{name: config.MissingSourceObservations, endpoint: "/observations", query: queryOptions{precision: true}, missingMessage: "observation data is missing"}},
+		{request: currentConditionsRequest()},
+		{request: sourceRequest{name: "hourly", endpoint: "/forecast/hourly", query: queryOptions{precision: true, timezone: true}, missingMessage: "hourly forecast data is missing", required: true, decodeLabel: "hourly forecast"}},
+		{request: sourceRequest{name: config.MissingSourceNarrative, endpoint: "/forecast/narrative", query: queryOptions{precision: true, timezone: true}, missingMessage: "narrative forecast data is missing"}},
+		{request: sourceRequest{name: config.MissingSourceAlerts, endpoint: "/alerts/active", query: queryOptions{allowNull: true}, missingMessage: "active alerts data is missing"}},
+		{request: sourceRequest{name: config.MissingSourceDiscussion, endpoint: "/discussion", query: queryOptions{timezone: true}, missingMessage: "forecast discussion data is missing"}},
+		{request: sourceRequest{name: config.MissingSourceWeatherStory, endpoint: "/weatherstories/latest", query: queryOptions{omitUnits: true}, missingMessage: "NWS weather story data is missing"}},
+		{request: sourceRequest{name: sourceSPCConvectiveOutlooks, endpoint: convectiveOutlooksEndpoint, query: queryOptions{timezone: true, omitUnits: true}, missingMessage: "SPC convective outlook data is missing"}},
+	}
+	if warmup.endpoint == currentConditionsEndpoint {
+		sources[1].warmup = warmup
+		sources[1].usesWarmup = true
+	}
+
+	var group sync.WaitGroup
+	for i := range sources {
+		if sources[i].usesWarmup {
+			continue
+		}
+		group.Add(1)
+		go func(index int) {
+			defer group.Done()
+			request := sources[index].request
+			raw, source, err := b.client.fetch(ctx, request.name, request.endpoint, request.query)
+			sources[index].fetched = fetchedSource{raw: raw, source: source}
+			sources[index].err = err
+		}(i)
+	}
+	group.Wait()
+	return sources
+}
+
+func (b *bundleBuilder) mergeSource(acquired sourceAcquisition) error {
+	switch acquired.request.name {
+	case config.MissingSourceObservations:
+		return b.fetchObservation(acquired)
+	case config.MissingSourceCurrent:
+		return b.fetchCurrent(acquired)
+	case "hourly":
+		return b.fetchHourly(acquired)
+	case config.MissingSourceNarrative:
+		return b.fetchNarrative(acquired)
+	case config.MissingSourceAlerts:
+		return b.fetchAlerts(acquired)
+	case config.MissingSourceDiscussion:
+		return b.fetchDiscussion(acquired)
+	case config.MissingSourceWeatherStory:
+		return b.fetchWeatherStory(acquired)
+	case sourceSPCConvectiveOutlooks:
+		return b.fetchSPCConvectiveOutlooks(acquired)
+	default:
+		return fmt.Errorf("merge unknown weather source %q", acquired.request.name)
+	}
+}
+
+func (b *bundleBuilder) fetchObservation(acquired sourceAcquisition) error {
 	var observation weatherdata.Observation
-	fetched, ok, err := b.fetchDecodedSource(ctx, sourceRequest{
-		name:           "observations",
-		endpoint:       "/observations",
-		query:          queryOptions{precision: true},
-		missingMessage: "observation data is missing",
-	}, &observation)
+	fetched, ok, err := b.fetchDecodedSource(acquired, &observation)
 	if err != nil || !ok {
 		return err
 	}
@@ -183,14 +241,18 @@ func (b *bundleBuilder) fetchObservation(ctx context.Context) error {
 	return nil
 }
 
-func (b *bundleBuilder) fetchCurrent(ctx context.Context) error {
-	var current weatherdata.Current
-	fetched, ok, err := b.fetchDecodedSource(ctx, sourceRequest{
-		name:           "current",
-		endpoint:       "/conditions/current",
+func currentConditionsRequest() sourceRequest {
+	return sourceRequest{
+		name:           config.MissingSourceCurrent,
+		endpoint:       currentConditionsEndpoint,
 		query:          queryOptions{precision: true},
 		missingMessage: "current conditions data is missing",
-	}, &current)
+	}
+}
+
+func (b *bundleBuilder) fetchCurrent(acquired sourceAcquisition) error {
+	var current weatherdata.Current
+	fetched, ok, err := b.fetchDecodedSource(acquired, &current)
 	if err != nil || !ok {
 		return err
 	}
@@ -200,16 +262,9 @@ func (b *bundleBuilder) fetchCurrent(ctx context.Context) error {
 	return nil
 }
 
-func (b *bundleBuilder) fetchHourly(ctx context.Context) error {
+func (b *bundleBuilder) fetchHourly(acquired sourceAcquisition) error {
 	var hourly weatherdata.ForecastRun
-	fetched, ok, err := b.fetchDecodedSource(ctx, sourceRequest{
-		name:           "hourly",
-		endpoint:       "/forecast/hourly",
-		query:          queryOptions{precision: true, timezone: true},
-		missingMessage: "hourly forecast data is missing",
-		required:       true,
-		decodeLabel:    "hourly forecast",
-	}, &hourly)
+	fetched, ok, err := b.fetchDecodedSource(acquired, &hourly)
 	if err != nil || !ok {
 		return err
 	}
@@ -217,6 +272,14 @@ func (b *bundleBuilder) fetchHourly(ctx context.Context) error {
 	if len(hourly.Periods) == 0 {
 		return fmt.Errorf("hourly forecast from %s contains no periods", source.Endpoint)
 	}
+	for i, period := range hourly.Periods {
+		if !period.HasUsableTimeBounds() {
+			return fmt.Errorf("hourly forecast from %s has unusable time bounds for period %d", source.Endpoint, i+1)
+		}
+		if !period.HasValidPrecipitationProbability() {
+			return fmt.Errorf("hourly forecast from %s has invalid precipitation probability for period %d", source.Endpoint, i+1)
+		}
+	}
 	source.IssuedAt = &hourly.IssuedAt
 	source.UpdatedAt = hourly.UpdatedAt
 	b.bundle.Hourly = &hourly
@@ -224,14 +287,9 @@ func (b *bundleBuilder) fetchHourly(ctx context.Context) error {
 	return nil
 }
 
-func (b *bundleBuilder) fetchNarrative(ctx context.Context) error {
+func (b *bundleBuilder) fetchNarrative(acquired sourceAcquisition) error {
 	var narrative weatherdata.ForecastRun
-	fetched, ok, err := b.fetchDecodedSource(ctx, sourceRequest{
-		name:           "narrative",
-		endpoint:       "/forecast/narrative",
-		query:          queryOptions{precision: true, timezone: true},
-		missingMessage: "narrative forecast data is missing",
-	}, &narrative)
+	fetched, ok, err := b.fetchDecodedSource(acquired, &narrative)
 	if err != nil || !ok {
 		return err
 	}
@@ -243,24 +301,21 @@ func (b *bundleBuilder) fetchNarrative(ctx context.Context) error {
 	return nil
 }
 
-func (b *bundleBuilder) fetchAlerts(ctx context.Context) error {
-	raw, source, err := b.client.fetch(ctx, "alerts", "/alerts/active", queryOptions{allowNull: true})
-	if err != nil {
+func (b *bundleBuilder) fetchAlerts(acquired sourceAcquisition) error {
+	fetched, ok, err := b.fetchSource(acquired)
+	if err != nil || !ok {
 		return err
 	}
-	if raw == nil {
-		return b.handleMissing(&source, "active alerts data is missing", false)
-	}
+	raw, source := fetched.raw, fetched.source
 	if isJSONNull(raw) {
-		b.bundle.Alerts = &weatherdata.AlertRun{Raw: append(json.RawMessage(nil), raw...)}
+		b.bundle.Alerts = &weatherdata.AlertRun{}
 		b.addSource(source)
 		return nil
 	}
 	var alerts weatherdata.AlertRun
 	if err := decodeSource(raw, &alerts); err != nil {
-		return b.handleMalformed(&source, err, sourceRequest{name: "alerts"})
+		return b.handleMalformed(&source, err, acquired.request)
 	}
-	alerts.Raw = append(json.RawMessage(nil), raw...)
 	if alerts.AsOf != nil {
 		source.IssuedAt = alerts.AsOf
 	}
@@ -269,14 +324,9 @@ func (b *bundleBuilder) fetchAlerts(ctx context.Context) error {
 	return nil
 }
 
-func (b *bundleBuilder) fetchDiscussion(ctx context.Context) error {
+func (b *bundleBuilder) fetchDiscussion(acquired sourceAcquisition) error {
 	var discussion weatherdata.Discussion
-	fetched, ok, err := b.fetchDecodedSource(ctx, sourceRequest{
-		name:           "discussion",
-		endpoint:       "/discussion",
-		query:          queryOptions{timezone: true},
-		missingMessage: "forecast discussion data is missing",
-	}, &discussion)
+	fetched, ok, err := b.fetchDecodedSource(acquired, &discussion)
 	if err != nil || !ok {
 		return err
 	}
@@ -288,18 +338,16 @@ func (b *bundleBuilder) fetchDiscussion(ctx context.Context) error {
 	return nil
 }
 
-func (b *bundleBuilder) fetchWeatherStory(ctx context.Context) error {
+func (b *bundleBuilder) fetchWeatherStory(acquired sourceAcquisition) error {
 	var story weatherdata.WeatherStory
-	fetched, ok, err := b.fetchDecodedSource(ctx, sourceRequest{
-		name:           "weather_story",
-		endpoint:       "/weatherstories/latest",
-		query:          queryOptions{omitUnits: true},
-		missingMessage: "NWS weather story data is missing",
-	}, &story)
+	fetched, ok, err := b.fetchDecodedSource(acquired, &story)
 	if err != nil || !ok {
 		return err
 	}
 	source := fetched.source
+	if !story.HasUsableContent() {
+		return b.handleMalformed(&source, fmt.Errorf("weather story has no usable content"), acquired.request)
+	}
 	if !story.StartTime.IsZero() {
 		source.IssuedAt = &story.StartTime
 	}
@@ -309,14 +357,9 @@ func (b *bundleBuilder) fetchWeatherStory(ctx context.Context) error {
 	return nil
 }
 
-func (b *bundleBuilder) fetchSPCConvectiveOutlooks(ctx context.Context) error {
+func (b *bundleBuilder) fetchSPCConvectiveOutlooks(acquired sourceAcquisition) error {
 	var run weatherdata.ConvectiveOutlookRun
-	fetched, ok, err := b.fetchDecodedSource(ctx, sourceRequest{
-		name:           sourceSPCConvectiveOutlooks,
-		endpoint:       convectiveOutlooksEndpoint,
-		query:          queryOptions{timezone: true, omitUnits: true},
-		missingMessage: "SPC convective outlook data is missing",
-	}, &run)
+	fetched, ok, err := b.fetchDecodedSource(acquired, &run)
 	if err != nil || !ok {
 		return err
 	}
@@ -332,26 +375,35 @@ func (b *bundleBuilder) fetchSPCConvectiveOutlooks(ctx context.Context) error {
 	return nil
 }
 
-func (b *bundleBuilder) fetchDecodedSource(ctx context.Context, request sourceRequest, target any) (fetchedSource, bool, error) {
-	fetched, ok, err := b.fetchSource(ctx, request)
+func (b *bundleBuilder) fetchDecodedSource(acquired sourceAcquisition, target any) (fetchedSource, bool, error) {
+	fetched, ok, err := b.fetchSource(acquired)
 	if err != nil || !ok {
 		return fetchedSource{}, false, err
 	}
+	return b.decodeFetchedSource(fetched, acquired.request, target)
+}
+
+func (b *bundleBuilder) decodeFetchedSource(fetched fetchedSource, request sourceRequest, target any) (fetchedSource, bool, error) {
 	if err := decodeSource(fetched.raw, target); err != nil {
 		return fetchedSource{}, false, b.handleMalformed(&fetched.source, err, request)
 	}
 	return fetched, true, nil
 }
 
-func (b *bundleBuilder) fetchSource(ctx context.Context, request sourceRequest) (fetchedSource, bool, error) {
-	raw, source, err := b.client.fetch(ctx, request.name, request.endpoint, request.query)
-	if err != nil {
-		return fetchedSource{}, false, err
+func (b *bundleBuilder) fetchSource(acquired sourceAcquisition) (fetchedSource, bool, error) {
+	if acquired.usesWarmup {
+		raw, source, err := b.client.decodeSourceResponse(acquired.request.name, acquired.request.endpoint, acquired.request.query, acquired.warmup.requestURL, acquired.warmup.body, acquired.warmup.fetchedAt)
+		if err != nil {
+			return fetchedSource{}, false, err
+		}
+		acquired.fetched = fetchedSource{raw: raw, source: source}
+	} else if acquired.err != nil {
+		return fetchedSource{}, false, acquired.err
 	}
-	if raw == nil {
-		return fetchedSource{}, false, b.handleMissing(&source, request.missingMessage, request.required)
+	if acquired.fetched.raw == nil {
+		return fetchedSource{}, false, b.handleMissing(&acquired.fetched.source, acquired.request.missingMessage, acquired.request.required)
 	}
-	return fetchedSource{raw: raw, source: source}, true, nil
+	return acquired.fetched, true, nil
 }
 
 func (b *bundleBuilder) handleMissing(source *weatherdata.Source, message string, required bool) error {
@@ -422,7 +474,10 @@ func (c *Client) fetch(ctx context.Context, sourceName string, endpoint string,
 	if err != nil {
 		return nil, weatherdata.Source{}, err
 	}
+	return c.decodeSourceResponse(sourceName, endpoint, opts, reqURL, body, c.now())
+}
 
+func (c *Client) decodeSourceResponse(sourceName string, endpoint string, opts queryOptions, reqURL *url.URL, body []byte, fetchedAt time.Time) (json.RawMessage, weatherdata.Source, error) {
 	var env envelope
 	if err := json.Unmarshal(body, &env); err != nil {
 		return nil, weatherdata.Source{}, fmt.Errorf("decode %s envelope: %w", endpoint, err)
@@ -432,7 +487,7 @@ func (c *Client) fetch(ctx context.Context, sourceName string, endpoint string,
 		Name:      sourceName,
 		Endpoint:  endpoint,
 		Query:     queryMap(reqURL.Query()),
-		FetchedAt: c.now(),
+		FetchedAt: fetchedAt,
 	}
 	if len(env.Data) == 0 || (isJSONNull(env.Data) && !opts.allowNull) {
 		source.Missing = true
@@ -446,53 +501,40 @@ func (c *Client) fetch(ctx context.Context, sourceName string, endpoint string,
 	return env.Data, source, nil
 }
 
-func (c *Client) warmup(ctx context.Context) error {
+func (c *Client) warmup(ctx context.Context) (warmupResponse, error) {
 	endpoint := c.warmupEndpoint
 	if strings.TrimSpace(endpoint) == "" {
 		endpoint = defaultWarmupEndpoint
 	}
 	attempts := positiveAttemptCount(c.warmupAttempts)
 	var lastErr error
+	var lastRetryable bool
 	for attempt := 1; attempt <= attempts; attempt++ {
 		if err := ctx.Err(); err != nil {
-			return fmt.Errorf("warm up weather API via %s: %w", endpoint, err)
+			return warmupResponse{}, fmt.Errorf("warm up weather API via %s: %w", endpoint, err)
 		}
-		if err := c.warmupOnce(ctx, endpoint); err != nil {
+		reqURL, body, err := c.warmupOnce(ctx, endpoint)
+		if err != nil {
 			lastErr = err
+			lastRetryable = isRetryableRequestError(err)
 		} else {
-			return nil
+			return warmupResponse{endpoint: endpoint, requestURL: reqURL, body: body, fetchedAt: c.now()}, nil
 		}
-		if attempt == attempts {
+		if !lastRetryable || attempt == attempts {
 			break
 		}
 		if err := waitForRetry(ctx, c.warmupDelay); err != nil {
-			return fmt.Errorf("warm up weather API via %s after %d attempt(s): %w", endpoint, attempt, err)
+			return warmupResponse{}, fmt.Errorf("warm up weather API via %s after %d attempt(s): %w", endpoint, attempt, err)
 		}
 	}
-	return fmt.Errorf("warm up weather API via %s failed after %d attempts: %w", endpoint, attempts, lastErr)
+	if !lastRetryable {
+		return warmupResponse{}, lastErr
+	}
+	return warmupResponse{}, fmt.Errorf("warm up weather API via %s failed after %d attempts: %w", endpoint, attempts, lastErr)
 }
 
-func (c *Client) warmupOnce(ctx context.Context, endpoint string) error {
-	reqURL := c.endpointURL(endpoint, queryOptions{precision: true})
-	req, err := http.NewRequestWithContext(ctx, http.MethodGet, reqURL.String(), nil)
-	if err != nil {
-		return fmt.Errorf("create request for %s: %w", endpoint, err)
-	}
-
-	resp, err := c.httpClient.Do(req)
-	if err != nil {
-		return fmt.Errorf("fetch %s: %w", endpoint, err)
-	}
-	defer resp.Body.Close()
-
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 10<<20))
-	if err != nil {
-		return fmt.Errorf("read %s response: %w", endpoint, err)
-	}
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		return fmt.Errorf("fetch %s: unexpected HTTP status %d: %s", endpoint, resp.StatusCode, strings.TrimSpace(string(body)))
-	}
-	return nil
+func (c *Client) warmupOnce(ctx context.Context, endpoint string) (*url.URL, []byte, error) {
+	return c.fetchHTTPOnce(ctx, endpoint, queryOptions{precision: true})
 }
 
 func (c *Client) fetchHTTP(ctx context.Context, endpoint string, opts queryOptions) (*url.URL, []byte, error) {
@@ -539,16 +581,12 @@ func (c *Client) fetchHTTPOnce(ctx context.Context, endpoint string, opts queryO
 	}
 	defer resp.Body.Close()
 
-	body, err := io.ReadAll(io.LimitReader(resp.Body, 10<<20))
+	body, err := readResponseBody(resp.Body)
 	if err != nil {
-		err = fmt.Errorf("read %s response: %w", endpoint, err)
-		if ctx.Err() != nil {
-			return reqURL, nil, err
-		}
-		return reqURL, nil, retryableRequestError{err: err}
+		return reqURL, nil, responseReadError(ctx, endpoint, err)
 	}
 	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		err := fmt.Errorf("fetch %s: unexpected HTTP status %d: %s", endpoint, resp.StatusCode, strings.TrimSpace(string(body)))
+		err := fmt.Errorf("fetch %s: unexpected HTTP status %d", endpoint, resp.StatusCode)
 		if isRetryableHTTPStatus(resp.StatusCode) {
 			return reqURL, nil, retryableRequestError{err: err}
 		}
@@ -557,6 +595,25 @@ func (c *Client) fetchHTTPOnce(ctx context.Context, endpoint string, opts queryO
 	return reqURL, body, nil
 }
 
+func readResponseBody(body io.Reader) ([]byte, error) {
+	data, err := io.ReadAll(io.LimitReader(body, maxResponseBodyBytes+1))
+	if err != nil {
+		return nil, err
+	}
+	if int64(len(data)) > maxResponseBodyBytes {
+		return nil, errResponseBodyTooLarge
+	}
+	return data, nil
+}
+
+func responseReadError(ctx context.Context, endpoint string, err error) error {
+	err = fmt.Errorf("read %s response: %w", endpoint, err)
+	if errors.Is(err, errResponseBodyTooLarge) || ctx.Err() != nil {
+		return err
+	}
+	return retryableRequestError{err: err}
+}
+
 type retryableRequestError struct {
 	err error
 }
@@ -659,10 +716,3 @@ func sourceHash(raw json.RawMessage) (string, error) {
 	sum := sha256.Sum256(compact.Bytes())
 	return hex.EncodeToString(sum[:]), nil
 }
-
-func SaveBundle(path string, bundle *weatherdata.Bundle) error {
-	if err := fileutil.WriteJSONAtomic(path, bundle); err != nil {
-		return fmt.Errorf("save bundle: %w", err)
-	}
-	return nil
-}

internal/adapters/weatherapi/client_test.go

@@ -3,11 +3,13 @@ package weatherapi
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"net/http"
 	"net/http/httptest"
 	"os"
 	"path/filepath"
 	"strings"
+	"sync"
 	"testing"
 	"time"
 
@@ -15,6 +17,12 @@ import (
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
 )
 
+type roundTripperFunc func(*http.Request) (*http.Response, error)
+
+func (f roundTripperFunc) RoundTrip(req *http.Request) (*http.Response, error) {
+	return f(req)
+}
+
 func TestFetchBundleFromFixtures(t *testing.T) {
 	var requested []string
 	server := fixtureServer(t, nil, &requested)
@@ -80,8 +88,8 @@ func TestFetchBundleFromFixtures(t *testing.T) {
 		"/weatherstories/latest",
 		convectiveOutlooksEndpoint,
 	}
-	if len(requested) != len(wantPaths)+1 {
-		t.Fatalf("requested paths = %v, want warmup plus %d source endpoints", requested, len(wantPaths))
+	if len(requested) != len(wantPaths) {
+		t.Fatalf("requested paths = %v, want %d source endpoints", requested, len(wantPaths))
 	}
 	if !strings.HasPrefix(requested[0], defaultWarmupEndpoint+"?") && requested[0] != defaultWarmupEndpoint {
 		t.Fatalf("first requested path = %q, want warmup endpoint %s", requested[0], defaultWarmupEndpoint)
@@ -91,6 +99,9 @@ func TestFetchBundleFromFixtures(t *testing.T) {
 			t.Fatalf("requested paths = %v, want %s", requested, want)
 		}
 	}
+	if got := countPath(requested, currentConditionsEndpoint); got != 1 {
+		t.Fatalf("conditions/current requests = %d, want 1; requested paths = %v", got, requested)
+	}
 	if !containsPath(requested, "/forecast/hourly") || containsPath(requested, "/forecast/hourly/today") {
 		t.Fatalf("requested paths = %v, want full hourly endpoint only", requested)
 	}
@@ -105,6 +116,191 @@ func TestFetchBundleFromFixtures(t *testing.T) {
 	}
 }
 
+func TestFetchBundleMergesConcurrentSourcesInSourceOrder(t *testing.T) {
+	paths := []string{
+		"/observations",
+		"/forecast/hourly",
+		"/forecast/narrative",
+		"/alerts/active",
+		"/discussion",
+		"/weatherstories/latest",
+		convectiveOutlooksEndpoint,
+	}
+	started := make(chan string, len(paths))
+	release := make(map[string]chan struct{}, len(paths))
+	for _, path := range paths {
+		release[path] = make(chan struct{})
+	}
+	var releaseOnce sync.Once
+	releaseAll := func() {
+		releaseOnce.Do(func() {
+			for i := len(paths) - 1; i >= 0; i-- {
+				close(release[paths[i]])
+			}
+		})
+	}
+	t.Cleanup(releaseAll)
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == currentConditionsEndpoint {
+			if !serveWeatherFixture(w, r) {
+				http.NotFound(w, r)
+			}
+			return
+		}
+		ready, ok := release[r.URL.Path]
+		if !ok {
+			http.NotFound(w, r)
+			return
+		}
+		started <- r.URL.Path
+		<-ready
+		if !serveWeatherFixture(w, r) {
+			http.NotFound(w, r)
+		}
+	}))
+	defer server.Close()
+	client := newTestClient(t, server.URL+"/", nil)
+
+	type fetchResult struct {
+		bundle *weatherdata.Bundle
+		err    error
+	}
+	result := make(chan fetchResult, 1)
+	go func() {
+		bundle, err := client.FetchBundle(context.Background())
+		result <- fetchResult{bundle: bundle, err: err}
+	}()
+
+	seen := make(map[string]bool, len(paths))
+	for range paths {
+		select {
+		case path := <-started:
+			seen[path] = true
+		case <-time.After(time.Second):
+			t.Fatalf("independent requests started = %v, want %v", seen, paths)
+		}
+	}
+	releaseAll()
+
+	select {
+	case got := <-result:
+		if got.err != nil {
+			t.Fatalf("FetchBundle() error = %v", got.err)
+		}
+		wantSources := []string{
+			config.MissingSourceObservations,
+			config.MissingSourceCurrent,
+			"hourly",
+			config.MissingSourceNarrative,
+			config.MissingSourceAlerts,
+			config.MissingSourceDiscussion,
+			config.MissingSourceWeatherStory,
+			sourceSPCConvectiveOutlooks,
+		}
+		gotSources := make([]string, 0, len(got.bundle.Sources))
+		for _, source := range got.bundle.Sources {
+			gotSources = append(gotSources, source.Name)
+		}
+		if strings.Join(gotSources, ",") != strings.Join(wantSources, ",") {
+			t.Fatalf("source order = %v, want %v", gotSources, wantSources)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("FetchBundle() did not finish after all source responses were released")
+	}
+}
+
+func TestFetchBundleReportsConcurrentFailuresInSourceOrder(t *testing.T) {
+	var requested []string
+	server := fixtureServer(t, map[string]handlerOverride{
+		"/forecast/hourly":    {status: http.StatusBadRequest, body: `invalid hourly request`},
+		"/forecast/narrative": {status: http.StatusBadRequest, body: `invalid narrative request`},
+	}, &requested)
+	client := newTestClient(t, server.URL+"/", nil)
+
+	_, err := client.FetchBundle(context.Background())
+	if err == nil {
+		t.Fatal("FetchBundle() error = nil, want source error")
+	}
+	if !strings.Contains(err.Error(), "/forecast/hourly") {
+		t.Fatalf("error = %q, want the earlier hourly source failure", err.Error())
+	}
+	if !containsPath(requested, "/forecast/narrative") {
+		t.Fatalf("requested paths = %v, want independent narrative request", requested)
+	}
+}
+
+func TestFetchBundleCancelsConcurrentSourceRequests(t *testing.T) {
+	paths := []string{
+		"/observations",
+		"/forecast/hourly",
+		"/forecast/narrative",
+		"/alerts/active",
+		"/discussion",
+		"/weatherstories/latest",
+		convectiveOutlooksEndpoint,
+	}
+	started := make(chan string, len(paths))
+	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if r.URL.Path == currentConditionsEndpoint {
+			if !serveWeatherFixture(w, r) {
+				http.NotFound(w, r)
+			}
+			return
+		}
+		for _, path := range paths {
+			if r.URL.Path == path {
+				started <- path
+				<-r.Context().Done()
+				return
+			}
+		}
+		http.NotFound(w, r)
+	}))
+	defer server.Close()
+	client := newTestClient(t, server.URL+"/", nil)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+
+	result := make(chan error, 1)
+	go func() {
+		_, err := client.FetchBundle(ctx)
+		result <- err
+	}()
+	for range paths {
+		select {
+		case <-started:
+		case <-time.After(time.Second):
+			cancel()
+			t.Fatal("not all independent requests started before cancellation")
+		}
+	}
+	cancel()
+	select {
+	case err := <-result:
+		if err == nil || !strings.Contains(err.Error(), context.Canceled.Error()) {
+			t.Fatalf("FetchBundle() error = %v, want context cancellation", err)
+		}
+	case <-time.After(time.Second):
+		t.Fatal("FetchBundle() did not return after cancellation")
+	}
+}
+
+func TestFetchBundleRejectsInvalidHourlyPrecipitationProbability(t *testing.T) {
+	for _, probability := range []string{"-1", "101"} {
+		t.Run(probability, func(t *testing.T) {
+			server := fixtureServer(t, map[string]handlerOverride{
+				"/forecast/hourly": {status: http.StatusOK, body: `{"data":{"periods":[{"startTime":"2026-05-29T13:00:00Z","endTime":"2026-05-29T14:00:00Z","probabilityOfPrecipitationPercent":` + probability + `}]}}`},
+			}, nil)
+			client := newTestClient(t, server.URL+"/", nil)
+
+			_, err := client.FetchBundle(context.Background())
+			if err == nil || !strings.Contains(err.Error(), "invalid precipitation probability") {
+				t.Fatalf("FetchBundle() error = %v, want invalid precipitation probability", err)
+			}
+		})
+	}
+}
+
 func TestFetchBundleBuildsExpectedQueries(t *testing.T) {
 	var requested []string
 	server := fixtureServer(t, nil, &requested)
@@ -194,8 +390,9 @@ func TestFetchBundleRecordsSourceHash(t *testing.T) {
 }
 
 func TestHTTPErrorIsActionable(t *testing.T) {
+	const marker = "upstream-secret-marker"
 	server := fixtureServer(t, map[string]handlerOverride{
-		"/forecast/hourly": {status: http.StatusBadGateway, body: `upstream failed`},
+		"/forecast/hourly": {status: http.StatusBadGateway, body: marker + strings.Repeat("x", 4096)},
 	}, nil)
 	client := newTestClient(t, server.URL+"/", nil)
 
@@ -206,6 +403,9 @@ func TestHTTPErrorIsActionable(t *testing.T) {
 	if !strings.Contains(err.Error(), "/forecast/hourly") || !strings.Contains(err.Error(), "502") {
 		t.Fatalf("error = %q, want endpoint and status", err.Error())
 	}
+	if strings.Contains(err.Error(), marker) {
+		t.Fatalf("error = %q, must not contain upstream response text", err.Error())
+	}
 }
 
 func TestWarmupRetriesBeforeFetchBundle(t *testing.T) {
@@ -231,8 +431,8 @@ func TestWarmupRetriesBeforeFetchBundle(t *testing.T) {
 	if bundle.Current == nil {
 		t.Fatal("Current = nil, want successful fetch after warmup retry")
 	}
-	if warmupCalls != 3 {
-		t.Fatalf("conditions/current calls = %d, want failed warmup, successful warmup, and current source fetch", warmupCalls)
+	if warmupCalls != 2 {
+		t.Fatalf("conditions/current calls = %d, want failed and successful warmup attempts", warmupCalls)
 	}
 	if len(requested) < 2 || !containsPath(requested[:2], defaultWarmupEndpoint) {
 		t.Fatalf("initial requests = %v, want warmup endpoint retries", requested)
@@ -265,6 +465,111 @@ func TestWarmupFailureStopsBeforeSourceFetches(t *testing.T) {
 	}
 }
 
+func TestWarmupDoesNotRetryPermanentStatus(t *testing.T) {
+	var requested []string
+	server := fixtureServer(t, map[string]handlerOverride{
+		defaultWarmupEndpoint: {status: http.StatusNotFound, body: `not found`},
+	}, &requested)
+	client := newTestClient(t, server.URL+"/", nil)
+
+	_, err := client.FetchBundle(context.Background())
+	if err == nil || !strings.Contains(err.Error(), "404") {
+		t.Fatalf("FetchBundle() error = %v, want non-retryable warmup status", err)
+	}
+	if got := countPath(requested, defaultWarmupEndpoint); got != 1 {
+		t.Fatalf("warmup requests = %d, want 1; all requests = %v", got, requested)
+	}
+	if containsPath(requested, "/observations") {
+		t.Fatalf("requested paths = %v, want warmup failure before source fetches", requested)
+	}
+}
+
+func TestWarmupErrorDiagnosticsRedactResponseBody(t *testing.T) {
+	const marker = "upstream-secret-marker"
+	server := fixtureServer(t, map[string]handlerOverride{
+		defaultWarmupEndpoint: {status: http.StatusNotFound, body: marker + strings.Repeat("x", 4096)},
+	}, nil)
+	client := newTestClient(t, server.URL+"/", nil)
+
+	_, err := client.FetchBundle(context.Background())
+	if err == nil {
+		t.Fatal("FetchBundle() error = nil, want warmup error")
+	}
+	if !strings.Contains(err.Error(), defaultWarmupEndpoint) || !strings.Contains(err.Error(), "404") {
+		t.Fatalf("error = %q, want warmup endpoint and status", err.Error())
+	}
+	if strings.Contains(err.Error(), marker) {
+		t.Fatalf("error = %q, must not contain upstream response text", err.Error())
+	}
+}
+
+func TestFetchAcceptsResponseAtBodyLimit(t *testing.T) {
+	body := paddedJSON(t, `{"data":null}`, int(maxResponseBodyBytes))
+	server := fixtureServer(t, map[string]handlerOverride{
+		"/forecast/narrative": {handler: func(w http.ResponseWriter, r *http.Request) {
+			_, _ = w.Write([]byte(body))
+		}},
+	}, nil)
+	client := newTestClient(t, server.URL+"/", nil)
+
+	if _, err := client.FetchBundle(context.Background()); err != nil {
+		t.Fatalf("FetchBundle() error = %v", err)
+	}
+}
+
+func TestFetchRejectsOversizedResponseWithoutRetry(t *testing.T) {
+	var requested []string
+	var narrativeCalls int
+	oversizedBody := paddedJSON(t, `{"data":null}`, int(maxResponseBodyBytes)) + "x"
+	server := fixtureServer(t, map[string]handlerOverride{
+		"/forecast/narrative": {handler: func(w http.ResponseWriter, r *http.Request) {
+			narrativeCalls++
+			_, _ = w.Write([]byte(oversizedBody))
+		}},
+	}, &requested)
+	client := newTestClient(t, server.URL+"/", nil)
+
+	_, err := client.FetchBundle(context.Background())
+	if err == nil {
+		t.Fatal("FetchBundle() error = nil, want oversized response error")
+	}
+	if !strings.Contains(err.Error(), "/forecast/narrative") || !strings.Contains(err.Error(), errResponseBodyTooLarge.Error()) {
+		t.Fatalf("error = %q, want endpoint and response limit", err.Error())
+	}
+	if narrativeCalls != 1 {
+		t.Fatalf("narrative calls = %d, want no retry", narrativeCalls)
+	}
+	if !containsPath(requested, "/alerts/active") {
+		t.Fatalf("requested paths = %v, want independent source requests despite narrative failure", requested)
+	}
+}
+
+func TestWarmupRejectsOversizedResponseWithoutRetry(t *testing.T) {
+	var requested []string
+	oversizedBody := paddedJSON(t, `{"data":{}}`, int(maxResponseBodyBytes)) + "x"
+	server := fixtureServer(t, map[string]handlerOverride{
+		defaultWarmupEndpoint: {handler: func(w http.ResponseWriter, r *http.Request) {
+			_, _ = w.Write([]byte(oversizedBody))
+		}},
+	}, &requested)
+	client := newTestClient(t, server.URL+"/", nil)
+	client.warmupAttempts = 2
+
+	_, err := client.FetchBundle(context.Background())
+	if err == nil {
+		t.Fatal("FetchBundle() error = nil, want oversized warmup response error")
+	}
+	if !strings.Contains(err.Error(), defaultWarmupEndpoint) || !strings.Contains(err.Error(), errResponseBodyTooLarge.Error()) {
+		t.Fatalf("error = %q, want warmup endpoint and response limit", err.Error())
+	}
+	if got := countPath(requested, defaultWarmupEndpoint); got != 1 {
+		t.Fatalf("warmup requests = %d, want no retry; all requests = %v", got, requested)
+	}
+	if containsPath(requested, "/observations") {
+		t.Fatalf("requested paths = %v, want warmup failure before source fetches", requested)
+	}
+}
+
 func TestFetchRetriesRetryableStatus(t *testing.T) {
 	var hourlyCalls int
 	server := fixtureServer(t, map[string]handlerOverride{
@@ -312,6 +617,40 @@ func TestFetchDoesNotRetryNonRetryableStatus(t *testing.T) {
 	}
 }
 
+func TestNewValidatesWeatherAPIBaseURLSchemeWithoutRequests(t *testing.T) {
+	requests := 0
+	httpClient := &http.Client{Transport: roundTripperFunc(func(*http.Request) (*http.Response, error) {
+		requests++
+		return nil, errors.New("unexpected request")
+	})}
+	tests := []struct {
+		name    string
+		baseURL string
+		wantErr string
+	}{
+		{name: "local HTTP", baseURL: "http://127.0.0.1:8080/weather/"},
+		{name: "local HTTPS", baseURL: "https://127.0.0.1:8443/weather/"},
+		{name: "unsupported scheme", baseURL: "ftp://weather.example.test/", wantErr: "weather_api.base_url must use http or https"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := testConfig(tt.baseURL)
+			_, err := New(cfg, WithHTTPClient(httpClient))
+			if tt.wantErr == "" {
+				if err != nil {
+					t.Fatalf("New() error = %v", err)
+				}
+			} else if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("New() error = %v, want %q", err, tt.wantErr)
+			}
+		})
+	}
+	if requests != 0 {
+		t.Fatalf("HTTP requests = %d, want none", requests)
+	}
+}
+
 func TestFetchDoesNotRetryMalformedEnvelope(t *testing.T) {
 	var hourlyCalls int
 	server := fixtureServer(t, map[string]handlerOverride{
@@ -351,6 +690,66 @@ func TestRequiredHourlyForecast(t *testing.T) {
 	}
 }
 
+func TestRequiredHourlyForecastValidatesPeriodBounds(t *testing.T) {
+	tests := []struct {
+		name    string
+		body    string
+		wantErr bool
+	}{
+		{
+			name: "valid period",
+			body: `{"data":{"periods":[{"startTime":"2026-05-29T13:00:00Z","endTime":"2026-05-29T14:00:00Z"}]}}`,
+		},
+		{
+			name:    "missing start",
+			body:    `{"data":{"periods":[{"endTime":"2026-05-29T14:00:00Z"}]}}`,
+			wantErr: true,
+		},
+		{
+			name:    "missing end",
+			body:    `{"data":{"periods":[{"startTime":"2026-05-29T13:00:00Z"}]}}`,
+			wantErr: true,
+		},
+		{
+			name:    "empty range",
+			body:    `{"data":{"periods":[{"startTime":"2026-05-29T13:00:00Z","endTime":"2026-05-29T13:00:00Z"}]}}`,
+			wantErr: true,
+		},
+		{
+			name:    "reversed range",
+			body:    `{"data":{"periods":[{"startTime":"2026-05-29T14:00:00Z","endTime":"2026-05-29T13:00:00Z"}]}}`,
+			wantErr: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			var requested []string
+			server := fixtureServer(t, map[string]handlerOverride{
+				"/forecast/hourly": {status: http.StatusOK, body: tt.body},
+			}, &requested)
+			client := newTestClient(t, server.URL+"/", nil)
+
+			bundle, err := client.FetchBundle(context.Background())
+			if tt.wantErr {
+				if err == nil || !strings.Contains(err.Error(), "hourly forecast") || !strings.Contains(err.Error(), "time bounds") {
+					t.Fatalf("FetchBundle() error = %v, want hourly time-bounds failure", err)
+				}
+				if got := countPath(requested, "/forecast/hourly"); got != 1 {
+					t.Fatalf("hourly requests = %d, want no retry; all requests = %v", got, requested)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("FetchBundle() error = %v", err)
+			}
+			if bundle.Hourly == nil || len(bundle.Hourly.Periods) != 1 {
+				t.Fatalf("Hourly = %#v, want accepted hourly period", bundle.Hourly)
+			}
+		})
+	}
+}
+
 func TestNullAlertsMeansNoActiveAlerts(t *testing.T) {
 	server := fixtureServer(t, map[string]handlerOverride{
 		"/alerts/active": {status: http.StatusOK, body: `{"data": null}`},
@@ -542,6 +941,44 @@ func TestMalformedWeatherStoryUsesPolicy(t *testing.T) {
 	}
 }
 
+func TestEmptyWeatherStoryUsesPolicy(t *testing.T) {
+	for _, tt := range []struct {
+		name    string
+		policy  config.MissingSourcePolicy
+		wantErr bool
+	}{
+		{name: "warn", policy: config.MissingSourceWarn},
+		{name: "error", policy: config.MissingSourceError, wantErr: true},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			server := fixtureServer(t, map[string]handlerOverride{
+				"/weatherstories/latest": {status: http.StatusOK, body: `{"data": {}}`},
+			}, nil)
+			client := newTestClient(t, server.URL+"/", map[string]config.MissingSourcePolicy{
+				"weather_story": tt.policy,
+			})
+
+			bundle, err := client.FetchBundle(context.Background())
+			if tt.wantErr {
+				if err == nil || !strings.Contains(err.Error(), "weather story has no usable content") {
+					t.Fatalf("FetchBundle() error = %v, want unusable weather story error", err)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("FetchBundle() error = %v", err)
+			}
+			if bundle.WeatherStory != nil {
+				t.Fatalf("WeatherStory = %#v, want nil for empty source", bundle.WeatherStory)
+			}
+			source := sourceByName(t, bundle.Sources, "weather_story")
+			if !source.Missing || len(source.Warnings) != 1 || source.Warnings[0].Code != "malformed_source" {
+				t.Fatalf("weather_story source = %#v, want malformed source warning", source)
+			}
+		})
+	}
+}
+
 func TestContextCancellation(t *testing.T) {
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		<-r.Context().Done()
@@ -618,48 +1055,40 @@ func TestHTTPTimeout(t *testing.T) {
 	}
 }
 
-func TestSaveBundle(t *testing.T) {
-	server := fixtureServer(t, nil, nil)
-	client := newTestClient(t, server.URL+"/", nil)
-	bundle, err := client.FetchBundle(context.Background())
-	if err != nil {
-		t.Fatalf("FetchBundle() error = %v", err)
-	}
-
-	path := filepath.Join(t.TempDir(), "nested", "bundle.json")
-	if err := SaveBundle(path, bundle); err != nil {
-		t.Fatalf("SaveBundle() error = %v", err)
-	}
-	data, err := os.ReadFile(path)
-	if err != nil {
-		t.Fatalf("read saved bundle: %v", err)
-	}
-	if !strings.Contains(string(data), `"hourly"`) {
-		t.Fatalf("saved bundle missing hourly source:\n%s", string(data))
-	}
-}
-
 type handlerOverride struct {
 	status  int
 	body    string
 	handler http.HandlerFunc
 }
 
+var weatherFixtureFiles = map[string]string{
+	"/observations":            "observations.json",
+	"/conditions/current":      "current.json",
+	"/forecast/hourly":         "hourly.json",
+	"/forecast/narrative":      "narrative.json",
+	"/alerts/active":           "alerts.json",
+	"/discussion":              "discussion.json",
+	"/weatherstories/latest":   "weather_story.json",
+	convectiveOutlooksEndpoint: "convective_outlooks.json",
+}
+
+func serveWeatherFixture(w http.ResponseWriter, r *http.Request) bool {
+	name, ok := weatherFixtureFiles[r.URL.Path]
+	if !ok {
+		return false
+	}
+	http.ServeFile(w, r, filepath.Join("testdata", name))
+	return true
+}
+
 func fixtureServer(t *testing.T, overrides map[string]handlerOverride, requested *[]string) *httptest.Server {
 	t.Helper()
-	fixtures := map[string]string{
-		"/observations":            "observations.json",
-		"/conditions/current":      "current.json",
-		"/forecast/hourly":         "hourly.json",
-		"/forecast/narrative":      "narrative.json",
-		"/alerts/active":           "alerts.json",
-		"/discussion":              "discussion.json",
-		"/weatherstories/latest":   "weather_story.json",
-		convectiveOutlooksEndpoint: "convective_outlooks.json",
-	}
+	var requestedMu sync.Mutex
 	server := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
 		if requested != nil {
+			requestedMu.Lock()
 			*requested = append(*requested, r.URL.String())
+			requestedMu.Unlock()
 		}
 		if override, ok := overrides[r.URL.Path]; ok {
 			if override.handler != nil {
@@ -670,12 +1099,9 @@ func fixtureServer(t *testing.T, overrides map[string]handlerOverride, requested
 			_, _ = w.Write([]byte(override.body))
 			return
 		}
-		name, ok := fixtures[r.URL.Path]
-		if !ok {
+		if !serveWeatherFixture(w, r) {
 			http.NotFound(w, r)
-			return
 		}
-		http.ServeFile(w, r, filepath.Join("testdata", name))
 	}))
 	t.Cleanup(server.Close)
 	return server
@@ -706,6 +1132,14 @@ func fixedNow() time.Time {
 	return time.Date(2026, 5, 29, 15, 0, 0, 0, time.UTC)
 }
 
+func paddedJSON(t *testing.T, value string, size int) string {
+	t.Helper()
+	if len(value) > size {
+		t.Fatalf("JSON value length = %d, exceeds requested size %d", len(value), size)
+	}
+	return value + strings.Repeat(" ", size-len(value))
+}
+
 func containsPath(requested []string, path string) bool {
 	for _, rawURL := range requested {
 		if strings.HasPrefix(rawURL, path+"?") || rawURL == path {

internal/app/app.go

@@ -3,10 +3,9 @@ package app
 
 import (
 	"context"
+	"errors"
 	"fmt"
-	"os"
 	"path/filepath"
-	"strings"
 	"time"
 
 	distributoradapter "gitea.maximumdirect.net/eric/weatherreporter/internal/adapters/distributor"
@@ -68,6 +67,7 @@ type BatchRequest struct {
 type ModuleSnapshotRequest struct {
 	Config   config.Config
 	Resolved report.Resolved
+	Identity briefing.PreparedIdentity
 }
 
 type ReportFacts struct {
@@ -101,6 +101,7 @@ type BatchResult struct {
 	Total        int                      `json:"total"`
 	Succeeded    int                      `json:"succeeded"`
 	Failed       int                      `json:"failed"`
+	Canceled     int                      `json:"canceled,omitempty"`
 	Notification *BatchNotificationResult `json:"notification,omitempty"`
 	Reports      []BatchReportResult      `json:"reports"`
 }
@@ -144,12 +145,19 @@ type BatchReportResult struct {
 
 type BatchError struct {
 	Result *BatchResult
+	Cause  error
 }
 
 func (e BatchError) Error() string {
 	if e.Result == nil {
 		return "batch failed"
 	}
+	if errors.Is(e.Cause, context.DeadlineExceeded) {
+		return fmt.Sprintf("batch %s deadline exceeded", e.Result.Batch)
+	}
+	if errors.Is(e.Cause, context.Canceled) || e.Result.Canceled > 0 {
+		return fmt.Sprintf("batch %s canceled", e.Result.Batch)
+	}
 	failedReports := batchReportFailures(e.Result)
 	if batchNotificationFailed(e.Result) && failedReports == 0 {
 		if e.Result.Notification.Error != "" {
@@ -160,6 +168,10 @@ func (e BatchError) Error() string {
 	return fmt.Sprintf("batch %s failed: %d of %d reports failed", e.Result.Batch, failedReports, len(e.Result.Reports))
 }
 
+func (e BatchError) Unwrap() error {
+	return e.Cause
+}
+
 func batchNotificationFailed(result *BatchResult) bool {
 	return result != nil && result.Notification != nil && result.Notification.Status == "failed"
 }
@@ -251,7 +263,10 @@ func GenerateDetailed(ctx context.Context, req GenerateRequest) (*ReportResult,
 		return nil, err
 	}
 	result := initialReportResult(req, resolved, PromptInspectionResult{})
-	outputPath, err := resolveReportOutputPath(req.WorkingDir, req.OutputPath, resolved)
+	if err := preflightDistributorNotification(req.Config); err != nil {
+		return result, err
+	}
+	outputPath, err := resolveReportOutputPath(req.WorkingDir, req.OutputPath, req.Config.Output.Directory, resolved)
 	if err != nil {
 		return result, err
 	}
@@ -260,6 +275,7 @@ func GenerateDetailed(ctx context.Context, req GenerateRequest) (*ReportResult,
 	if err != nil {
 		return result, promptexec.NewError(promptexec.InvalidConfiguration, "initialize prompt debug", err)
 	}
+	defer func() { _ = debugWriter.Close() }()
 	inspection, err := InspectPromptExecution(ctx, PromptInspectionRequest{
 		Resolved:  resolved,
 		Executor:  req.Executor,
@@ -302,7 +318,10 @@ func RunBatchDetailed(ctx context.Context, req BatchRequest) (*BatchResult, erro
 	if _, err := report.BatchForCommandName(string(req.Batch)); err != nil {
 		return nil, err
 	}
-	outputDir, err := resolveOutputDir(req.WorkingDir, req.OutputDir)
+	if err := preflightDistributorNotification(req.Config); err != nil {
+		return nil, err
+	}
+	outputDir, err := resolveOutputDirWithConfigured(req.WorkingDir, req.OutputDir, req.Config.Output.Directory)
 	if err != nil {
 		return nil, err
 	}
@@ -311,6 +330,7 @@ func RunBatchDetailed(ctx context.Context, req BatchRequest) (*BatchResult, erro
 	if err != nil {
 		return nil, promptexec.NewError(promptexec.InvalidConfiguration, "initialize prompt debug", err)
 	}
+	defer func() { _ = debugWriter.Close() }()
 	candidates, err := batchInspectionCandidates(req, now)
 	if err != nil {
 		return nil, err
@@ -337,7 +357,12 @@ func RunBatchDetailed(ctx context.Context, req BatchRequest) (*BatchResult, erro
 	if req.Batch == BatchEvening || req.Batch == BatchMorning {
 		startedAt := now
 		result := &BatchResult{Batch: req.Batch, StartedAt: startedAt}
-		for _, planned := range plannedReports {
+		var cancellation error
+		for index, planned := range plannedReports {
+			if cancellation = batchContextCancellationCause(ctx); cancellation != nil {
+				appendCanceledBatchReports(result, plannedReports[index:])
+				break
+			}
 			resolved := planned.Resolved
 			item := batchReportResult(planned)
 			reportResult, err := generatePromptReport(ctx, promptReportRequest{
@@ -357,26 +382,72 @@ func RunBatchDetailed(ctx context.Context, req BatchRequest) (*BatchResult, erro
 				copyBatchReportDetails(&item, reportResult)
 			}
 			if err != nil {
-				item.Status = "failed"
-				item.Error = err.Error()
-				result.Failed++
+				if reportCancellation := batchReportCancellationCause(err); reportCancellation != nil {
+					cancellation = reportCancellation
+					item.Status = "canceled"
+					result.Canceled++
+				} else {
+					item.Status = "failed"
+					item.Error = err.Error()
+					result.Failed++
+				}
 			} else {
 				item.Status = "succeeded"
 				result.Succeeded++
 			}
 			result.Reports = append(result.Reports, item)
+			if cancellation == nil {
+				cancellation = batchContextCancellationCause(ctx)
+			}
+			if cancellation != nil {
+				appendCanceledBatchReports(result, plannedReports[index+1:])
+				break
+			}
 		}
 		result.Total = len(result.Reports)
-		batchNotification := notifyBatch(ctx, req.Config, req.Batch, batchRunID(startedAt, req.Batch), startedAt, result, plannedReports, req.Notifier)
+		batchNotification := notifyBatch(batchNotificationInput{
+			ctx: ctx, cancellation: cancellation, cfg: req.Config, batch: req.Batch,
+			runID: batchRunID(startedAt, req.Batch), startedAt: startedAt,
+			result: result, planned: plannedReports, notifier: req.Notifier,
+		})
 		if batchNotification != nil {
 			result.Notification = batchNotification
 		}
 		result.FinishedAt = time.Now()
-		return result, nil
+		return result, cancellation
 	}
 	return nil, fmt.Errorf("run is not implemented")
 }
 
+func batchReportCancellationCause(err error) error {
+	if errors.Is(err, context.Canceled) {
+		return context.Canceled
+	}
+	if errors.Is(err, context.DeadlineExceeded) {
+		return context.DeadlineExceeded
+	}
+	return nil
+}
+
+func batchContextCancellationCause(ctx context.Context) error {
+	if ctx == nil {
+		return nil
+	}
+	return ctx.Err()
+}
+
+func appendCanceledBatchReports(result *BatchResult, plannedReports []plannedBatchReport) {
+	if result == nil {
+		return
+	}
+	for _, planned := range plannedReports {
+		item := batchReportResult(planned)
+		item.Status = "canceled"
+		result.Reports = append(result.Reports, item)
+		result.Canceled++
+	}
+}
+
 func copyBatchReportDetails(item *BatchReportResult, result *ReportResult) {
 	item.LLMDebugPath = result.LLMDebugPath
 	item.OutputPath = result.OutputPath
@@ -431,104 +502,6 @@ func batchReportResult(planned plannedBatchReport) BatchReportResult {
 	}
 }
 
-func plannedBatchOutputPath(outputDir string, planned plannedBatchReport) (string, error) {
-	outputName, err := planned.Resolved.OutputName()
-	if err != nil {
-		return "", err
-	}
-	return validateOutputPath(filepath.Join(outputDir, outputName))
-}
-
-func prepareBatchOutputs(outputDir string, plannedReports []plannedBatchReport) error {
-	for index := range plannedReports {
-		outputPath, err := plannedBatchOutputPath(outputDir, plannedReports[index])
-		if err != nil {
-			return err
-		}
-		plannedReports[index].OutputPath = outputPath
-	}
-	return nil
-}
-
-func resolveReportOutputPath(workingDir, override string, resolved report.Resolved) (string, error) {
-	outputName, err := resolved.OutputName()
-	if err != nil {
-		return "", err
-	}
-	return resolveOutputPath(workingDir, override, outputName)
-}
-
-func resolveOutputDir(workingDir, override string) (string, error) {
-	workingDir, err := validateWorkingDir(workingDir)
-	if err != nil {
-		return "", err
-	}
-	if override == "" {
-		return workingDir, nil
-	}
-	if strings.TrimSpace(override) == "" {
-		return "", fmt.Errorf("output directory is required")
-	}
-	directory := override
-	if !filepath.IsAbs(directory) {
-		directory = filepath.Join(workingDir, directory)
-	}
-	directory = filepath.Clean(directory)
-	if info, err := os.Stat(directory); err == nil && !info.IsDir() {
-		return "", fmt.Errorf("output directory %q is not a directory", directory)
-	} else if err != nil && !os.IsNotExist(err) {
-		return "", fmt.Errorf("inspect output directory %q: %w", directory, err)
-	}
-	return directory, nil
-}
-
-func resolveOutputPath(workingDir, override, defaultName string) (string, error) {
-	workingDir, err := validateWorkingDir(workingDir)
-	if err != nil {
-		return "", err
-	}
-	path := override
-	if path == "" {
-		path = defaultName
-	}
-	if strings.TrimSpace(path) == "" {
-		return "", fmt.Errorf("final output path is required")
-	}
-	if !filepath.IsAbs(path) {
-		path = filepath.Join(workingDir, path)
-	}
-	return validateOutputPath(path)
-}
-
-func validateWorkingDir(workingDir string) (string, error) {
-	if strings.TrimSpace(workingDir) == "" {
-		return "", fmt.Errorf("working directory is required")
-	}
-	if !filepath.IsAbs(workingDir) {
-		return "", fmt.Errorf("working directory %q must be absolute", workingDir)
-	}
-	return filepath.Clean(workingDir), nil
-}
-
-func validateOutputPath(path string) (string, error) {
-	if strings.TrimSpace(path) == "" {
-		return "", fmt.Errorf("final output path is required")
-	}
-	path = filepath.Clean(path)
-	if !filepath.IsAbs(path) {
-		return "", fmt.Errorf("final output path %q must be absolute", path)
-	}
-	if filepath.Dir(path) == path {
-		return "", fmt.Errorf("final output path %q must not be a filesystem root", path)
-	}
-	if info, err := os.Stat(path); err == nil && info.IsDir() {
-		return "", fmt.Errorf("final output path %q is a directory", path)
-	} else if err != nil && !os.IsNotExist(err) {
-		return "", fmt.Errorf("inspect final output path %q: %w", path, err)
-	}
-	return path, nil
-}
-
 func ResolveGenerate(req GenerateRequest, now time.Time) (report.Resolved, error) {
 	location, err := timeutil.LoadLocation(req.Config.WeatherAPI.Timezone)
 	if err != nil {
@@ -609,6 +582,16 @@ func reportNotifier(cfg config.Config, notifier Notifier) (Notifier, bool) {
 	}, true
 }
 
+func preflightDistributorNotification(cfg config.Config) error {
+	if !cfg.Notify.Distributor.Enabled {
+		return nil
+	}
+	if err := config.ValidateDistributorEndpoint(cfg.Notify.Distributor.Endpoint); err != nil {
+		return fmt.Errorf("validate notify.distributor.endpoint: %w", err)
+	}
+	return nil
+}
+
 func buildNotificationRequest(cfg config.Config, resolved report.Resolved, outputPath, runID string, generatedAt time.Time) (NotificationRequest, error) {
 	values, err := distributorTemplateValuesForReport(cfg, resolved, runID, filepath.Base(outputPath))
 	if err != nil {
@@ -731,25 +714,7 @@ func (n distributorNotifier) Notify(ctx context.Context, req NotificationRequest
 		Files:          distributorUploadFiles(req.ReportPath, req.BundlePaths),
 		CreatedAt:      req.CreatedAt,
 	})
-	notification := &NotificationResult{
-		PipelineID:     req.PipelineID,
-		BundleID:       req.BundleID,
-		IdempotencyKey: req.IdempotencyKey,
-		RunID:          result.RunID,
-		Status:         result.Status,
-		UploadStatus:   result.UploadStatus,
-		StatusError:    result.StatusError,
-	}
-	if result.RunStatus != nil {
-		if result.RunStatus.PipelineID != "" {
-			notification.PipelineID = result.RunStatus.PipelineID
-		}
-		notification.AcceptedAt = result.RunStatus.AcceptedAt
-		notification.StartedAt = result.RunStatus.StartedAt
-		notification.FinishedAt = result.RunStatus.FinishedAt
-		notification.Report = append([]byte(nil), result.RunStatus.Report...)
-		notification.Error = result.RunStatus.Error
-	}
+	notification := notificationResultFromUpload(req.PipelineID, req.BundleID, req.IdempotencyKey, result)
 	if err != nil {
 		return notification, err
 	}
@@ -773,7 +738,7 @@ func notificationResultFromUpload(pipelineID string, bundleID string, idempotenc
 		RunID:          result.RunID,
 		Status:         result.Status,
 		UploadStatus:   result.UploadStatus,
-		StatusError:    result.StatusError,
+		StatusError:    safeDistributorStatusError(result.StatusError),
 	}
 	if result.RunStatus != nil {
 		if result.RunStatus.PipelineID != "" {
@@ -782,12 +747,25 @@ func notificationResultFromUpload(pipelineID string, bundleID string, idempotenc
 		notification.AcceptedAt = result.RunStatus.AcceptedAt
 		notification.StartedAt = result.RunStatus.StartedAt
 		notification.FinishedAt = result.RunStatus.FinishedAt
-		notification.Report = append([]byte(nil), result.RunStatus.Report...)
-		notification.Error = result.RunStatus.Error
+		notification.Error = safeDistributorRunError(result.RunStatus.Error)
 	}
 	return notification
 }
 
+func safeDistributorStatusError(value string) string {
+	if value == "" {
+		return ""
+	}
+	return "distributor status could not be confirmed"
+}
+
+func safeDistributorRunError(value string) string {
+	if value == "" {
+		return ""
+	}
+	return "distributor reported a failed run"
+}
+
 func distributorUploadFiles(sourcePath string, bundlePaths []string) []distributoradapter.UploadFile {
 	files := make([]distributoradapter.UploadFile, 0, len(bundlePaths))
 	for _, bundlePath := range bundlePaths {
@@ -827,7 +805,12 @@ func BuildModuleSnapshotFromFacts(req ModuleSnapshotRequest, reportFacts ReportF
 	if err != nil {
 		return module.Snapshot{}, err
 	}
+	identity := req.Identity
+	if identity.ReportID == "" {
+		identity = briefing.BuildPreparedIdentity(briefingBuildContext(req.Config, req.Resolved, reportFacts.Collected))
+	}
 	moduleContext := briefing.ModuleContext{
+		Identity:  identity,
 		Resolved:  req.Resolved,
 		Collected: reportFacts.Collected,
 		Derived:   reportFacts.Derived,
@@ -859,16 +842,16 @@ func briefingBuildContext(cfg config.Config, resolved report.Resolved, collected
 	}
 }
 
-func promptMetadata(metadata briefing.Metadata) promptinput.Metadata {
+func promptMetadata(identity briefing.PreparedIdentity) promptinput.Metadata {
 	return promptinput.Metadata{
-		RunID:          metadata.RunID,
-		ReportID:       metadata.ReportID,
-		Variant:        metadata.Variant,
-		PromptID:       metadata.PromptID,
-		GeneratedAt:    metadata.GeneratedAt,
-		Timezone:       metadata.Timezone,
-		ValidPeriod:    metadata.ValidPeriod,
-		SourceWarnings: metadata.SourceWarnings,
+		RunID:          identity.RunID,
+		ReportID:       identity.ReportID,
+		Variant:        identity.Variant,
+		PromptID:       identity.PromptID,
+		GeneratedAt:    identity.GeneratedAt,
+		Timezone:       identity.Timezone,
+		ValidPeriod:    identity.ValidPeriod,
+		SourceWarnings: identity.SourceWarnings,
 	}
 }
 

internal/app/batch_generation_test.go

@@ -9,6 +9,7 @@ import (
 	"testing"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
 )
 
 func TestRunBatchDetailedKeepsSuccessfulOutputAndSkipsNotificationAfterPartialFailure(t *testing.T) {
@@ -21,7 +22,7 @@ func TestRunBatchDetailedKeepsSuccessfulOutputAndSkipsNotificationAfterPartialFa
 		Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputDir: t.TempDir(),
 		Collector: &generationCollector{bundle: &bundle}, Executor: executor, Notifier: notifier,
 	})
-	if err != nil || result == nil || result.Total != 2 || result.Succeeded != 1 || result.Failed != 1 || result.Notification == nil || result.Notification.Status != "skipped" || notifier.batchCalls != 0 {
+	if err != nil || result == nil || result.Total != 2 || result.Succeeded != 1 || result.Failed != 1 || result.Canceled != 0 || result.Notification == nil || result.Notification.Status != "skipped" || notifier.batchCalls != 0 {
 		t.Fatalf("RunBatchDetailed() result/error/notifier = %#v/%v/%#v", result, err, notifier)
 	}
 	if result.Reports[0].Status != "succeeded" || result.Reports[0].OutputPath == "" || result.Reports[1].Status != "failed" || result.Reports[1].OutputPath != "" {
@@ -32,6 +33,107 @@ func TestRunBatchDetailedKeepsSuccessfulOutputAndSkipsNotificationAfterPartialFa
 	}
 }
 
+func TestRunBatchDetailedStopsAfterReportCancellation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	bundle := generationBundle(t)
+	bundle.Hourly.Periods = bundle.Hourly.Periods[:1]
+	notifier := &generationNotifier{}
+	executor := &generationExecutor{cancelBeforeReturn: cancel}
+
+	result, err := RunBatchDetailed(ctx, BatchRequest{
+		Config: generationDistributorConfig(), Batch: BatchMorning,
+		Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputDir: t.TempDir(),
+		Collector: &generationCollector{bundle: &bundle}, Executor: executor, Notifier: notifier,
+	})
+	if !errors.Is(err, context.Canceled) || result == nil || result.Total != 2 || result.Succeeded != 0 || result.Failed != 0 || result.Canceled != 2 || executor.executeCalls != 1 || notifier.batchCalls != 0 || result.Notification == nil || result.Notification.Status != "skipped" || result.Notification.Reason != "batch canceled" {
+		t.Fatalf("RunBatchDetailed() result/error/executor/notifier = %#v/%v/%#v/%#v", result, err, executor, notifier)
+	}
+	for _, item := range result.Reports {
+		if item.Status != "canceled" || item.OutputPath != "" {
+			t.Fatalf("canceled report = %#v", item)
+		}
+	}
+}
+
+func TestRunBatchDetailedPreservesIndependentFailureDuringCancellation(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	bundle := generationBundle(t)
+	bundle.Hourly.Periods = bundle.Hourly.Periods[:1]
+	notifier := &generationNotifier{}
+	executor := &generationExecutor{
+		executeErr: errors.New("independent report failure"),
+		beforeExecute: func(promptexec.ExecuteRequest) {
+			cancel()
+		},
+	}
+
+	result, err := RunBatchDetailed(ctx, BatchRequest{
+		Config: generationDistributorConfig(), Batch: BatchMorning,
+		Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputDir: t.TempDir(),
+		Collector: &generationCollector{bundle: &bundle}, Executor: executor, Notifier: notifier,
+	})
+	if !errors.Is(err, context.Canceled) || result == nil || result.Total != 2 || result.Succeeded != 0 || result.Failed != 1 || result.Canceled != 1 || notifier.batchCalls != 0 || result.Notification == nil || result.Notification.Status != "skipped" || result.Notification.Reason != "batch canceled" {
+		t.Fatalf("RunBatchDetailed() result/error/notifier = %#v/%v/%#v", result, err, notifier)
+	}
+	if result.Reports[0].Status != "failed" || result.Reports[0].Error == "" || result.Reports[1].Status != "canceled" {
+		t.Fatalf("report results = %#v", result.Reports)
+	}
+}
+
+func TestNotifyBatchSkipsCancellationObservedAfterReportsComplete(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+	notifier := &generationNotifier{}
+
+	result := notifyBatch(batchNotificationInput{
+		ctx: ctx, cfg: generationDistributorConfig(), batch: BatchMorning,
+		runID: "run-id", startedAt: generationTime("2026-05-29T08:30:00-05:00"),
+		result:   &BatchResult{Total: 1, Succeeded: 1, Reports: []BatchReportResult{{Status: "succeeded"}}},
+		notifier: notifier,
+	})
+
+	if result == nil || result.Status != "skipped" || result.Reason != "batch canceled" || notifier.batchCalls != 0 {
+		t.Fatalf("notifyBatch() result/notifier = %#v/%#v", result, notifier)
+	}
+}
+
+func TestRunBatchDetailedRetainsPublishedReportBeforeCancellation(t *testing.T) {
+	for _, cause := range []error{context.Canceled, context.DeadlineExceeded} {
+		t.Run(cause.Error(), func(t *testing.T) {
+			bundle := generationBundle(t)
+			bundle.Hourly.Periods = bundle.Hourly.Periods[:1]
+			notifier := &generationNotifier{}
+			ctx := &publicationGateContext{Context: context.Background(), err: cause, afterChecks: 4}
+
+			result, err := RunBatchDetailed(ctx, BatchRequest{
+				Config: generationDistributorConfig(), Batch: BatchMorning,
+				Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputDir: t.TempDir(),
+				Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{}, Notifier: notifier,
+			})
+			if !errors.Is(err, cause) || result == nil || result.Total != 2 || result.Succeeded != 1 || result.Failed != 0 || result.Canceled != 1 || len(result.Reports) != 2 || result.Reports[0].Status != "succeeded" || result.Reports[0].OutputPath == "" || result.Reports[1].Status != "canceled" || result.Reports[1].OutputPath != "" || notifier.batchCalls != 0 || result.Notification == nil || result.Notification.Status != "skipped" || result.Notification.Reason != "batch canceled" {
+				t.Fatalf("RunBatchDetailed() result/error/notifier = %#v/%v/%#v", result, err, notifier)
+			}
+			if _, statErr := os.Stat(result.Reports[0].OutputPath); statErr != nil {
+				t.Fatalf("published report %q: %v", result.Reports[0].OutputPath, statErr)
+			}
+		})
+	}
+}
+
+func TestRunBatchPreservesCancellationCause(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	bundle := generationBundle(t)
+	bundle.Hourly.Periods = bundle.Hourly.Periods[:1]
+	err := RunBatch(ctx, BatchRequest{
+		Config: generationDistributorConfig(), Batch: BatchMorning,
+		Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputDir: t.TempDir(),
+		Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{cancelBeforeReturn: cancel}, Notifier: &generationNotifier{},
+	})
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("RunBatch() error = %v", err)
+	}
+}
+
 func TestRunBatchDetailedNotifiesOnlyAfterAllOutputsExist(t *testing.T) {
 	bundle := generationBundle(t)
 	bundle.Hourly.Periods = bundle.Hourly.Periods[:1]
@@ -61,6 +163,123 @@ func TestRunBatchDetailedNotifiesOnlyAfterAllOutputsExist(t *testing.T) {
 	}
 }
 
+func TestRunBatchDetailedRejectsUnsupportedDistributorEndpointBeforeWork(t *testing.T) {
+	outputDir := t.TempDir()
+	cfg := generationDistributorConfig()
+	cfg.Notify.Distributor.Endpoint = "ftp://distributor.example.test"
+	bundle := generationBundle(t)
+	collector := &generationCollector{bundle: &bundle}
+	executor := &generationExecutor{}
+	notifier := &generationNotifier{}
+
+	result, err := RunBatchDetailed(context.Background(), BatchRequest{
+		Config: cfg, Batch: BatchMorning,
+		Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputDir: outputDir,
+		Collector: collector, Executor: executor, Notifier: notifier,
+	})
+	if err == nil || result != nil || collector.called || executor.promptInspections != 0 || executor.called || notifier.calls != 0 || notifier.batchCalls != 0 {
+		t.Fatalf("RunBatchDetailed() result/error/collector/executor/notifier = %#v/%v/%t/%#v/%#v", result, err, collector.called, executor, notifier)
+	}
+	entries, readErr := os.ReadDir(outputDir)
+	if readErr != nil || len(entries) != 0 {
+		t.Fatalf("output directory entries/error = %v/%v", entries, readErr)
+	}
+}
+
+func TestRunBatchDetailedUsesDefaultAndConfiguredOutputDirectories(t *testing.T) {
+	tests := []struct {
+		name      string
+		directory func(t *testing.T, workingDir string) string
+		wantDir   func(t *testing.T, workingDir string, configuredDir string) string
+	}{
+		{
+			name: "working directory default",
+			directory: func(_ *testing.T, _ string) string {
+				return ""
+			},
+			wantDir: func(_ *testing.T, workingDir string, _ string) string {
+				return workingDir
+			},
+		},
+		{
+			name: "absolute directory",
+			directory: func(t *testing.T, _ string) string {
+				return filepath.Join(t.TempDir(), "reports")
+			},
+			wantDir: func(_ *testing.T, _ string, configuredDir string) string {
+				return configuredDir
+			},
+		},
+		{
+			name: "relative directory",
+			directory: func(_ *testing.T, _ string) string {
+				return "configured/../reports"
+			},
+			wantDir: func(_ *testing.T, workingDir string, _ string) string {
+				return filepath.Join(workingDir, "reports")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			workingDir := t.TempDir()
+			configuredDir := tt.directory(t, workingDir)
+			cfg := generationDistributorConfig()
+			cfg.Output.Directory = configuredDir
+			bundle := generationBundle(t)
+			bundle.Hourly.Periods = bundle.Hourly.Periods[:1]
+			notifier := &generationNotifier{}
+
+			result, err := RunBatchDetailed(context.Background(), BatchRequest{
+				Config: cfg, Batch: BatchMorning,
+				Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: workingDir,
+				Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{}, Notifier: notifier,
+			})
+			wantDir := tt.wantDir(t, workingDir, configuredDir)
+			if err != nil || result == nil || result.Succeeded != len(result.Reports) || notifier.batchCalls != 1 {
+				t.Fatalf("RunBatchDetailed() result/error/notifier = %#v/%v/%#v", result, err, notifier)
+			}
+			for _, item := range result.Reports {
+				if filepath.Dir(item.OutputPath) != wantDir {
+					t.Fatalf("report output %q, want directory %q", item.OutputPath, wantDir)
+				}
+			}
+			for _, file := range notifier.batchRequest.Files {
+				if filepath.Dir(file.SourcePath) != wantDir {
+					t.Fatalf("notification source %q, want directory %q", file.SourcePath, wantDir)
+				}
+			}
+		})
+	}
+}
+
+func TestRunBatchDetailedExplicitOutputDirectoryIgnoresConfiguredDirectory(t *testing.T) {
+	configuredPath := filepath.Join(t.TempDir(), "not-a-directory")
+	if err := os.WriteFile(configuredPath, []byte("not a directory"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	explicitDir := t.TempDir()
+	cfg := generationDistributorConfig()
+	cfg.Output.Directory = configuredPath
+	bundle := generationBundle(t)
+	bundle.Hourly.Periods = bundle.Hourly.Periods[:1]
+
+	result, err := RunBatchDetailed(context.Background(), BatchRequest{
+		Config: cfg, Batch: BatchMorning,
+		Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputDir: explicitDir,
+		Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{}, Notifier: &generationNotifier{},
+	})
+	if err != nil || result == nil || result.Succeeded != len(result.Reports) {
+		t.Fatalf("RunBatchDetailed() result/error = %#v/%v", result, err)
+	}
+	for _, item := range result.Reports {
+		if filepath.Dir(item.OutputPath) != explicitDir {
+			t.Fatalf("report output %q, want directory %q", item.OutputPath, explicitDir)
+		}
+	}
+}
+
 func TestRunBatchDetailedPreflightsAllOutputPaths(t *testing.T) {
 	bundle := generationBundle(t)
 	bundle.Hourly.Periods = bundle.Hourly.Periods[:1]

internal/app/batch_notification.go

@@ -42,46 +42,64 @@ type batchNotifier interface {
 	NotifyBatch(context.Context, batchNotificationRequest) (*NotificationResult, error)
 }
 
+type batchNotificationInput struct {
+	ctx          context.Context
+	cancellation error
+	cfg          config.Config
+	batch        BatchKind
+	runID        string
+	startedAt    time.Time
+	result       *BatchResult
+	planned      []plannedBatchReport
+	notifier     Notifier
+}
+
 func batchRunID(startedAt time.Time, batch BatchKind) string {
 	return startedAt.UTC().Format(runIDTimestampLayout) + "_" + string(batch)
 }
 
-func notifyBatch(ctx context.Context, cfg config.Config, batch BatchKind, runID string, startedAt time.Time, result *BatchResult, planned []plannedBatchReport, notifier Notifier) *BatchNotificationResult {
-	if !cfg.Notify.Distributor.Enabled {
+func notifyBatch(input batchNotificationInput) *BatchNotificationResult {
+	if !input.cfg.Notify.Distributor.Enabled {
 		return nil
 	}
-	if !cfg.Notify.Distributor.Batch.Enabled {
+	if !input.cfg.Notify.Distributor.Batch.Enabled {
 		return nil
 	}
-	if result == nil {
+	if input.result == nil {
 		return failedBatchNotificationResult(batchNotificationRequest{}, fmt.Errorf("batch result is required"))
 	}
-	if result.Failed > 0 {
+	if input.cancellation != nil || batchContextCancellationCause(input.ctx) != nil || input.result.Canceled > 0 {
+		return &BatchNotificationResult{
+			Status: "skipped",
+			Reason: "batch canceled",
+		}
+	}
+	if input.result.Failed > 0 {
 		return &BatchNotificationResult{
 			Status: "skipped",
 			Reason: "one or more reports failed",
 		}
 	}
 
-	req, err := buildBatchNotificationRequest(cfg, batch, runID, startedAt, result.Reports, planned)
+	req, err := buildBatchNotificationRequest(input.cfg, input.batch, input.runID, input.startedAt, input.result.Reports, input.planned)
 	if err != nil {
 		return failedBatchNotificationResult(batchNotificationRequest{}, err)
 	}
 
-	batchNotifier, err := resolveBatchNotifier(cfg, notifier)
+	batchNotifier, err := resolveBatchNotifier(input.cfg, input.notifier)
 	if err != nil {
 		return failedBatchNotificationResult(req, err)
 	}
 
-	notification, notifyErr := batchNotifier.NotifyBatch(ctx, req)
+	notification, notifyErr := batchNotifier.NotifyBatch(input.ctx, req)
 	wrappedErr := notifyErr
 	if notifyErr != nil {
-		wrappedErr = fmt.Errorf("notify batch %q run %q bundle %q: %w", batch, runID, req.BundleID, notifyErr)
+		wrappedErr = fmt.Errorf("notify batch %q run %q bundle %q: %w", input.batch, input.runID, req.BundleID, notifyErr)
 	}
 	batchResult := batchNotificationResult(req, notification)
 	if wrappedErr != nil {
 		batchResult.Status = "failed"
-		batchResult.Error = wrappedErr.Error()
+		batchResult.Error = safeDistributorNotificationFailure(wrappedErr)
 		return batchResult
 	}
 	return batchResult
@@ -233,7 +251,7 @@ func batchNotificationResult(req batchNotificationRequest, result *NotificationR
 			notification.IdempotencyKey = result.IdempotencyKey
 		}
 		if result.Error != "" {
-			notification.Error = result.Error
+			notification.Error = safeDistributorRunError(result.Error)
 		}
 	}
 	if notification.Status == "" {
@@ -246,11 +264,18 @@ func failedBatchNotificationResult(req batchNotificationRequest, err error) *Bat
 	notification := batchNotificationResult(req, nil)
 	notification.Status = "failed"
 	if err != nil {
-		notification.Error = err.Error()
+		notification.Error = safeDistributorNotificationFailure(err)
 	}
 	return notification
 }
 
+func safeDistributorNotificationFailure(err error) string {
+	if err == nil {
+		return ""
+	}
+	return "distributor notification failed"
+}
+
 func renderBatchNotificationIdentity(cfg config.Config, batch BatchKind, runID string, startedAt time.Time) (batchNotificationIdentity, error) {
 	values, err := batchNotificationTemplateValues(cfg, batch, runID, startedAt)
 	if err != nil {

internal/app/comparison.go

@@ -0,0 +1,237 @@
+package app
+
+import (
+	"context"
+	"fmt"
+	"os"
+	"path/filepath"
+	"time"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptdebug"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/timeutil"
+)
+
+// ComparisonRequest describes one explicit, multi-profile report comparison.
+// It deliberately does not accept a notifier: comparison publication is local.
+type ComparisonRequest struct {
+	Config      config.Config
+	Report      ReportKind
+	ProfileIDs  []string
+	WorkingDir  string
+	OutputDir   string
+	Replace     bool
+	LLMDebugDir string
+	Date        time.Time
+	Clock       timeutil.Clock
+	Collector   Collector
+	Executor    promptexec.Executor
+}
+
+// ComparisonResult records the resolved comparison and profile outcomes.
+type ComparisonResult struct {
+	ComparisonID    string
+	ReportID        report.ID
+	ReportName      string
+	PromptID        string
+	PromptVersion   string
+	PromptHash      string
+	StartedAt       time.Time
+	FinishedAt      time.Time
+	Timezone        string
+	ValidPeriod     timeutil.Period
+	OutputDirectory string
+	ManifestPath    string
+	DataPackagePath string
+	Total           int
+	Succeeded       int
+	Failed          int
+	Results         []ComparisonProfileResult
+}
+
+// ComparisonProfileResult records one explicitly selected profile.
+type ComparisonProfileResult struct {
+	Position         int
+	ProfileID        string
+	BackendID        string
+	ModelName        string
+	Status           string
+	ValidationStatus promptexec.ValidationStatus
+	ReportPath       string
+	LLMDebugPath     string
+	Error            *comparison.SafeError
+}
+
+type comparisonPublisher func(context.Context, comparison.DestinationPlan, comparison.LogicalBundle) (comparison.PublicationResult, error)
+
+// CompareDetailed assembles, executes, and atomically publishes a comparison
+// bundle. Profile failures publish a complete partial bundle. Failures before
+// commit leave the destination untouched; a post-commit cleanup failure leaves
+// the new bundle installed and returns its artifact paths with an error.
+func CompareDetailed(ctx context.Context, req ComparisonRequest) (*ComparisonResult, error) {
+	return compareDetailed(ctx, req, comparison.Publish)
+}
+
+func compareDetailed(ctx context.Context, req ComparisonRequest, publish comparisonPublisher) (*ComparisonResult, error) {
+	if err := comparison.ValidateProfileIDs(req.ProfileIDs); err != nil {
+		return nil, err
+	}
+
+	clock := req.Clock
+	if clock == nil {
+		clock = timeutil.SystemClock{}
+	}
+	now := clock.Now()
+	resolved, err := ResolveGenerate(GenerateRequest{Config: req.Config, Report: req.Report, Date: req.Date}, now)
+	if err != nil {
+		return nil, err
+	}
+	metadata := resolved.Metadata()
+	comparisonID, err := comparison.BuildComparisonID(metadata.RunID)
+	if err != nil {
+		return nil, fmt.Errorf("build comparison identity: %w", err)
+	}
+	result := initialComparisonResult(req, resolved, comparisonID, now.UTC())
+	defer func() {
+		if result.FinishedAt.IsZero() {
+			finalizeComparisonResult(result, clock)
+		}
+	}()
+
+	outputName, err := resolved.OutputName()
+	if err != nil {
+		return result, fmt.Errorf("resolve comparison output name: %w", err)
+	}
+	outputDirectory, err := resolveComparisonOutputDirectory(req.WorkingDir, req.OutputDir, req.Config.Output.Directory, outputName)
+	if err != nil {
+		return result, err
+	}
+	result.OutputDirectory = outputDirectory
+	publicationPlan, err := comparison.PlanDestination(req.WorkingDir, outputDirectory, req.Replace)
+	if err != nil {
+		return result, fmt.Errorf("preflight comparison destination: %w", err)
+	}
+
+	debugWriter, err := promptdebug.NewPromptDebugWriter(req.LLMDebugDir)
+	if err != nil {
+		return result, promptexec.NewError(promptexec.InvalidConfiguration, "initialize prompt debug", err)
+	}
+	defer func() { _ = debugWriter.Close() }()
+	inspection, err := InspectComparisonExecution(ctx, ComparisonInspectionRequest{
+		Resolved: resolved, ProfileIDs: req.ProfileIDs, Executor: req.Executor, LookupEnv: os.LookupEnv,
+	})
+	result.PromptID, result.PromptVersion, result.PromptHash = inspection.PromptID, inspection.PromptVersion, inspection.PromptHash
+	if err != nil {
+		return result, err
+	}
+
+	collection, err := collectWeather(ctx, req.Config, req.Collector)
+	if err != nil {
+		return result, err
+	}
+	prepared, err := prepareReport(prepareReportRequest{Config: req.Config, Resolved: resolved, Collection: *collection, handler: inspection.handler})
+	if err != nil {
+		return result, fmt.Errorf("prepare comparison report: %w", err)
+	}
+
+	executed := executeComparisonProfiles(ctx, comparisonExecutionRequest{
+		Prepared: prepared, Inspection: inspection, ComparisonID: comparisonID, DebugWriter: debugWriter, Executor: req.Executor,
+	})
+	finalizeComparisonResult(result, clock)
+	copyComparisonOutcomes(result, executed.Outcomes, false)
+	if executed.Canceled {
+		return result, fmt.Errorf("comparison execution: %w", ctx.Err())
+	}
+
+	bundle := comparisonBundle(result, prepared.dataPackageCopy(), executed.Outcomes)
+	if err := bundle.Validate(); err != nil {
+		return result, fmt.Errorf("build comparison bundle: %w", err)
+	}
+	publication, err := publish(ctx, publicationPlan, bundle)
+	if publication.Committed {
+		result.OutputDirectory = publicationPlan.Target
+		result.ManifestPath = filepath.Join(publicationPlan.Target, comparison.ManifestFilename)
+		result.DataPackagePath = filepath.Join(publicationPlan.Target, comparison.DataPackageFilename)
+		copyComparisonOutcomes(result, executed.Outcomes, true)
+	}
+	if err != nil {
+		return result, fmt.Errorf("publish comparison bundle: %w", err)
+	}
+
+	if result.Failed > 0 {
+		return result, fmt.Errorf("comparison completed with %d failed profiles", result.Failed)
+	}
+	return result, nil
+}
+
+func finalizeComparisonResult(result *ComparisonResult, clock timeutil.Clock) {
+	finishedAt := clock.Now().UTC()
+	if finishedAt.IsZero() {
+		finishedAt = time.Unix(0, 1).UTC()
+	}
+	if finishedAt.Before(result.StartedAt) {
+		finishedAt = result.StartedAt
+	}
+	result.FinishedAt = finishedAt
+}
+
+func initialComparisonResult(req ComparisonRequest, resolved report.Resolved, comparisonID string, startedAt time.Time) *ComparisonResult {
+	metadata := resolved.Metadata()
+	return &ComparisonResult{
+		ComparisonID: comparisonID,
+		ReportID:     resolved.Definition.ID,
+		ReportName:   resolved.Definition.Name,
+		StartedAt:    startedAt,
+		Timezone:     req.Config.WeatherAPI.Timezone,
+		ValidPeriod:  metadata.ValidPeriod,
+	}
+}
+
+func copyComparisonOutcomes(result *ComparisonResult, outcomes []comparisonProfileOutcome, published bool) {
+	result.Results = make([]ComparisonProfileResult, len(outcomes))
+	result.Total, result.Succeeded, result.Failed = len(outcomes), 0, 0
+	for index, outcome := range outcomes {
+		profile := ComparisonProfileResult{
+			Position: outcome.Position, ProfileID: outcome.ProfileID, BackendID: outcome.BackendID, ModelName: outcome.ModelName,
+			Status: outcome.Status, ValidationStatus: outcome.ValidationStatus, LLMDebugPath: outcome.LLMDebugPath, Error: outcome.Error,
+		}
+		if published && outcome.Status == comparison.StatusSucceeded {
+			profile.ReportPath = filepath.Join(result.OutputDirectory, outcome.ReportPath)
+		}
+		result.Results[index] = profile
+		if outcome.Status == comparison.StatusSucceeded {
+			result.Succeeded++
+		} else {
+			result.Failed++
+		}
+	}
+}
+
+func comparisonBundle(result *ComparisonResult, dataPackage []byte, outcomes []comparisonProfileOutcome) comparison.LogicalBundle {
+	manifest := comparison.Manifest{
+		SchemaVersion: comparison.SchemaVersion, ComparisonID: result.ComparisonID,
+		StartedAt: result.StartedAt.UTC(), FinishedAt: result.FinishedAt.UTC(),
+		ReportID: string(result.ReportID), Timezone: result.Timezone,
+		ValidPeriod: comparison.ValidPeriod{Start: result.ValidPeriod.Start, End: result.ValidPeriod.End},
+		PromptID:    result.PromptID, PromptVersion: result.PromptVersion, PromptHash: result.PromptHash,
+		DataPackage: comparison.DataPackageReference{Path: comparison.DataPackageFilename, SHA256: comparison.SHA256(dataPackage)},
+		Total:       result.Total, Succeeded: result.Succeeded, Failed: result.Failed,
+		Results: make([]comparison.Result, len(outcomes)),
+	}
+	bundle := comparison.LogicalBundle{Manifest: manifest, DataPackage: dataPackage}
+	for index, outcome := range outcomes {
+		manifestResult := comparison.Result{
+			Position: outcome.Position, ProfileID: outcome.ProfileID, BackendID: outcome.BackendID, ModelName: outcome.ModelName,
+			Status: outcome.Status, ValidationStatus: string(outcome.ValidationStatus), Error: outcome.Error,
+		}
+		if outcome.Status == comparison.StatusSucceeded {
+			manifestResult.ReportPath = outcome.ReportPath
+			bundle.Reports = append(bundle.Reports, comparison.BundleReport{Position: outcome.Position, Path: outcome.ReportPath, Markdown: outcome.Markdown})
+		}
+		bundle.Manifest.Results[index] = manifestResult
+	}
+	return bundle
+}

internal/app/comparison_execution.go

@@ -0,0 +1,177 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"sync"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptdebug"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
+)
+
+type comparisonExecutionRequest struct {
+	Prepared     preparedReport
+	Inspection   ComparisonInspectionResult
+	ComparisonID string
+	DebugWriter  *promptdebug.PromptDebugWriter
+	Executor     promptexec.Executor
+}
+
+type comparisonExecutionResult struct {
+	Outcomes []comparisonProfileOutcome
+	Canceled bool
+}
+
+type comparisonProfileOutcome struct {
+	Position         int
+	ProfileID        string
+	BackendID        string
+	ModelName        string
+	Status           string
+	ValidationStatus promptexec.ValidationStatus
+	ReportPath       string
+	Markdown         []byte
+	LLMDebugPath     string
+	Error            *comparison.SafeError
+	canceled         bool
+}
+
+type comparisonProfileExecutionState uint8
+
+const (
+	comparisonProfilePending comparisonProfileExecutionState = iota
+	comparisonProfileRunning
+	comparisonProfileComplete
+)
+
+func executeComparisonProfiles(ctx context.Context, req comparisonExecutionRequest) comparisonExecutionResult {
+	profiles := req.Inspection.Profiles
+	result := comparisonExecutionResult{Outcomes: make([]comparisonProfileOutcome, len(profiles))}
+	states := make([]comparisonProfileExecutionState, len(profiles))
+	for index, profile := range profiles {
+		result.Outcomes[index] = comparisonProfileOutcome{
+			Position:  index + 1,
+			ProfileID: profile.ProfileID,
+			BackendID: profile.BackendID,
+			ModelName: profile.ModelName,
+			Status:    comparison.StatusFailed,
+		}
+	}
+
+	var waitGroup sync.WaitGroup
+	for index, profile := range profiles {
+		if err := ctx.Err(); err != nil {
+			result.Canceled = true
+			break
+		}
+		index, profile := index, profile
+		states[index] = comparisonProfileRunning
+		waitGroup.Add(1)
+		go func() {
+			defer waitGroup.Done()
+			result.Outcomes[index] = executeComparisonProfile(ctx, req, index, profile)
+			states[index] = comparisonProfileComplete
+		}()
+	}
+	waitGroup.Wait()
+	if err := ctx.Err(); err != nil {
+		result.Canceled = true
+		for index := range result.Outcomes {
+			if states[index] != comparisonProfileComplete || result.Outcomes[index].canceled {
+				markCanceledComparisonOutcome(&result.Outcomes[index], err)
+			}
+		}
+	}
+	return result
+}
+
+func executeComparisonProfile(ctx context.Context, req comparisonExecutionRequest, index int, profile ComparisonProfileInspection) comparisonProfileOutcome {
+	position := index + 1
+	outcome := comparisonProfileOutcome{
+		Position: position, ProfileID: profile.ProfileID, BackendID: profile.BackendID, ModelName: profile.ModelName,
+		Status: comparison.StatusFailed,
+	}
+	debugRef := promptdebug.PromptDebugRef{
+		ReportID:  req.Prepared.resolved.Definition.ID,
+		ValidDate: req.Prepared.resolved.ValidPeriod.Start.Format("2006-01-02"),
+		RunID:     comparisonDebugRunID(req.ComparisonID, position, len(req.Inspection.Profiles), profile.ProfileID),
+	}
+	execution, markdown, err := executePreparedProfile(ctx, profileExecutionRequest{
+		Prepared: req.Prepared,
+		Prompt: PromptInspectionResult{
+			PromptID: req.Inspection.PromptID, PromptVersion: req.Inspection.PromptVersion, PromptHash: req.Inspection.PromptHash,
+		},
+		Profile:  promptexec.ProfileInspection{ProfileID: profile.ProfileID, BackendID: profile.BackendID, ModelName: profile.ModelName},
+		Executor: req.Executor, DebugWriter: req.DebugWriter, DebugRef: &debugRef,
+	})
+	outcome.ProfileID, outcome.BackendID, outcome.ModelName = execution.ProfileID, execution.BackendID, execution.ModelName
+	outcome.ValidationStatus = execution.ValidationStatus
+	outcome.LLMDebugPath = execution.LLMDebugPath
+	if err != nil {
+		outcome.canceled = cancellationError(err)
+		safe := comparisonSafeExecutionError(err)
+		outcome.Error = &safe
+		return outcome
+	}
+	reportPath, err := comparison.ReportFilename(position, len(req.Inspection.Profiles), profile.ProfileID)
+	if err != nil {
+		safe := comparison.NewSafeError("application", "derive comparison report filename failed")
+		outcome.Error = &safe
+		return outcome
+	}
+	outcome.Status = comparison.StatusSucceeded
+	outcome.ReportPath = reportPath
+	outcome.Markdown = append([]byte(nil), markdown...)
+	return outcome
+}
+
+func comparisonDebugRunID(comparisonID string, position, profileCount int, profileID string) string {
+	return fmt.Sprintf("%s_%0*d-%s", comparisonID, comparison.OrdinalWidth(profileCount), position, comparison.ProfileSlug(profileID))
+}
+
+func markCanceledComparisonOutcome(outcome *comparisonProfileOutcome, err error) {
+	outcome.Status = comparison.StatusFailed
+	outcome.ValidationStatus = promptexec.ValidationSkipped
+	outcome.ReportPath = ""
+	outcome.Markdown = nil
+	safe := comparisonSafeExecutionError(err)
+	outcome.Error = &safe
+}
+
+func cancellationError(err error) bool {
+	category := promptexec.CategoryOf(err)
+	return errors.Is(err, context.Canceled) || errors.Is(err, context.DeadlineExceeded) ||
+		category == promptexec.Canceled || category == promptexec.DeadlineExceeded
+}
+
+func comparisonSafeExecutionError(err error) comparison.SafeError {
+	category := promptexec.CategoryOf(err)
+	if category == "" {
+		switch {
+		case errors.Is(err, context.Canceled):
+			category = promptexec.Canceled
+		case errors.Is(err, context.DeadlineExceeded):
+			category = promptexec.DeadlineExceeded
+		}
+	}
+	if category == "" {
+		return comparison.NewSafeError("application", comparisonExecutionMessage(err))
+	}
+	return comparison.NewSafeError(string(category), comparisonExecutionMessage(err))
+}
+
+func comparisonExecutionMessage(err error) string {
+	if errors.Is(err, context.Canceled) {
+		return "profile execution canceled"
+	}
+	if errors.Is(err, context.DeadlineExceeded) {
+		return "profile execution deadline exceeded"
+	}
+	var execution *profileExecutionError
+	if errors.As(err, &execution) {
+		return comparison.TruncateErrorMessage(execution.operation + " failed")
+	}
+	return "profile execution failed"
+}

internal/app/comparison_execution_test.go

@@ -0,0 +1,320 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"fmt"
+	"os"
+	"path/filepath"
+	"reflect"
+	"sync"
+	"testing"
+	"time"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptdebug"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
+)
+
+func TestExecuteComparisonProfilesRunsOrderedProfilesConcurrently(t *testing.T) {
+	prepared, prompt := preparedDailyProfile(t)
+	profiles := comparisonProfiles(10)
+	executor := newBarrierExecutor(profiles)
+	results := startComparisonExecution(t, context.Background(), comparisonExecutionRequest{
+		Prepared: prepared, Inspection: comparisonInspection(prompt, profiles), ComparisonID: "comparison_daily", Executor: executor,
+	}, executor)
+	waitForProfileStarts(t, executor, profiles, results)
+	if executor.maximumInFlight() < 2 {
+		t.Fatalf("maximum in-flight executions = %d, want overlap", executor.maximumInFlight())
+	}
+	for index := len(profiles) - 1; index >= 0; index-- {
+		executor.release(profiles[index].ProfileID)
+	}
+	result := <-results
+	if result.Canceled || len(result.Outcomes) != len(profiles) {
+		t.Fatalf("result = %#v", result)
+	}
+	for index, profile := range profiles {
+		outcome := result.Outcomes[index]
+		wantPath, err := comparison.ReportFilename(index+1, len(profiles), profile.ProfileID)
+		if err != nil {
+			t.Fatal(err)
+		}
+		if outcome.Position != index+1 || outcome.ProfileID != profile.ProfileID || outcome.Status != comparison.StatusSucceeded || outcome.ValidationStatus != promptexec.ValidationPassed || outcome.ReportPath != wantPath || len(outcome.Markdown) == 0 || outcome.Error != nil {
+			t.Fatalf("outcome[%d] = %#v", index, outcome)
+		}
+		request, ok := executor.request(profile.ProfileID)
+		if !ok || request.PromptVersion != prompt.PromptVersion || !bytesEqual(request.DataPackage, prepared.dataPackage) {
+			t.Fatalf("request for %q = %#v, want prompt version %q and shared data package", profile.ProfileID, request, prompt.PromptVersion)
+		}
+	}
+}
+
+func TestExecuteComparisonProfilesContinuesAfterProfileFailure(t *testing.T) {
+	prepared, prompt := preparedDailyProfile(t)
+	profiles := comparisonProfiles(3)
+	executor := newBarrierExecutor(profiles)
+	executor.setError(profiles[1].ProfileID, errors.New("provider response body must not escape"))
+	results := startComparisonExecution(t, context.Background(), comparisonExecutionRequest{
+		Prepared: prepared, Inspection: comparisonInspection(prompt, profiles), ComparisonID: "comparison_daily", Executor: executor,
+	}, executor)
+	waitForProfileStarts(t, executor, profiles, results)
+	for _, profile := range profiles {
+		executor.release(profile.ProfileID)
+	}
+	result := <-results
+	if result.Canceled || result.Outcomes[0].Status != comparison.StatusSucceeded || result.Outcomes[1].Status != comparison.StatusFailed || result.Outcomes[2].Status != comparison.StatusSucceeded {
+		t.Fatalf("outcomes = %#v", result.Outcomes)
+	}
+	failure := result.Outcomes[1]
+	if failure.Error == nil || failure.Error.Category != string(promptexec.Generation) || failure.Error.Message != "execute prompt failed" || failure.ReportPath != "" || len(failure.Markdown) != 0 {
+		t.Fatalf("failure outcome = %#v", failure)
+	}
+}
+
+func TestExecuteComparisonProfilesPropagatesCancellationAndJoins(t *testing.T) {
+	prepared, prompt := preparedDailyProfile(t)
+	profiles := comparisonProfiles(4)
+	executor := newBarrierExecutor(profiles)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	results := startComparisonExecution(t, ctx, comparisonExecutionRequest{
+		Prepared: prepared, Inspection: comparisonInspection(prompt, profiles), ComparisonID: "comparison_daily", Executor: executor,
+	}, executor)
+	waitForProfileStarts(t, executor, profiles, results)
+	cancel()
+	result := <-results
+	if !result.Canceled || executor.inFlightCount() != 0 {
+		t.Fatalf("result/in-flight = %#v/%d", result, executor.inFlightCount())
+	}
+	for _, outcome := range result.Outcomes {
+		if outcome.Status != comparison.StatusFailed || outcome.Error == nil || outcome.Error.Category != string(promptexec.Canceled) || outcome.ValidationStatus != promptexec.ValidationSkipped || outcome.ReportPath != "" || len(outcome.Markdown) != 0 {
+			t.Fatalf("canceled outcome = %#v", outcome)
+		}
+	}
+}
+
+func TestExecuteComparisonProfilesUsesDistinctDeterministicDebugReferences(t *testing.T) {
+	prepared, prompt := preparedDailyProfile(t)
+	profiles := []ComparisonProfileInspection{
+		{ProfileID: "light.one", BackendID: "local", ModelName: "light"},
+		{ProfileID: "deep/two", BackendID: "cloud", ModelName: "deep"},
+	}
+	debugWriter, err := promptdebug.NewPromptDebugWriter(t.TempDir())
+	if errors.Is(err, promptdebug.ErrSecureCaptureUnsupported) {
+		t.Skipf("secure prompt debug capture is unavailable: %v", err)
+	}
+	if err != nil {
+		t.Fatalf("NewPromptDebugWriter() error = %v", err)
+	}
+	executor := newBarrierExecutor(profiles)
+	results := startComparisonExecution(t, context.Background(), comparisonExecutionRequest{
+		Prepared: prepared, Inspection: comparisonInspection(prompt, profiles), ComparisonID: "comparison_daily", DebugWriter: debugWriter, Executor: executor,
+	}, executor)
+	waitForProfileStarts(t, executor, profiles, results)
+	for _, profile := range profiles {
+		executor.release(profile.ProfileID)
+	}
+	result := <-results
+	paths := map[string]struct{}{}
+	for index, outcome := range result.Outcomes {
+		wantName := fmt.Sprintf("comparison_daily_%0*d-%s", comparison.OrdinalWidth(len(profiles)), index+1, comparison.ProfileSlug(outcome.ProfileID))
+		if filepath.Base(outcome.LLMDebugPath) != wantName {
+			t.Fatalf("debug path = %q, want base %q", outcome.LLMDebugPath, wantName)
+		}
+		if _, err := os.Stat(filepath.Join(outcome.LLMDebugPath, "preparation.json")); err != nil {
+			t.Fatalf("preparation artifact %q: %v", outcome.LLMDebugPath, err)
+		}
+		paths[outcome.LLMDebugPath] = struct{}{}
+	}
+	if len(paths) != len(profiles) {
+		t.Fatalf("debug paths = %#v", paths)
+	}
+}
+
+type barrierExecutor struct {
+	mu               sync.Mutex
+	started          chan string
+	callbackFailures chan error
+	releases         map[string]chan struct{}
+	requests         map[string]promptexec.ExecuteRequest
+	errors           map[string]error
+	profiles         map[string]ComparisonProfileInspection
+	inFlight         int
+	maximum          int
+}
+
+func newBarrierExecutor(profiles []ComparisonProfileInspection) *barrierExecutor {
+	releases := make(map[string]chan struct{}, len(profiles))
+	identities := make(map[string]ComparisonProfileInspection, len(profiles))
+	for _, profile := range profiles {
+		releases[profile.ProfileID] = make(chan struct{})
+		identities[profile.ProfileID] = profile
+	}
+	return &barrierExecutor{
+		started: make(chan string, len(profiles)), callbackFailures: make(chan error, len(profiles)), releases: releases,
+		requests: make(map[string]promptexec.ExecuteRequest, len(profiles)), errors: map[string]error{}, profiles: identities,
+	}
+}
+
+func (e *barrierExecutor) InspectPrompt(context.Context, string, string) (promptexec.PromptInspection, error) {
+	return promptexec.PromptInspection{}, errors.New("unexpected prompt inspection")
+}
+
+func (e *barrierExecutor) InspectProfile(context.Context, string) (promptexec.ProfileInspection, error) {
+	return promptexec.ProfileInspection{}, errors.New("unexpected profile inspection")
+}
+
+func (e *barrierExecutor) Execute(ctx context.Context, req promptexec.ExecuteRequest, callback promptexec.PreparationCallback) (*promptexec.Execution, error) {
+	stamp := time.Date(2026, 5, 29, 15, 0, 0, 0, time.UTC)
+	e.mu.Lock()
+	profile := e.profiles[req.ProfileID]
+	e.mu.Unlock()
+	if err := callback(promptexec.Preparation{PromptID: req.PromptID, PromptVersion: req.PromptVersion, PromptHash: generationPromptHash, ProfileID: req.ProfileID, BackendID: profile.BackendID, ModelName: profile.ModelName, Output: promptexec.OutputContract{Format: "json", ValidationMode: "json_schema", SchemaPath: generationDefinitionForPrompt(req.PromptID).GeneratedTextSchemaID + ".generated_text.schema.json"}, StartedAt: stamp, EndedAt: stamp}, nil); err != nil {
+		e.callbackFailures <- err
+		return nil, err
+	}
+	e.mu.Lock()
+	e.requests[req.ProfileID] = promptexec.ExecuteRequest{PromptID: req.PromptID, PromptVersion: req.PromptVersion, ProfileID: req.ProfileID, DataPackage: append([]byte(nil), req.DataPackage...), CaptureDebug: req.CaptureDebug}
+	e.inFlight++
+	if e.inFlight > e.maximum {
+		e.maximum = e.inFlight
+	}
+	release := e.releases[req.ProfileID]
+	e.mu.Unlock()
+	e.started <- req.ProfileID
+	select {
+	case <-release:
+	case <-ctx.Done():
+		e.mu.Lock()
+		e.inFlight--
+		e.mu.Unlock()
+		return nil, ctx.Err()
+	}
+	e.mu.Lock()
+	e.inFlight--
+	err := e.errors[req.ProfileID]
+	e.mu.Unlock()
+	if err != nil {
+		return nil, err
+	}
+	return &promptexec.Execution{
+		PromptID: req.PromptID, PromptVersion: req.PromptVersion, PromptHash: generationPromptHash,
+		ProfileID: req.ProfileID, BackendID: profile.BackendID, ModelName: profile.ModelName,
+		StartedAt: stamp, EndedAt: stamp, RawOutput: comparisonRawOutput(),
+		Validation: promptexec.NewValidation(promptexec.ValidationPassed, "json_schema", generationDefinitionForPrompt(req.PromptID).GeneratedTextSchemaID+".generated_text.schema.json", nil),
+	}, nil
+}
+
+func (e *barrierExecutor) request(profileID string) (promptexec.ExecuteRequest, bool) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	request, ok := e.requests[profileID]
+	return request, ok
+}
+
+func (e *barrierExecutor) setError(profileID string, err error) {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	e.errors[profileID] = err
+}
+
+func (e *barrierExecutor) release(profileID string) {
+	close(e.releases[profileID])
+}
+
+func (e *barrierExecutor) releaseAll() {
+	for _, release := range e.releases {
+		select {
+		case <-release:
+		default:
+			close(release)
+		}
+	}
+}
+
+func (e *barrierExecutor) maximumInFlight() int {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return e.maximum
+}
+
+func (e *barrierExecutor) inFlightCount() int {
+	e.mu.Lock()
+	defer e.mu.Unlock()
+	return e.inFlight
+}
+
+const comparisonExecutionTestTimeout = 5 * time.Second
+
+func startComparisonExecution(t *testing.T, ctx context.Context, request comparisonExecutionRequest, executor *barrierExecutor) <-chan comparisonExecutionResult {
+	t.Helper()
+	results := make(chan comparisonExecutionResult, 1)
+	finished := make(chan struct{})
+	t.Cleanup(func() {
+		executor.releaseAll()
+		timeout := time.NewTimer(comparisonExecutionTestTimeout)
+		defer timeout.Stop()
+		select {
+		case <-finished:
+		case <-timeout.C:
+			t.Error("comparison execution workers did not finish after release")
+		}
+	})
+	go func() {
+		defer close(finished)
+		results <- executeComparisonProfiles(ctx, request)
+	}()
+	return results
+}
+
+func waitForProfileStarts(t *testing.T, executor *barrierExecutor, profiles []ComparisonProfileInspection, results <-chan comparisonExecutionResult) {
+	t.Helper()
+	timeout := time.NewTimer(comparisonExecutionTestTimeout)
+	defer timeout.Stop()
+	seen := map[string]struct{}{}
+	for range profiles {
+		var profileID string
+		select {
+		case profileID = <-executor.started:
+		case err := <-executor.callbackFailures:
+			executor.releaseAll()
+			select {
+			case result := <-results:
+				t.Fatalf("comparison profile preparation failed before executor entry: %v; result: %#v", err, result)
+			case <-timeout.C:
+				t.Fatalf("comparison profile preparation failed before executor entry: %v; comparison did not finish", err)
+			}
+		case result := <-results:
+			t.Fatalf("comparison completed before all profiles started: %#v", result)
+		case <-timeout.C:
+			t.Fatal("timed out waiting for comparison profile starts")
+		}
+		if _, duplicate := seen[profileID]; duplicate {
+			t.Fatalf("duplicate execution start for %q", profileID)
+		}
+		seen[profileID] = struct{}{}
+	}
+}
+
+func comparisonProfiles(count int) []ComparisonProfileInspection {
+	profiles := make([]ComparisonProfileInspection, 0, count)
+	for index := 1; index <= count; index++ {
+		profiles = append(profiles, ComparisonProfileInspection{ProfileID: fmt.Sprintf("profile.%02d", index), BackendID: "backend", ModelName: "model"})
+	}
+	return profiles
+}
+
+func comparisonInspection(prompt PromptInspectionResult, profiles []ComparisonProfileInspection) ComparisonInspectionResult {
+	return ComparisonInspectionResult{PromptID: prompt.PromptID, PromptVersion: prompt.PromptVersion, PromptHash: prompt.PromptHash, Profiles: profiles}
+}
+
+func comparisonRawOutput() []byte {
+	return []byte(`{"summary":"Showers are possible during the selected day.","forecast_discussion":["A front will keep rain chances in the forecast."],"precipitation_timing":"Rain is most likely during the afternoon."}`)
+}
+
+func bytesEqual(left, right []byte) bool {
+	return reflect.DeepEqual(left, right)
+}
+
+var _ promptexec.Executor = (*barrierExecutor)(nil)

internal/app/comparison_test.go

@@ -0,0 +1,399 @@
+package app
+
+import (
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"testing"
+	"time"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/timeutil"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
+)
+
+func TestCompareDetailedPublishesOneCoherentBundle(t *testing.T) {
+	cfg := comparisonConfig()
+	bundle := generationBundle(t)
+	workingDir := t.TempDir()
+	executor := &generationExecutor{}
+	inspectedBeforeCollection := false
+	result, err := CompareDetailed(context.Background(), ComparisonRequest{
+		Config: cfg, Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep"},
+		WorkingDir: workingDir, Date: generationTime("2026-05-29T12:00:00-05:00"),
+		Clock: timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")},
+		Collector: &generationCollector{bundle: &bundle, beforeRun: func() {
+			inspectedBeforeCollection = executor.promptInspections == 1 && executor.profileInspections == 2
+		}}, Executor: executor,
+	})
+	if err != nil {
+		t.Fatalf("CompareDetailed() error = %v", err)
+	}
+	if result == nil || result.Total != 2 || result.Succeeded != 2 || result.Failed != 0 || executor.promptInspections != 1 || executor.profileInspections != 2 || executor.executeCalls != 2 || !inspectedBeforeCollection || result.ManifestPath == "" || result.DataPackagePath == "" {
+		t.Fatalf("result/executor = %#v/%#v", result, executor)
+	}
+	if result.OutputDirectory != filepath.Dir(result.ManifestPath) || !filepath.IsAbs(result.ManifestPath) || !filepath.IsAbs(result.DataPackagePath) {
+		t.Fatalf("published paths = %#v", result)
+	}
+	for index, profile := range result.Results {
+		if profile.Position != index+1 || profile.Status != comparison.StatusSucceeded || !filepath.IsAbs(profile.ReportPath) || profile.Error != nil {
+			t.Fatalf("profile result = %#v", profile)
+		}
+	}
+	data, readErr := os.ReadFile(result.ManifestPath)
+	if readErr != nil {
+		t.Fatal(readErr)
+	}
+	var manifest comparison.Manifest
+	if err := json.Unmarshal(data, &manifest); err != nil {
+		t.Fatal(err)
+	}
+	if manifest.ComparisonID != result.ComparisonID || manifest.Total != result.Total || manifest.Succeeded != result.Succeeded || manifest.DataPackage.SHA256 == "" || len(manifest.Results) != 2 {
+		t.Fatalf("manifest = %#v", manifest)
+	}
+	if manifest.Results[0].ReportPath != filepath.Base(result.Results[0].ReportPath) || manifest.Results[1].ReportPath != filepath.Base(result.Results[1].ReportPath) {
+		t.Fatalf("manifest report paths = %#v", manifest.Results)
+	}
+}
+
+func TestCompareDetailedPublishesPartialBundleAndReturnsAggregateError(t *testing.T) {
+	cfg := comparisonConfig()
+	bundle := generationBundle(t)
+	executor := &generationExecutor{executeErrors: map[string]error{"weather-deep": errors.New("provider detail must not escape")}}
+	result, err := CompareDetailed(context.Background(), ComparisonRequest{
+		Config: cfg, Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep", "weather-fallback"},
+		WorkingDir: t.TempDir(), Date: generationTime("2026-05-29T12:00:00-05:00"),
+		Clock:     timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")},
+		Collector: &generationCollector{bundle: &bundle}, Executor: executor,
+	})
+	if err == nil || err.Error() != "comparison completed with 1 failed profiles" || result == nil || result.Total != 3 || result.Succeeded != 2 || result.Failed != 1 {
+		t.Fatalf("CompareDetailed() result/error = %#v/%v", result, err)
+	}
+	failure := result.Results[1]
+	if failure.Status != comparison.StatusFailed || failure.ReportPath != "" || failure.Error == nil || strings.Contains(failure.Error.Message, "provider detail") {
+		t.Fatalf("failure = %#v", failure)
+	}
+	if _, statErr := os.Stat(result.ManifestPath); statErr != nil {
+		t.Fatalf("partial manifest: %v", statErr)
+	}
+	if _, statErr := os.Stat(filepath.Join(result.OutputDirectory, filepath.Base(result.Results[0].ReportPath))); statErr != nil {
+		t.Fatalf("successful partial report: %v", statErr)
+	}
+}
+
+func TestCompareDetailedRetainsCommittedPathsWhenBackupCleanupFails(t *testing.T) {
+	for _, test := range []struct {
+		name  string
+		state comparison.BackupRecoveryState
+		path  bool
+	}{
+		{name: "complete recovery bundle", state: comparison.BackupRecoveryComplete, path: true},
+		{name: "partial remnants", state: comparison.BackupRecoveryPartial, path: true},
+		{name: "absent backup", state: comparison.BackupRecoveryAbsent},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			bundle := generationBundle(t)
+			recoveryPath := ""
+			if test.path {
+				recoveryPath = filepath.Join(t.TempDir(), ".comparison-daily.backup-recovery")
+			}
+			cleanupCause := errors.New("backup cleanup failed")
+			publish := func(context.Context, comparison.DestinationPlan, comparison.LogicalBundle) (comparison.PublicationResult, error) {
+				return comparison.PublicationResult{Committed: true, RecoveryState: test.state, RecoveryPath: recoveryPath}, &comparison.PublicationCleanupError{RecoveryState: test.state, RecoveryPath: recoveryPath, Err: cleanupCause}
+			}
+
+			result, err := compareDetailed(context.Background(), ComparisonRequest{
+				Config: comparisonConfig(), Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep"},
+				WorkingDir: t.TempDir(), Date: generationTime("2026-05-29T12:00:00-05:00"),
+				Clock:     timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")},
+				Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{},
+			}, publish)
+			var cleanupErr *comparison.PublicationCleanupError
+			if result == nil || !errors.As(err, &cleanupErr) || !errors.Is(err, cleanupCause) || cleanupErr.RecoveryState != test.state || cleanupErr.RecoveryPath != recoveryPath || !filepath.IsAbs(result.ManifestPath) || !filepath.IsAbs(result.DataPackagePath) {
+				t.Fatalf("CompareDetailed() result/error = %#v/%v", result, err)
+			}
+			for _, profile := range result.Results {
+				if profile.Status == comparison.StatusSucceeded && !filepath.IsAbs(profile.ReportPath) {
+					t.Fatalf("published profile result = %#v", profile)
+				}
+			}
+		})
+	}
+}
+
+func TestCompareDetailedPreflightsBeforePromptOrCollection(t *testing.T) {
+	invalidDestination := filepath.Join(t.TempDir(), "not-a-directory")
+	if err := os.WriteFile(invalidDestination, []byte("x"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	bundle := generationBundle(t)
+	collector := &generationCollector{bundle: &bundle}
+	executor := &generationExecutor{}
+	result, err := CompareDetailed(context.Background(), ComparisonRequest{
+		Config: comparisonConfig(), Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep"},
+		WorkingDir: t.TempDir(), OutputDir: invalidDestination, Date: generationTime("2026-05-29T12:00:00-05:00"),
+		Clock: timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")}, Collector: collector, Executor: executor,
+	})
+	if err == nil || result == nil || collector.called || executor.promptInspections != 0 || executor.executeCalls != 0 || result.ManifestPath != "" {
+		t.Fatalf("result/error/collector/executor = %#v/%v/%#v/%#v", result, err, collector, executor)
+	}
+}
+
+func TestCompareDetailedFinalizesUnpublishedFailures(t *testing.T) {
+	for _, test := range []struct {
+		name           string
+		prepare        func(t *testing.T, outputDirectory string)
+		debugDir       string
+		executor       *generationExecutor
+		collector      *generationCollector
+		wantPrompt     bool
+		wantCollection bool
+	}{
+		{
+			name: "destination preflight",
+			prepare: func(t *testing.T, outputDirectory string) {
+				t.Helper()
+				if err := os.WriteFile(outputDirectory, []byte("not a directory"), 0o600); err != nil {
+					t.Fatal(err)
+				}
+			},
+			executor: &generationExecutor{},
+		},
+		{
+			name:      "debug initialization",
+			debugDir:  "relative-debug-directory",
+			executor:  &generationExecutor{},
+			collector: &generationCollector{},
+		},
+		{
+			name:       "prompt preflight",
+			executor:   &generationExecutor{inspectErr: promptexec.NewError(promptexec.PromptLoad, "unsafe prompt detail", errors.New("unsafe cause"))},
+			collector:  &generationCollector{},
+			wantPrompt: false,
+		},
+		{
+			name: "profile preflight",
+			executor: &generationExecutor{profileInspectErrors: map[string]error{
+				"weather-deep": promptexec.NewError(promptexec.MissingCredential, "profile credential is unavailable", errors.New("unsafe cause")),
+			}},
+			collector:  &generationCollector{},
+			wantPrompt: true,
+		},
+		{
+			name:           "collection",
+			executor:       &generationExecutor{},
+			collector:      &generationCollector{err: errors.New("collection failed")},
+			wantPrompt:     true,
+			wantCollection: true,
+		},
+		{
+			name:           "preparation",
+			executor:       &generationExecutor{},
+			collector:      &generationCollector{bundle: &weatherdata.Bundle{}},
+			wantPrompt:     true,
+			wantCollection: true,
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			workingDirectory := t.TempDir()
+			outputDirectory := filepath.Join(workingDirectory, "comparison-output")
+			if test.prepare != nil {
+				test.prepare(t, outputDirectory)
+			}
+			collector := test.collector
+			if collector == nil {
+				bundle := generationBundle(t)
+				collector = &generationCollector{bundle: &bundle}
+			}
+			result, err := CompareDetailed(context.Background(), ComparisonRequest{
+				Config: comparisonConfig(), Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep"},
+				WorkingDir: workingDirectory, OutputDir: outputDirectory, LLMDebugDir: test.debugDir,
+				Date: generationTime("2026-05-29T12:00:00-05:00"), Clock: timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")},
+				Collector: collector, Executor: test.executor,
+			})
+			if err == nil {
+				t.Fatal("CompareDetailed() error = nil")
+			}
+			assertUnpublishedComparisonResult(t, result, outputDirectory)
+			if (result.PromptID != "") != test.wantPrompt || (result.PromptHash != "") != test.wantPrompt {
+				t.Fatalf("prompt identity = %q/%q, want resolved=%t", result.PromptID, result.PromptHash, test.wantPrompt)
+			}
+			if collector.called != test.wantCollection || test.executor.executeCalls != 0 {
+				t.Fatalf("collection/execution = %t/%d, want collection=%t and no execution", collector.called, test.executor.executeCalls, test.wantCollection)
+			}
+		})
+	}
+}
+
+func TestCompareDetailedLeavesDestinationWhenCollectionOrPreparationFails(t *testing.T) {
+	collectionErr := errors.New("weather collection failed")
+	for _, test := range []struct {
+		name      string
+		collector *generationCollector
+	}{
+		{name: "collection", collector: &generationCollector{err: collectionErr}},
+		{name: "preparation", collector: &generationCollector{bundle: &weatherdata.Bundle{}}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			workingDir := t.TempDir()
+			executor := &generationExecutor{}
+			result, err := CompareDetailed(context.Background(), ComparisonRequest{
+				Config: comparisonConfig(), Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep"},
+				WorkingDir: workingDir, Date: generationTime("2026-05-29T12:00:00-05:00"),
+				Clock: timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")}, Collector: test.collector, Executor: executor,
+			})
+			if err == nil || result == nil || executor.executeCalls != 0 || result.ManifestPath != "" || result.DataPackagePath != "" {
+				t.Fatalf("CompareDetailed() result/error/executor = %#v/%v/%#v", result, err, executor)
+			}
+			if _, statErr := os.Stat(filepath.Join(workingDir, "comparison-daily-2026-05-29")); !os.IsNotExist(statErr) {
+				t.Fatalf("comparison destination stat error = %v", statErr)
+			}
+		})
+	}
+}
+
+func TestCompareDetailedPublishesManifestWhenEveryProfileFails(t *testing.T) {
+	bundle := generationBundle(t)
+	executor := &generationExecutor{executeErrors: map[string]error{
+		"weather-light": errors.New("first provider failure"), "weather-deep": errors.New("second provider failure"),
+	}}
+	result, err := CompareDetailed(context.Background(), ComparisonRequest{
+		Config: comparisonConfig(), Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep"},
+		WorkingDir: t.TempDir(), Date: generationTime("2026-05-29T12:00:00-05:00"),
+		Clock:     timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")},
+		Collector: &generationCollector{bundle: &bundle}, Executor: executor,
+	})
+	if err == nil || err.Error() != "comparison completed with 2 failed profiles" || result == nil || result.Succeeded != 0 || result.Failed != 2 || result.ManifestPath == "" {
+		t.Fatalf("CompareDetailed() result/error = %#v/%v", result, err)
+	}
+	for _, profile := range result.Results {
+		if profile.ReportPath != "" || profile.Error == nil {
+			t.Fatalf("failed profile = %#v", profile)
+		}
+	}
+}
+
+func TestCompareDetailedCancellationPreservesPublishedBundle(t *testing.T) {
+	workingDir := t.TempDir()
+	bundle := generationBundle(t)
+	request := ComparisonRequest{
+		Config: comparisonConfig(), Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep"},
+		WorkingDir: workingDir, Date: generationTime("2026-05-29T12:00:00-05:00"),
+		Clock: timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")}, Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{},
+	}
+	previous, err := CompareDetailed(context.Background(), request)
+	if err != nil {
+		t.Fatalf("initial CompareDetailed() error = %v", err)
+	}
+	before, err := os.ReadFile(previous.ManifestPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	ctx, cancel := context.WithCancel(context.Background())
+	request.Replace = true
+	request.Executor = &generationExecutor{cancelBeforeReturn: cancel}
+	result, err := CompareDetailed(ctx, request)
+	if !errors.Is(err, context.Canceled) || result == nil || result.ManifestPath != "" || result.DataPackagePath != "" {
+		t.Fatalf("canceled CompareDetailed() result/error = %#v/%v", result, err)
+	}
+	after, readErr := os.ReadFile(previous.ManifestPath)
+	if readErr != nil || string(after) != string(before) {
+		t.Fatalf("published manifest changed = %q, error = %v", after, readErr)
+	}
+}
+
+func TestCompareDetailedPreservesCompletedProfileFailureWhenCanceled(t *testing.T) {
+	bundle := generationBundle(t)
+	ctx, cancel := context.WithCancel(context.Background())
+	defer cancel()
+	failureStarted := make(chan struct{})
+	var signalFailure sync.Once
+	executor := &generationExecutor{
+		validations:         map[string]promptexec.ValidationStatus{"weather-light": promptexec.ValidationFailed},
+		waitForCancellation: map[string]bool{"weather-deep": true},
+		beforeExecute: func(request promptexec.ExecuteRequest) {
+			if request.ProfileID == "weather-light" {
+				signalFailure.Do(func() { close(failureStarted) })
+			}
+		},
+	}
+	results := make(chan struct {
+		result *ComparisonResult
+		err    error
+	}, 1)
+	go func() {
+		result, err := CompareDetailed(ctx, ComparisonRequest{
+			Config: comparisonConfig(), Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep"},
+			WorkingDir: t.TempDir(), Date: generationTime("2026-05-29T12:00:00-05:00"),
+			Clock:     timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")},
+			Collector: &generationCollector{bundle: &bundle}, Executor: executor,
+		})
+		results <- struct {
+			result *ComparisonResult
+			err    error
+		}{result: result, err: err}
+	}()
+
+	select {
+	case <-failureStarted:
+		cancel()
+	case <-time.After(5 * time.Second):
+		t.Fatal("timed out waiting for the completed profile failure")
+	}
+	completed := <-results
+	if !errors.Is(completed.err, context.Canceled) || completed.result == nil || completed.result.ManifestPath != "" || completed.result.DataPackagePath != "" || completed.result.Succeeded != 0 || completed.result.Failed != 2 {
+		t.Fatalf("CompareDetailed() result/error = %#v/%v", completed.result, completed.err)
+	}
+	failed, canceled := completed.result.Results[0], completed.result.Results[1]
+	if failed.Error == nil || failed.Error.Category != string(promptexec.ValidationRejected) || failed.ValidationStatus != promptexec.ValidationFailed || failed.ReportPath != "" {
+		t.Fatalf("completed failure = %#v", failed)
+	}
+	if canceled.Error == nil || canceled.Error.Category != string(promptexec.Canceled) || canceled.ValidationStatus != promptexec.ValidationSkipped || canceled.ReportPath != "" {
+		t.Fatalf("canceled profile = %#v", canceled)
+	}
+}
+
+func TestCompareDetailedLeavesExistingBundleWhenPublicationPreflightChanges(t *testing.T) {
+	workingDir := t.TempDir()
+	target := filepath.Join(workingDir, "comparison-output")
+	bundle := generationBundle(t)
+	executor := &generationExecutor{beforeExecute: func(promptexec.ExecuteRequest) {
+		_ = os.WriteFile(target, []byte("changed"), 0o600)
+	}}
+	result, err := CompareDetailed(context.Background(), ComparisonRequest{
+		Config: comparisonConfig(), Report: ReportDaily, ProfileIDs: []string{"weather-light", "weather-deep"},
+		WorkingDir: workingDir, OutputDir: target, Date: generationTime("2026-05-29T12:00:00-05:00"),
+		Clock: timeutil.FixedClock{Time: generationTime("2026-05-29T08:30:00-05:00")}, Collector: &generationCollector{bundle: &bundle}, Executor: executor,
+	})
+	if err == nil || result == nil || result.ManifestPath != "" || result.DataPackagePath != "" || result.Results[0].ReportPath != "" {
+		t.Fatalf("CompareDetailed() result/error = %#v/%v", result, err)
+	}
+	data, readErr := os.ReadFile(target)
+	if readErr != nil || string(data) != "changed" {
+		t.Fatalf("destination = %q, error = %v", data, readErr)
+	}
+}
+
+func comparisonConfig() config.Config {
+	cfg := config.Defaults()
+	cfg.WeatherAPI.Timezone, cfg.Location.ID = "America/Chicago", "home"
+	return cfg
+}
+
+func assertUnpublishedComparisonResult(t *testing.T, result *ComparisonResult, outputDirectory string) {
+	t.Helper()
+	if result == nil || result.OutputDirectory != outputDirectory || !filepath.IsAbs(result.OutputDirectory) || result.FinishedAt.IsZero() || result.FinishedAt.Location() != time.UTC || result.FinishedAt.Before(result.StartedAt) || result.ManifestPath != "" || result.DataPackagePath != "" {
+		t.Fatalf("unpublished comparison result = %#v", result)
+	}
+	for _, profile := range result.Results {
+		if profile.ReportPath != "" {
+			t.Fatalf("unpublished profile result = %#v", profile)
+		}
+	}
+}

internal/app/distributor_notification_test.go

@@ -0,0 +1,45 @@
+package app
+
+import (
+	"errors"
+	"strings"
+	"testing"
+
+	distributoradapter "gitea.maximumdirect.net/eric/weatherreporter/internal/adapters/distributor"
+)
+
+func TestNotificationResultFromUploadExcludesRemoteResponseDetails(t *testing.T) {
+	const remote = "REMOTE-DIAGNOSTIC"
+	notification := notificationResultFromUpload("weather", "bundle", "key", distributoradapter.UploadResult{
+		RunID: "run-123", Status: "failed", UploadStatus: "accepted", StatusError: remote,
+		RunStatus: &distributoradapter.RunStatus{PipelineID: "weather", Status: "failed", Report: []byte(`{"detail":"REMOTE-DIAGNOSTIC"}`), Error: remote},
+	})
+	if notification == nil || notification.StatusError != "distributor status could not be confirmed" || notification.Error != "distributor reported a failed run" || len(notification.Report) != 0 {
+		t.Fatalf("notification = %#v", notification)
+	}
+	if strings.Contains(notification.StatusError, remote) || strings.Contains(notification.Error, remote) {
+		t.Fatalf("notification includes remote detail: %#v", notification)
+	}
+}
+
+func TestBatchNotificationResultExcludesRemoteResponseDetails(t *testing.T) {
+	const remote = "REMOTE-DIAGNOSTIC"
+	notification := batchNotificationResult(batchNotificationRequest{PipelineID: "weather", BundleID: "bundle", IdempotencyKey: "key"}, &NotificationResult{Status: "failed", Error: remote})
+	if notification == nil || notification.Error != "distributor reported a failed run" {
+		t.Fatalf("notification = %#v", notification)
+	}
+	if strings.Contains(notification.Error, remote) {
+		t.Fatalf("notification includes remote detail: %#v", notification)
+	}
+}
+
+func TestFailedBatchNotificationResultExcludesRemoteResponseDetails(t *testing.T) {
+	const remote = "REMOTE-DIAGNOSTIC"
+	notification := failedBatchNotificationResult(batchNotificationRequest{PipelineID: "weather", BundleID: "bundle", IdempotencyKey: "key"}, errors.New(remote))
+	if notification == nil || notification.Error != "distributor notification failed" {
+		t.Fatalf("notification = %#v", notification)
+	}
+	if strings.Contains(notification.Error, remote) {
+		t.Fatalf("notification includes remote detail: %#v", notification)
+	}
+}

internal/app/generation_test.go

@@ -6,13 +6,17 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strings"
+	"sync"
 	"testing"
 	"time"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/collect"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptdebug"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/testutil"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
 )
 
@@ -20,65 +24,153 @@ type generationCollector struct {
 	bundle    *weatherdata.Bundle
 	err       error
 	called    bool
+	calls     int
 	beforeRun func()
 }
 
+type publicationGateContext struct {
+	context.Context
+	err         error
+	checks      int
+	afterChecks int
+}
+
+func (c *publicationGateContext) Err() error {
+	c.checks++
+	afterChecks := c.afterChecks
+	if afterChecks == 0 {
+		afterChecks = 2
+	}
+	if c.checks >= afterChecks {
+		return c.err
+	}
+	return nil
+}
+
 func (c *generationCollector) Run(context.Context, collect.Request) (*collect.Result, error) {
 	if c.beforeRun != nil {
 		c.beforeRun()
 	}
 	c.called = true
+	c.calls++
 	return &collect.Result{Bundle: c.bundle}, c.err
 }
 
 type generationExecutor struct {
-	called             bool
-	promptInspections  int
-	inspectErr         error
-	executeErr         error
-	cancelBeforeReturn context.CancelFunc
-	validation         promptexec.ValidationStatus
-	rawOutput          []byte
-	failedPrompt       string
+	called               bool
+	executeCalls         int
+	promptInspections    int
+	profileInspections   int
+	inspectErr           error
+	profileInspectErrors map[string]error
+	executeErr           error
+	executeErrors        map[string]error
+	beforeExecute        func(promptexec.ExecuteRequest)
+	cancelBeforeReturn   context.CancelFunc
+	validation           promptexec.ValidationStatus
+	validations          map[string]promptexec.ValidationStatus
+	rawOutput            []byte
+	waitForCancellation  map[string]bool
+	failedPrompt         string
+	skipPreparation      bool
+	preparationCalls     int
+	prepare              func(*promptexec.Preparation)
+	complete             func(*promptexec.Execution)
 }
 
+var generationExecutorMu sync.Mutex
+
 func (e *generationExecutor) InspectPrompt(_ context.Context, id, version string) (promptexec.PromptInspection, error) {
+	generationExecutorMu.Lock()
+	defer generationExecutorMu.Unlock()
 	e.promptInspections++
 	if e.inspectErr != nil {
 		return promptexec.PromptInspection{}, e.inspectErr
 	}
 	definition := generationDefinitionForPrompt(id)
-	return promptexec.PromptInspection{PromptID: id, PromptVersion: version, PromptHash: "prompt-hash", DefaultProfileID: "fixture", Inputs: []promptexec.InputDefinition{{Name: "data_package", Required: true, ContentType: "application/yaml"}}, Output: promptexec.OutputContract{Format: "json", ValidationMode: "json_schema", SchemaPath: definition.GeneratedTextSchemaID + ".generated_text.schema.json"}}, nil
+	return promptexec.PromptInspection{PromptID: id, PromptVersion: version, PromptHash: generationPromptHash, DefaultProfileID: "fixture", Inputs: []promptexec.InputDefinition{{Name: "data_package", Required: true, ContentType: "application/yaml"}}, Output: promptexec.OutputContract{Format: "json", ValidationMode: "json_schema", SchemaPath: definition.GeneratedTextSchemaID + ".generated_text.schema.json"}}, nil
 }
-func (*generationExecutor) InspectProfile(_ context.Context, id string) (promptexec.ProfileInspection, error) {
+func (e *generationExecutor) InspectProfile(_ context.Context, id string) (promptexec.ProfileInspection, error) {
+	generationExecutorMu.Lock()
+	defer generationExecutorMu.Unlock()
+	e.profileInspections++
+	if err := e.profileInspectErrors[id]; err != nil {
+		return promptexec.ProfileInspection{}, err
+	}
 	return promptexec.ProfileInspection{ProfileID: id, BackendID: "fixture", ModelName: "fixture-model"}, nil
 }
-func (e *generationExecutor) Execute(_ context.Context, req promptexec.ExecuteRequest, callback promptexec.PreparationCallback) (*promptexec.Execution, error) {
+func (e *generationExecutor) Execute(ctx context.Context, req promptexec.ExecuteRequest, callback promptexec.PreparationCallback) (*promptexec.Execution, error) {
 	stamp := time.Date(2026, 5, 29, 15, 0, 0, 0, time.UTC)
-	if err := callback(promptexec.Preparation{PromptID: req.PromptID, PromptVersion: req.PromptVersion, PromptHash: "prompt-hash", RenderedPromptHash: "rendered-hash", ProfileID: req.ProfileID, BackendID: "fixture", ModelName: "fixture-model", StartedAt: stamp, EndedAt: stamp}, nil); err != nil {
-		return nil, err
+	generationExecutorMu.Lock()
+	skipPreparation := e.skipPreparation
+	prepare := e.prepare
+	preparationCalls := e.preparationCalls
+	generationExecutorMu.Unlock()
+	if !skipPreparation {
+		calls := preparationCalls
+		if calls == 0 {
+			calls = 1
+		}
+		for range calls {
+			preparation := promptexec.Preparation{PromptID: req.PromptID, PromptVersion: req.PromptVersion, PromptHash: generationPromptHash, RenderedPromptHash: "rendered-hash", ProfileID: req.ProfileID, BackendID: "fixture", ModelName: "fixture-model", Output: promptexec.OutputContract{Format: "json", ValidationMode: "json_schema", SchemaPath: generationDefinitionForPrompt(req.PromptID).GeneratedTextSchemaID + ".generated_text.schema.json"}, StartedAt: stamp, EndedAt: stamp}
+			if prepare != nil {
+				prepare(&preparation)
+			}
+			if err := callback(preparation, nil); err != nil {
+				return nil, err
+			}
+		}
 	}
+	generationExecutorMu.Lock()
 	e.called = true
-	if e.executeErr != nil {
-		return nil, e.executeErr
-	}
+	e.executeCalls++
+	beforeExecute := e.beforeExecute
+	profileErr := e.executeErrors[req.ProfileID]
+	executeErr := e.executeErr
 	status := e.validation
+	if profileStatus, ok := e.validations[req.ProfileID]; ok {
+		status = profileStatus
+	}
+	rawOutput := append([]byte(nil), e.rawOutput...)
+	waitForCancellation := e.waitForCancellation[req.ProfileID]
+	failedPrompt := e.failedPrompt
+	cancelBeforeReturn := e.cancelBeforeReturn
+	complete := e.complete
+	generationExecutorMu.Unlock()
+	if beforeExecute != nil {
+		beforeExecute(req)
+	}
+	if waitForCancellation {
+		<-ctx.Done()
+		return nil, ctx.Err()
+	}
+	if profileErr != nil {
+		return nil, profileErr
+	}
+	if executeErr != nil {
+		return nil, executeErr
+	}
 	if status == "" {
 		status = promptexec.ValidationPassed
 	}
-	if e.failedPrompt == req.PromptID {
+	if failedPrompt == req.PromptID {
 		status = promptexec.ValidationFailed
 	}
-	rawOutput := e.rawOutput
 	if rawOutput == nil {
 		rawOutput = []byte(`{"summary":"Showers are possible during the selected day.","forecast_discussion":["A front will keep rain chances in the forecast."],"precipitation_timing":"Rain is most likely during the afternoon."}`)
 	}
-	if e.cancelBeforeReturn != nil {
-		e.cancelBeforeReturn()
+	if cancelBeforeReturn != nil {
+		cancelBeforeReturn()
 	}
-	return &promptexec.Execution{RunID: "provider-run", PromptID: req.PromptID, PromptVersion: req.PromptVersion, PromptHash: "prompt-hash", RenderedPromptHash: "rendered-hash", ProfileID: req.ProfileID, BackendID: "fixture", ModelName: "fixture-model", StartedAt: stamp, EndedAt: stamp, RawOutput: rawOutput, Validation: promptexec.NewValidation(status, "json_schema", generationDefinitionForPrompt(req.PromptID).GeneratedTextSchemaID+".generated_text.schema.json", nil)}, nil
+	execution := &promptexec.Execution{RunID: "provider-run", PromptID: req.PromptID, PromptVersion: req.PromptVersion, PromptHash: generationPromptHash, RenderedPromptHash: "rendered-hash", ProfileID: req.ProfileID, BackendID: "fixture", ModelName: "fixture-model", StartedAt: stamp, EndedAt: stamp, RawOutput: rawOutput, Validation: promptexec.NewValidation(status, "json_schema", generationDefinitionForPrompt(req.PromptID).GeneratedTextSchemaID+".generated_text.schema.json", nil)}
+	if complete != nil {
+		complete(execution)
+	}
+	return execution, nil
 }
 
+const generationPromptHash = "0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef"
+
 func generationDefinitionForPrompt(promptID string) report.Definition {
 	for _, definition := range report.DefaultRegistry().All() {
 		if definition.PromptID == promptID {
@@ -93,12 +185,13 @@ func TestGenerateDetailedPublishesOnlySelectedOutput(t *testing.T) {
 	cfg.WeatherAPI.Timezone, cfg.Location.ID = "America/Chicago", "home"
 	bundle := generationBundle(t)
 	executor := &generationExecutor{}
+	collector := &generationCollector{bundle: &bundle}
 	workingDir := t.TempDir()
-	result, err := GenerateDetailed(context.Background(), GenerateRequest{Config: cfg, Report: ReportDaily, Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: workingDir, Collector: &generationCollector{bundle: &bundle}, Executor: executor})
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{Config: cfg, Report: ReportDaily, Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: workingDir, Collector: collector, Executor: executor})
 	if err != nil {
 		t.Fatalf("GenerateDetailed() error = %v", err)
 	}
-	if !executor.called || result.OutputPath != filepath.Join(workingDir, "daily-2026-05-29.md") || result.ValidationStatus != promptexec.ValidationPassed || result.ProfileID == "" || result.BackendID == "" || result.ModelName == "" {
+	if !executor.called || executor.executeCalls != 1 || collector.calls != 1 || result.OutputPath != filepath.Join(workingDir, "daily-2026-05-29.md") || result.ValidationStatus != promptexec.ValidationPassed || result.ProfileID == "" || result.BackendID == "" || result.ModelName == "" {
 		t.Fatalf("result = %#v", result)
 	}
 	if result.LLMDebugPath != "" {
@@ -113,6 +206,150 @@ func TestGenerateDetailedPublishesOnlySelectedOutput(t *testing.T) {
 	}
 }
 
+func TestGenerateDetailedUsesConfiguredOutputDirectory(t *testing.T) {
+	tests := []struct {
+		name      string
+		directory func(t *testing.T, workingDir string) string
+		wantDir   func(t *testing.T, workingDir string, configuredDir string) string
+	}{
+		{
+			name: "absolute directory",
+			directory: func(t *testing.T, _ string) string {
+				return filepath.Join(t.TempDir(), "reports")
+			},
+			wantDir: func(_ *testing.T, _ string, configuredDir string) string {
+				return configuredDir
+			},
+		},
+		{
+			name: "relative directory",
+			directory: func(_ *testing.T, _ string) string {
+				return "configured/../reports"
+			},
+			wantDir: func(_ *testing.T, workingDir string, _ string) string {
+				return filepath.Join(workingDir, "reports")
+			},
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			workingDir := t.TempDir()
+			configuredDir := tt.directory(t, workingDir)
+			cfg := generationDistributorConfig()
+			cfg.Output.Directory = configuredDir
+			bundle := generationBundle(t)
+			notifier := &generationNotifier{}
+
+			result, err := GenerateDetailed(context.Background(), GenerateRequest{
+				Config: cfg, Report: ReportDaily,
+				Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+				WorkingDir: workingDir, Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{}, Notifier: notifier,
+			})
+			wantPath := filepath.Join(tt.wantDir(t, workingDir, configuredDir), "daily-2026-05-29.md")
+			if err != nil || result == nil || result.OutputPath != wantPath || notifier.request.ReportPath != wantPath {
+				t.Fatalf("GenerateDetailed() result/error/notification = %#v/%v/%#v", result, err, notifier.request)
+			}
+			if info, statErr := os.Stat(filepath.Dir(wantPath)); statErr != nil || !info.IsDir() {
+				t.Fatalf("configured output directory info/error = %#v/%v", info, statErr)
+			}
+			if _, statErr := os.Stat(wantPath); statErr != nil {
+				t.Fatalf("output %q: %v", wantPath, statErr)
+			}
+		})
+	}
+}
+
+func TestGenerateDetailedExplicitOutputPathIgnoresConfiguredDirectory(t *testing.T) {
+	configuredPath := filepath.Join(t.TempDir(), "not-a-directory")
+	if err := os.WriteFile(configuredPath, []byte("not a directory"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	explicitPath := filepath.Join(t.TempDir(), "explicit.md")
+	cfg := generationConfig()
+	cfg.Output.Directory = configuredPath
+	bundle := generationBundle(t)
+
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{
+		Config: cfg, Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+		WorkingDir: t.TempDir(), OutputPath: explicitPath, Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{},
+	})
+	if err != nil || result == nil || result.OutputPath != explicitPath {
+		t.Fatalf("GenerateDetailed() result/error = %#v/%v", result, err)
+	}
+	if _, statErr := os.Stat(explicitPath); statErr != nil {
+		t.Fatalf("explicit output %q: %v", explicitPath, statErr)
+	}
+}
+
+func TestGenerateDetailedRejectsConfiguredNonDirectoryBeforeWork(t *testing.T) {
+	configuredPath := filepath.Join(t.TempDir(), "not-a-directory")
+	if err := os.WriteFile(configuredPath, []byte("not a directory"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	cfg := generationDistributorConfig()
+	cfg.Output.Directory = configuredPath
+	bundle := generationBundle(t)
+	collector := &generationCollector{bundle: &bundle}
+	executor := &generationExecutor{}
+	notifier := &generationNotifier{}
+
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{
+		Config: cfg, Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+		WorkingDir: t.TempDir(), Collector: collector, Executor: executor, Notifier: notifier,
+	})
+	if err == nil || result == nil || collector.called || executor.promptInspections != 0 || executor.called || notifier.calls != 0 {
+		t.Fatalf("GenerateDetailed() result/error/collector/executor/notifier = %#v/%v/%t/%#v/%#v", result, err, collector.called, executor, notifier)
+	}
+	if data, readErr := os.ReadFile(configuredPath); readErr != nil || string(data) != "not a directory" {
+		t.Fatalf("configured path = %q, error = %v", data, readErr)
+	}
+}
+
+func TestGenerateDetailedRejectsOverlongOutputBeforeWork(t *testing.T) {
+	missingDirectory := filepath.Join(t.TempDir(), "missing")
+	outputPath := filepath.Join(missingDirectory, strings.Repeat("a", 253)+".md")
+	bundle := generationBundle(t)
+	collector := &generationCollector{bundle: &bundle}
+	executor := &generationExecutor{}
+
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{
+		Config: generationConfig(), Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+		WorkingDir: t.TempDir(), OutputPath: outputPath, Collector: collector, Executor: executor,
+	})
+	if err == nil || result == nil || collector.called || executor.promptInspections != 0 || executor.called {
+		t.Fatalf("GenerateDetailed() result/error/collector/executor = %#v/%v/%t/%#v", result, err, collector.called, executor)
+	}
+	if _, statErr := os.Stat(missingDirectory); !os.IsNotExist(statErr) {
+		t.Fatalf("missing output directory exists after preflight failure: %v", statErr)
+	}
+}
+
+func TestGenerateDetailedRejectsUnsupportedDistributorEndpointBeforeWork(t *testing.T) {
+	outputPath := filepath.Join(t.TempDir(), "daily.md")
+	cfg := generationDistributorConfig()
+	cfg.Notify.Distributor.Endpoint = "ftp://distributor.example.test"
+	bundle := generationBundle(t)
+	collector := &generationCollector{bundle: &bundle}
+	executor := &generationExecutor{}
+	notifier := &generationNotifier{}
+
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{
+		Config: cfg, Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+		WorkingDir: t.TempDir(), OutputPath: outputPath, Collector: collector, Executor: executor, Notifier: notifier,
+	})
+	if err == nil || result == nil || collector.called || executor.promptInspections != 0 || executor.called || notifier.calls != 0 {
+		t.Fatalf("GenerateDetailed() result/error/collector/executor/notifier = %#v/%v/%t/%#v/%#v", result, err, collector.called, executor, notifier)
+	}
+	if _, statErr := os.Stat(outputPath); !os.IsNotExist(statErr) {
+		t.Fatalf("output exists after endpoint preflight failure: %v", statErr)
+	}
+}
+
 func TestGenerateDetailedReturnsResolvedResultWhenCollectionFails(t *testing.T) {
 	cfg := config.Defaults()
 	cfg.WeatherAPI.Timezone, cfg.Location.ID = "America/Chicago", "home"
@@ -201,6 +438,41 @@ func TestGenerateDetailedPreservesDestinationWhenContextDeadlineExpiresBeforePub
 	}
 }
 
+func TestGenerateDetailedPreservesDestinationWhenContextChangesDuringPublication(t *testing.T) {
+	for _, tt := range []struct {
+		name     string
+		err      error
+		category promptexec.ErrorCategory
+	}{
+		{name: "canceled", err: context.Canceled, category: promptexec.Canceled},
+		{name: "deadline", err: context.DeadlineExceeded, category: promptexec.DeadlineExceeded},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			outputPath := filepath.Join(t.TempDir(), "daily.md")
+			const previousReport = "previous report"
+			if err := os.WriteFile(outputPath, []byte(previousReport), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			ctx := &publicationGateContext{Context: context.Background(), err: tt.err}
+			cfg := generationConfig()
+			cfg.Notify.Distributor.Enabled = true
+			cfg.Notify.Distributor.PipelineIDTemplate = "weather"
+			bundle := generationBundle(t)
+			notifier := &generationNotifier{}
+			result, err := GenerateDetailed(ctx, GenerateRequest{
+				Config: cfg, Report: ReportDaily,
+				Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+				WorkingDir: t.TempDir(), OutputPath: outputPath, Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{}, Notifier: notifier,
+			})
+			data, readErr := os.ReadFile(outputPath)
+			matches, globErr := filepath.Glob(filepath.Join(filepath.Dir(outputPath), ".weatherreporter-*.tmp"))
+			if !errors.Is(err, tt.err) || promptexec.CategoryOf(err) != tt.category || result == nil || result.OutputPath != "" || notifier.calls != 0 || readErr != nil || string(data) != previousReport || globErr != nil || len(matches) != 0 {
+				t.Fatalf("GenerateDetailed() result/error/output/notification/temp = %#v/%v/%q/%#v/%v/%v", result, err, data, notifier, matches, globErr)
+			}
+		})
+	}
+}
+
 func TestGenerateDetailedRetainsPublishedOutputWhenNotificationFails(t *testing.T) {
 	cfg := generationConfig()
 	cfg.Notify.Distributor.Enabled = true
@@ -223,10 +495,54 @@ func TestGenerateDetailedDoesNotReplaceDirectoryOutput(t *testing.T) {
 	if err := os.Mkdir(outputPath, 0o700); err != nil {
 		t.Fatal(err)
 	}
-	result, err := GenerateDetailed(context.Background(), GenerateRequest{Config: generationConfig(), Report: ReportDaily, Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputPath: outputPath, Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{}})
+	collector := &generationCollector{bundle: &bundle}
+	executor := &generationExecutor{}
+	notifier := &generationNotifier{}
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{Config: generationConfig(), Report: ReportDaily, Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputPath: outputPath, Collector: collector, Executor: executor, Notifier: notifier})
 	info, statErr := os.Stat(outputPath)
-	if err == nil || result == nil || statErr != nil || !info.IsDir() {
-		t.Fatalf("GenerateDetailed() result/error/output-info = %#v/%v/%#v (%v)", result, err, info, statErr)
+	if err == nil || result == nil || statErr != nil || !info.IsDir() || collector.called || executor.promptInspections != 0 || executor.called || notifier.calls != 0 {
+		t.Fatalf("GenerateDetailed() result/error/output-info/collector/executor/notifier = %#v/%v/%#v (%v)/%t/%#v/%#v", result, err, info, statErr, collector.called, executor, notifier)
+	}
+}
+
+func TestGenerateDetailedDoesNotReplaceSymbolicLinkOutput(t *testing.T) {
+	dir := t.TempDir()
+	backing := filepath.Join(dir, "backing.md")
+	if err := os.WriteFile(backing, []byte("previous report"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	outputPath := filepath.Join(dir, "daily.md")
+	testutil.RequireSymlink(t, backing, outputPath)
+	bundle := generationBundle(t)
+	collector := &generationCollector{bundle: &bundle}
+	executor := &generationExecutor{}
+	notifier := &generationNotifier{}
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{Config: generationConfig(), Report: ReportDaily, Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"), WorkingDir: t.TempDir(), OutputPath: outputPath, Collector: collector, Executor: executor, Notifier: notifier})
+	info, statErr := os.Lstat(outputPath)
+	data, readErr := os.ReadFile(backing)
+	if err == nil || result == nil || statErr != nil || info.Mode()&os.ModeSymlink == 0 || readErr != nil || string(data) != "previous report" || collector.called || executor.promptInspections != 0 || executor.called || notifier.calls != 0 {
+		t.Fatalf("GenerateDetailed() result/error/output/backing/collector/executor/notifier = %#v/%v/%#v (%v)/%q (%v)/%t/%#v/%#v", result, err, info, statErr, data, readErr, collector.called, executor, notifier)
+	}
+}
+
+func TestGenerateDetailedWritesRequestedPromptDebugArtifacts(t *testing.T) {
+	bundle := generationBundle(t)
+	debugRoot := t.TempDir()
+	result, err := GenerateDetailed(context.Background(), GenerateRequest{
+		Config: generationConfig(), Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+		WorkingDir: t.TempDir(), LLMDebugDir: debugRoot, Collector: &generationCollector{bundle: &bundle}, Executor: &generationExecutor{},
+	})
+	if errors.Is(err, promptdebug.ErrSecureCaptureUnsupported) {
+		t.Skipf("secure prompt debug capture is unavailable: %v", err)
+	}
+	if err != nil || result == nil || result.LLMDebugPath == "" {
+		t.Fatalf("GenerateDetailed() result/error = %#v/%v", result, err)
+	}
+	for _, name := range []string{"preparation.json", "execution.json"} {
+		if _, statErr := os.Stat(filepath.Join(result.LLMDebugPath, name)); statErr != nil {
+			t.Fatalf("debug artifact %q: %v", name, statErr)
+		}
 	}
 }
 
@@ -244,14 +560,19 @@ func generationBundlePointer(t *testing.T) *weatherdata.Bundle {
 type generationNotifier struct {
 	err          error
 	batchErr     error
+	calls        int
 	request      NotificationRequest
 	batchRequest batchNotificationRequest
 	batchCalls   int
 }
 
 func (n *generationNotifier) Notify(_ context.Context, request NotificationRequest) (*NotificationResult, error) {
+	n.calls++
 	n.request = request
-	return nil, n.err
+	if n.err != nil {
+		return nil, n.err
+	}
+	return &NotificationResult{Status: "succeeded"}, nil
 }
 
 func (n *generationNotifier) NotifyBatch(_ context.Context, request batchNotificationRequest) (*NotificationResult, error) {

internal/app/output.go

@@ -0,0 +1,192 @@
+package app
+
+import (
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/fileutil"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
+)
+
+func plannedBatchOutputPath(outputDir string, planned plannedBatchReport) (string, error) {
+	outputName, err := planned.Resolved.OutputName()
+	if err != nil {
+		return "", err
+	}
+	return validateOutputPath(filepath.Join(outputDir, outputName))
+}
+
+func prepareBatchOutputs(outputDir string, plannedReports []plannedBatchReport) error {
+	for index := range plannedReports {
+		outputPath, err := plannedBatchOutputPath(outputDir, plannedReports[index])
+		if err != nil {
+			return err
+		}
+		plannedReports[index].OutputPath = outputPath
+	}
+	return nil
+}
+
+func resolveReportOutputPath(workingDir, override, configuredDir string, resolved report.Resolved) (string, error) {
+	outputName, err := resolved.OutputName()
+	if err != nil {
+		return "", err
+	}
+	if override != "" {
+		return resolveOutputPath(workingDir, override, outputName)
+	}
+	outputDir, err := resolveOutputDir(workingDir, configuredDir)
+	if err != nil {
+		return "", err
+	}
+	return validateOutputPath(filepath.Join(outputDir, outputName))
+}
+
+func resolveOutputDirWithConfigured(workingDir, override, configuredDir string) (string, error) {
+	directory := configuredDir
+	if override != "" {
+		directory = override
+	}
+	return resolveOutputDir(workingDir, directory)
+}
+
+func resolveComparisonOutputDirectory(workingDir, override, configuredDir, reportOutputName string) (string, error) {
+	workingDir, err := validateWorkingDir(workingDir)
+	if err != nil {
+		return "", err
+	}
+	if override != "" {
+		return resolveComparisonDirectoryPath(workingDir, override)
+	}
+	outputDir, err := resolveOutputDir(workingDir, configuredDir)
+	if err != nil {
+		return "", err
+	}
+	name, err := comparison.DefaultDirectoryName(reportOutputName)
+	if err != nil {
+		return "", err
+	}
+	return filepath.Join(outputDir, name), nil
+}
+
+func resolveComparisonDirectoryPath(workingDir, directory string) (string, error) {
+	if strings.TrimSpace(directory) == "" {
+		return "", fmt.Errorf("comparison output directory is required")
+	}
+	if !filepath.IsAbs(directory) {
+		directory = filepath.Join(workingDir, directory)
+	}
+	return filepath.Clean(directory), nil
+}
+
+func resolveOutputDir(workingDir, override string) (string, error) {
+	workingDir, err := validateWorkingDir(workingDir)
+	if err != nil {
+		return "", err
+	}
+	if override == "" {
+		return workingDir, nil
+	}
+	if strings.TrimSpace(override) == "" {
+		return "", fmt.Errorf("output directory is required")
+	}
+	directory := override
+	if !filepath.IsAbs(directory) {
+		directory = filepath.Join(workingDir, directory)
+	}
+	directory = filepath.Clean(directory)
+	if err := preflightOutputDirectory(directory); err != nil {
+		return "", err
+	}
+	return directory, nil
+}
+
+func preflightOutputDirectory(directory string) error {
+	info, err := os.Stat(directory)
+	if err == nil {
+		if !info.IsDir() {
+			return fmt.Errorf("output directory %q is not a directory", directory)
+		}
+		return nil
+	}
+	if !os.IsNotExist(err) {
+		return fmt.Errorf("inspect output directory %q: %w", directory, err)
+	}
+
+	// A missing directory is valid, but os.Stat also reports ErrNotExist for a
+	// dangling symlink. Walk to the first existing component so invalid links
+	// fail preflight instead of being discovered only during publication.
+	for component := directory; ; component = filepath.Dir(component) {
+		componentInfo, componentErr := os.Lstat(component)
+		if componentErr == nil {
+			if componentInfo.Mode()&os.ModeSymlink != 0 {
+				targetInfo, targetErr := os.Stat(component)
+				if targetErr != nil {
+					return fmt.Errorf("inspect output directory %q at %q: %w", directory, component, targetErr)
+				}
+				if !targetInfo.IsDir() {
+					return fmt.Errorf("output directory %q has non-directory path component %q", directory, component)
+				}
+				return nil
+			}
+			if !componentInfo.IsDir() {
+				return fmt.Errorf("output directory %q has non-directory path component %q", directory, component)
+			}
+			return nil
+		}
+		if !os.IsNotExist(componentErr) {
+			return fmt.Errorf("inspect output directory %q at %q: %w", directory, component, componentErr)
+		}
+		if filepath.Dir(component) == component {
+			return fmt.Errorf("inspect output directory %q: no existing directory ancestor", directory)
+		}
+	}
+}
+
+func resolveOutputPath(workingDir, override, defaultName string) (string, error) {
+	workingDir, err := validateWorkingDir(workingDir)
+	if err != nil {
+		return "", err
+	}
+	path := override
+	if path == "" {
+		path = defaultName
+	}
+	if strings.TrimSpace(path) == "" {
+		return "", fmt.Errorf("final output path is required")
+	}
+	if !filepath.IsAbs(path) {
+		path = filepath.Join(workingDir, path)
+	}
+	return validateOutputPath(path)
+}
+
+func validateWorkingDir(workingDir string) (string, error) {
+	if strings.TrimSpace(workingDir) == "" {
+		return "", fmt.Errorf("working directory is required")
+	}
+	if !filepath.IsAbs(workingDir) {
+		return "", fmt.Errorf("working directory %q must be absolute", workingDir)
+	}
+	return filepath.Clean(workingDir), nil
+}
+
+func validateOutputPath(path string) (string, error) {
+	if strings.TrimSpace(path) == "" {
+		return "", fmt.Errorf("final output path is required")
+	}
+	path = filepath.Clean(path)
+	if !filepath.IsAbs(path) {
+		return "", fmt.Errorf("final output path %q must be absolute", path)
+	}
+	if filepath.Dir(path) == path {
+		return "", fmt.Errorf("final output path %q must not be a filesystem root", path)
+	}
+	if err := fileutil.ValidateAtomicPath(path); err != nil {
+		return "", fmt.Errorf("validate final output path %q: %w", path, err)
+	}
+	return path, nil
+}

internal/app/output_linux_test.go

@@ -0,0 +1,59 @@
+//go:build linux
+
+package app
+
+import (
+	"context"
+	"net"
+	"os"
+	"path/filepath"
+	"syscall"
+	"testing"
+)
+
+func TestGenerateDetailedRejectsSpecialOutputBeforeWork(t *testing.T) {
+	for _, tt := range []struct {
+		name  string
+		setup func(t *testing.T, path string)
+	}{
+		{
+			name: "named pipe",
+			setup: func(t *testing.T, path string) {
+				t.Helper()
+				if err := syscall.Mkfifo(path, 0o600); err != nil {
+					t.Fatal(err)
+				}
+			},
+		},
+		{
+			name: "socket",
+			setup: func(t *testing.T, path string) {
+				t.Helper()
+				listener, err := net.ListenUnix("unix", &net.UnixAddr{Name: path, Net: "unix"})
+				if err != nil {
+					t.Fatal(err)
+				}
+				t.Cleanup(func() { _ = listener.Close() })
+			},
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			outputPath := filepath.Join(t.TempDir(), "daily.md")
+			tt.setup(t, outputPath)
+			bundle := generationBundle(t)
+			collector := &generationCollector{bundle: &bundle}
+			executor := &generationExecutor{}
+			notifier := &generationNotifier{}
+
+			result, err := GenerateDetailed(context.Background(), GenerateRequest{
+				Config: generationConfig(), Report: ReportDaily,
+				Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+				WorkingDir: t.TempDir(), OutputPath: outputPath, Collector: collector, Executor: executor, Notifier: notifier,
+			})
+			info, statErr := os.Lstat(outputPath)
+			if err == nil || result == nil || statErr != nil || info.Mode().IsRegular() || collector.called || executor.promptInspections != 0 || executor.called || notifier.calls != 0 {
+				t.Fatalf("GenerateDetailed() result/error/output/collector/executor/notifier = %#v/%v/%#v (%v)/%t/%#v/%#v", result, err, info, statErr, collector.called, executor, notifier)
+			}
+		})
+	}
+}

internal/app/output_test.go

@@ -0,0 +1,73 @@
+package app
+
+import (
+	"os"
+	"path/filepath"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/testutil"
+)
+
+func TestResolveComparisonOutputDirectory(t *testing.T) {
+	workingDir := t.TempDir()
+	configured := filepath.Join(workingDir, "configured")
+	blocked := filepath.Join(workingDir, "not-a-directory")
+	if err := os.WriteFile(blocked, []byte("blocked"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	tests := []struct {
+		name             string
+		override         string
+		configuredDir    string
+		reportOutputName string
+		want             string
+		wantErr          bool
+	}{
+		{name: "working directory default", reportOutputName: "today.md", want: filepath.Join(workingDir, "comparison-today")},
+		{name: "configured relative directory", configuredDir: "configured", reportOutputName: "tomorrow.md", want: filepath.Join(configured, "comparison-tomorrow")},
+		{name: "configured absolute directory", configuredDir: configured, reportOutputName: "hourly.md", want: filepath.Join(configured, "comparison-hourly")},
+		{name: "relative explicit directory", override: "exact", configuredDir: blocked, reportOutputName: "daily-2026-08-24.md", want: filepath.Join(workingDir, "exact")},
+		{name: "absolute explicit directory", override: filepath.Join(workingDir, "absolute"), reportOutputName: "today.md", want: filepath.Join(workingDir, "absolute")},
+		{name: "invalid report suffix", reportOutputName: "today.txt", wantErr: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			got, err := resolveComparisonOutputDirectory(workingDir, test.override, test.configuredDir, test.reportOutputName)
+			if (err != nil) != test.wantErr {
+				t.Fatalf("resolveComparisonOutputDirectory() error = %v, want error %t", err, test.wantErr)
+			}
+			if !test.wantErr && got != test.want {
+				t.Fatalf("resolveComparisonOutputDirectory() = %q, want %q", got, test.want)
+			}
+		})
+	}
+}
+
+func TestResolveOutputDirRejectsDanglingSymlinkComponents(t *testing.T) {
+	workingDir := t.TempDir()
+	dangling := filepath.Join(workingDir, "dangling")
+	testutil.RequireSymlink(t, filepath.Join(workingDir, "missing"), dangling)
+
+	for _, directory := range []string{dangling, filepath.Join(dangling, "reports")} {
+		t.Run(filepath.Base(directory), func(t *testing.T) {
+			if _, err := resolveOutputDir(workingDir, directory); err == nil {
+				t.Fatalf("resolveOutputDir(%q) error = nil, want dangling symlink error", directory)
+			}
+		})
+	}
+}
+
+func TestResolveOutputDirAllowsMissingDirectoryBelowValidSymlink(t *testing.T) {
+	workingDir := t.TempDir()
+	target := t.TempDir()
+	link := filepath.Join(workingDir, "linked")
+	testutil.RequireSymlink(t, target, link)
+
+	directory := filepath.Join(link, "reports")
+	got, err := resolveOutputDir(workingDir, directory)
+	if err != nil || got != directory {
+		t.Fatalf("resolveOutputDir() = %q, %v, want %q, nil", got, err, directory)
+	}
+}

internal/app/prepared_report.go

@@ -0,0 +1,148 @@
+package app
+
+import (
+	"encoding/json"
+	"fmt"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/briefing"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/collect"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/facts"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/generatedtext"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/module"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptinput"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
+)
+
+// preparedReport contains the immutable deterministic inputs shared by prompt
+// executions for one resolved report.
+type preparedReport struct {
+	resolved       report.Resolved
+	derived        facts.DerivedFacts
+	moduleSnapshot module.Snapshot
+	identity       briefing.PreparedIdentity
+	sourceWarnings []weatherdata.SourceWarning
+	dataPackage    []byte
+	handler        generatedtext.Handler
+}
+
+type prepareReportRequest struct {
+	Config     config.Config
+	Resolved   report.Resolved
+	Collection collect.Result
+	handler    generatedtext.Handler
+}
+
+type preparationError struct {
+	operation string
+	err       error
+}
+
+func (e *preparationError) Error() string {
+	return e.operation + ": " + e.err.Error()
+}
+
+func (e *preparationError) Unwrap() error {
+	return e.err
+}
+
+func prepareReport(req prepareReportRequest) (preparedReport, error) {
+	if req.Collection.Bundle == nil {
+		return preparedReport{}, &preparationError{operation: "prepare report", err: fmt.Errorf("collected weather bundle is required")}
+	}
+
+	reportFacts, err := BuildReportFacts(ModuleSnapshotRequest{Config: req.Config, Resolved: req.Resolved}, req.Collection.Bundle)
+	if err != nil {
+		return preparedReport{}, &preparationError{operation: "build report facts", err: err}
+	}
+	buildContext := briefingBuildContext(req.Config, req.Resolved, reportFacts.Collected)
+	identity := briefing.BuildPreparedIdentity(buildContext)
+	moduleSnapshot, err := BuildModuleSnapshotFromFacts(ModuleSnapshotRequest{Config: req.Config, Resolved: req.Resolved, Identity: identity}, reportFacts)
+	if err != nil {
+		return preparedReport{}, &preparationError{operation: "build module snapshot", err: err}
+	}
+	dataPackage, err := promptinput.Build(promptinput.BuildRequest{Metadata: promptMetadata(identity), Modules: moduleSnapshot})
+	if err != nil {
+		return preparedReport{}, &preparationError{operation: "build data package", err: err}
+	}
+	serializedDataPackage, err := promptinput.MarshalYAML(dataPackage)
+	if err != nil {
+		return preparedReport{}, &preparationError{operation: "marshal data package", err: err}
+	}
+	clonedDerived, err := clonePreparedValue(reportFacts.Derived)
+	if err != nil {
+		return preparedReport{}, &preparationError{operation: "copy prepared derived facts", err: err}
+	}
+	clonedSnapshot, err := clonePreparedValue(moduleSnapshot)
+	if err != nil {
+		return preparedReport{}, &preparationError{operation: "copy prepared module snapshot", err: err}
+	}
+	clonedIdentity, err := clonePreparedValue(identity)
+	if err != nil {
+		return preparedReport{}, &preparationError{operation: "copy prepared identity", err: err}
+	}
+	prepared := preparedReport{
+		resolved:       cloneResolved(req.Resolved),
+		derived:        clonedDerived,
+		moduleSnapshot: clonedSnapshot,
+		identity:       clonedIdentity,
+		sourceWarnings: append([]weatherdata.SourceWarning(nil), clonedIdentity.SourceWarnings...),
+		dataPackage:    append([]byte(nil), serializedDataPackage...),
+		handler:        req.handler,
+	}
+	return prepared, nil
+}
+
+func cloneResolved(value report.Resolved) report.Resolved {
+	cloned := value
+	cloned.Definition.DistributorPathTemplates = append([]string(nil), value.Definition.DistributorPathTemplates...)
+	cloned.Definition.Modules = make([]module.ConfigItem, len(value.Definition.Modules))
+	for i, item := range value.Definition.Modules {
+		cloned.Definition.Modules[i] = item
+		switch options := item.Options.(type) {
+		case module.AreaForecastDiscussionOptions:
+			options.Sections = append([]string(nil), options.Sections...)
+			cloned.Definition.Modules[i].Options = options
+		}
+	}
+	return cloned
+}
+
+func (p preparedReport) dataPackageCopy() []byte {
+	return append([]byte(nil), p.dataPackage...)
+}
+
+func (p preparedReport) sourceWarningsCopy() []weatherdata.SourceWarning {
+	return append([]weatherdata.SourceWarning(nil), p.sourceWarnings...)
+}
+
+func (p preparedReport) renderInputs() (briefing.PreparedIdentity, module.Snapshot, facts.DerivedFacts, error) {
+	identity, err := clonePreparedValue(p.identity)
+	if err != nil {
+		return briefing.PreparedIdentity{}, module.Snapshot{}, facts.DerivedFacts{}, err
+	}
+	snapshot, err := clonePreparedValue(p.moduleSnapshot)
+	if err != nil {
+		return briefing.PreparedIdentity{}, module.Snapshot{}, facts.DerivedFacts{}, err
+	}
+	derived, err := clonePreparedValue(p.derived)
+	if err != nil {
+		return briefing.PreparedIdentity{}, module.Snapshot{}, facts.DerivedFacts{}, err
+	}
+	return identity, snapshot, derived, nil
+}
+
+func clonePreparedValue[T any](value T) (T, error) {
+	encoded, err := json.Marshal(value)
+	if err != nil {
+		var zero T
+		return zero, fmt.Errorf("marshal immutable prepared value: %w", err)
+	}
+	var cloned T
+	if err := json.Unmarshal(encoded, &cloned); err != nil {
+		var zero T
+		return zero, fmt.Errorf("unmarshal immutable prepared value: %w", err)
+	}
+	return cloned, nil
+}

internal/app/prepared_report_test.go

@@ -0,0 +1,121 @@
+package app
+
+import (
+	"bytes"
+	"reflect"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/briefing"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/collect"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/generatedtext"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/module"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
+)
+
+func TestPrepareReportBuildsImmutableDeterministicInputs(t *testing.T) {
+	cfg := generationConfig()
+	bundle := generationBundle(t)
+	resolved, err := ResolveGenerate(GenerateRequest{
+		Config: cfg, Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+	}, generationTime("2026-05-29T08:30:00-05:00"))
+	if err != nil {
+		t.Fatalf("ResolveGenerate() error = %v", err)
+	}
+
+	request := prepareReportRequest{Config: cfg, Resolved: resolved, Collection: collect.Result{Bundle: &bundle}, handler: preparedHandler(t, resolved)}
+	prepared, err := prepareReport(request)
+	if err != nil {
+		t.Fatalf("prepareReport() error = %v", err)
+	}
+	repeated, err := prepareReport(request)
+	if err != nil {
+		t.Fatalf("second prepareReport() error = %v", err)
+	}
+	if len(prepared.dataPackage) == 0 || !bytes.Equal(prepared.dataPackage, repeated.dataPackage) || !reflect.DeepEqual(prepared.identity, repeated.identity) {
+		t.Fatalf("prepared package and identity are not deterministic: %q/%#v", prepared.dataPackage, prepared.identity)
+	}
+
+	originalDataPackage := append([]byte(nil), prepared.dataPackage...)
+	originalIdentity := prepared.identity
+	originalDerived := prepared.derived
+	originalWarnings := append([]weatherdata.SourceWarning(nil), prepared.sourceWarnings...)
+	identity, snapshot, derived, err := prepared.renderInputs()
+	if err != nil {
+		t.Fatalf("renderInputs() error = %v", err)
+	}
+	identity.SourceWarnings = append(identity.SourceWarnings, weatherdata.SourceWarning{Source: "test", Message: "consumer mutation"})
+	snapshot.Outputs = nil
+	derived.PrecipTiming.ThunderMentioned = false
+	bundle.Hourly.Periods[0].TextDescription = "mutated after preparation"
+	bundle.Warnings = append(bundle.Warnings, weatherdata.SourceWarning{Source: "test", Message: "mutated warning"})
+	if len(bundle.Sources) > 0 {
+		if bundle.Sources[0].Query == nil {
+			bundle.Sources[0].Query = map[string]string{}
+		}
+		bundle.Sources[0].Query["mutated"] = "true"
+	}
+
+	if !bytes.Equal(prepared.dataPackage, originalDataPackage) || !reflect.DeepEqual(prepared.identity, originalIdentity) || !reflect.DeepEqual(prepared.derived, originalDerived) || !reflect.DeepEqual(prepared.sourceWarnings, originalWarnings) {
+		t.Fatalf("prepared values changed after caller mutation: %#v", prepared)
+	}
+	if len(prepared.moduleSnapshot.Outputs) == 0 {
+		t.Fatal("prepared report values retain consumer mutation")
+	}
+}
+
+func TestPrepareReportProjectsPreparedIdentity(t *testing.T) {
+	cfg := generationConfig()
+	bundle := generationBundle(t)
+	resolved, err := ResolveGenerate(GenerateRequest{
+		Config: cfg, Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+	}, generationTime("2026-05-29T08:30:00-05:00"))
+	if err != nil {
+		t.Fatalf("ResolveGenerate() error = %v", err)
+	}
+	prepared, err := prepareReport(prepareReportRequest{Config: cfg, Resolved: resolved, Collection: collect.Result{Bundle: &bundle}, handler: preparedHandler(t, resolved)})
+	if err != nil {
+		t.Fatalf("prepareReport() error = %v", err)
+	}
+
+	identity := prepared.identity
+	renderIdentity, _, _, err := prepared.renderInputs()
+	if err != nil {
+		t.Fatalf("renderInputs() error = %v", err)
+	}
+	if !reflect.DeepEqual(renderIdentity, identity) {
+		t.Fatalf("render identity = %#v, want %#v", renderIdentity, identity)
+	}
+	prompt := promptMetadata(identity)
+	if prompt.RunID != identity.RunID || prompt.ReportID != identity.ReportID || prompt.Variant != identity.Variant || prompt.PromptID != identity.PromptID || !prompt.GeneratedAt.Equal(identity.GeneratedAt) || prompt.Timezone != identity.Timezone || prompt.ValidPeriod != identity.ValidPeriod || !reflect.DeepEqual(prompt.SourceWarnings, identity.SourceWarnings) {
+		t.Fatalf("prompt metadata does not match prepared identity: %#v/%#v", prompt, identity)
+	}
+
+	moduleMetadata, found, err := module.StanzaValue[briefing.MetadataModule](prepared.moduleSnapshot, "metadata")
+	if err != nil || !found {
+		t.Fatalf("metadata stanza = %#v/%t/%v", moduleMetadata, found, err)
+	}
+	if moduleMetadata.RunID != identity.RunID || moduleMetadata.ReportID != identity.ReportID || moduleMetadata.Variant != identity.Variant || moduleMetadata.PromptID != identity.PromptID || !moduleMetadata.GeneratedAt.Equal(identity.GeneratedAt) || moduleMetadata.Units != identity.Units || moduleMetadata.Timezone != identity.Timezone || moduleMetadata.ValidPeriod != identity.ValidPeriod || !reflect.DeepEqual(moduleMetadata.Location, identity.Location) {
+		t.Fatalf("module metadata does not match prepared identity: %#v/%#v", moduleMetadata, identity)
+	}
+	if len(moduleMetadata.SourceWarnings) != len(identity.SourceWarnings) {
+		t.Fatalf("module source warnings = %#v, want %#v", moduleMetadata.SourceWarnings, identity.SourceWarnings)
+	}
+	for index, warning := range identity.SourceWarnings {
+		summary := moduleMetadata.SourceWarnings[index]
+		if summary.Source != warning.Source || summary.Code != warning.Code || summary.Severity != warning.Severity || summary.Message != warning.Message || summary.CompletenessImpact != warning.CompletenessImpact {
+			t.Fatalf("module source warning %d = %#v, want %#v", index, summary, warning)
+		}
+	}
+}
+
+func preparedHandler(t *testing.T, resolved report.Resolved) generatedtext.Handler {
+	t.Helper()
+	handler, err := generatedtext.LookupDefinition(resolved.Definition)
+	if err != nil {
+		t.Fatalf("LookupDefinition() error = %v", err)
+	}
+	return handler
+}

internal/app/profile_execution.go

@@ -0,0 +1,200 @@
+package app
+
+import (
+	"context"
+	"fmt"
+	"reflect"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/generatedtext"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptdebug"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
+)
+
+type profileExecutionRequest struct {
+	Prepared    preparedReport
+	Prompt      PromptInspectionResult
+	Profile     promptexec.ProfileInspection
+	Executor    promptexec.Executor
+	DebugWriter *promptdebug.PromptDebugWriter
+	DebugRef    *promptdebug.PromptDebugRef
+}
+
+type profileExecutionOutcome struct {
+	ProfileID        string
+	BackendID        string
+	ModelName        string
+	ValidationStatus promptexec.ValidationStatus
+	LLMDebugPath     string
+}
+
+type profileExecutionError struct {
+	operation       string
+	err             error
+	callbackFailure bool
+}
+
+func (e *profileExecutionError) Error() string {
+	return e.operation + ": " + e.err.Error()
+}
+
+func (e *profileExecutionError) Unwrap() error {
+	return e.err
+}
+
+func executePreparedProfile(ctx context.Context, req profileExecutionRequest) (profileExecutionOutcome, []byte, error) {
+	outcome := profileExecutionOutcome{
+		ProfileID: req.Profile.ProfileID,
+		BackendID: req.Profile.BackendID,
+		ModelName: req.Profile.ModelName,
+	}
+	if req.Executor == nil {
+		return outcome, nil, &profileExecutionError{operation: "execute prompt", err: promptexec.NewError(promptexec.InvalidConfiguration, "prompt executor is required", nil)}
+	}
+	if err := validatePreparedExecutionRequest(req); err != nil {
+		return outcome, nil, &profileExecutionError{operation: "validate prompt provenance", err: err}
+	}
+
+	callbackFailed := false
+	preparationCount := 0
+	var preparation promptexec.Preparation
+	preparationCallback := func(value promptexec.Preparation, debug *promptexec.PreparationDebug) error {
+		preparationCount++
+		if preparationCount != 1 {
+			return promptProvenanceError()
+		}
+		if err := validatePreparationProvenance(req, value); err != nil {
+			return err
+		}
+		preparation = clonePreparation(value)
+		if req.DebugWriter == nil || !req.DebugWriter.Enabled() {
+			return nil
+		}
+		if req.DebugRef == nil {
+			callbackFailed = true
+			return promptDebugWriteError(fmt.Errorf("prompt debug reference is required"))
+		}
+		path, err := req.DebugWriter.WritePreparation(*req.DebugRef, value, debug)
+		if err != nil {
+			callbackFailed = true
+			return promptDebugWriteError(err)
+		}
+		outcome.LLMDebugPath = path
+		return nil
+	}
+
+	captureDebug := req.DebugWriter != nil && req.DebugWriter.Enabled()
+	execution, err := req.Executor.Execute(ctx, promptexec.ExecuteRequest{
+		PromptID:      req.Prompt.PromptID,
+		PromptVersion: req.Prompt.PromptVersion,
+		ProfileID:     req.Profile.ProfileID,
+		DataPackage:   req.Prepared.dataPackageCopy(),
+		CaptureDebug:  captureDebug,
+	}, preparationCallback)
+	if err != nil {
+		if callbackFailed {
+			return outcome, nil, &profileExecutionError{operation: "execute prompt", err: err, callbackFailure: true}
+		}
+		return outcome, nil, &profileExecutionError{operation: "execute prompt", err: classifiedPromptError("prompt execution failed", err)}
+	}
+	if execution == nil {
+		return outcome, nil, &profileExecutionError{operation: "execute prompt", err: promptexec.NewError(promptexec.Generation, "prompt executor returned no execution", nil)}
+	}
+	if preparationCount != 1 {
+		return outcome, nil, &profileExecutionError{operation: "validate prompt provenance", err: promptProvenanceError()}
+	}
+	if err := validateExecutionProvenance(req, preparation, *execution); err != nil {
+		return outcome, nil, &profileExecutionError{operation: "validate prompt provenance", err: err}
+	}
+	outcome.ValidationStatus = execution.Validation.Status
+	if err := generatedtext.ValidateRawOutput(execution.RawOutput); err != nil {
+		return outcome, nil, &profileExecutionError{operation: "validate generated text", err: err}
+	}
+	if req.DebugWriter != nil && req.DebugWriter.Enabled() {
+		if req.DebugRef == nil {
+			return outcome, nil, &profileExecutionError{operation: "write prompt debug", err: promptDebugWriteError(fmt.Errorf("prompt debug reference is required"))}
+		}
+		path, err := req.DebugWriter.WriteExecution(*req.DebugRef, *execution)
+		if err != nil {
+			return outcome, nil, &profileExecutionError{operation: "write prompt debug", err: promptDebugWriteError(err)}
+		}
+		if path != "" {
+			outcome.LLMDebugPath = path
+		}
+	}
+
+	if execution.Validation.Status != promptexec.ValidationPassed && execution.Validation.Status != promptexec.ValidationFailed {
+		return outcome, nil, &profileExecutionError{operation: "validate prompt execution", err: promptexec.NewError(promptexec.OperationalValidation, "prompt execution did not complete validation", nil)}
+	}
+	if execution.Validation.Status == promptexec.ValidationFailed {
+		return outcome, nil, &profileExecutionError{operation: "validate prompt execution", err: promptexec.NewError(promptexec.ValidationRejected, "prompt output did not satisfy its schema", nil)}
+	}
+
+	generatedText, err := req.Prepared.handler.Validate(execution.RawOutput)
+	if err != nil {
+		return outcome, nil, &profileExecutionError{operation: "validate generated text", err: err}
+	}
+	identity, snapshot, derived, err := req.Prepared.renderInputs()
+	if err != nil {
+		return outcome, nil, &profileExecutionError{operation: "copy prepared render inputs", err: err}
+	}
+	renderContext, err := req.Prepared.handler.BuildRenderContext(identity, snapshot, derived, generatedText)
+	if err != nil {
+		return outcome, nil, &profileExecutionError{operation: "build render context", err: err}
+	}
+	rendered, err := req.Prepared.handler.Render(renderContext)
+	if err != nil {
+		return outcome, nil, &profileExecutionError{operation: "render template", err: err}
+	}
+	return outcome, rendered, nil
+}
+
+func validatePreparedExecutionRequest(req profileExecutionRequest) error {
+	definition := req.Prepared.resolved.Definition
+	if definition.PromptID != req.Prompt.PromptID || definition.PromptVersion != req.Prompt.PromptVersion ||
+		definition.GeneratedTextSchemaID != req.Prepared.handler.SchemaID() {
+		return promptProvenanceError()
+	}
+	if req.Prompt.ProfileID != "" && (req.Prompt.ProfileID != req.Profile.ProfileID || req.Prompt.BackendID != req.Profile.BackendID || req.Prompt.ModelName != req.Profile.ModelName) {
+		return promptProvenanceError()
+	}
+	if req.Prompt.PromptHash == "" || req.Profile.ProfileID == "" || req.Profile.BackendID == "" || req.Profile.ModelName == "" {
+		return promptProvenanceError()
+	}
+	return nil
+}
+
+func validatePreparationProvenance(req profileExecutionRequest, preparation promptexec.Preparation) error {
+	definition := req.Prepared.resolved.Definition
+	if preparation.PromptID != req.Prompt.PromptID || preparation.PromptVersion != req.Prompt.PromptVersion || preparation.PromptHash != req.Prompt.PromptHash ||
+		preparation.ProfileID != req.Profile.ProfileID || preparation.BackendID != req.Profile.BackendID || preparation.ModelName != req.Profile.ModelName ||
+		!validPromptOutput(definition, preparation.Output) {
+		return promptProvenanceError()
+	}
+	return nil
+}
+
+func validateExecutionProvenance(req profileExecutionRequest, preparation promptexec.Preparation, execution promptexec.Execution) error {
+	definition := req.Prepared.resolved.Definition
+	if execution.PromptID != preparation.PromptID || execution.PromptVersion != preparation.PromptVersion || execution.PromptHash != preparation.PromptHash ||
+		execution.RenderedPromptHash != preparation.RenderedPromptHash || !reflect.DeepEqual(execution.InputHashes, preparation.InputHashes) ||
+		execution.ProfileID != preparation.ProfileID || execution.BackendID != preparation.BackendID || execution.ModelName != preparation.ModelName ||
+		execution.Validation.Mode != "json_schema" || execution.Validation.SchemaPath != definition.GeneratedTextSchemaID+".generated_text.schema.json" {
+		return promptProvenanceError()
+	}
+	return nil
+}
+
+func promptProvenanceError() error {
+	return promptexec.NewError(promptexec.InvalidConfiguration, "prompt execution provenance is inconsistent", nil)
+}
+
+func clonePreparation(value promptexec.Preparation) promptexec.Preparation {
+	if value.InputHashes != nil {
+		inputHashes := make(map[string]string, len(value.InputHashes))
+		for name, hash := range value.InputHashes {
+			inputHashes[name] = hash
+		}
+		value.InputHashes = inputHashes
+	}
+	return value
+}

internal/app/profile_execution_test.go

@@ -0,0 +1,176 @@
+package app
+
+import (
+	"context"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/collect"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/generatedtext"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptdebug"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
+)
+
+func TestExecutePreparedProfileRendersWithoutPublishing(t *testing.T) {
+	prepared, inspection := preparedDailyProfile(t)
+	executor := &generationExecutor{}
+	outputPath := filepath.Join(t.TempDir(), "report.md")
+	outcome, rendered, err := executePreparedProfile(context.Background(), profileExecutionRequest{
+		Prepared: prepared, Prompt: inspection,
+		Profile:  promptexec.ProfileInspection{ProfileID: inspection.ProfileID, BackendID: inspection.BackendID, ModelName: inspection.ModelName},
+		Executor: executor,
+	})
+	if err != nil {
+		t.Fatalf("executePreparedProfile() error = %v", err)
+	}
+	if len(rendered) == 0 || outcome.ValidationStatus != promptexec.ValidationPassed || outcome.ProfileID != inspection.ProfileID || executor.executeCalls != 1 {
+		t.Fatalf("outcome/rendered/execution calls = %#v/%q/%d", outcome, rendered, executor.executeCalls)
+	}
+	if _, statErr := os.Stat(outputPath); !os.IsNotExist(statErr) {
+		t.Fatalf("execution unexpectedly published %q: %v", outputPath, statErr)
+	}
+}
+
+func TestExecutePreparedProfileKeepsDebugCallbackFailureLocal(t *testing.T) {
+	prepared, inspection := preparedDailyProfile(t)
+	debugWriter, err := promptdebug.NewPromptDebugWriter(t.TempDir())
+	if errors.Is(err, promptdebug.ErrSecureCaptureUnsupported) {
+		t.Skipf("secure prompt debug capture is unavailable: %v", err)
+	}
+	if err != nil {
+		t.Fatalf("NewPromptDebugWriter() error = %v", err)
+	}
+	executor := &generationExecutor{}
+	outcome, rendered, err := executePreparedProfile(context.Background(), profileExecutionRequest{
+		Prepared: prepared, Prompt: inspection,
+		Profile:  promptexec.ProfileInspection{ProfileID: inspection.ProfileID, BackendID: inspection.BackendID, ModelName: inspection.ModelName},
+		Executor: executor, DebugWriter: debugWriter,
+		DebugRef: &promptdebug.PromptDebugRef{ReportID: inspectionResolved(t).Definition.ID, ValidDate: "2026-05-29", RunID: "invalid/path"},
+	})
+	var executionErr *profileExecutionError
+	if err == nil || !errors.As(err, &executionErr) || !executionErr.callbackFailure || promptexec.CategoryOf(err) != promptexec.InvalidConfiguration || len(rendered) != 0 || executor.executeCalls != 0 || outcome.LLMDebugPath != "" {
+		t.Fatalf("outcome/rendered/error/execution calls = %#v/%q/%v/%d", outcome, rendered, err, executor.executeCalls)
+	}
+}
+
+func TestExecutePreparedProfileBoundsOversizedExecutorOutput(t *testing.T) {
+	prepared, inspection := preparedDailyProfile(t)
+	marker := "provider-controlled-marker"
+	executor := &generationExecutor{rawOutput: []byte(strings.Repeat("x", generatedtext.MaxGeneratedTextBytes+1) + marker)}
+	_, _, err := executePreparedProfile(context.Background(), profileExecutionRequest{
+		Prepared: prepared, Prompt: inspection,
+		Profile:  promptexec.ProfileInspection{ProfileID: inspection.ProfileID, BackendID: inspection.BackendID, ModelName: inspection.ModelName},
+		Executor: executor,
+	})
+	if err == nil || !strings.Contains(err.Error(), "65536-byte limit") {
+		t.Fatalf("executePreparedProfile() error = %v, want bounded raw size error", err)
+	}
+	if len(err.Error()) > 160 || strings.Contains(err.Error(), marker) {
+		t.Fatalf("ordinary error leaked provider content: %q", err)
+	}
+}
+
+func TestExecutePreparedProfileRejectsInconsistentProvenance(t *testing.T) {
+	tests := []struct {
+		name    string
+		mutate  func(*preparedReport, *PromptInspectionResult, *promptexec.ProfileInspection, *generationExecutor)
+		invoked bool
+	}{
+		{
+			name: "prepared definition", mutate: func(prepared *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, _ *generationExecutor) {
+				prepared.resolved.Definition.PromptVersion = "different-version"
+			},
+		},
+		{
+			name: "missing callback", mutate: func(_ *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, executor *generationExecutor) {
+				executor.skipPreparation = true
+			}, invoked: true,
+		},
+		{
+			name: "duplicate callback", mutate: func(_ *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, executor *generationExecutor) {
+				executor.preparationCalls = 2
+			},
+		},
+		{
+			name: "callback prompt hash", mutate: func(_ *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, executor *generationExecutor) {
+				executor.prepare = func(value *promptexec.Preparation) { value.PromptHash = "different-hash" }
+			},
+		},
+		{
+			name: "callback output schema", mutate: func(_ *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, executor *generationExecutor) {
+				executor.prepare = func(value *promptexec.Preparation) { value.Output.SchemaPath = "other.generated_text.schema.json" }
+			},
+		},
+		{
+			name: "completed profile", mutate: func(_ *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, executor *generationExecutor) {
+				executor.complete = func(value *promptexec.Execution) { value.ProfileID = "different-profile" }
+			}, invoked: true,
+		},
+		{
+			name: "completed rendered prompt hash", mutate: func(_ *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, executor *generationExecutor) {
+				executor.complete = func(value *promptexec.Execution) { value.RenderedPromptHash = "different-rendered-hash" }
+			}, invoked: true,
+		},
+		{
+			name: "completed input hashes", mutate: func(_ *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, executor *generationExecutor) {
+				executor.prepare = func(value *promptexec.Preparation) {
+					value.InputHashes = map[string]string{"data_package": "prepared-hash"}
+				}
+				executor.complete = func(value *promptexec.Execution) {
+					value.InputHashes = map[string]string{"data_package": "completed-hash"}
+				}
+			}, invoked: true,
+		},
+		{
+			name: "completed validation mode", mutate: func(_ *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, executor *generationExecutor) {
+				executor.complete = func(value *promptexec.Execution) { value.Validation.Mode = "other" }
+			}, invoked: true,
+		},
+		{
+			name: "completed validation schema", mutate: func(_ *preparedReport, _ *PromptInspectionResult, _ *promptexec.ProfileInspection, executor *generationExecutor) {
+				executor.complete = func(value *promptexec.Execution) { value.Validation.SchemaPath = "other.generated_text.schema.json" }
+			}, invoked: true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			prepared, inspection := preparedDailyProfile(t)
+			profile := promptexec.ProfileInspection{ProfileID: inspection.ProfileID, BackendID: inspection.BackendID, ModelName: inspection.ModelName}
+			executor := &generationExecutor{}
+			tt.mutate(&prepared, &inspection, &profile, executor)
+
+			outcome, rendered, err := executePreparedProfile(context.Background(), profileExecutionRequest{Prepared: prepared, Prompt: inspection, Profile: profile, Executor: executor})
+			if err == nil || promptexec.CategoryOf(err) != promptexec.InvalidConfiguration || len(rendered) != 0 {
+				t.Fatalf("outcome/rendered/error = %#v/%q/%v", outcome, rendered, err)
+			}
+			if outcome.ProfileID != profile.ProfileID || outcome.BackendID != profile.BackendID || outcome.ModelName != profile.ModelName || outcome.ValidationStatus != "" {
+				t.Fatalf("outcome retained unverified provenance: %#v", outcome)
+			}
+			if (executor.executeCalls == 1) != tt.invoked {
+				t.Fatalf("executor calls = %d, want invoked=%t", executor.executeCalls, tt.invoked)
+			}
+		})
+	}
+}
+
+func preparedDailyProfile(t *testing.T) (preparedReport, PromptInspectionResult) {
+	t.Helper()
+	cfg := generationConfig()
+	resolved, err := ResolveGenerate(GenerateRequest{
+		Config: cfg, Report: ReportDaily,
+		Date: generationTime("2026-05-29T12:00:00-05:00"), Now: generationTime("2026-05-29T08:30:00-05:00"),
+	}, generationTime("2026-05-29T08:30:00-05:00"))
+	if err != nil {
+		t.Fatalf("ResolveGenerate() error = %v", err)
+	}
+	bundle := generationBundle(t)
+	prepared, err := prepareReport(prepareReportRequest{Config: cfg, Resolved: resolved, Collection: collect.Result{Bundle: &bundle}, handler: preparedHandler(t, resolved)})
+	if err != nil {
+		t.Fatalf("prepareReport() error = %v", err)
+	}
+	return prepared, PromptInspectionResult{PromptID: resolved.Definition.PromptID, PromptVersion: resolved.Definition.PromptVersion, PromptHash: generationPromptHash, ProfileID: "fixture", BackendID: "fixture", ModelName: "fixture-model"}
+}

internal/app/prompt_generate.go

@@ -5,16 +5,11 @@ import (
 	"errors"
 	"fmt"
 
-	"gitea.maximumdirect.net/eric/weatherreporter/internal/briefing"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/collect"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/fileutil"
-	"gitea.maximumdirect.net/eric/weatherreporter/internal/generatedtext"
-	"gitea.maximumdirect.net/eric/weatherreporter/internal/module"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptdebug"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
-	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptinput"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
-	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
 )
 
 type promptReportRequest struct {
@@ -27,51 +22,7 @@ type promptReportRequest struct {
 	noNotify    bool
 }
 
-type promptReportWorkflow struct {
-	ctx              context.Context
-	req              promptReportRequest
-	result           *ReportResult
-	briefingMetadata briefing.Metadata
-	reportFacts      ReportFacts
-	moduleSnapshot   module.Snapshot
-	dataPackage      []byte
-	handler          generatedtext.Handler
-	debugRef         promptdebug.PromptDebugRef
-	callbackFailed   bool
-}
-
 func generatePromptReport(ctx context.Context, req promptReportRequest) (*ReportResult, error) {
-	workflow, err := newPromptReportWorkflow(ctx, req)
-	if err != nil {
-		return nil, err
-	}
-	if err := workflow.buildInputs(); err != nil {
-		return workflow.result, err
-	}
-	execution, err := workflow.executePrompt()
-	if err != nil {
-		if workflow.callbackFailed {
-			return workflow.result, err
-		}
-		return workflow.result, workflow.reportError("execute prompt", classifiedPromptError("prompt execution failed", err))
-	}
-	if execution == nil {
-		return workflow.result, workflow.reportError("execute prompt", promptexec.NewError(promptexec.Generation, "prompt executor returned no execution", nil))
-	}
-	workflow.result.ValidationStatus = execution.Validation.Status
-	if err := workflow.writeExecutionDebug(*execution); err != nil {
-		return workflow.result, err
-	}
-	if execution.Validation.Status != promptexec.ValidationPassed && execution.Validation.Status != promptexec.ValidationFailed {
-		return workflow.result, workflow.reportError("validate prompt execution", promptexec.NewError(promptexec.OperationalValidation, "prompt execution did not complete validation", nil))
-	}
-	if execution.Validation.Status == promptexec.ValidationFailed {
-		return workflow.result, workflow.reportError("validate prompt execution", promptexec.NewError(promptexec.ValidationRejected, "prompt output did not satisfy its schema", nil))
-	}
-	return workflow.renderAndPublish(execution.RawOutput)
-}
-
-func newPromptReportWorkflow(ctx context.Context, req promptReportRequest) (*promptReportWorkflow, error) {
 	if req.Collection.Bundle == nil {
 		return nil, fmt.Errorf("collected weather bundle is required")
 	}
@@ -79,10 +30,36 @@ func newPromptReportWorkflow(ctx context.Context, req promptReportRequest) (*pro
 	if result == nil {
 		result = initialReportResult(req.GenerateRequest, req.Resolved, req.Inspection)
 	}
-	return &promptReportWorkflow{
-		ctx: ctx, req: req,
-		result: result,
-	}, nil
+	prepared, err := prepareReport(prepareReportRequest{Config: req.Config, Resolved: req.Resolved, Collection: req.Collection, handler: req.Inspection.handler})
+	if err != nil {
+		return result, generatedPreparationError(req.Resolved, result.RunID, err)
+	}
+	result.SourceWarnings = prepared.sourceWarningsCopy()
+	debugRef := promptdebug.PromptDebugRef{ReportID: result.ReportID, ValidDate: prepared.resolved.ValidPeriod.Start.Format("2006-01-02"), RunID: result.RunID}
+	outcome, rendered, err := executePreparedProfile(ctx, profileExecutionRequest{
+		Prepared: prepared,
+		Prompt:   req.Inspection,
+		Profile: promptexec.ProfileInspection{
+			ProfileID: req.Inspection.ProfileID,
+			BackendID: req.Inspection.BackendID,
+			ModelName: req.Inspection.ModelName,
+		},
+		Executor: req.Executor, DebugWriter: req.DebugWriter, DebugRef: &debugRef,
+	})
+	result.ProfileID, result.BackendID, result.ModelName = outcome.ProfileID, outcome.BackendID, outcome.ModelName
+	result.ValidationStatus = outcome.ValidationStatus
+	result.LLMDebugPath = outcome.LLMDebugPath
+	if err != nil {
+		return result, generatedProfileExecutionError(req.Resolved, result.RunID, err)
+	}
+	return publishPromptReport(ctx, promptPublicationRequest{
+		GenerateRequest:      req.GenerateRequest,
+		Resolved:             req.Resolved,
+		OutputPath:           req.OutputPath,
+		Result:               result,
+		Markdown:             rendered,
+		suppressNotification: req.noNotify,
+	})
 }
 
 func initialReportResult(req GenerateRequest, resolved report.Resolved, inspection PromptInspectionResult) *ReportResult {
@@ -96,100 +73,54 @@ func initialReportResult(req GenerateRequest, resolved report.Resolved, inspecti
 	}
 }
 
-func (w *promptReportWorkflow) buildInputs() error {
-	var err error
-	w.reportFacts, err = BuildReportFacts(ModuleSnapshotRequest{Config: w.req.Config, Resolved: w.req.Resolved}, w.req.Collection.Bundle)
-	if err != nil {
-		return w.reportError("build report facts", err)
-	}
-	w.moduleSnapshot, err = BuildModuleSnapshotFromFacts(ModuleSnapshotRequest{Config: w.req.Config, Resolved: w.req.Resolved}, w.reportFacts)
-	if err != nil {
-		return w.reportError("build module snapshot", err)
-	}
-	w.briefingMetadata = briefing.BuildMetadata(briefingBuildContext(w.req.Config, w.req.Resolved, w.reportFacts.Collected))
-	w.result.SourceWarnings = append([]weatherdata.SourceWarning(nil), w.briefingMetadata.SourceWarnings...)
-	dataPackage, err := promptinput.Build(promptinput.BuildRequest{Metadata: promptMetadata(w.briefingMetadata), Modules: w.moduleSnapshot})
-	if err != nil {
-		return w.reportError("build data package", err)
-	}
-	w.dataPackage, err = promptinput.MarshalYAML(dataPackage)
-	if err != nil {
-		return w.reportError("marshal data package", err)
-	}
-	w.handler, err = generatedtext.LookupDefinition(w.req.Resolved.Definition)
-	if err != nil {
-		return w.reportError("lookup generated text catalog", err)
-	}
-	w.debugRef = promptdebug.PromptDebugRef{ReportID: w.result.ReportID, ValidDate: w.req.Resolved.ValidPeriod.Start.Format("2006-01-02"), RunID: w.result.RunID}
-	return nil
+type promptPublicationRequest struct {
+	GenerateRequest
+	Resolved             report.Resolved
+	OutputPath           string
+	Result               *ReportResult
+	Markdown             []byte
+	suppressNotification bool
 }
 
-func (w *promptReportWorkflow) executePrompt() (*promptexec.Execution, error) {
-	captureDebug := w.req.DebugWriter != nil && w.req.DebugWriter.Enabled()
-	return w.req.Executor.Execute(w.ctx, promptexec.ExecuteRequest{PromptID: w.req.Inspection.PromptID, PromptVersion: w.req.Inspection.PromptVersion, ProfileID: w.req.Inspection.ProfileID, DataPackage: w.dataPackage, CaptureDebug: captureDebug}, w.writePreparationDebug)
+func publishPromptReport(ctx context.Context, req promptPublicationRequest) (*ReportResult, error) {
+	if err := publicationContextError(ctx); err != nil {
+		return req.Result, generatedReportError(req.Resolved, req.Result.RunID, "publish report", err)
+	}
+	if err := fileutil.WriteFileAtomicContext(ctx, req.OutputPath, req.Markdown); err != nil {
+		if contextErr := publicationContextError(ctx); contextErr != nil {
+			return req.Result, generatedReportError(req.Resolved, req.Result.RunID, "publish report", contextErr)
+		}
+		return req.Result, err
+	}
+	req.Result.OutputPath = req.OutputPath
+	if req.suppressNotification {
+		return req.Result, nil
+	}
+	notification, err := notifyReport(ctx, req.Config, req.Resolved, req.Result.OutputPath, req.Result.RunID, req.Result.GeneratedAt, req.Notifier)
+	req.Result.Notification = notification
+	if err != nil {
+		return req.Result, err
+	}
+	return req.Result, nil
 }
 
-func (w *promptReportWorkflow) writePreparationDebug(preparation promptexec.Preparation, debug *promptexec.PreparationDebug) error {
-	w.result.ProfileID, w.result.BackendID, w.result.ModelName = preparation.ProfileID, preparation.BackendID, preparation.ModelName
-	if w.req.DebugWriter == nil {
-		return nil
+func generatedPreparationError(resolved report.Resolved, runID string, err error) error {
+	var preparation *preparationError
+	if errors.As(err, &preparation) {
+		return generatedReportError(resolved, runID, preparation.operation, preparation.err)
 	}
-	path, err := w.req.DebugWriter.WritePreparation(w.debugRef, preparation, debug)
-	if err != nil {
-		w.callbackFailed = true
-		return promptDebugWriteError(err)
-	}
-	w.result.LLMDebugPath = path
-	return nil
+	return generatedReportError(resolved, runID, "prepare report", err)
 }
 
-func (w *promptReportWorkflow) writeExecutionDebug(execution promptexec.Execution) error {
-	if w.req.DebugWriter == nil {
-		return nil
+func generatedProfileExecutionError(resolved report.Resolved, runID string, err error) error {
+	var execution *profileExecutionError
+	if errors.As(err, &execution) {
+		if execution.callbackFailure {
+			return execution.err
+		}
+		return generatedReportError(resolved, runID, execution.operation, execution.err)
 	}
-	path, err := w.req.DebugWriter.WriteExecution(w.debugRef, execution)
-	if err != nil {
-		return w.reportError("write prompt debug", promptDebugWriteError(err))
-	}
-	if path != "" {
-		w.result.LLMDebugPath = path
-	}
-	return nil
-}
-
-func (w *promptReportWorkflow) renderAndPublish(raw []byte) (*ReportResult, error) {
-	generatedText, _, err := w.handler.Validate(raw)
-	if err != nil {
-		return w.result, w.reportError("validate generated text", err)
-	}
-	renderContext, err := w.handler.BuildRenderContext(w.briefingMetadata, w.moduleSnapshot, w.reportFacts.Collected, w.reportFacts.Derived, generatedText)
-	if err != nil {
-		return w.result, w.reportError("build render context", err)
-	}
-	rendered, err := w.handler.Render(renderContext)
-	if err != nil {
-		return w.result, w.reportError("render template", err)
-	}
-	if err := publicationContextError(w.ctx); err != nil {
-		return w.result, w.reportError("publish report", err)
-	}
-	if err := fileutil.WriteFileAtomic(w.req.OutputPath, rendered); err != nil {
-		return w.result, err
-	}
-	w.result.OutputPath = w.req.OutputPath
-	if w.req.noNotify {
-		return w.result, nil
-	}
-	notification, err := notifyReport(w.ctx, w.req.Config, w.req.Resolved, w.result.OutputPath, w.result.RunID, w.result.GeneratedAt, w.req.Notifier)
-	w.result.Notification = notification
-	if err != nil {
-		return w.result, err
-	}
-	return w.result, nil
-}
-
-func (w *promptReportWorkflow) reportError(operation string, err error) error {
-	return generatedReportError(w.req.Resolved, w.result.RunID, operation, err)
+	return generatedReportError(resolved, runID, "execute prompt", err)
 }
 
 func classifiedPromptError(operation string, err error) error {

internal/app/prompt_inspection.go

@@ -5,7 +5,9 @@ import (
 	"os"
 	"strings"
 
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/generatedtext"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
 )
@@ -28,6 +30,7 @@ type PromptInspectionResult struct {
 	ProfileID     string
 	BackendID     string
 	ModelName     string
+	handler       generatedtext.Handler
 }
 
 // PromptExecutionsInspectionRequest validates all prompt/profile combinations
@@ -39,6 +42,33 @@ type PromptExecutionsInspectionRequest struct {
 	LookupEnv func(string) (string, bool)
 }
 
+// ComparisonInspectionRequest contains the explicit profile selection for one
+// resolved prompt comparison. It intentionally has no configured profile field.
+type ComparisonInspectionRequest struct {
+	Resolved   report.Resolved
+	ProfileIDs []string
+	Executor   promptexec.Executor
+	LookupEnv  func(string) (string, bool)
+}
+
+// ComparisonInspectionResult contains the safe, shared prompt identity and
+// ordered effective profile identities for a comparison.
+type ComparisonInspectionResult struct {
+	PromptID      string
+	PromptVersion string
+	PromptHash    string
+	Profiles      []ComparisonProfileInspection
+	handler       generatedtext.Handler
+}
+
+// ComparisonProfileInspection contains one requested profile's safe effective
+// execution identity.
+type ComparisonProfileInspection struct {
+	ProfileID string
+	BackendID string
+	ModelName string
+}
+
 // InspectPromptExecution validates the exact prompt and profile needed for a
 // report before collection, execution, or durable writes begin.
 func InspectPromptExecution(ctx context.Context, req PromptInspectionRequest) (PromptInspectionResult, error) {
@@ -64,21 +94,13 @@ func InspectPromptExecutions(ctx context.Context, req PromptExecutionsInspection
 	profiles := map[string]promptexec.ProfileInspection{}
 	for _, resolved := range req.Resolved {
 		definition := resolved.Definition
-		if strings.TrimSpace(definition.PromptID) == "" || strings.TrimSpace(definition.PromptVersion) == "" {
-			return nil, promptexec.NewError(promptexec.InvalidConfiguration, "report prompt identity is incomplete", nil)
-		}
-		inspection, err := req.Executor.InspectPrompt(ctx, definition.PromptID, definition.PromptVersion)
+		handler, err := generatedtext.LookupDefinition(definition)
 		if err != nil {
-			return nil, promptInspectionError("prompt inspection failed", err)
+			return nil, promptexec.NewError(promptexec.InvalidConfiguration, "report generated-text catalog is incompatible", err)
 		}
-		if inspection.PromptID != definition.PromptID || inspection.PromptVersion != definition.PromptVersion {
-			return nil, promptexec.NewError(promptexec.InvalidConfiguration, "prompt inspection did not return the requested prompt version", nil)
-		}
-		if !validPromptInput(inspection.Inputs) {
-			return nil, promptexec.NewError(promptexec.InvalidConfiguration, "prompt must declare exactly one required application/yaml data_package input", nil)
-		}
-		if !validPromptOutput(definition, inspection.Output) {
-			return nil, promptexec.NewError(promptexec.InvalidConfiguration, "prompt must declare the report JSON Schema output contract", nil)
+		inspection, err := inspectPromptContract(ctx, req.Executor, definition)
+		if err != nil {
+			return nil, err
 		}
 		profileID := req.Promptkit.Profile
 		if profileID == "" {
@@ -98,11 +120,76 @@ func InspectPromptExecutions(ctx context.Context, req PromptExecutionsInspection
 		results[definition.ID] = PromptInspectionResult{
 			PromptID: inspection.PromptID, PromptVersion: inspection.PromptVersion, PromptHash: inspection.PromptHash,
 			ProfileID: profile.ProfileID, BackendID: profile.BackendID, ModelName: profile.ModelName,
+			handler: handler,
 		}
 	}
 	return results, nil
 }
 
+// InspectComparisonExecution validates one exact prompt and every explicitly
+// requested profile before collection or model execution. Profiles are
+// inspected sequentially in request order. If a profile fails, the returned
+// partial result retains the prompt identity and successfully inspected prefix.
+func InspectComparisonExecution(ctx context.Context, req ComparisonInspectionRequest) (ComparisonInspectionResult, error) {
+	if err := comparison.ValidateProfileIDs(req.ProfileIDs); err != nil {
+		return ComparisonInspectionResult{}, promptexec.NewError(promptexec.InvalidRequest, "comparison profile selection is invalid", err)
+	}
+	if req.Executor == nil {
+		return ComparisonInspectionResult{}, promptexec.NewError(promptexec.InvalidConfiguration, "prompt executor is required", nil)
+	}
+
+	handler, err := generatedtext.LookupDefinition(req.Resolved.Definition)
+	if err != nil {
+		return ComparisonInspectionResult{}, comparisonInspectionError("comparison generated-text catalog inspection failed", promptexec.NewError(promptexec.InvalidConfiguration, "report generated-text catalog is incompatible", err))
+	}
+	inspection, err := inspectPromptContract(ctx, req.Executor, req.Resolved.Definition)
+	if err != nil {
+		return ComparisonInspectionResult{}, comparisonInspectionError("comparison prompt inspection failed", err)
+	}
+	result := ComparisonInspectionResult{
+		PromptID:      inspection.PromptID,
+		PromptVersion: inspection.PromptVersion,
+		PromptHash:    inspection.PromptHash,
+		Profiles:      make([]ComparisonProfileInspection, 0, len(req.ProfileIDs)),
+		handler:       handler,
+	}
+	for _, profileID := range req.ProfileIDs {
+		profile, err := inspectPromptProfile(ctx, req.Executor, profileID, req.LookupEnv)
+		if err != nil {
+			return result, comparisonInspectionError("comparison profile inspection failed", err)
+		}
+		result.Profiles = append(result.Profiles, ComparisonProfileInspection{
+			ProfileID: profile.ProfileID,
+			BackendID: profile.BackendID,
+			ModelName: profile.ModelName,
+		})
+	}
+	return result, nil
+}
+
+func inspectPromptContract(ctx context.Context, executor promptexec.Executor, definition report.Definition) (promptexec.PromptInspection, error) {
+	if strings.TrimSpace(definition.PromptID) == "" || strings.TrimSpace(definition.PromptVersion) == "" {
+		return promptexec.PromptInspection{}, promptexec.NewError(promptexec.InvalidConfiguration, "report prompt identity is incomplete", nil)
+	}
+	inspection, err := executor.InspectPrompt(ctx, definition.PromptID, definition.PromptVersion)
+	if err != nil {
+		return promptexec.PromptInspection{}, promptInspectionError("prompt inspection failed", err)
+	}
+	if inspection.PromptID != definition.PromptID || inspection.PromptVersion != definition.PromptVersion {
+		return promptexec.PromptInspection{}, promptexec.NewError(promptexec.InvalidConfiguration, "prompt inspection did not return the requested prompt version", nil)
+	}
+	if strings.TrimSpace(inspection.PromptHash) == "" {
+		return promptexec.PromptInspection{}, promptexec.NewError(promptexec.InvalidConfiguration, "prompt inspection did not return a prompt hash", nil)
+	}
+	if !validPromptInput(inspection.Inputs) {
+		return promptexec.PromptInspection{}, promptexec.NewError(promptexec.InvalidConfiguration, "prompt must declare exactly one required application/yaml data_package input", nil)
+	}
+	if !validPromptOutput(definition, inspection.Output) {
+		return promptexec.PromptInspection{}, promptexec.NewError(promptexec.InvalidConfiguration, "prompt must declare the report JSON Schema output contract", nil)
+	}
+	return inspection, nil
+}
+
 func inspectPromptProfile(ctx context.Context, executor promptexec.Executor, profileID string, lookupEnv func(string) (string, bool)) (promptexec.ProfileInspection, error) {
 	profile, err := executor.InspectProfile(ctx, profileID)
 	if err != nil {
@@ -123,6 +210,9 @@ func inspectPromptProfile(ctx context.Context, executor promptexec.Executor, pro
 			return promptexec.ProfileInspection{}, promptexec.NewError(promptexec.MissingCredential, "selected profile credential is unavailable", nil)
 		}
 	}
+	if strings.TrimSpace(profile.BackendID) == "" || strings.TrimSpace(profile.ModelName) == "" {
+		return promptexec.ProfileInspection{}, promptexec.NewError(promptexec.InvalidConfiguration, "profile inspection did not return a complete execution identity", nil)
+	}
 	return profile, nil
 }
 
@@ -140,3 +230,11 @@ func promptInspectionError(operation string, err error) error {
 	}
 	return promptexec.NewError(promptexec.InvalidConfiguration, operation, err)
 }
+
+func comparisonInspectionError(operation string, err error) error {
+	category := promptexec.CategoryOf(err)
+	if category == "" {
+		category = promptexec.InvalidConfiguration
+	}
+	return promptexec.NewError(category, operation, err)
+}

internal/app/prompt_inspection_test.go

@@ -3,6 +3,7 @@ package app
 import (
 	"context"
 	"errors"
+	"reflect"
 	"strings"
 	"testing"
 	"time"
@@ -70,6 +71,21 @@ func TestInspectPromptExecutionRejectsInvalidContractsAndCredentials(t *testing.
 			}(),
 			wantCategory: promptexec.InvalidConfiguration,
 		},
+		{
+			name: "missing prompt hash",
+			prompt: func() promptexec.PromptInspection {
+				value := basePrompt
+				value.PromptHash = ""
+				return value
+			}(),
+			wantCategory: promptexec.InvalidConfiguration,
+		},
+		{
+			name:         "missing profile backend",
+			prompt:       basePrompt,
+			profile:      promptexec.ProfileInspection{ProfileID: "default-profile", ModelName: "model"},
+			wantCategory: promptexec.InvalidConfiguration,
+		},
 		{
 			name:         "direct key",
 			prompt:       basePrompt,
@@ -109,9 +125,7 @@ func TestInspectPromptExecutionReturnsSafeInspectionError(t *testing.T) {
 
 func TestInspectPromptExecutionsReusesEffectiveProfile(t *testing.T) {
 	first := inspectionResolved(t)
-	second := first
-	second.Definition.ID = report.Today
-	second.Definition.PromptID = "weather.today"
+	second := inspectionResolvedFor(t, report.Today)
 	executor := &inspectionExecutor{
 		prompt: validPromptInspection(first.Definition),
 		profiles: map[string]promptexec.ProfileInspection{
@@ -131,6 +145,159 @@ func TestInspectPromptExecutionsReusesEffectiveProfile(t *testing.T) {
 	}
 }
 
+func TestPromptInspectionRejectsIncompatibleGeneratedTextCatalogBeforeExecutorWork(t *testing.T) {
+	base := inspectionResolved(t)
+	tests := []struct {
+		name     string
+		resolved report.Resolved
+		inspect  func(context.Context, report.Resolved, *inspectionExecutor) error
+	}{
+		{
+			name: "single report unknown template",
+			resolved: func() report.Resolved {
+				resolved := base
+				resolved.Definition.TemplateID = "unknown"
+				return resolved
+			}(),
+			inspect: func(ctx context.Context, resolved report.Resolved, executor *inspectionExecutor) error {
+				_, err := InspectPromptExecution(ctx, PromptInspectionRequest{Resolved: resolved, Executor: executor})
+				return err
+			},
+		},
+		{
+			name: "batch known pair for another report",
+			resolved: func() report.Resolved {
+				resolved := base
+				resolved.Definition.GeneratedTextSchemaID = "today"
+				resolved.Definition.TemplateID = "today"
+				return resolved
+			}(),
+			inspect: func(ctx context.Context, resolved report.Resolved, executor *inspectionExecutor) error {
+				_, err := InspectPromptExecutions(ctx, PromptExecutionsInspectionRequest{Resolved: []report.Resolved{resolved}, Executor: executor})
+				return err
+			},
+		},
+		{
+			name: "comparison known pair for another report",
+			resolved: func() report.Resolved {
+				resolved := base
+				resolved.Definition.GeneratedTextSchemaID = "today"
+				resolved.Definition.TemplateID = "today"
+				return resolved
+			}(),
+			inspect: func(ctx context.Context, resolved report.Resolved, executor *inspectionExecutor) error {
+				_, err := InspectComparisonExecution(ctx, ComparisonInspectionRequest{Resolved: resolved, ProfileIDs: []string{"weather-light", "weather-deep"}, Executor: executor})
+				return err
+			},
+		},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			executor := &inspectionExecutor{}
+			err := test.inspect(context.Background(), test.resolved, executor)
+			if err == nil || promptexec.CategoryOf(err) != promptexec.InvalidConfiguration {
+				t.Fatalf("inspection error/category = %v/%q, want invalid configuration", err, promptexec.CategoryOf(err))
+			}
+			if len(executor.promptRequests) != 0 || len(executor.profileRequests) != 0 || executor.executeRequests != 0 {
+				t.Fatalf("incompatible catalog performed executor work: prompts %#v profiles %#v executions %d", executor.promptRequests, executor.profileRequests, executor.executeRequests)
+			}
+		})
+	}
+}
+
+func TestInspectComparisonExecutionPreservesOrderedExplicitProfiles(t *testing.T) {
+	resolved := inspectionResolved(t)
+	executor := &inspectionExecutor{
+		prompt: validPromptInspection(resolved.Definition),
+		profiles: map[string]promptexec.ProfileInspection{
+			"weather-light": {ProfileID: "weather-light", BackendID: "local", ModelName: "light-model"},
+			"weather-deep":  {ProfileID: "weather-deep", BackendID: "cloud", ModelName: "deep-model"},
+		},
+	}
+	profileIDs := []string{"weather-light", "weather-deep"}
+	result, err := InspectComparisonExecution(context.Background(), ComparisonInspectionRequest{
+		Resolved: resolved, ProfileIDs: profileIDs, Executor: executor,
+	})
+	if err != nil {
+		t.Fatalf("InspectComparisonExecution() error = %v", err)
+	}
+	if result.PromptID != resolved.Definition.PromptID || result.PromptVersion != resolved.Definition.PromptVersion || result.PromptHash != "prompt-hash" {
+		t.Fatalf("prompt result = %#v", result)
+	}
+	if !reflect.DeepEqual(executor.profileRequests, profileIDs) || len(executor.promptRequests) != 1 || executor.executeRequests != 0 {
+		t.Fatalf("prompt/profile/execute requests = %#v/%#v/%d", executor.promptRequests, executor.profileRequests, executor.executeRequests)
+	}
+	wantProfiles := []ComparisonProfileInspection{
+		{ProfileID: "weather-light", BackendID: "local", ModelName: "light-model"},
+		{ProfileID: "weather-deep", BackendID: "cloud", ModelName: "deep-model"},
+	}
+	if !reflect.DeepEqual(result.Profiles, wantProfiles) {
+		t.Fatalf("profiles = %#v, want %#v", result.Profiles, wantProfiles)
+	}
+}
+
+func TestInspectComparisonExecutionRejectsInvalidProfilesBeforeInspection(t *testing.T) {
+	resolved := inspectionResolved(t)
+	for _, profileIDs := range [][]string{
+		{"weather-light"},
+		{"weather-light", " \t"},
+		{"weather-light", "weather-light"},
+	} {
+		t.Run(strings.Join(profileIDs, ","), func(t *testing.T) {
+			executor := &inspectionExecutor{prompt: validPromptInspection(resolved.Definition)}
+			_, err := InspectComparisonExecution(context.Background(), ComparisonInspectionRequest{
+				Resolved: resolved, ProfileIDs: profileIDs, Executor: executor,
+			})
+			if err == nil || promptexec.CategoryOf(err) != promptexec.InvalidRequest {
+				t.Fatalf("error/category = %v/%q, want invalid request", err, promptexec.CategoryOf(err))
+			}
+			if len(executor.promptRequests) != 0 || len(executor.profileRequests) != 0 || executor.executeRequests != 0 {
+				t.Fatalf("invalid profile selection performed prompt/profile/execution work: %#v/%#v/%d", executor.promptRequests, executor.profileRequests, executor.executeRequests)
+			}
+		})
+	}
+}
+
+func TestInspectComparisonExecutionStopsAtFirstProfileFailure(t *testing.T) {
+	resolved := inspectionResolved(t)
+	executor := &inspectionExecutor{
+		prompt: validPromptInspection(resolved.Definition),
+		profiles: map[string]promptexec.ProfileInspection{
+			"weather-light": {ProfileID: "weather-light", BackendID: "local", ModelName: "light-model"},
+			"missing-key":   {ProfileID: "missing-key", APIKeyEnv: "PROMPT_API_KEY"},
+			"weather-deep":  {ProfileID: "weather-deep", BackendID: "cloud", ModelName: "deep-model"},
+		},
+	}
+	result, err := InspectComparisonExecution(context.Background(), ComparisonInspectionRequest{
+		Resolved: resolved, ProfileIDs: []string{"weather-light", "missing-key", "weather-deep"}, Executor: executor,
+		LookupEnv: func(string) (string, bool) { return "", false },
+	})
+	if err == nil || promptexec.CategoryOf(err) != promptexec.MissingCredential {
+		t.Fatalf("error/category = %v/%q, want missing credential", err, promptexec.CategoryOf(err))
+	}
+	if !reflect.DeepEqual(executor.profileRequests, []string{"weather-light", "missing-key"}) || len(executor.promptRequests) != 1 || executor.executeRequests != 0 {
+		t.Fatalf("prompt/profile/execute requests = %#v/%#v/%d", executor.promptRequests, executor.profileRequests, executor.executeRequests)
+	}
+	if result.PromptID != resolved.Definition.PromptID || result.PromptVersion != resolved.Definition.PromptVersion || result.PromptHash == "" || len(result.Profiles) != 1 || result.Profiles[0].ProfileID != "weather-light" {
+		t.Fatalf("partial inspection result = %#v", result)
+	}
+}
+
+func TestInspectComparisonExecutionStopsBeforeProfileInspectionWhenPromptFails(t *testing.T) {
+	resolved := inspectionResolved(t)
+	executor := &inspectionExecutor{promptErr: promptexec.NewError(promptexec.PromptNotFound, "prompt is unavailable", nil)}
+	_, err := InspectComparisonExecution(context.Background(), ComparisonInspectionRequest{
+		Resolved: resolved, ProfileIDs: []string{"weather-light", "weather-deep"}, Executor: executor,
+	})
+	if err == nil || promptexec.CategoryOf(err) != promptexec.PromptNotFound || !strings.Contains(err.Error(), "comparison prompt") {
+		t.Fatalf("error/category = %v/%q, want prompt-context prompt not found", err, promptexec.CategoryOf(err))
+	}
+	if len(executor.promptRequests) != 1 || len(executor.profileRequests) != 0 || executor.executeRequests != 0 {
+		t.Fatalf("prompt/profile/execute requests = %#v/%#v/%d", executor.promptRequests, executor.profileRequests, executor.executeRequests)
+	}
+}
+
 type inspectionPromptRequest struct {
 	id      string
 	version string
@@ -143,6 +310,7 @@ type inspectionExecutor struct {
 	promptErr       error
 	promptRequests  []inspectionPromptRequest
 	profileRequests []string
+	executeRequests int
 }
 
 func (e *inspectionExecutor) InspectPrompt(_ context.Context, id string, version string) (promptexec.PromptInspection, error) {
@@ -166,16 +334,21 @@ func (e *inspectionExecutor) InspectProfile(_ context.Context, id string) (promp
 }
 
 func (e *inspectionExecutor) Execute(context.Context, promptexec.ExecuteRequest, promptexec.PreparationCallback) (*promptexec.Execution, error) {
+	e.executeRequests++
 	return nil, errors.New("unexpected execution")
 }
 
 func inspectionResolved(t *testing.T) report.Resolved {
+	return inspectionResolvedFor(t, report.Daily)
+}
+
+func inspectionResolvedFor(t *testing.T, id report.ID) report.Resolved {
 	t.Helper()
-	resolved, err := report.DefaultRegistry().Resolve(report.Daily, report.ResolveRequest{
-		Now:      time.Date(2026, 5, 29, 12, 0, 0, 0, time.UTC),
-		Date:     time.Date(2026, 5, 29, 0, 0, 0, 0, time.UTC),
-		Location: time.UTC,
-	})
+	request := report.ResolveRequest{Now: time.Date(2026, 5, 29, 12, 0, 0, 0, time.UTC), Location: time.UTC}
+	if id == report.Daily {
+		request.Date = time.Date(2026, 5, 29, 0, 0, 0, 0, time.UTC)
+	}
+	resolved, err := report.DefaultRegistry().Resolve(id, request)
 	if err != nil {
 		t.Fatalf("Resolve() error = %v", err)
 	}

internal/app/prompt_profile_integration_test.go

@@ -41,12 +41,13 @@ func TestPromptInspectionResolvesEmbeddedAndOverriddenProfilesOffline(t *testing
 
 	override, err := promptkitadapter.New(promptkitadapter.Config{ProfileFile: writeProfileFile(t, `id: weather-light
 endpoint: https://local.example/v1
+backend: openrouter
 model: local-weather
 `)})
 	if err != nil {
 		t.Fatalf("New(override) error = %v", err)
 	}
-	inspect(t, override, report.Hourly, "", "weather-light", "", "local-weather")
+	inspect(t, override, report.Hourly, "", "weather-light", "openrouter", "local-weather")
 }
 
 func resolvedPromptProfile(t *testing.T, id report.ID) report.Resolved {

internal/briefing/assets/spc_convective_outlook_definitions.json

@@ -1,32 +1,50 @@
 {
+  "provenance": {
+    "sources": [
+      {
+        "url": "https://www.spc.noaa.gov/about/outlooks/",
+        "updated_on": "2026-03-03",
+        "applies_to": "categorical outlook descriptions"
+      },
+      {
+        "url": "https://www.spc.noaa.gov/exper/conditional-intensity-information",
+        "updated_on": "2026-02-04",
+        "applies_to": "conditional intensity group descriptions"
+      }
+    ],
+    "reviewed_on": "2026-08-13",
+    "review_owner": "Weatherreporter maintainers",
+    "review_schedule": "Review annually and whenever SPC updates either referenced page."
+  },
+  "definitions": {
   "categorical:TSTM": {
     "plain_language": "General or non-severe thunderstorms.",
-    "official_description": "No severe thunderstorms expected.",
+    "official_description": "Encloses a 10% or higher probability of thunderstorms.",
     "relative_level": "0 of 5"
   },
   "categorical:MRGL": {
     "plain_language": "Isolated severe storms possible.",
-    "official_description": "Isolated severe storms may occur within the risk area, but they are expected to be limited in duration, coverage, and intensity.",
+    "official_description": "Includes severe storms of either limited organization and longevity or very low coverage.",
     "relative_level": "1 of 5"
   },
   "categorical:SLGT": {
     "plain_language": "Scattered severe storms possible.",
-    "official_description": "Isolated intense storms are possible within the risk area, but severe weather is generally expected to be short-lived and/or not widespread.",
+    "official_description": "Implies organized severe thunderstorms are expected, but usually in low coverage with varying levels of intensity.",
     "relative_level": "2 of 5"
   },
   "categorical:ENH": {
     "plain_language": "Numerous severe storms possible.",
-    "official_description": "Numerous severe storms are possible within the risk area, some of which may be intense.",
+    "official_description": "Depicts a greater concentration of organized severe thunderstorms with varying levels of intensity.",
     "relative_level": "3 of 5"
   },
   "categorical:MDT": {
     "plain_language": "Widespread severe storms likely.",
-    "official_description": "Widespread severe storms are likely within the risk area. Storms may be long-lived, widespread, and intense. This risk is usually reserved for days with several supercells producing intense tornadoes and/or very large hail, or an intense squall line with widespread damaging winds.",
+    "official_description": "Indicates potential for widespread severe weather with several tornadoes and/or numerous severe thunderstorms, some of which may be intense.",
     "relative_level": "4 of 5"
   },
   "categorical:HIGH": {
     "plain_language": "Major severe outbreak expected.",
-    "official_description": "A major severe weather outbreak is expected, with long-lived, very widespread, and particularly intense severe storms. This risk is reserved for when high confidence exists in widespread coverage of severe weather with embedded instances of extreme severity (i.e., violent tornadoes or very damaging convective wind events).",
+    "official_description": "Suggests a severe weather outbreak is expected from either numerous intense to violent long-track tornadoes or a long-lived derecho system with hurricane-force wind gusts producing widespread damage.",
     "relative_level": "5 of 5"
   },
   "tornado:CIG1": {
@@ -69,4 +87,5 @@
     "official_description": "Intensity Level 2: Reasonable Max hail size greater than 3.75 inches. Note that this product describes the reasonable maximum intensity of a hazard if that hazard occurs. It does not by itself indicate the probability that the hazard will occur.",
     "relative_level": "2 of 2"
   }
+  }
 }

internal/briefing/base_modules_test.go

@@ -137,7 +137,7 @@ func TestHourlyForecastPrecipMentionThreshold(t *testing.T) {
 		{StartTime: mustParseModuleTime("2026-05-29T09:00:00-05:00"), ProbabilityOfPrecipitationPercent: floatPtr(20)},
 		{StartTime: mustParseModuleTime("2026-05-29T10:00:00-05:00")},
 	}
-	value := hourlyForecastPeriodsWithPrecipMentionThreshold(periods, "America/Chicago", DefaultHourlyForecastPrecipMentionProbabilityThreshold)
+	value := hourlyForecastPeriodsWithPrecipMentionThreshold(periods, "America/Chicago", 20)
 	if len(value) != 3 {
 		t.Fatalf("periods length = %d, want 3", len(value))
 	}
@@ -462,19 +462,58 @@ func TestAreaForecastDiscussionModuleCanSelectSections(t *testing.T) {
 	registry := MustDefaultModuleRegistry()
 	ctx := testModuleContext()
 
-	output, err := registry.BuildModule(ctx, module.ConfigItem{
-		ID:      module.AreaForecastDiscussion,
-		Options: module.AreaForecastDiscussionOptions{Sections: []string{"short_term"}},
-	})
+	for _, tt := range []struct {
+		name    string
+		options any
+	}{
+		{name: "value", options: module.AreaForecastDiscussionOptions{Sections: []string{"short_term"}}},
+		{name: "pointer", options: &module.AreaForecastDiscussionOptions{Sections: []string{"short_term"}}},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			output, err := registry.BuildModule(ctx, module.ConfigItem{
+				ID:      module.AreaForecastDiscussion,
+				Options: tt.options,
+			})
+			if err != nil {
+				t.Fatalf("BuildModule() error = %v", err)
+			}
+			afd := moduleValue[AreaForecastDiscussionModule](t, output)
+			if afd.ShortTerm != "Showers increase this afternoon." {
+				t.Fatalf("ShortTerm = %q, want selected short term section", afd.ShortTerm)
+			}
+			if afd.Product != "" || len(afd.KeyMessages) != 0 || afd.LongTerm != "" {
+				t.Fatalf("AFD = %#v, want only short_term section", afd)
+			}
+		})
+	}
+}
+
+func TestWeatherStoryModuleOmitsEmptyContent(t *testing.T) {
+	registry := MustDefaultModuleRegistry()
+	ctx := testModuleContext()
+	ctx.Collected.WeatherStory = &weatherdata.WeatherStory{OfficeID: "LSX", Priority: true, Order: 1}
+
+	output, err := registry.BuildModule(ctx, module.ConfigItem{ID: module.WeatherStory})
 	if err != nil {
 		t.Fatalf("BuildModule() error = %v", err)
 	}
-	afd := moduleValue[AreaForecastDiscussionModule](t, output)
-	if afd.ShortTerm != "Showers increase this afternoon." {
-		t.Fatalf("ShortTerm = %q, want selected short term section", afd.ShortTerm)
+	if output != nil {
+		t.Fatalf("output = %#v, want omitted weather story", output)
 	}
-	if afd.Product != "" || len(afd.KeyMessages) != 0 || afd.LongTerm != "" {
-		t.Fatalf("AFD = %#v, want only short_term section", afd)
+}
+
+func TestWeatherStoryModulePreservesZeroPriorityAndOrder(t *testing.T) {
+	registry := MustDefaultModuleRegistry()
+	ctx := testModuleContext()
+	ctx.Collected.WeatherStory = &weatherdata.WeatherStory{Title: "Rain Chances"}
+
+	output, err := registry.BuildModule(ctx, module.ConfigItem{ID: module.WeatherStory})
+	if err != nil {
+		t.Fatalf("BuildModule() error = %v", err)
+	}
+	story := moduleValue[WeatherStoryModule](t, output)
+	if !story.Available || story.Priority || story.Order != 0 {
+		t.Fatalf("WeatherStory = %#v, want available story with zero priority and order", story)
 	}
 }
 
@@ -561,7 +600,7 @@ func testModuleContext() ModuleContext {
 	hourlyHumidity := 66.0
 	hourlyWindMph := 14.0
 	updatedAt := mustParseModuleTime("2026-05-29T07:30:00-05:00")
-	return ModuleContext{
+	ctx := ModuleContext{
 		Resolved: resolved,
 		Collected: facts.CollectedFacts{
 			Current: &weatherdata.Current{
@@ -689,6 +728,14 @@ func testModuleContext() ModuleContext {
 			Timezone: "America/Chicago",
 		},
 	}
+	ctx.Identity = BuildPreparedIdentity(BuildContext{
+		Resolved: ctx.Resolved,
+		Bundle:   ctx.Collected.Bundle(),
+		Units:    ctx.Units,
+		Timezone: ctx.Timezone,
+		Location: ctx.Location,
+	})
+	return ctx
 }
 
 func moduleValue[T any](t *testing.T, output *module.Output) T {

internal/briefing/derived_daily_summary_module.go

@@ -16,7 +16,7 @@ type DerivedDailySummaryModule struct {
 	MostLikelyPrecipitationHour   string   `json:"most_likely_precipitation_hour,omitempty"`
 	ThunderMentioned              bool     `json:"thunder_mentioned"`
 	MaxWindGustMph                *int     `json:"max_wind_gust_mph,omitempty"`
-	HeatIndexMaxF                 *int     `json:"heat_index_max_f,omitempty"`
+	ApparentTemperatureMaxF       *int     `json:"apparent_temperature_max_f,omitempty"`
 	DominantConditions            []string `json:"dominant_conditions,omitempty"`
 	Hazards                       []string `json:"hazards,omitempty"`
 }
@@ -72,7 +72,7 @@ func derivedDailySummaryValue(summary forecast.DailySummary, timing forecast.Pre
 	} else {
 		value.LowTempF = roundedInt(temperature.Min)
 	}
-	value.HeatIndexMaxF = roundedInt(apparent.Max)
+	value.ApparentTemperatureMaxF = roundedInt(apparent.Max)
 	narrativePrecipitation := narrativeMaxPrecipitation(summary.NarrativePeriods)
 	if narrativePrecipitation != nil {
 		value.DailyPrecipitationProbability = roundedInt(&narrativePrecipitation.Value)

internal/briefing/derived_daypart_summaries_module.go

@@ -4,7 +4,6 @@ import (
 	"fmt"
 	"sort"
 	"strings"
-	"unicode"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/forecast"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/module"
@@ -80,6 +79,9 @@ func buildDerivedDaypartSummariesModule(ctx ModuleContext, _ any) (*module.Outpu
 	prefixDates := multipleSummaryDates(ctx.Derived.DailySummaries)
 	for _, daypart := range ctx.Derived.DaypartSummaries {
 		key := daypartKey(daypart, prefixDates)
+		if existing, exists := value[key]; exists {
+			return nil, fmt.Errorf("daypart summary key %q collides with display name %q", key, existing.DisplayName)
+		}
 		value[key] = derivedDaypartSummaryValue(daypart, ctx.Timezone)
 	}
 	return &module.Output{ID: module.DerivedDaypartSummaries, StanzaName: "derived_daypart_summaries", Value: value}, nil
@@ -135,7 +137,7 @@ func derivedDaypartSummaryValue(daypart forecast.DaypartSummary, timezone string
 	temperature := daypartTemperatureDisplay(daypart)
 	value := DerivedDaypartSummaryModule{
 		Date:                     localDateLabel(daypart.Period.Start, timezone),
-		DisplayName:              titleWord(strings.TrimSpace(daypart.Name)),
+		DisplayName:              capitalizeFirst(strings.TrimSpace(daypart.Name)),
 		PeriodBegins:             friendlyPeriodBeginsLabel(daypart.Period, timezone),
 		PeriodEnds:               friendlyPeriodEndsLabel(daypart.Period, timezone),
 		TempRangeF:               rangeLabel(daypart.Temperature),
@@ -148,7 +150,7 @@ func derivedDaypartSummaryValue(daypart forecast.DaypartSummary, timezone string
 		ApparentTempRangeF:       daypartApparentRangeLabel(daypart.ApparentTemperature),
 		DominantCondition:        daypart.DominantCondition,
 		DominantConditionLower:   strings.ToLower(daypart.DominantCondition),
-		DominantConditionDisplay: sentenceCase(daypart.DominantCondition),
+		DominantConditionDisplay: capitalizeFirst(strings.TrimSpace(daypart.DominantCondition)),
 		NotableConditions:        append([]string(nil), daypart.NotableConditions...),
 		Snow:                     daypart.Indicators.Snow,
 		Ice:                      daypart.Indicators.Ice,
@@ -162,7 +164,7 @@ func derivedDaypartSummaryValue(daypart forecast.DaypartSummary, timezone string
 		value.MaxPopPercent = roundedInt(&daypart.MaxPrecipitationProbability.Value)
 		value.MaxPopTime = clockLabel(daypart.MaxPrecipitationProbability.Time, timezone)
 		value.MaxPopTimeLabel = hourMinuteLabel(daypart.MaxPrecipitationProbability.Time, timezone)
-		value.MentionPrecipitation = mentionHourlyForecastPrecipitation(&daypart.MaxPrecipitationProbability.Value, DefaultHourlyForecastPrecipMentionProbabilityThreshold)
+		value.MentionPrecipitation = mentionHourlyForecastPrecipitation(&daypart.MaxPrecipitationProbability.Value, hourlyForecastPrecipMentionProbabilityThreshold)
 	}
 	if daypart.PeakWindGust != nil {
 		value.MaxWindGustMph = roundedInt(&daypart.PeakWindGust.Value)
@@ -301,18 +303,8 @@ func celsiusToFahrenheit(value float64) float64 {
 }
 
 func temperatureBandIndex(value int) int {
-	decade := (value / 10) * 10
-	remainder := value - decade
-	if remainder < 0 {
-		remainder = -remainder
-	}
-	band := 1
-	switch {
-	case remainder <= 3:
-		band = 0
-	case remainder >= 7:
-		band = 2
-	}
+	decade, remainder := temperatureBandParts(value)
+	band := temperatureBandQualifierIndex(remainder)
 	return decade*3 + band
 }
 
@@ -348,29 +340,47 @@ func temperaturePhraseF(value forecast.Range) string {
 }
 
 func temperatureBandPhrase(value int) string {
-	decade := (value / 10) * 10
-	remainder := value - decade
-	if remainder < 0 {
-		remainder = -remainder
-	}
-	qualifier := "mid"
-	switch {
-	case remainder <= 3:
-		qualifier = "low"
-	case remainder >= 7:
-		qualifier = "upper"
+	if value < 0 {
+		decade, remainder := temperatureBandParts(-value)
+		qualifier := temperatureBandQualifier(remainder)
+		if decade == 0 {
+			return fmt.Sprintf("%s single digits below zero", qualifier)
+		}
+		return fmt.Sprintf("%s %ds below zero", qualifier, decade)
 	}
+	decade, remainder := temperatureBandParts(value)
+	qualifier := temperatureBandQualifier(remainder)
 	return fmt.Sprintf("%s %ds", qualifier, decade)
 }
 
-func sentenceCase(value string) string {
-	trimmed := strings.TrimSpace(value)
-	if trimmed == "" {
-		return ""
+func temperatureBandParts(value int) (int, int) {
+	decade := value / 10
+	if value < 0 && value%10 != 0 {
+		decade--
+	}
+	return decade * 10, value - decade*10
+}
+
+func temperatureBandQualifierIndex(remainder int) int {
+	switch {
+	case remainder <= 3:
+		return 0
+	case remainder >= 7:
+		return 2
+	default:
+		return 1
+	}
+}
+
+func temperatureBandQualifier(remainder int) string {
+	switch temperatureBandQualifierIndex(remainder) {
+	case 0:
+		return "low"
+	case 2:
+		return "upper"
+	default:
+		return "mid"
 	}
-	runes := []rune(trimmed)
-	runes[0] = unicode.ToUpper(runes[0])
-	return string(runes)
 }
 
 func multipleSummaryDates(summaries []forecast.DailySummary) bool {
@@ -382,7 +392,7 @@ func multipleSummaryDates(summaries []forecast.DailySummary) bool {
 }
 
 func daypartKey(daypart forecast.DaypartSummary, prefixDate bool) string {
-	key := normalizedKey(daypart.Name)
+	key := forecast.CanonicalDaypartKey(daypart.Name)
 	if key == "" {
 		key = "unnamed"
 	}
@@ -391,21 +401,3 @@ func daypartKey(daypart forecast.DaypartSummary, prefixDate bool) string {
 	}
 	return daypart.Period.Start.Format(timeutil.DateLayout) + "_" + key
 }
-
-func normalizedKey(value string) string {
-	lower := strings.ToLower(strings.TrimSpace(value))
-	var out strings.Builder
-	lastUnderscore := false
-	for _, r := range lower {
-		if unicode.IsLetter(r) || unicode.IsDigit(r) {
-			out.WriteRune(r)
-			lastUnderscore = false
-			continue
-		}
-		if !lastUnderscore {
-			out.WriteByte('_')
-			lastUnderscore = true
-		}
-	}
-	return strings.Trim(out.String(), "_")
-}

internal/briefing/derived_modules_test.go

@@ -42,19 +42,22 @@ func TestDerivedDailySummaryModulePackagesOrdinaryForecast(t *testing.T) {
 	if value.MaxWindGustMph == nil || *value.MaxWindGustMph != 42 {
 		t.Fatalf("MaxWindGustMph = %#v, want 42", value.MaxWindGustMph)
 	}
-	if value.HeatIndexMaxF == nil || *value.HeatIndexMaxF != 101 {
-		t.Fatalf("HeatIndexMaxF = %#v, want 101", value.HeatIndexMaxF)
+	if value.ApparentTemperatureMaxF == nil || *value.ApparentTemperatureMaxF != 101 {
+		t.Fatalf("ApparentTemperatureMaxF = %#v, want 101", value.ApparentTemperatureMaxF)
 	}
 	data, err := json.Marshal(output.Value)
 	if err != nil {
 		t.Fatalf("marshal daily summary: %v", err)
 	}
 	jsonText := string(data)
-	for _, field := range []string{"high_temp_f", "low_temp_f", "daily_precipitation_probability", "most_likely_precipitation_hour", "heat_index_max_f"} {
+	for _, field := range []string{"high_temp_f", "low_temp_f", "daily_precipitation_probability", "most_likely_precipitation_hour", "apparent_temperature_max_f"} {
 		if !strings.Contains(jsonText, field) {
 			t.Fatalf("daily json = %s, want field %s", jsonText, field)
 		}
 	}
+	if strings.Contains(jsonText, "heat_index") {
+		t.Fatalf("daily json = %s, want no heat-index label for generic apparent temperature", jsonText)
+	}
 	for _, removed := range []string{"max_pop_percent", "max_pop_window", "first_precip_hour", "last_precip_hour"} {
 		if strings.Contains(jsonText, removed) {
 			t.Fatalf("daily json = %s, want removed field %s omitted", jsonText, removed)
@@ -65,6 +68,54 @@ func TestDerivedDailySummaryModulePackagesOrdinaryForecast(t *testing.T) {
 	}
 }
 
+func TestDerivedDailySummaryPreservesApparentTemperatureMeaning(t *testing.T) {
+	for _, tt := range []struct {
+		name        string
+		temperature float64
+		want        int
+	}{
+		{name: "hot", temperature: 101, want: 101},
+		{name: "mild", temperature: 63, want: 63},
+		{name: "below freezing", temperature: -12, want: -12},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			value, err := derivedDailySummaryValue(forecast.DailySummary{
+				Date: "2026-05-29",
+				Dayparts: []forecast.DaypartSummary{{
+					ApparentTemperature: forecast.Range{Max: floatPtr(tt.temperature)},
+				}},
+			}, forecast.PrecipTiming{}, "America/Chicago")
+			if err != nil {
+				t.Fatalf("derivedDailySummaryValue() error = %v", err)
+			}
+			if value.ApparentTemperatureMaxF == nil || *value.ApparentTemperatureMaxF != tt.want {
+				t.Fatalf("ApparentTemperatureMaxF = %#v, want %d", value.ApparentTemperatureMaxF, tt.want)
+			}
+		})
+	}
+}
+
+func TestDerivedDailySummaryLabelsMetricApparentTemperature(t *testing.T) {
+	start := mustParseModuleTime("2026-05-29T12:00:00-05:00")
+	period := timeutil.Period{Start: start, End: start.Add(time.Hour)}
+	daypart := forecast.SummarizeDaypart("afternoon", period, []weatherdata.ForecastPeriod{{
+		StartTime:            period.Start,
+		EndTime:              period.End,
+		TemperatureC:         floatPtr(20),
+		ApparentTemperatureC: floatPtr(20),
+	}})
+	value, err := derivedDailySummaryValue(forecast.DailySummary{
+		Date:     "2026-05-29",
+		Dayparts: []forecast.DaypartSummary{daypart},
+	}, forecast.PrecipTiming{}, "America/Chicago")
+	if err != nil {
+		t.Fatalf("derivedDailySummaryValue() error = %v", err)
+	}
+	if value.ApparentTemperatureMaxF == nil || *value.ApparentTemperatureMaxF != 68 {
+		t.Fatalf("ApparentTemperatureMaxF = %#v, want converted 68", value.ApparentTemperatureMaxF)
+	}
+}
+
 func TestDerivedDailySummaryModuleFallsBackWithoutNarrativeFacts(t *testing.T) {
 	registry := MustDefaultModuleRegistry()
 	ctx := derivedModuleContext(report.Daily)
@@ -96,7 +147,7 @@ func TestPrecipTimingModuleHandlesRainyAndDryForecasts(t *testing.T) {
 		t.Fatalf("BuildModule(rainy) error = %v", err)
 	}
 	rainy := moduleValue[PrecipTimingModule](t, output)
-	if rainy.MaxPopPercent == nil || *rainy.MaxPopPercent != 80 || rainy.MaxPopTime != "12 PM" || rainy.ProbabilityThreshold != forecast.DefaultPrecipWindowProbabilityThreshold || !rainy.ThunderMentioned {
+	if rainy.MaxPopPercent == nil || *rainy.MaxPopPercent != 80 || rainy.MaxPopTime != "12 PM" || rainy.ProbabilityThreshold != 40 || !rainy.ThunderMentioned {
 		t.Fatalf("rainy precip timing = %#v, want peak, threshold, and thunder", rainy)
 	}
 	if len(rainy.PrecipitationWindows) != 2 {
@@ -215,7 +266,7 @@ func TestPrecipTimingModuleBuildsExpectationPhrases(t *testing.T) {
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
 			value := precipTimingValue(forecast.PrecipTiming{
-				ProbabilityThreshold: forecast.DefaultPrecipWindowProbabilityThreshold,
+				ProbabilityThreshold: 40,
 				PrecipitationWindows: []forecast.PrecipitationWindow{
 					{
 						Start: now,
@@ -223,7 +274,7 @@ func TestPrecipTimingModuleBuildsExpectationPhrases(t *testing.T) {
 							Value: tt.maxPop,
 							Time:  now,
 						},
-						ProbabilityThreshold: forecast.DefaultPrecipWindowProbabilityThreshold,
+						ProbabilityThreshold: 40,
 						TextDescriptions:     tt.descriptions,
 					},
 				},
@@ -304,6 +355,52 @@ func TestDerivedDaypartSummariesExposeConfiguredKeysAndHazards(t *testing.T) {
 	}
 }
 
+func TestDerivedDaypartSummariesRejectCanonicalKeyCollisions(t *testing.T) {
+	registry := MustDefaultModuleRegistry()
+	ctx := derivedModuleContext(report.Daily)
+	first := ctx.Derived.DaypartSummaries[0]
+	first.Name = "Morning"
+	second := first
+	second.Name = "morning!"
+	ctx.Derived.DaypartSummaries = []forecast.DaypartSummary{first, second}
+	ctx.Derived.DailySummaries = []forecast.DailySummary{{Date: first.Period.Start.Format(timeutil.DateLayout)}}
+
+	_, err := registry.BuildModule(ctx, module.ConfigItem{ID: module.DerivedDaypartSummaries})
+	if err == nil || !strings.Contains(err.Error(), "collides") {
+		t.Fatalf("BuildModule() error = %v, want canonical daypart-key collision", err)
+	}
+}
+
+func TestDerivedDaypartSummaryDisplayCapitalizesUnicodeNames(t *testing.T) {
+	value := derivedDaypartSummaryValue(forecast.DaypartSummary{
+		Name:              "mañana",
+		DominantCondition: "llovizna",
+	}, "UTC")
+	if value.DisplayName != "Mañana" || value.DominantConditionDisplay != "Llovizna" {
+		t.Fatalf("daypart display = %#v, want rune-safe capitalization", value)
+	}
+}
+
+func TestDerivedDaypartSummariesKeepDistinctUnicodeKeys(t *testing.T) {
+	registry := MustDefaultModuleRegistry()
+	ctx := derivedModuleContext(report.Daily)
+	first := ctx.Derived.DaypartSummaries[0]
+	first.Name = "mañana"
+	second := first
+	second.Name = "manana"
+	ctx.Derived.DaypartSummaries = []forecast.DaypartSummary{first, second}
+	ctx.Derived.DailySummaries = []forecast.DailySummary{{Date: first.Period.Start.Format(timeutil.DateLayout)}}
+
+	output, err := registry.BuildModule(ctx, module.ConfigItem{ID: module.DerivedDaypartSummaries})
+	if err != nil {
+		t.Fatalf("BuildModule() error = %v", err)
+	}
+	value := moduleValue[map[string]DerivedDaypartSummaryModule](t, output)
+	if len(value) != 2 || value["mañana"].DisplayName != "Mañana" || value["manana"].DisplayName != "Manana" {
+		t.Fatalf("daypart summaries = %#v, want distinct Unicode canonical keys", value)
+	}
+}
+
 func TestDerivedDaypartSummariesPromptExportOmitsTemplateHelpers(t *testing.T) {
 	registry := MustDefaultModuleRegistry()
 	ctx := derivedModuleContext(report.Daily)
@@ -390,6 +487,20 @@ func TestDerivedDaypartPromptExportTemperatureTrends(t *testing.T) {
 			wantTrend:  "steady",
 			wantSteady: "upper 70s",
 		},
+		{
+			name:      "rising across zero",
+			temps:     []float64{-5, 5},
+			wantTrend: "rising",
+			wantStart: "mid single digits below zero",
+			wantEnd:   "mid 0s",
+		},
+		{
+			name:      "falling across zero",
+			temps:     []float64{5, -5},
+			wantTrend: "falling",
+			wantStart: "mid 0s",
+			wantEnd:   "mid single digits below zero",
+		},
 	}
 
 	for _, test := range tests {
@@ -460,6 +571,20 @@ func TestDerivedDaypartTemperaturePresentationFields(t *testing.T) {
 			wantTrend:  "steady",
 			wantSteady: "upper 70s",
 		},
+		{
+			name:      "rising across zero",
+			temps:     []float64{-5, 5},
+			wantTrend: "rising",
+			wantStart: "mid single digits below zero",
+			wantEnd:   "mid 0s",
+		},
+		{
+			name:      "falling across zero",
+			temps:     []float64{5, -5},
+			wantTrend: "falling",
+			wantStart: "mid 0s",
+			wantEnd:   "mid single digits below zero",
+		},
 	}
 
 	for _, test := range tests {
@@ -506,6 +631,11 @@ func TestTemperaturePhraseF(t *testing.T) {
 			value: forecast.Range{Max: floatPtr(84)},
 			want:  "mid 80s",
 		},
+		{
+			name:  "below zero range",
+			value: forecast.Range{Min: floatPtr(-9), Max: floatPtr(-1)},
+			want:  "upper single digits below zero to low single digits below zero",
+		},
 		{
 			name:  "empty",
 			value: forecast.Range{},
@@ -521,6 +651,130 @@ func TestTemperaturePhraseF(t *testing.T) {
 	}
 }
 
+func TestTemperatureBandIndexPreservesSignedOrder(t *testing.T) {
+	values := []int{-11, -10, -9, -5, -1, 0, 1, 9}
+	previous := temperatureBandIndex(values[0])
+	for _, value := range values[1:] {
+		current := temperatureBandIndex(value)
+		if current < previous {
+			t.Fatalf("temperatureBandIndex(%d) = %d, want at least %d", value, current, previous)
+		}
+		previous = current
+	}
+	for _, tt := range []struct {
+		value int
+		want  string
+	}{
+		{value: -11, want: "low 10s below zero"},
+		{value: -10, want: "low 10s below zero"},
+		{value: -9, want: "upper single digits below zero"},
+		{value: -5, want: "mid single digits below zero"},
+		{value: -1, want: "low single digits below zero"},
+		{value: 0, want: "low 0s"},
+		{value: 1, want: "low 0s"},
+		{value: 9, want: "upper 0s"},
+	} {
+		if got := temperatureBandPhrase(tt.value); got != tt.want {
+			t.Fatalf("temperatureBandPhrase(%d) = %q, want %q", tt.value, got, tt.want)
+		}
+	}
+}
+
+func TestOutdoorWindowsScoreSnowIceAndFog(t *testing.T) {
+	for _, tt := range []struct {
+		name       string
+		indicators forecast.Indicators
+		reason     string
+	}{
+		{name: "snow", indicators: forecast.Indicators{Snow: true}, reason: "snow risk"},
+		{name: "ice", indicators: forecast.Indicators{Ice: true}, reason: "ice risk"},
+		{name: "fog", indicators: forecast.Indicators{Fog: true}, reason: "fog risk"},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			window := scoreOutdoorWindow(forecast.DaypartSummary{Name: tt.name, Indicators: tt.indicators})
+			if window.Score != outdoorIndicatorRiskScore || !containsString(window.Reasons, tt.reason) || containsString(window.Reasons, "quiet weather") {
+				t.Fatalf("outdoor window = %#v, want indicator risk without quiet weather", window)
+			}
+		})
+	}
+
+	dayparts := []forecast.DaypartSummary{
+		{Name: "snow", HourlyPeriods: []weatherdata.ForecastPeriod{{}}, Indicators: forecast.Indicators{Snow: true}},
+		{Name: "ice and fog", HourlyPeriods: []weatherdata.ForecastPeriod{{}}, Indicators: forecast.Indicators{Ice: true, Fog: true}},
+	}
+	windows := buildOutdoorWindows(dayparts)
+	if windows.Best == nil || windows.Best.Daypart != "snow" || windows.Worst == nil || windows.Worst.Daypart != "ice and fog" {
+		t.Fatalf("outdoor windows = %#v, want mixed hazards ranked by accumulated risk", windows)
+	}
+
+	tied := buildOutdoorWindows([]forecast.DaypartSummary{
+		{Name: "first", HourlyPeriods: []weatherdata.ForecastPeriod{{}}, Indicators: forecast.Indicators{Snow: true}},
+		{Name: "second", HourlyPeriods: []weatherdata.ForecastPeriod{{}}, Indicators: forecast.Indicators{Ice: true}},
+	})
+	if tied.Best == nil || tied.Best.Daypart != "first" || tied.Worst == nil || tied.Worst.Daypart != "first" {
+		t.Fatalf("tied outdoor windows = %#v, want input-order tie behavior", tied)
+	}
+}
+
+func TestPlanningUsesCanonicalDaypartIdentities(t *testing.T) {
+	timedValue := func(value float64) *forecast.TimedValue {
+		return &forecast.TimedValue{Value: value}
+	}
+	containsText := func(values []string, text string) bool {
+		return strings.Contains(strings.Join(values, "\n"), text)
+	}
+	summary := &forecast.DailySummary{Dayparts: []forecast.DaypartSummary{
+		{Name: "Overnight!", MaxPrecipitationProbability: timedValue(60)},
+		{Name: "MORNING", MaxPrecipitationProbability: timedValue(60)},
+		{Name: "Afternoon!!!", MaxPrecipitationProbability: timedValue(60)},
+		{Name: "EVENING!", MaxPrecipitationProbability: timedValue(60)},
+	}}
+
+	today := buildTodayPlanning(summary)
+	if !containsText(today.MorningReadiness, "Morning precipitation chance peaks near 60%.") {
+		t.Fatalf("today morning readiness = %#v, want canonical morning window", today.MorningReadiness)
+	}
+	if !containsText(today.CommuteSchoolWorkdayConcerns, "Afternoon!!! precipitation chance reaches 60%.") ||
+		containsText(today.CommuteSchoolWorkdayConcerns, "Overnight!") ||
+		containsText(today.CommuteSchoolWorkdayConcerns, "EVENING!") {
+		t.Fatalf("today workday concerns = %#v, want only canonical workday windows", today.CommuteSchoolWorkdayConcerns)
+	}
+	if !containsText(today.LateDayChangeWatch, "Afternoon!!! precipitation timing may shift") ||
+		!containsText(today.LateDayChangeWatch, "EVENING! precipitation timing may shift") {
+		t.Fatalf("today late-day watch = %#v, want canonical afternoon and evening windows", today.LateDayChangeWatch)
+	}
+
+	base := buildMorningCommuteOvernightPlanning(summary)
+	if !containsText(base.MorningReadiness, "Morning precipitation chance peaks near 60%.") ||
+		!containsText(base.OvernightChangeWatch, "Overnight precipitation timing may shift") ||
+		containsText(base.CommuteSchoolWorkdayConcerns, "Overnight!") ||
+		containsText(base.CommuteSchoolWorkdayConcerns, "EVENING!") {
+		t.Fatalf("daily/tomorrow planning = %#v, want canonical daypart treatment", base)
+	}
+}
+
+func TestCapitalizeFirst(t *testing.T) {
+	tests := []struct {
+		name  string
+		input string
+		want  string
+	}{
+		{name: "empty", input: "", want: ""},
+		{name: "ASCII", input: "morning", want: "Morning"},
+		{name: "multibyte", input: "mañana", want: "Mañana"},
+		{name: "already uppercase", input: "Morning", want: "Morning"},
+		{name: "leading space", input: " morning", want: " morning"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			if got := capitalizeFirst(tt.input); got != tt.want {
+				t.Fatalf("capitalizeFirst(%q) = %q, want %q", tt.input, got, tt.want)
+			}
+		})
+	}
+}
+
 func TestOutdoorWindowsAndTomorrowPlanningModulesPreserveDailyContent(t *testing.T) {
 	registry := MustDefaultModuleRegistry()
 	ctx := derivedModuleContext(report.Tomorrow)

internal/briefing/fact_requirements.go

@@ -0,0 +1,85 @@
+package briefing
+
+type factRequirementCategory string
+
+const (
+	collectedFactRequirement factRequirementCategory = "collected"
+	derivedFactRequirement   factRequirementCategory = "derived"
+)
+
+type factRequirement struct {
+	identity  string
+	category  factRequirementCategory
+	available func(ModuleContext) bool
+}
+
+func (r factRequirement) String() string {
+	return r.identity
+}
+
+var (
+	currentConditionsRequirement = &factRequirement{identity: "collected.current_conditions", category: collectedFactRequirement, available: func(ctx ModuleContext) bool {
+		return ctx.Collected.Current != nil
+	}}
+	narrativeForecastRequirement = &factRequirement{identity: "collected.narrative_forecast", category: collectedFactRequirement, available: func(ctx ModuleContext) bool {
+		return ctx.Collected.Narrative != nil
+	}}
+	hourlyForecastRequirement = &factRequirement{identity: "collected.hourly_forecast", category: collectedFactRequirement, available: func(ctx ModuleContext) bool {
+		return ctx.Collected.Hourly != nil
+	}}
+	alertsRequirement = &factRequirement{identity: "collected.alerts", category: collectedFactRequirement, available: func(ctx ModuleContext) bool {
+		return ctx.Collected.Alerts != nil
+	}}
+	discussionRequirement = &factRequirement{identity: "collected.discussion", category: collectedFactRequirement, available: func(ctx ModuleContext) bool {
+		return ctx.Collected.Discussion != nil
+	}}
+	weatherStoryRequirement = &factRequirement{identity: "collected.weather_story", category: collectedFactRequirement, available: func(ctx ModuleContext) bool {
+		return ctx.Collected.WeatherStory != nil
+	}}
+	spcOutlooksRequirement = &factRequirement{identity: "collected.spc_convective_outlooks", category: collectedFactRequirement, available: func(ctx ModuleContext) bool {
+		return ctx.Collected.SPCConvectiveOutlooks != nil
+	}}
+	sourceMetadataRequirement = &factRequirement{identity: "collected.source_metadata", category: collectedFactRequirement, available: func(ctx ModuleContext) bool {
+		return len(ctx.Collected.SourceProvenance) > 0 || len(ctx.Collected.SourceWarnings) > 0
+	}}
+
+	hourlyPeriodsRequirement = &factRequirement{identity: "derived.hourly_periods", category: derivedFactRequirement, available: func(ctx ModuleContext) bool {
+		return len(ctx.Derived.ValidPeriodHourlyPeriods) > 0
+	}}
+	narrativePeriodsRequirement = &factRequirement{identity: "derived.narrative_periods", category: derivedFactRequirement, available: func(ctx ModuleContext) bool {
+		return len(ctx.Derived.ValidPeriodNarrativePeriods) > 0
+	}}
+	alertOverlapsRequirement = &factRequirement{identity: "derived.alert_overlaps", category: derivedFactRequirement, available: func(ModuleContext) bool {
+		return true
+	}}
+	dailySummariesRequirement = &factRequirement{identity: "derived.daily_summaries", category: derivedFactRequirement, available: func(ctx ModuleContext) bool {
+		return len(ctx.Derived.DailySummaries) > 0
+	}}
+	daypartSummariesRequirement = &factRequirement{identity: "derived.daypart_summaries", category: derivedFactRequirement, available: func(ctx ModuleContext) bool {
+		return len(ctx.Derived.DaypartSummaries) > 0
+	}}
+	precipTimingRequirement = &factRequirement{identity: "derived.precip_timing", category: derivedFactRequirement, available: func(ModuleContext) bool {
+		return true
+	}}
+	spcDerivedOutlooksRequirement = &factRequirement{identity: "derived.spc_convective_outlooks", category: derivedFactRequirement, available: func(ctx ModuleContext) bool {
+		return ctx.Derived.SPCConvectiveOutlooks != nil
+	}}
+)
+
+var factRequirementVocabulary = []*factRequirement{
+	currentConditionsRequirement,
+	narrativeForecastRequirement,
+	hourlyForecastRequirement,
+	alertsRequirement,
+	discussionRequirement,
+	weatherStoryRequirement,
+	spcOutlooksRequirement,
+	sourceMetadataRequirement,
+	hourlyPeriodsRequirement,
+	narrativePeriodsRequirement,
+	alertOverlapsRequirement,
+	dailySummariesRequirement,
+	daypartSummariesRequirement,
+	precipTimingRequirement,
+	spcDerivedOutlooksRequirement,
+}

internal/briefing/hourly_forecast_module.go

@@ -9,7 +9,7 @@ import (
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
 )
 
-const DefaultHourlyForecastPrecipMentionProbabilityThreshold = 20
+const hourlyForecastPrecipMentionProbabilityThreshold = 20
 
 type HourlyForecastModule struct {
 	Product          string                 `json:"product,omitempty"`
@@ -184,7 +184,7 @@ func hourlyForecastPromptPeriods(periods []HourlyForecastPeriod) []HourlyForecas
 }
 
 func hourlyForecastPeriods(periods []weatherdata.ForecastPeriod, timezone string) []HourlyForecastPeriod {
-	return hourlyForecastPeriodsWithPrecipMentionThreshold(periods, timezone, DefaultHourlyForecastPrecipMentionProbabilityThreshold)
+	return hourlyForecastPeriodsWithPrecipMentionThreshold(periods, timezone, hourlyForecastPrecipMentionProbabilityThreshold)
 }
 
 func hourlyForecastPeriodsWithPrecipMentionThreshold(periods []weatherdata.ForecastPeriod, timezone string, threshold float64) []HourlyForecastPeriod {

internal/briefing/metadata_module.go

@@ -31,18 +31,17 @@ type SourceWarningSummary struct {
 }
 
 func buildMetadataModule(ctx ModuleContext, _ any) (*module.Output, error) {
-	metadata := ctx.Resolved.Metadata()
 	value := MetadataModule{
-		RunID:          metadata.RunID,
-		ReportID:       metadata.ReportID,
-		Variant:        variantForReport(metadata.ReportID),
-		PromptID:       metadata.PromptID,
-		GeneratedAt:    metadata.GeneratedAt,
-		Units:          ctx.Units,
-		Timezone:       ctx.Timezone,
-		ValidPeriod:    metadata.ValidPeriod,
-		Location:       copyLocation(ctx.Location),
-		SourceWarnings: sourceWarningSummaries(ctx.Collected.SourceWarnings),
+		RunID:          ctx.Identity.RunID,
+		ReportID:       ctx.Identity.ReportID,
+		Variant:        ctx.Identity.Variant,
+		PromptID:       ctx.Identity.PromptID,
+		GeneratedAt:    ctx.Identity.GeneratedAt,
+		Units:          ctx.Identity.Units,
+		Timezone:       ctx.Identity.Timezone,
+		ValidPeriod:    ctx.Identity.ValidPeriod,
+		Location:       copyLocation(ctx.Identity.Location),
+		SourceWarnings: sourceWarningSummaries(ctx.Identity.SourceWarnings),
 	}
 	return &module.Output{ID: module.Metadata, StanzaName: "metadata", Value: value}, nil
 }

internal/briefing/modules.go

@@ -11,6 +11,7 @@ import (
 )
 
 type ModuleContext struct {
+	Identity  PreparedIdentity
 	Resolved  report.Resolved
 	Collected facts.CollectedFacts
 	Derived   facts.DerivedFacts
@@ -27,8 +28,8 @@ type ModuleDefinition struct {
 	ID                module.ID
 	StanzaName        string
 	DefaultOptions    any
-	RequiredCollected []module.FactRequirement
-	RequiredDerived   []module.FactRequirement
+	RequiredCollected []*factRequirement
+	RequiredDerived   []*factRequirement
 	SupportedReports  []report.ID
 	MissingData       module.MissingDataBehavior
 	AllowDuplicate    bool
@@ -75,6 +76,9 @@ func NewModuleRegistry(definitions []ModuleDefinition) (ModuleRegistry, error) {
 		if definition.MissingData == module.MissingDataWarn {
 			return ModuleRegistry{}, fmt.Errorf("module %q uses unsupported missing data behavior %q", definition.ID, definition.MissingData)
 		}
+		if err := validateFactRequirements(definition); err != nil {
+			return ModuleRegistry{}, err
+		}
 		if existingID, ok := seenStanzas[definition.StanzaName]; ok {
 			return ModuleRegistry{}, fmt.Errorf("duplicate stanza name %q for modules %q and %q", definition.StanzaName, existingID, definition.ID)
 		}
@@ -100,7 +104,8 @@ func (r ModuleRegistry) BuildModule(ctx ModuleContext, item module.ConfigItem) (
 	if !definition.SupportsReport(ctx.Resolved.Definition.ID) {
 		return nil, fmt.Errorf("module %q is not compatible with report %q", item.ID, ctx.Resolved.Definition.ID)
 	}
-	if err := definition.ValidateOptions(item.Options); err != nil {
+	options, err := definition.CanonicalOptions(item.Options)
+	if err != nil {
 		return nil, err
 	}
 	if definition.Builder == nil {
@@ -120,7 +125,6 @@ func (r ModuleRegistry) BuildModule(ctx ModuleContext, item module.ConfigItem) (
 			return nil, fmt.Errorf("module %q has unknown missing data behavior %q", item.ID, definition.MissingData)
 		}
 	}
-	options := item.Options
 	if options == nil {
 		options = definition.DefaultOptions
 	}
@@ -152,60 +156,48 @@ func (r ModuleRegistry) BuildModule(ctx ModuleContext, item module.ConfigItem) (
 func missingRequirements(definition ModuleDefinition, ctx ModuleContext) []string {
 	var missing []string
 	for _, requirement := range definition.RequiredCollected {
-		if !collectedFactAvailable(requirement, ctx) {
-			missing = append(missing, string(requirement))
+		if !requirement.available(ctx) {
+			missing = append(missing, requirement.String())
 		}
 	}
 	for _, requirement := range definition.RequiredDerived {
-		if !derivedFactAvailable(requirement, ctx) {
-			missing = append(missing, string(requirement))
+		if !requirement.available(ctx) {
+			missing = append(missing, requirement.String())
 		}
 	}
 	return missing
 }
 
-func collectedFactAvailable(requirement module.FactRequirement, ctx ModuleContext) bool {
-	switch requirement {
-	case module.CollectedCurrentConditions:
-		return ctx.Collected.Current != nil
-	case module.CollectedNarrativeForecast:
-		return ctx.Collected.Narrative != nil
-	case module.CollectedHourlyForecast:
-		return ctx.Collected.Hourly != nil
-	case module.CollectedAlerts:
-		return ctx.Collected.Alerts != nil
-	case module.CollectedDiscussion:
-		return ctx.Collected.Discussion != nil
-	case module.CollectedWeatherStory:
-		return ctx.Collected.WeatherStory != nil
-	case module.CollectedSPCConvectiveOutlooks:
-		return ctx.Collected.SPCConvectiveOutlooks != nil
-	case module.CollectedSourceMetadata:
-		return len(ctx.Collected.SourceProvenance) > 0 || len(ctx.Collected.SourceWarnings) > 0
-	default:
-		return false
+func validateFactRequirements(definition ModuleDefinition) error {
+	if err := validateFactRequirementCategory(definition.ID, definition.RequiredCollected, collectedFactRequirement); err != nil {
+		return err
 	}
+	return validateFactRequirementCategory(definition.ID, definition.RequiredDerived, derivedFactRequirement)
 }
 
-func derivedFactAvailable(requirement module.FactRequirement, ctx ModuleContext) bool {
-	switch requirement {
-	case module.RequiresDerivedHourlyPeriods:
-		return len(ctx.Derived.ValidPeriodHourlyPeriods) > 0
-	case module.RequiresDerivedNarrativePeriods:
-		return len(ctx.Derived.ValidPeriodNarrativePeriods) > 0
-	case module.RequiresDerivedAlertOverlaps:
-		return true
-	case module.RequiresDerivedDailySummaries:
-		return len(ctx.Derived.DailySummaries) > 0
-	case module.RequiresDerivedDaypartSummaries:
-		return len(ctx.Derived.DaypartSummaries) > 0
-	case module.RequiresDerivedPrecipTiming:
-		return true
-	case module.RequiresDerivedSPCConvectiveOutlooks:
-		return ctx.Derived.SPCConvectiveOutlooks != nil
-	default:
-		return false
+func validateFactRequirementCategory(moduleID module.ID, requirements []*factRequirement, want factRequirementCategory) error {
+	for _, requirement := range requirements {
+		if requirement == nil {
+			return fmt.Errorf("module %q uses unknown %s fact requirement %q", moduleID, want, "")
+		}
+		descriptor, ok := lookupFactRequirement(requirement.identity)
+		if !ok || descriptor != requirement {
+			return fmt.Errorf("module %q uses unknown %s fact requirement %q", moduleID, want, requirement.identity)
+		}
+		if descriptor.category != want {
+			return fmt.Errorf("module %q lists %s fact requirement %q as %s", moduleID, descriptor.category, descriptor.identity, want)
+		}
 	}
+	return nil
+}
+
+func lookupFactRequirement(identity string) (*factRequirement, bool) {
+	for _, requirement := range factRequirementVocabulary {
+		if requirement.identity == identity {
+			return requirement, true
+		}
+	}
+	return nil, false
 }
 
 func (r ModuleRegistry) ValidateComposition(reportID report.ID, items []module.ConfigItem) error {
@@ -264,6 +256,24 @@ func (d ModuleDefinition) ValidateOptions(options any) error {
 	return fmt.Errorf("module %q options have type %s, want %s", d.ID, got, want)
 }
 
+// CanonicalOptions validates options and converts an accepted typed pointer to its value form.
+func (d ModuleDefinition) CanonicalOptions(options any) (any, error) {
+	if err := d.ValidateOptions(options); err != nil {
+		return nil, err
+	}
+	if options == nil {
+		return nil, nil
+	}
+	value := reflect.ValueOf(options)
+	if value.Kind() != reflect.Pointer {
+		return options, nil
+	}
+	if value.IsNil() {
+		return nil, fmt.Errorf("module %q options must not be a nil pointer", d.ID)
+	}
+	return value.Elem().Interface(), nil
+}
+
 func defaultModuleDefinitions() []ModuleDefinition {
 	allReports := []report.ID{report.Daily, report.Today, report.Tomorrow, report.Hourly}
 	daypartReports := []report.ID{report.Daily, report.Today, report.Tomorrow}
@@ -272,7 +282,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:                module.Metadata,
 			StanzaName:        "metadata",
 			DefaultOptions:    module.MetadataOptions{},
-			RequiredCollected: []module.FactRequirement{module.CollectedSourceMetadata},
+			RequiredCollected: []*factRequirement{sourceMetadataRequirement},
 			SupportedReports:  allReports,
 			MissingData:       module.MissingDataEmpty,
 			Builder:           buildMetadataModule,
@@ -281,7 +291,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:                module.CurrentConditions,
 			StanzaName:        "current_conditions",
 			DefaultOptions:    module.CurrentConditionsOptions{},
-			RequiredCollected: []module.FactRequirement{module.CollectedCurrentConditions},
+			RequiredCollected: []*factRequirement{currentConditionsRequirement},
 			SupportedReports:  allReports,
 			MissingData:       module.MissingDataOmit,
 			Builder:           buildCurrentConditionsModule,
@@ -291,8 +301,8 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:                module.NarrativeForecast,
 			StanzaName:        "narrative_forecast",
 			DefaultOptions:    module.NarrativeForecastOptions{},
-			RequiredCollected: []module.FactRequirement{module.CollectedNarrativeForecast},
-			RequiredDerived:   []module.FactRequirement{module.RequiresDerivedNarrativePeriods},
+			RequiredCollected: []*factRequirement{narrativeForecastRequirement},
+			RequiredDerived:   []*factRequirement{narrativePeriodsRequirement},
 			SupportedReports:  []report.ID{report.Daily, report.Today, report.Tomorrow},
 			MissingData:       module.MissingDataOmit,
 			Builder:           buildNarrativeForecastModule,
@@ -301,8 +311,8 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:                module.HourlyForecast,
 			StanzaName:        "hourly_forecast",
 			DefaultOptions:    module.HourlyForecastOptions{},
-			RequiredCollected: []module.FactRequirement{module.CollectedHourlyForecast},
-			RequiredDerived:   []module.FactRequirement{module.RequiresDerivedHourlyPeriods},
+			RequiredCollected: []*factRequirement{hourlyForecastRequirement},
+			RequiredDerived:   []*factRequirement{hourlyPeriodsRequirement},
 			SupportedReports:  []report.ID{report.Daily, report.Today, report.Tomorrow, report.Hourly},
 			MissingData:       module.MissingDataOmit,
 			Builder:           buildHourlyForecastModule,
@@ -312,7 +322,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:               module.DerivedDailySummary,
 			StanzaName:       "derived_daily_summary",
 			DefaultOptions:   module.DerivedDailySummaryOptions{},
-			RequiredDerived:  []module.FactRequirement{module.RequiresDerivedDailySummaries, module.RequiresDerivedPrecipTiming},
+			RequiredDerived:  []*factRequirement{dailySummariesRequirement, precipTimingRequirement},
 			SupportedReports: []report.ID{report.Daily, report.Today, report.Tomorrow},
 			MissingData:      module.MissingDataError,
 			Builder:          buildDerivedDailySummaryModule,
@@ -321,7 +331,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:               module.DerivedDaypartSummaries,
 			StanzaName:       "derived_daypart_summaries",
 			DefaultOptions:   module.DerivedDaypartSummariesOptions{},
-			RequiredDerived:  []module.FactRequirement{module.RequiresDerivedDaypartSummaries},
+			RequiredDerived:  []*factRequirement{daypartSummariesRequirement},
 			SupportedReports: daypartReports,
 			MissingData:      module.MissingDataError,
 			Builder:          buildDerivedDaypartSummariesModule,
@@ -331,7 +341,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:               module.PrecipTiming,
 			StanzaName:       "precip_timing",
 			DefaultOptions:   module.PrecipTimingOptions{},
-			RequiredDerived:  []module.FactRequirement{module.RequiresDerivedPrecipTiming},
+			RequiredDerived:  []*factRequirement{precipTimingRequirement},
 			SupportedReports: allReports,
 			MissingData:      module.MissingDataEmpty,
 			Builder:          buildPrecipTimingModule,
@@ -340,8 +350,8 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:                module.AlertDigest,
 			StanzaName:        "alert_digest",
 			DefaultOptions:    module.AlertDigestOptions{},
-			RequiredCollected: []module.FactRequirement{module.CollectedAlerts},
-			RequiredDerived:   []module.FactRequirement{module.RequiresDerivedAlertOverlaps},
+			RequiredCollected: []*factRequirement{alertsRequirement},
+			RequiredDerived:   []*factRequirement{alertOverlapsRequirement},
 			SupportedReports:  allReports,
 			MissingData:       module.MissingDataEmpty,
 			Builder:           buildAlertDigestModule,
@@ -350,8 +360,8 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:                module.SPCConvectiveOutlooks,
 			StanzaName:        string(module.SPCConvectiveOutlooks),
 			DefaultOptions:    module.SPCConvectiveOutlooksOptions{},
-			RequiredCollected: []module.FactRequirement{module.CollectedSPCConvectiveOutlooks},
-			RequiredDerived:   []module.FactRequirement{module.RequiresDerivedSPCConvectiveOutlooks},
+			RequiredCollected: []*factRequirement{spcOutlooksRequirement},
+			RequiredDerived:   []*factRequirement{spcDerivedOutlooksRequirement},
 			SupportedReports:  allReports,
 			MissingData:       module.MissingDataEmpty,
 			Builder:           buildSPCConvectiveOutlooksModule,
@@ -360,7 +370,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:                module.AreaForecastDiscussion,
 			StanzaName:        "area_forecast_discussion",
 			DefaultOptions:    module.AreaForecastDiscussionOptions{},
-			RequiredCollected: []module.FactRequirement{module.CollectedDiscussion},
+			RequiredCollected: []*factRequirement{discussionRequirement},
 			SupportedReports:  allReports,
 			MissingData:       module.MissingDataOmit,
 			Builder:           buildAreaForecastDiscussionModule,
@@ -369,8 +379,8 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:                module.SPCConvectiveDiscussion,
 			StanzaName:        string(module.SPCConvectiveDiscussion),
 			DefaultOptions:    module.SPCConvectiveDiscussionOptions{},
-			RequiredCollected: []module.FactRequirement{module.CollectedSPCConvectiveOutlooks},
-			RequiredDerived:   []module.FactRequirement{module.RequiresDerivedSPCConvectiveOutlooks},
+			RequiredCollected: []*factRequirement{spcOutlooksRequirement},
+			RequiredDerived:   []*factRequirement{spcDerivedOutlooksRequirement},
 			SupportedReports:  allReports,
 			MissingData:       module.MissingDataOmit,
 			Builder:           buildSPCConvectiveDiscussionModule,
@@ -379,7 +389,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:                module.WeatherStory,
 			StanzaName:        "weather_story",
 			DefaultOptions:    module.WeatherStoryOptions{},
-			RequiredCollected: []module.FactRequirement{module.CollectedWeatherStory},
+			RequiredCollected: []*factRequirement{weatherStoryRequirement},
 			SupportedReports:  allReports,
 			MissingData:       module.MissingDataOmit,
 			Builder:           buildWeatherStoryModule,
@@ -388,7 +398,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:               module.OutdoorWindows,
 			StanzaName:       "outdoor_windows",
 			DefaultOptions:   module.OutdoorWindowsOptions{},
-			RequiredDerived:  []module.FactRequirement{module.RequiresDerivedDaypartSummaries},
+			RequiredDerived:  []*factRequirement{daypartSummariesRequirement},
 			SupportedReports: daypartReports,
 			MissingData:      module.MissingDataEmpty,
 			Builder:          buildOutdoorWindowsModule,
@@ -397,7 +407,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:               module.TodayPlanning,
 			StanzaName:       "today_planning",
 			DefaultOptions:   module.TodayPlanningOptions{},
-			RequiredDerived:  []module.FactRequirement{module.RequiresDerivedDailySummaries},
+			RequiredDerived:  []*factRequirement{dailySummariesRequirement},
 			SupportedReports: []report.ID{report.Today},
 			MissingData:      module.MissingDataEmpty,
 			Builder:          buildTodayPlanningModule,
@@ -406,7 +416,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:               module.TomorrowPlanning,
 			StanzaName:       "tomorrow_planning",
 			DefaultOptions:   module.TomorrowPlanningOptions{},
-			RequiredDerived:  []module.FactRequirement{module.RequiresDerivedDailySummaries},
+			RequiredDerived:  []*factRequirement{dailySummariesRequirement},
 			SupportedReports: []report.ID{report.Tomorrow},
 			MissingData:      module.MissingDataEmpty,
 			Builder:          buildTomorrowPlanningModule,
@@ -415,7 +425,7 @@ func defaultModuleDefinitions() []ModuleDefinition {
 			ID:               module.DailyPlanning,
 			StanzaName:       "daily_planning",
 			DefaultOptions:   module.DailyPlanningOptions{},
-			RequiredDerived:  []module.FactRequirement{module.RequiresDerivedDailySummaries},
+			RequiredDerived:  []*factRequirement{dailySummariesRequirement},
 			SupportedReports: []report.ID{report.Daily},
 			MissingData:      module.MissingDataEmpty,
 			Builder:          buildDailyPlanningModule,

internal/briefing/modules_test.go

@@ -30,6 +30,55 @@ func TestDefaultModuleRegistryValidatesReportDefaults(t *testing.T) {
 	}
 }
 
+func TestFactRequirementVocabularyMatchesModuleDefinitions(t *testing.T) {
+	vocabulary := make(map[string]*factRequirement, len(factRequirementVocabulary))
+	for _, requirement := range factRequirementVocabulary {
+		if requirement.identity == "" {
+			t.Fatal("fact requirement identity is empty")
+		}
+		if requirement.category != collectedFactRequirement && requirement.category != derivedFactRequirement {
+			t.Fatalf("fact requirement %q category = %q, want collected or derived", requirement.identity, requirement.category)
+		}
+		if _, exists := vocabulary[requirement.identity]; exists {
+			t.Fatalf("duplicate fact requirement %q", requirement.identity)
+		}
+		if requirement.available == nil {
+			t.Fatalf("fact requirement %q has no availability predicate", requirement.identity)
+		}
+		vocabulary[requirement.identity] = requirement
+	}
+
+	used := map[*factRequirement]struct{}{}
+	for _, definition := range defaultModuleDefinitions() {
+		for _, requirement := range definition.RequiredCollected {
+			assertFactRequirementCategory(t, vocabulary, used, definition.ID, requirement, collectedFactRequirement)
+		}
+		for _, requirement := range definition.RequiredDerived {
+			assertFactRequirementCategory(t, vocabulary, used, definition.ID, requirement, derivedFactRequirement)
+		}
+	}
+	for _, requirement := range factRequirementVocabulary {
+		if _, ok := used[requirement]; !ok {
+			t.Fatalf("fact requirement %q is not used by a module definition", requirement.identity)
+		}
+	}
+}
+
+func assertFactRequirementCategory(t *testing.T, vocabulary map[string]*factRequirement, used map[*factRequirement]struct{}, moduleID module.ID, requirement *factRequirement, want factRequirementCategory) {
+	t.Helper()
+	descriptor, ok := vocabulary[requirement.identity]
+	if !ok {
+		t.Fatalf("module %q uses unknown fact requirement %q", moduleID, requirement.identity)
+	}
+	if descriptor != requirement {
+		t.Fatalf("module %q requirement %q does not use the vocabulary descriptor", moduleID, requirement.identity)
+	}
+	if requirement.category != want {
+		t.Fatalf("module %q requirement %q category = %q, want %q", moduleID, requirement.identity, requirement.category, want)
+	}
+	used[requirement] = struct{}{}
+}
+
 func TestDefaultReportModulesBuildSnapshots(t *testing.T) {
 	registry := MustDefaultModuleRegistry()
 	for _, definition := range report.DefaultRegistry().All() {
@@ -434,6 +483,52 @@ func TestModuleRegistryRejectsDefinitionsWithoutBuilders(t *testing.T) {
 	}
 }
 
+func TestModuleRegistryRejectsInvalidFactRequirements(t *testing.T) {
+	tests := []struct {
+		name      string
+		configure func(*ModuleDefinition)
+		wantErr   string
+	}{
+		{
+			name: "Unknown",
+			configure: func(definition *ModuleDefinition) {
+				definition.RequiredCollected = []*factRequirement{{identity: "collected.unknown", category: collectedFactRequirement}}
+			},
+			wantErr: `module "metadata" uses unknown collected fact requirement "collected.unknown"`,
+		},
+		{
+			name: "DerivedListedAsCollected",
+			configure: func(definition *ModuleDefinition) {
+				definition.RequiredCollected = []*factRequirement{dailySummariesRequirement}
+			},
+			wantErr: `module "metadata" lists derived fact requirement "derived.daily_summaries" as collected`,
+		},
+		{
+			name: "CollectedListedAsDerived",
+			configure: func(definition *ModuleDefinition) {
+				definition.RequiredDerived = []*factRequirement{currentConditionsRequirement}
+			},
+			wantErr: `module "metadata" lists collected fact requirement "collected.current_conditions" as derived`,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			definition := ModuleDefinition{
+				ID:             module.Metadata,
+				StanzaName:     "metadata",
+				DefaultOptions: module.MetadataOptions{},
+				Builder:        noopModuleBuilder,
+			}
+			tt.configure(&definition)
+			_, err := NewModuleRegistry([]ModuleDefinition{definition})
+			if err == nil || err.Error() != tt.wantErr {
+				t.Fatalf("error = %v, want %q", err, tt.wantErr)
+			}
+		})
+	}
+}
+
 func TestModuleRegistryRejectsUnsupportedMissingDataWarn(t *testing.T) {
 	_, err := NewModuleRegistry([]ModuleDefinition{
 		{ID: module.Metadata, StanzaName: "metadata", DefaultOptions: module.MetadataOptions{}, MissingData: module.MissingDataWarn, Builder: noopModuleBuilder},
@@ -458,6 +553,7 @@ func TestModuleRegistryAcceptsTypedOptions(t *testing.T) {
 	err := registry.ValidateComposition(report.Daily, []module.ConfigItem{
 		{ID: module.Metadata, Options: module.MetadataOptions{}},
 		{ID: module.CurrentConditions, Options: &module.CurrentConditionsOptions{}},
+		{ID: module.AreaForecastDiscussion, Options: &module.AreaForecastDiscussionOptions{Sections: []string{"short_term"}}},
 	})
 	if err != nil {
 		t.Fatalf("ValidateComposition() error = %v", err)
@@ -466,25 +562,25 @@ func TestModuleRegistryAcceptsTypedOptions(t *testing.T) {
 
 func TestSPCConvectiveOutlookCollectedRequirementAvailability(t *testing.T) {
 	ctx := ModuleContext{}
-	if collectedFactAvailable(module.CollectedSPCConvectiveOutlooks, ctx) {
-		t.Fatal("collectedFactAvailable() = true, want false without source")
+	if spcOutlooksRequirement.available(ctx) {
+		t.Fatal("SPC outlook requirement is available, want false without source")
 	}
 
 	ctx.Collected = facts.CollectedFacts{SPCConvectiveOutlooks: &weatherdata.ConvectiveOutlookRun{}}
-	if !collectedFactAvailable(module.CollectedSPCConvectiveOutlooks, ctx) {
-		t.Fatal("collectedFactAvailable() = false, want true with checked source")
+	if !spcOutlooksRequirement.available(ctx) {
+		t.Fatal("SPC outlook requirement is unavailable, want true with checked source")
 	}
 }
 
 func TestSPCConvectiveOutlookDerivedRequirementAvailability(t *testing.T) {
 	ctx := ModuleContext{}
-	if derivedFactAvailable(module.RequiresDerivedSPCConvectiveOutlooks, ctx) {
-		t.Fatal("derivedFactAvailable() = true, want false without derived outlooks")
+	if spcDerivedOutlooksRequirement.available(ctx) {
+		t.Fatal("derived SPC outlook requirement is available, want false without derived outlooks")
 	}
 
 	ctx.Derived = facts.DerivedFacts{SPCConvectiveOutlooks: []weatherdata.ConvectiveOutlook{}}
-	if !derivedFactAvailable(module.RequiresDerivedSPCConvectiveOutlooks, ctx) {
-		t.Fatal("derivedFactAvailable() = false, want true for checked empty derived outlooks")
+	if !spcDerivedOutlooksRequirement.available(ctx) {
+		t.Fatal("derived SPC outlook requirement is unavailable, want true for checked empty derived outlooks")
 	}
 }
 

internal/briefing/package.go

@@ -9,7 +9,9 @@ import (
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
 )
 
-type Metadata struct {
+// PreparedIdentity is the single prepared authority for report identity,
+// timing, configuration context, and source warnings.
+type PreparedIdentity struct {
 	RunID            string                      `json:"runId"`
 	ReportID         report.ID                   `json:"reportId"`
 	Variant          string                      `json:"variant,omitempty"`
@@ -21,9 +23,7 @@ type Metadata struct {
 	Location         *LocationContext            `json:"location,omitempty"`
 	SourceLocationID string                      `json:"sourceLocationId,omitempty"`
 	SourceLocation   string                      `json:"sourceLocation,omitempty"`
-	Sources          []SourceMetadata            `json:"sources,omitempty"`
 	SourceWarnings   []weatherdata.SourceWarning `json:"sourceWarnings,omitempty"`
-	Alerts           *AlertStatus                `json:"alerts,omitempty"`
 }
 
 type LocationContext struct {
@@ -33,24 +33,6 @@ type LocationContext struct {
 	Timezone string `json:"timezone,omitempty"`
 }
 
-type SourceMetadata struct {
-	Name       string                      `json:"name"`
-	Endpoint   string                      `json:"endpoint,omitempty"`
-	FetchedAt  time.Time                   `json:"fetchedAt"`
-	IssuedAt   *time.Time                  `json:"issuedAt,omitempty"`
-	UpdatedAt  *time.Time                  `json:"updatedAt,omitempty"`
-	DataSHA256 string                      `json:"dataSha256,omitempty"`
-	Missing    bool                        `json:"missing,omitempty"`
-	Warnings   []weatherdata.SourceWarning `json:"warnings,omitempty"`
-}
-
-type AlertStatus struct {
-	Checked       bool `json:"checked"`
-	ActiveCount   int  `json:"activeCount"`
-	RelevantCount int  `json:"relevantCount"`
-	Missing       bool `json:"missing,omitempty"`
-}
-
 type BuildContext struct {
 	Resolved report.Resolved
 	Bundle   *weatherdata.Bundle
@@ -59,10 +41,10 @@ type BuildContext struct {
 	Location *LocationContext
 }
 
-func BuildMetadata(ctx BuildContext) Metadata {
+func BuildPreparedIdentity(ctx BuildContext) PreparedIdentity {
 	metadata := ctx.Resolved.Metadata()
 	sourceLocationID, sourceLocation := sourceLocation(ctx.Bundle)
-	return Metadata{
+	return PreparedIdentity{
 		RunID:            metadata.RunID,
 		ReportID:         metadata.ReportID,
 		Variant:          variantForReport(metadata.ReportID),
@@ -74,9 +56,7 @@ func BuildMetadata(ctx BuildContext) Metadata {
 		Location:         copyLocation(ctx.Location),
 		SourceLocationID: sourceLocationID,
 		SourceLocation:   sourceLocation,
-		Sources:          sourceMetadata(ctx.Bundle),
-		SourceWarnings:   sourceWarnings(ctx.Bundle),
-		Alerts:           alertStatus(ctx.Bundle),
+		SourceWarnings:   append([]weatherdata.SourceWarning(nil), sourceWarnings(ctx.Bundle)...),
 	}
 }
 
@@ -135,26 +115,6 @@ func sourceLocation(bundle *weatherdata.Bundle) (string, string) {
 	return "", ""
 }
 
-func sourceMetadata(bundle *weatherdata.Bundle) []SourceMetadata {
-	if bundle == nil {
-		return nil
-	}
-	out := make([]SourceMetadata, 0, len(bundle.Sources))
-	for _, source := range bundle.Sources {
-		out = append(out, SourceMetadata{
-			Name:       source.Name,
-			Endpoint:   source.Endpoint,
-			FetchedAt:  source.FetchedAt,
-			IssuedAt:   source.IssuedAt,
-			UpdatedAt:  source.UpdatedAt,
-			DataSHA256: source.DataSHA256,
-			Missing:    source.Missing,
-			Warnings:   source.Warnings,
-		})
-	}
-	return out
-}
-
 func sourceWarnings(bundle *weatherdata.Bundle) []weatherdata.SourceWarning {
 	if bundle == nil {
 		return nil
@@ -162,27 +122,6 @@ func sourceWarnings(bundle *weatherdata.Bundle) []weatherdata.SourceWarning {
 	return bundle.Warnings
 }
 
-func alertStatus(bundle *weatherdata.Bundle) *AlertStatus {
-	if bundle == nil {
-		return nil
-	}
-	status := &AlertStatus{}
-	if bundle.Alerts != nil {
-		status.Checked = true
-		status.ActiveCount = len(bundle.Alerts.Alerts)
-	}
-	for _, source := range bundle.Sources {
-		if source.Name == "alerts" && source.Missing {
-			status.Missing = true
-			break
-		}
-	}
-	if !status.Checked && !status.Missing {
-		return nil
-	}
-	return status
-}
-
 func variantForReport(id report.ID) string {
 	switch id {
 	case report.Daily, report.Today:

internal/briefing/precip_timing_module.go

@@ -100,7 +100,7 @@ func precipitationWindowExpectationPhrase(maxPopPercent int, precipitationType s
 	case maxPopPercent >= precipTimingExpectLowerBound:
 		return fmt.Sprintf("Expect %s.", precipitationType)
 	case maxPopPercent >= precipTimingLikelyLowerBound:
-		return fmt.Sprintf("%s likely.", sentenceCase(precipitationType))
+		return fmt.Sprintf("%s likely.", capitalizeFirst(strings.TrimSpace(precipitationType)))
 	case maxPopPercent >= precipTimingChanceLowerBound:
 		return fmt.Sprintf("Chance of %s.", precipitationType)
 	default:

internal/briefing/prepared_identity_test.go

@@ -0,0 +1,26 @@
+package briefing
+
+import (
+	"reflect"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
+)
+
+func TestPreparedIdentityCopiesMutableFields(t *testing.T) {
+	moduleContext := testModuleContext()
+	context := BuildContext{
+		Resolved: moduleContext.Resolved,
+		Bundle:   moduleContext.Collected.Bundle(),
+		Units:    moduleContext.Units,
+		Timezone: moduleContext.Timezone,
+		Location: moduleContext.Location,
+	}
+	identity := BuildPreparedIdentity(context)
+	originalWarnings := append([]weatherdata.SourceWarning(nil), moduleContext.Collected.SourceWarnings...)
+	identity.Location.Name = "consumer mutation"
+	identity.SourceWarnings = append(identity.SourceWarnings, moduleContext.Collected.SourceWarnings[0])
+	if moduleContext.Location.Name == "consumer mutation" || !reflect.DeepEqual(moduleContext.Collected.SourceWarnings, originalWarnings) {
+		t.Fatalf("prepared identity changed its source context: %#v", identity)
+	}
+}

internal/briefing/spc_convective_outlook_definitions.go

@@ -17,11 +17,29 @@ func mustLoadSPCOutlookBackgroundDefinitions() map[string]SPCOutlookBackgroundDe
 	if err != nil {
 		panic(fmt.Sprintf("read embedded SPC outlook definitions: %v", err))
 	}
-	var definitions map[string]SPCOutlookBackgroundDefinition
-	if err := json.Unmarshal(data, &definitions); err != nil {
+	var asset spcOutlookBackgroundDefinitionAsset
+	if err := json.Unmarshal(data, &asset); err != nil {
 		panic(fmt.Sprintf("decode embedded SPC outlook definitions: %v", err))
 	}
-	return definitions
+	return asset.Definitions
+}
+
+type spcOutlookBackgroundDefinitionAsset struct {
+	Provenance  spcOutlookDefinitionProvenance            `json:"provenance"`
+	Definitions map[string]SPCOutlookBackgroundDefinition `json:"definitions"`
+}
+
+type spcOutlookDefinitionProvenance struct {
+	Sources        []spcOutlookDefinitionSource `json:"sources"`
+	ReviewedOn     string                       `json:"reviewed_on"`
+	ReviewOwner    string                       `json:"review_owner"`
+	ReviewSchedule string                       `json:"review_schedule"`
+}
+
+type spcOutlookDefinitionSource struct {
+	URL       string `json:"url"`
+	UpdatedOn string `json:"updated_on"`
+	AppliesTo string `json:"applies_to"`
 }
 
 func spcOutlookBackgroundDefinition(outlookType string, label string) *SPCOutlookBackgroundDefinition {

internal/briefing/spc_convective_outlooks_module_test.go

@@ -65,11 +65,9 @@ func TestSPCConvectiveOutlooksModuleBuildsPromptSafeRiskProduct(t *testing.T) {
 	if got.Day != 1 || got.OutlookType != "categorical" || got.Label != "SLGT" || got.LabelText != "Slight Risk" {
 		t.Fatalf("outlook = %#v, want categorical slight risk fields", got)
 	}
-	if got.BackgroundDefinition == nil ||
-		got.BackgroundDefinition.PlainLanguage != "Scattered severe storms possible." ||
-		got.BackgroundDefinition.OfficialDescription != "Isolated intense storms are possible within the risk area, but severe weather is generally expected to be short-lived and/or not widespread." ||
-		got.BackgroundDefinition.RelativeLevel != "2 of 5" {
-		t.Fatalf("background definition = %#v, want Slight Risk helper", got.BackgroundDefinition)
+	wantBackground := spcOutlookBackgroundDefinition("categorical", "SLGT")
+	if got.BackgroundDefinition == nil || wantBackground == nil || *got.BackgroundDefinition != *wantBackground {
+		t.Fatalf("background definition = %#v, want matching Slight Risk helper %#v", got.BackgroundDefinition, wantBackground)
 	}
 	if got.PeriodBegins != "2026-05-29 at 11:00 AM" || got.PeriodEnds != "2026-05-30 at 7:00 AM" || got.IssuedAt != "2026-05-29 at 8:45 AM" {
 		t.Fatalf("outlook times = %#v, want friendly local labels", got)
@@ -193,12 +191,33 @@ func TestSPCOutlookBackgroundDefinitionsAssetHasUsableEntries(t *testing.T) {
 	}
 }
 
-func TestSPCRiskDigestDefaultPolicyConstants(t *testing.T) {
-	if defaultSPCRiskDigestOutlookType != "categorical" {
-		t.Fatalf("defaultSPCRiskDigestOutlookType = %q, want categorical", defaultSPCRiskDigestOutlookType)
+func TestSPCOutlookBackgroundDefinitionAssetRecordsProvenance(t *testing.T) {
+	data, err := spcConvectiveOutlookDefinitionAssets.ReadFile("assets/spc_convective_outlook_definitions.json")
+	if err != nil {
+		t.Fatalf("ReadFile() error = %v", err)
 	}
-	if defaultSPCRiskDigestMinimumSeverityRank != 3 {
-		t.Fatalf("defaultSPCRiskDigestMinimumSeverityRank = %d, want 3", defaultSPCRiskDigestMinimumSeverityRank)
+	var asset spcOutlookBackgroundDefinitionAsset
+	if err := json.Unmarshal(data, &asset); err != nil {
+		t.Fatalf("Unmarshal() error = %v", err)
+	}
+	if asset.Provenance.ReviewedOn == "" || asset.Provenance.ReviewOwner == "" || asset.Provenance.ReviewSchedule == "" {
+		t.Fatalf("asset provenance = %#v, want review metadata", asset.Provenance)
+	}
+	wantSources := map[string]string{
+		"https://www.spc.noaa.gov/about/outlooks/":                         "categorical outlook descriptions",
+		"https://www.spc.noaa.gov/exper/conditional-intensity-information": "conditional intensity group descriptions",
+	}
+	if len(asset.Provenance.Sources) != len(wantSources) {
+		t.Fatalf("asset provenance sources = %#v, want %d authoritative sources", asset.Provenance.Sources, len(wantSources))
+	}
+	for _, source := range asset.Provenance.Sources {
+		if source.UpdatedOn == "" || wantSources[source.URL] != source.AppliesTo {
+			t.Fatalf("asset provenance source = %#v, want authoritative source metadata", source)
+		}
+		delete(wantSources, source.URL)
+	}
+	if len(wantSources) != 0 {
+		t.Fatalf("asset provenance missing sources = %#v", wantSources)
 	}
 }
 

internal/briefing/summary_helpers.go

@@ -5,6 +5,7 @@ import (
 	"math"
 	"sort"
 	"strings"
+	"unicode"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/forecast"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/timeutil"
@@ -41,6 +42,15 @@ type TodayPlanning struct {
 	LateDayChangeWatch           []string
 }
 
+const outdoorIndicatorRiskScore = 25
+
+const (
+	morningDaypartIdentity   = "morning"
+	afternoonDaypartIdentity = "afternoon"
+	eveningDaypartIdentity   = "evening"
+	overnightDaypartIdentity = "overnight"
+)
+
 func buildOutdoorWindows(dayparts []forecast.DaypartSummary) OutdoorWindows {
 	var best *OutdoorWindow
 	var worst *OutdoorWindow
@@ -72,7 +82,7 @@ func buildTodayPlanning(summary *forecast.DailySummary) *TodayPlanning {
 	}
 
 	for _, daypart := range summary.Dayparts {
-		if daypart.Name == "overnight" || daypart.Name == "evening" {
+		if isOutsideWorkday(daypart) {
 			continue
 		}
 		planning.CommuteSchoolWorkdayConcerns = appendUnique(planning.CommuteSchoolWorkdayConcerns, concernNotes(daypart)...)
@@ -91,7 +101,7 @@ func buildTodayPlanning(summary *forecast.DailySummary) *TodayPlanning {
 		planning.OutdoorPlanning = append(planning.OutdoorPlanning, "No standout outdoor weather constraints are evident in the available forecast.")
 	}
 
-	for _, name := range []string{"afternoon", "evening"} {
+	for _, name := range []string{afternoonDaypartIdentity, eveningDaypartIdentity} {
 		daypart := daypartNamed(summary.Dayparts, name)
 		if daypart != nil {
 			planning.LateDayChangeWatch = appendUnique(planning.LateDayChangeWatch, lateDayWatchNotes(*daypart)...)
@@ -124,7 +134,7 @@ func buildMorningCommuteOvernightPlanning(summary *forecast.DailySummary) *morni
 	}
 
 	for _, daypart := range summary.Dayparts {
-		if daypart.Name == "overnight" || daypart.Name == "evening" {
+		if isOutsideWorkday(daypart) {
 			continue
 		}
 		planning.CommuteSchoolWorkdayConcerns = appendUnique(planning.CommuteSchoolWorkdayConcerns, concernNotes(daypart)...)
@@ -153,10 +163,10 @@ func outdoorPlanningNotes(dayparts []forecast.DaypartSummary) []string {
 	windows := buildOutdoorWindows(dayparts)
 	var notes []string
 	if windows.Best != nil {
-		notes = append(notes, fmt.Sprintf("Best outdoor window: %s (%s).", titleWord(windows.Best.Daypart), strings.Join(windows.Best.Reasons, ", ")))
+		notes = append(notes, fmt.Sprintf("Best outdoor window: %s (%s).", capitalizeFirst(windows.Best.Daypart), strings.Join(windows.Best.Reasons, ", ")))
 	}
 	if windows.Worst != nil && (windows.Best == nil || windows.Worst.Daypart != windows.Best.Daypart) {
-		notes = append(notes, fmt.Sprintf("Toughest outdoor window: %s (%s).", titleWord(windows.Worst.Daypart), strings.Join(windows.Worst.Reasons, ", ")))
+		notes = append(notes, fmt.Sprintf("Toughest outdoor window: %s (%s).", capitalizeFirst(windows.Worst.Daypart), strings.Join(windows.Worst.Reasons, ", ")))
 	}
 	return appendUnique(nil, notes...)
 }
@@ -183,7 +193,7 @@ func readinessNotes(daypart forecast.DaypartSummary) []string {
 
 func lateDayWatchNotes(daypart forecast.DaypartSummary) []string {
 	notes := []string{}
-	prefix := titleWord(daypart.Name)
+	prefix := capitalizeFirst(daypart.Name)
 	if prefix == "" {
 		prefix = "Late-day"
 	}
@@ -204,7 +214,7 @@ func lateDayWatchNotes(daypart forecast.DaypartSummary) []string {
 
 func concernNotes(daypart forecast.DaypartSummary) []string {
 	notes := []string{}
-	prefix := titleWord(daypart.Name)
+	prefix := capitalizeFirst(daypart.Name)
 	if prefix == "" {
 		prefix = "Daytime"
 	}
@@ -247,8 +257,9 @@ func overnightWatchNotes(daypart forecast.DaypartSummary) []string {
 }
 
 func daypartNamed(dayparts []forecast.DaypartSummary, name string) *forecast.DaypartSummary {
+	identity := forecast.CanonicalDaypartKey(name)
 	for i := range dayparts {
-		if strings.EqualFold(dayparts[i].Name, name) {
+		if forecast.CanonicalDaypartKey(dayparts[i].Name) == identity {
 			return &dayparts[i]
 		}
 	}
@@ -275,7 +286,7 @@ func scoreOutdoorWindow(daypart forecast.DaypartSummary) OutdoorWindow {
 		reasons = append(reasons, "alert overlap")
 	}
 	if daypart.Indicators.Heat || daypart.Indicators.Cold {
-		score += 25
+		score += outdoorIndicatorRiskScore
 		if daypart.Indicators.Heat {
 			reasons = append(reasons, "heat risk")
 		}
@@ -283,6 +294,19 @@ func scoreOutdoorWindow(daypart forecast.DaypartSummary) OutdoorWindow {
 			reasons = append(reasons, "cold risk")
 		}
 	}
+	for _, hazard := range []struct {
+		present bool
+		reason  string
+	}{
+		{present: daypart.Indicators.Snow, reason: "snow risk"},
+		{present: daypart.Indicators.Ice, reason: "ice risk"},
+		{present: daypart.Indicators.Fog, reason: "fog risk"},
+	} {
+		if hazard.present {
+			score += outdoorIndicatorRiskScore
+			reasons = append(reasons, hazard.reason)
+		}
+	}
 	if len(reasons) == 0 {
 		reasons = append(reasons, "quiet weather")
 	}
@@ -382,9 +406,20 @@ func appendUnique(values []string, candidates ...string) []string {
 	return values
 }
 
-func titleWord(value string) string {
+func isOutsideWorkday(daypart forecast.DaypartSummary) bool {
+	switch forecast.CanonicalDaypartKey(daypart.Name) {
+	case overnightDaypartIdentity, eveningDaypartIdentity:
+		return true
+	default:
+		return false
+	}
+}
+
+func capitalizeFirst(value string) string {
 	if value == "" {
 		return ""
 	}
-	return strings.ToUpper(value[:1]) + value[1:]
+	runes := []rune(value)
+	runes[0] = unicode.ToUpper(runes[0])
+	return string(runes)
 }

internal/briefing/weather_story_module.go

@@ -23,7 +23,7 @@ type WeatherStoryModule struct {
 
 func buildWeatherStoryModule(ctx ModuleContext, _ any) (*module.Output, error) {
 	story := ctx.Collected.WeatherStory
-	if story == nil {
+	if story == nil || !story.HasUsableContent() {
 		return nil, nil
 	}
 	period := timeutil.Period{Start: story.StartTime, End: story.EndTime}

internal/cli/comparison_test.go

@@ -0,0 +1,372 @@
+package cli
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"reflect"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/app"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/timeutil"
+)
+
+func TestParseComparisonFlagsPreservesProfileOrder(t *testing.T) {
+	opts, err := parseComparisonFlags(app.ReportDaily, []string{
+		"--profile", "weather-light", "--profile=weather-balanced", "--profile", "weather-deep",
+		"--date", "2026-05-29", "--out-dir", "reports", "--replace", "--quiet",
+	})
+	if err != nil {
+		t.Fatalf("parseComparisonFlags() error = %v", err)
+	}
+	wantProfiles := []string{"weather-light", "weather-balanced", "weather-deep"}
+	if !reflect.DeepEqual([]string(opts.ProfileIDs), wantProfiles) || opts.Date != "2026-05-29" || opts.OutputDir != "reports" || !opts.Replace || !opts.Quiet {
+		t.Fatalf("options = %#v", opts)
+	}
+}
+
+func TestResolveComparisonActionBuildsExplicitRequest(t *testing.T) {
+	workingDir := t.TempDir()
+	configPath := comparisonConfigPath(t, "weather_api:\n  base_url: https://weather.api.example.com/\n  units: metric\n  timezone: America/Chicago\noutput:\n  directory: configured-reports\npromptkit:\n  profile: configured-default\n")
+	clock := timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 30, 0, 0, time.UTC)}
+	var factoryConfig PromptExecutorConfig
+	factoryCalls := 0
+	executor := &factoryExecutor{}
+	runner := Runner{
+		Clock: clock, WorkingDir: workingDir,
+		ExecutorFactory: func(value PromptExecutorConfig) (promptexec.Executor, error) {
+			factoryCalls++
+			factoryConfig = value
+			return executor, nil
+		},
+	}
+	req, opts, err := runner.resolveComparisonAction([]string{
+		"daily", "--date", "2026-05-29", "--profile", "weather-light", "--profile", "weather-deep",
+		"--out-dir", "bundles/../comparison", "--replace", "--llm-debug-dir", "/tmp/debug", "--units", "imperial", "--tz", "America/New_York", "--config", configPath,
+	})
+	if err != nil {
+		t.Fatalf("resolveComparisonAction() error = %v", err)
+	}
+	if factoryCalls != 1 || req.Executor != executor || req.Clock != clock || req.WorkingDir != workingDir || req.OutputDir != filepath.Join(workingDir, "comparison") || !req.Replace || req.LLMDebugDir != "/tmp/debug" {
+		t.Fatalf("request/factory calls = %#v/%#v/%d", req, factoryConfig, factoryCalls)
+	}
+	if got, want := req.ProfileIDs, []string{"weather-light", "weather-deep"}; !reflect.DeepEqual(got, want) {
+		t.Fatalf("profile IDs = %#v, want %#v", got, want)
+	}
+	if req.Config.WeatherAPI.Units != "imperial" || req.Config.WeatherAPI.Timezone != "America/New_York" || req.Config.Output.Directory != "configured-reports" || factoryConfig.Profile != "" || opts.Quiet {
+		t.Fatalf("configuration/options/factory config = %#v/%#v/%#v", req.Config, opts, factoryConfig)
+	}
+	location, loadErr := time.LoadLocation("America/New_York")
+	if loadErr != nil || req.Date.Location().String() != location.String() || req.Date.Format("2006-01-02") != "2026-05-29" {
+		t.Fatalf("date/location = %v/%v", req.Date, loadErr)
+	}
+}
+
+func TestResolveComparisonActionLeavesConfiguredOutputWithoutOverride(t *testing.T) {
+	workingDir := t.TempDir()
+	configPath := comparisonConfigPath(t, "weather_api:\n  base_url: https://weather.api.example.com/\noutput:\n  directory: configured/../reports\n")
+	req, _, err := comparisonRunner(t, workingDir).resolveComparisonAction([]string{
+		"daily", "--date", "2026-05-29", "--profile", "weather-light", "--profile", "weather-deep", "--config", configPath,
+	})
+	if err != nil || req.OutputDir != "" || req.Config.Output.Directory != "configured/../reports" {
+		t.Fatalf("request/error = %#v/%v", req, err)
+	}
+}
+
+func TestComparisonInputFailuresDoNotConstructOrExecute(t *testing.T) {
+	for _, test := range []struct {
+		name string
+		args []string
+	}{
+		{name: "missing report", args: nil},
+		{name: "unknown report", args: []string{"unknown", "--profile", "one", "--profile", "two"}},
+		{name: "single profile", args: []string{"today", "--profile", "one"}},
+		{name: "blank profile", args: []string{"today", "--profile", "one", "--profile", " \t"}},
+		{name: "duplicate profile", args: []string{"today", "--profile", "one", "--profile", "one"}},
+		{name: "unexpected argument", args: []string{"today", "extra", "--profile", "one", "--profile", "two"}},
+		{name: "unsupported output flag", args: []string{"today", "--out", "report.md", "--profile", "one", "--profile", "two"}},
+		{name: "configuration failure", args: []string{"today", "--profile", "one", "--profile", "two", "--config", filepath.Join(t.TempDir(), "missing.yml")}},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			factoryCalls, applicationCalls := 0, 0
+			runner := Runner{
+				Clock: timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 30, 0, 0, time.UTC)},
+				ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+					factoryCalls++
+					return &factoryExecutor{}, nil
+				},
+				compareDetailed: func(context.Context, app.ComparisonRequest) (*app.ComparisonResult, error) {
+					applicationCalls++
+					return nil, nil
+				},
+			}
+			var stdout, stderr bytes.Buffer
+			if err := runner.Run(context.Background(), append([]string{"compare"}, test.args...), &stdout, &stderr); err == nil {
+				t.Fatal("Run() error = nil")
+			}
+			if factoryCalls != 0 || applicationCalls != 0 || stdout.Len() != 0 || stderr.Len() != 0 {
+				t.Fatalf("factory/application calls/output = %d/%d/%q/%q", factoryCalls, applicationCalls, stdout.String(), stderr.String())
+			}
+		})
+	}
+}
+
+func TestCompareCommandUsesOneExecutorAndInjectedApplication(t *testing.T) {
+	workingDir := t.TempDir()
+	configPath := comparisonConfigPath(t, "weather_api:\n  base_url: https://weather.api.example.com/\n")
+	executor := &factoryExecutor{}
+	factoryCalls, applicationCalls := 0, 0
+	var received app.ComparisonRequest
+	wantResult := &app.ComparisonResult{ComparisonID: "comparison_test"}
+	comparisonErr := errors.New("comparison completed with 1 failed profiles")
+	runner := Runner{
+		Clock: timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 30, 0, 0, time.UTC)}, WorkingDir: workingDir,
+		ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+			factoryCalls++
+			return executor, nil
+		},
+		compareDetailed: func(_ context.Context, req app.ComparisonRequest) (*app.ComparisonResult, error) {
+			applicationCalls++
+			received = req
+			return wantResult, comparisonErr
+		},
+	}
+	var stdout, stderr bytes.Buffer
+	err := runner.Run(context.Background(), []string{
+		"compare", "daily", "--date", "2026-05-29", "--profile", "weather-light", "--profile", "weather-deep", "--out-dir", "comparison", "--replace", "--config", configPath,
+	}, &stdout, &stderr)
+	if !errors.Is(err, comparisonErr) || factoryCalls != 1 || applicationCalls != 1 || received.Executor != executor || received.OutputDir != filepath.Join(workingDir, "comparison") || !received.Replace || stdout.Len() == 0 || stderr.Len() != 0 {
+		t.Fatalf("error/calls/request/output = %v/%d/%d/%#v/%q/%q", err, factoryCalls, applicationCalls, received, stdout.String(), stderr.String())
+	}
+	if !reflect.DeepEqual(received.ProfileIDs, []string{"weather-light", "weather-deep"}) {
+		t.Fatalf("profile IDs = %#v", received.ProfileIDs)
+	}
+}
+
+func TestCompareCommandWritesStructuredPartialFailure(t *testing.T) {
+	workingDir := t.TempDir()
+	configPath := comparisonConfigPath(t, "weather_api:\n  base_url: https://weather.api.example.com/\n")
+	profileFailure := comparison.NewSafeError("generation", "execute prompt failed")
+	result := comparisonResult("/reports/comparison-daily", []app.ComparisonProfileResult{
+		{Position: 1, ProfileID: "weather-light", BackendID: "local", ModelName: "light", Status: comparison.StatusSucceeded, ValidationStatus: promptexec.ValidationPassed, ReportPath: "/reports/comparison-daily/01-weather-light.md", LLMDebugPath: "/debug/comparison-light"},
+		{Position: 2, ProfileID: "weather-deep", BackendID: "cloud", ModelName: "deep", Status: comparison.StatusFailed, Error: &profileFailure},
+	})
+	partialErr := errors.New("comparison completed with 1 failed profiles")
+	factoryCalls, applicationCalls := 0, 0
+	runner := Runner{
+		Clock: timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 30, 0, 0, time.UTC)}, WorkingDir: workingDir,
+		ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+			factoryCalls++
+			return &factoryExecutor{}, nil
+		},
+		compareDetailed: func(context.Context, app.ComparisonRequest) (*app.ComparisonResult, error) {
+			applicationCalls++
+			return result, partialErr
+		},
+	}
+	var stdout, stderr bytes.Buffer
+	err := runner.Run(context.Background(), []string{"compare", "daily", "--date", "2026-05-29", "--profile", "weather-light", "--profile", "weather-deep", "--config", configPath}, &stdout, &stderr)
+	if !errors.Is(err, partialErr) || factoryCalls != 1 || applicationCalls != 1 || stderr.Len() != 0 {
+		t.Fatalf("error/calls/stderr = %v/%d/%d/%q", err, factoryCalls, applicationCalls, stderr.String())
+	}
+	var summary comparisonSummary
+	if err := json.Unmarshal(stdout.Bytes(), &summary); err != nil {
+		t.Fatalf("decode summary: %v\n%s", err, stdout.String())
+	}
+	if summary.Command != commandCompare || summary.Status != summaryStatusFailed || summary.Error == nil || summary.Error.Message != partialErr.Error() || summary.OutputDirectory != result.OutputDirectory || len(summary.Results) != 2 || summary.Results[0].ReportPath != result.Results[0].ReportPath || summary.Results[0].LLMDebugPath != result.Results[0].LLMDebugPath || summary.Results[1].Error == nil {
+		t.Fatalf("summary = %#v", summary)
+	}
+}
+
+func TestCompareCommandPreservesMixedCancellationOutcomes(t *testing.T) {
+	workingDir := t.TempDir()
+	configPath := comparisonConfigPath(t, "weather_api:\n  base_url: https://weather.api.example.com/\n")
+	profileFailure := comparison.NewSafeError("validation_rejected", "validate prompt execution failed")
+	canceledProfile := comparison.NewSafeError("canceled", "profile execution canceled")
+	result := comparisonResult("/reports/comparison-daily", []app.ComparisonProfileResult{
+		{Position: 1, ProfileID: "weather-light", ModelName: "light", Status: comparison.StatusFailed, ValidationStatus: promptexec.ValidationFailed, Error: &profileFailure},
+		{Position: 2, ProfileID: "weather-deep", ModelName: "deep", Status: comparison.StatusFailed, ValidationStatus: promptexec.ValidationSkipped, Error: &canceledProfile},
+	})
+	runner := comparisonRunner(t, workingDir)
+	runner.compareDetailed = func(context.Context, app.ComparisonRequest) (*app.ComparisonResult, error) {
+		return result, context.Canceled
+	}
+
+	var stdout, stderr bytes.Buffer
+	err := runner.Run(context.Background(), []string{"compare", "daily", "--date", "2026-05-29", "--profile", "weather-light", "--profile", "weather-deep", "--config", configPath}, &stdout, &stderr)
+	if !errors.Is(err, context.Canceled) || stderr.Len() != 0 {
+		t.Fatalf("Run() error/stderr = %v/%q", err, stderr.String())
+	}
+	var summary comparisonSummary
+	if err := json.Unmarshal(stdout.Bytes(), &summary); err != nil {
+		t.Fatalf("decode summary: %v\n%s", err, stdout.String())
+	}
+	if summary.Status != summaryStatusFailed || summary.Error == nil || summary.Error.Category != "canceled" || len(summary.Results) != 2 {
+		t.Fatalf("summary = %#v", summary)
+	}
+	if first := summary.Results[0]; first.Error == nil || first.Error.Category != "validation_rejected" || first.ValidationStatus != string(promptexec.ValidationFailed) {
+		t.Fatalf("completed profile summary = %#v", first)
+	}
+	if second := summary.Results[1]; second.Error == nil || second.Error.Category != "canceled" || second.ValidationStatus != string(promptexec.ValidationSkipped) {
+		t.Fatalf("canceled profile summary = %#v", second)
+	}
+}
+
+func TestCompareCommandReportsCommittedBundleWhenCleanupFails(t *testing.T) {
+	workingDir := t.TempDir()
+	configPath := comparisonConfigPath(t, "weather_api:\n  base_url: https://weather.api.example.com/\n")
+	outputDirectory := filepath.Join(workingDir, "comparison-daily")
+	result := comparisonResult(outputDirectory, []app.ComparisonProfileResult{
+		{Position: 1, ProfileID: "weather-light", ModelName: "light", Status: comparison.StatusSucceeded, ValidationStatus: promptexec.ValidationPassed, ReportPath: filepath.Join(outputDirectory, "01-weather-light.md")},
+		{Position: 2, ProfileID: "weather-deep", ModelName: "deep", Status: comparison.StatusSucceeded, ValidationStatus: promptexec.ValidationPassed, ReportPath: filepath.Join(outputDirectory, "02-weather-deep.md")},
+	})
+	recoveryPath := filepath.Join(workingDir, ".comparison-daily.backup-retained")
+	cleanupCause := errors.New("filesystem cleanup detail")
+	cleanupErr := &comparison.PublicationCleanupError{RecoveryState: comparison.BackupRecoveryComplete, RecoveryPath: recoveryPath, Err: cleanupCause}
+	runner := comparisonRunner(t, workingDir)
+	runner.compareDetailed = func(context.Context, app.ComparisonRequest) (*app.ComparisonResult, error) {
+		return result, cleanupErr
+	}
+
+	var stdout, stderr bytes.Buffer
+	err := runner.Run(context.Background(), []string{"compare", "daily", "--date", "2026-05-29", "--profile", "weather-light", "--profile", "weather-deep", "--config", configPath}, &stdout, &stderr)
+	if !errors.Is(err, cleanupCause) || stderr.Len() != 0 {
+		t.Fatalf("Run() error/stderr = %v/%q", err, stderr.String())
+	}
+	var summary comparisonSummary
+	if err := json.Unmarshal(stdout.Bytes(), &summary); err != nil {
+		t.Fatalf("decode summary: %v\n%s", err, stdout.String())
+	}
+	if summary.Status != summaryStatusFailed || summary.Error == nil || summary.Error.Category != "publication_cleanup" || summary.Error.Message != "comparison published but a complete prior bundle remains" || summary.ManifestPath != result.ManifestPath || summary.DataPackagePath != result.DataPackagePath || summary.Results[0].ReportPath == "" {
+		t.Fatalf("summary = %#v", summary)
+	}
+	for _, unsafe := range []string{cleanupCause.Error(), recoveryPath} {
+		if strings.Contains(stdout.String(), unsafe) {
+			t.Fatalf("summary contains unsafe recovery detail %q: %s", unsafe, stdout.String())
+		}
+	}
+}
+
+func TestCompareCommandWritesSuccessForDefaultAndExplicitDestinations(t *testing.T) {
+	workingDir := t.TempDir()
+	configPath := comparisonConfigPath(t, "weather_api:\n  base_url: https://weather.api.example.com/\noutput:\n  directory: configured-reports\n")
+	for _, test := range []struct {
+		name            string
+		outputArgument  []string
+		outputDirectory string
+		wantRequestPath string
+	}{
+		{name: "configured default", outputDirectory: filepath.Join(workingDir, "configured-reports", "comparison-daily-2026-05-29")},
+		{name: "explicit directory", outputArgument: []string{"--out-dir", "published"}, outputDirectory: filepath.Join(workingDir, "published"), wantRequestPath: filepath.Join(workingDir, "published")},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			var received app.ComparisonRequest
+			runner := comparisonRunner(t, workingDir)
+			runner.compareDetailed = func(_ context.Context, req app.ComparisonRequest) (*app.ComparisonResult, error) {
+				received = req
+				return comparisonResult(test.outputDirectory, []app.ComparisonProfileResult{
+					{Position: 1, ProfileID: "weather-light", ModelName: "light", Status: comparison.StatusSucceeded, ValidationStatus: promptexec.ValidationPassed, ReportPath: filepath.Join(test.outputDirectory, "01-weather-light.md")},
+					{Position: 2, ProfileID: "weather-deep", ModelName: "deep", Status: comparison.StatusSucceeded, ValidationStatus: promptexec.ValidationPassed, ReportPath: filepath.Join(test.outputDirectory, "02-weather-deep.md")},
+				}), nil
+			}
+			args := []string{"compare", "daily", "--date", "2026-05-29", "--profile", "weather-light", "--profile", "weather-deep", "--config", configPath}
+			args = append(args, test.outputArgument...)
+			var stdout, stderr bytes.Buffer
+			if err := runner.Run(context.Background(), args, &stdout, &stderr); err != nil {
+				t.Fatalf("Run() error = %v", err)
+			}
+			var summary comparisonSummary
+			if err := json.Unmarshal(stdout.Bytes(), &summary); err != nil || summary.Status != summaryStatusSucceeded || summary.OutputDirectory != test.outputDirectory || stderr.Len() != 0 || received.OutputDir != test.wantRequestPath {
+				t.Fatalf("summary/error/stderr/request = %#v/%v/%q/%#v", summary, err, stderr.String(), received)
+			}
+		})
+	}
+}
+
+func TestCompareCommandQuietPreservesFailure(t *testing.T) {
+	configPath := comparisonConfigPath(t, "weather_api:\n  base_url: https://weather.api.example.com/\n")
+	failure := errors.New("comparison completed with 2 failed profiles")
+	calls := 0
+	runner := comparisonRunner(t, t.TempDir())
+	runner.compareDetailed = func(context.Context, app.ComparisonRequest) (*app.ComparisonResult, error) {
+		calls++
+		return comparisonResult("/reports/comparison-daily", nil), failure
+	}
+	var stdout, stderr bytes.Buffer
+	err := runner.Run(context.Background(), []string{"compare", "daily", "--date", "2026-05-29", "--profile", "weather-light", "--profile", "weather-deep", "--quiet", "--config", configPath}, &stdout, &stderr)
+	if !errors.Is(err, failure) || calls != 1 || stdout.Len() != 0 || stderr.Len() != 0 {
+		t.Fatalf("error/calls/stdout/stderr = %v/%d/%q/%q", err, calls, stdout.String(), stderr.String())
+	}
+}
+
+func TestCompareCommandLeavesPreExecutionFailuresUnstructured(t *testing.T) {
+	runner := comparisonRunner(t, t.TempDir())
+	called := false
+	runner.compareDetailed = func(context.Context, app.ComparisonRequest) (*app.ComparisonResult, error) {
+		called = true
+		return nil, nil
+	}
+	var stdout, stderr bytes.Buffer
+	err := runner.Run(context.Background(), []string{"compare", "today", "--profile", "only-one"}, &stdout, &stderr)
+	if err == nil || called || stdout.Len() != 0 || stderr.Len() != 0 {
+		t.Fatalf("error/called/stdout/stderr = %v/%t/%q/%q", err, called, stdout.String(), stderr.String())
+	}
+}
+
+func TestCompareHelpIncludesCommand(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	if err := (Runner{}).Run(context.Background(), []string{"--help"}, &stdout, &stderr); err != nil || !strings.Contains(stdout.String(), "weatherreporter compare REPORT") || !strings.Contains(stdout.String(), "--profile PROFILE") || !strings.Contains(stdout.String(), "--date YYYY-MM-DD") || !strings.Contains(stdout.String(), "Suppress action summaries and routine batch status output.") {
+		t.Fatalf("help/error = %q/%v", stdout.String(), err)
+	}
+}
+
+func TestCompareHelpDoesNotRequireConfiguration(t *testing.T) {
+	var stdout, stderr bytes.Buffer
+	if err := (Runner{}).Run(context.Background(), []string{"compare", "--help"}, &stdout, &stderr); err != nil || !strings.Contains(stdout.String(), "weatherreporter compare REPORT") || stderr.Len() != 0 {
+		t.Fatalf("help/error/stderr = %q/%v/%q", stdout.String(), err, stderr.String())
+	}
+}
+
+func comparisonRunner(t *testing.T, workingDir string) Runner {
+	t.Helper()
+	return Runner{
+		Clock: timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 30, 0, 0, time.UTC)}, WorkingDir: workingDir,
+		ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) { return &factoryExecutor{}, nil },
+	}
+}
+
+func comparisonConfigPath(t *testing.T, contents string) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "config.yml")
+	if err := os.WriteFile(path, []byte(contents), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func comparisonResult(outputDirectory string, results []app.ComparisonProfileResult) *app.ComparisonResult {
+	started := time.Date(2026, 5, 29, 13, 30, 0, 0, time.UTC)
+	result := &app.ComparisonResult{
+		ComparisonID: "comparison_run-123", ReportID: "daily", ReportName: "Daily Report",
+		PromptID: "weather.daily_generated_text", PromptVersion: "2.0.0", PromptHash: strings.Repeat("a", 64),
+		StartedAt: started, FinishedAt: started.Add(time.Minute), Timezone: "America/Chicago",
+		ValidPeriod: timeutil.Period{Start: started, End: started.Add(24 * time.Hour)}, OutputDirectory: outputDirectory,
+		ManifestPath: filepath.Join(outputDirectory, "comparison.json"), DataPackagePath: filepath.Join(outputDirectory, "data-package.yml"),
+		Results: append([]app.ComparisonProfileResult(nil), results...), Total: len(results),
+	}
+	for _, profile := range results {
+		if profile.Status == "succeeded" {
+			result.Succeeded++
+		} else {
+			result.Failed++
+		}
+	}
+	return result
+}

internal/cli/generate_test.go

@@ -0,0 +1,141 @@
+package cli
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+	"time"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/app"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/timeutil"
+)
+
+func TestGenerateInputFailuresDoNotConstructOrExecute(t *testing.T) {
+	configPath := actionConfigPath(t)
+	for _, tt := range []struct {
+		name    string
+		args    []string
+		wantErr string
+	}{
+		{name: "MissingReport", args: nil, wantErr: "generate requires a report name"},
+		{name: "UnknownReport", args: []string{"unknown"}, wantErr: "unknown generate report"},
+		{name: "MissingDailyDate", args: []string{"daily", "--config", filepath.Join(t.TempDir(), "missing.yml")}, wantErr: "generate daily requires --date YYYY-MM-DD"},
+		{name: "MalformedDailyDate", args: []string{"daily", "--date", "not-a-date", "--config", configPath}},
+		{name: "MalformedTodayDate", args: []string{"today", "--date", "not-a-date", "--config", configPath}},
+		{name: "UnexpectedArgument", args: []string{"today", "extra"}},
+		{name: "UnsupportedFlag", args: []string{"today", "--out-dir", "reports"}},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			factoryCalls, applicationCalls := 0, 0
+			runner := Runner{
+				Clock: timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 30, 0, 0, time.UTC)},
+				ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+					factoryCalls++
+					return &factoryExecutor{}, nil
+				},
+				generateDetailed: func(context.Context, app.GenerateRequest) (*app.ReportResult, error) {
+					applicationCalls++
+					return nil, nil
+				},
+			}
+			var stdout, stderr bytes.Buffer
+			err := runner.Run(context.Background(), append([]string{"generate"}, tt.args...), &stdout, &stderr)
+			if err == nil {
+				t.Fatal("Run() error = nil")
+			}
+			if tt.wantErr != "" && !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("Run() error = %q, want %q", err, tt.wantErr)
+			}
+			if factoryCalls != 0 || applicationCalls != 0 || stdout.Len() != 0 || stderr.Len() != 0 {
+				t.Fatalf("factory/application calls/output = %d/%d/%q/%q", factoryCalls, applicationCalls, stdout.String(), stderr.String())
+			}
+		})
+	}
+}
+
+func TestGenerateCommandProjectsActionResults(t *testing.T) {
+	configPath := actionConfigPath(t)
+	failure := errors.New("prompt execution failed")
+	for _, tt := range []struct {
+		name      string
+		quiet     bool
+		actionErr error
+	}{
+		{name: "Success"},
+		{name: "Failure", actionErr: failure},
+		{name: "QuietFailure", quiet: true, actionErr: failure},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			factoryCalls, applicationCalls := 0, 0
+			executor := &factoryExecutor{}
+			runner := Runner{
+				Clock: timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 30, 0, 0, time.UTC)},
+				ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+					factoryCalls++
+					return executor, nil
+				},
+				generateDetailed: func(_ context.Context, req app.GenerateRequest) (*app.ReportResult, error) {
+					applicationCalls++
+					if req.Executor != executor {
+						t.Fatal("generate request did not receive the constructed executor")
+					}
+					return generatedReportResult(), tt.actionErr
+				},
+			}
+			args := []string{"generate", "daily", "--date", "2026-05-29", "--config", configPath}
+			if tt.quiet {
+				args = append(args, "--quiet")
+			}
+			var stdout, stderr bytes.Buffer
+			err := runner.Run(context.Background(), args, &stdout, &stderr)
+			if !errors.Is(err, tt.actionErr) || factoryCalls != 1 || applicationCalls != 1 || stderr.Len() != 0 {
+				t.Fatalf("error/calls/stderr = %v/%d/%d/%q", err, factoryCalls, applicationCalls, stderr.String())
+			}
+			if tt.quiet {
+				if stdout.Len() != 0 {
+					t.Fatalf("quiet stdout = %q, want empty", stdout.String())
+				}
+				return
+			}
+
+			var summary generateSummary
+			if err := json.Unmarshal(stdout.Bytes(), &summary); err != nil {
+				t.Fatalf("decode summary: %v", err)
+			}
+			wantStatus, wantError := summaryStatusSucceeded, ""
+			if tt.actionErr != nil {
+				wantStatus, wantError = summaryStatusFailed, tt.actionErr.Error()
+			}
+			if summary.Command != commandGenerate || summary.Status != wantStatus || summary.Error != wantError || summary.OutputPath != "/reports/daily.md" {
+				t.Fatalf("summary = %#v", summary)
+			}
+		})
+	}
+}
+
+func actionConfigPath(t *testing.T) string {
+	t.Helper()
+	path := filepath.Join(t.TempDir(), "config.yml")
+	if err := os.WriteFile(path, []byte("weather_api:\n  base_url: https://weather.api.example.com/\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	return path
+}
+
+func generatedReportResult() *app.ReportResult {
+	generatedAt := time.Date(2026, 5, 29, 13, 30, 0, 0, time.UTC)
+	return &app.ReportResult{
+		ReportID: report.Daily, ReportName: "Daily Report", PromptID: "weather.daily_generated_text", PromptVersion: "2.0.0",
+		RunID: "daily-20260529", GeneratedAt: generatedAt, Timezone: "America/Chicago",
+		ValidPeriod: timeutil.Period{Start: generatedAt, End: generatedAt.Add(24 * time.Hour)},
+		ProfileID:   "weather-light", BackendID: "local", ModelName: "weather-model", ValidationStatus: promptexec.ValidationPassed,
+		OutputPath: "/reports/daily.md",
+	}
+}

internal/cli/output.go

@@ -37,6 +37,10 @@ func writeBatchStatus(stderr io.Writer, result *app.BatchResult) {
 			_, _ = fmt.Fprintf(stderr, "report=%s status=failed error=%q\n", item.ReportID, item.Error)
 			continue
 		}
+		if item.Status == "canceled" {
+			_, _ = fmt.Fprintf(stderr, "report=%s status=canceled\n", item.ReportID)
+			continue
+		}
 		_, _ = fmt.Fprintf(stderr, "report=%s status=succeeded output=%q\n", item.ReportID, item.OutputPath)
 	}
 	if result.Notification != nil {
@@ -58,5 +62,5 @@ func writeBatchStatus(stderr io.Writer, result *app.BatchResult) {
 		}
 		_, _ = fmt.Fprintln(stderr)
 	}
-	_, _ = fmt.Fprintf(stderr, "batch=%s total=%d succeeded=%d failed=%d\n", result.Batch, result.Total, result.Succeeded, result.Failed)
+	_, _ = fmt.Fprintf(stderr, "batch=%s total=%d succeeded=%d failed=%d canceled=%d\n", result.Batch, result.Total, result.Succeeded, result.Failed, result.Canceled)
 }

internal/cli/report_date.go

@@ -0,0 +1,75 @@
+package cli
+
+import (
+	"errors"
+	"fmt"
+	"time"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/app"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/timeutil"
+)
+
+var (
+	errReportDateRequired    = errors.New("report date is required")
+	errReportDateNotAccepted = errors.New("report does not accept a date")
+)
+
+type reportDatePolicy struct {
+	acceptsDate         bool
+	requiresDate        bool
+	defaultsToLocalDate bool
+}
+
+func reportDatePolicyFor(report app.ReportKind) reportDatePolicy {
+	switch report {
+	case app.ReportDaily:
+		return reportDatePolicy{acceptsDate: true, requiresDate: true}
+	case app.ReportToday:
+		return reportDatePolicy{acceptsDate: true, defaultsToLocalDate: true}
+	default:
+		return reportDatePolicy{}
+	}
+}
+
+func addReportDateFlag(fs interface {
+	StringVar(*string, string, string, string)
+}, report app.ReportKind, value *string) {
+	if reportDatePolicyFor(report).acceptsDate {
+		fs.StringVar(value, "date", "", "report date in YYYY-MM-DD")
+	}
+}
+
+func reportDateRequiredError(action string, report app.ReportKind, value string) error {
+	if reportDatePolicyFor(report).requiresDate && value == "" {
+		return fmt.Errorf("%s %s requires --date YYYY-MM-DD", action, report)
+	}
+	return nil
+}
+
+func resolveActionReportDate(action string, report app.ReportKind, value string, location *time.Location, now time.Time) (time.Time, error) {
+	date, err := resolveReportDate(report, value, location, now)
+	if errors.Is(err, errReportDateRequired) {
+		return time.Time{}, fmt.Errorf("%s %s requires --date YYYY-MM-DD", action, report)
+	}
+	return date, err
+}
+
+func resolveReportDate(report app.ReportKind, value string, location *time.Location, now time.Time) (time.Time, error) {
+	policy := reportDatePolicyFor(report)
+	if !policy.acceptsDate {
+		if value != "" {
+			return time.Time{}, errReportDateNotAccepted
+		}
+		return time.Time{}, nil
+	}
+	if value == "" {
+		if policy.requiresDate {
+			return time.Time{}, errReportDateRequired
+		}
+		if policy.defaultsToLocalDate {
+			return timeutil.LocalDate(now, location), nil
+		}
+		return time.Time{}, nil
+	}
+	return timeutil.ParseLocalDate(value, location)
+}

internal/cli/report_date_test.go

@@ -0,0 +1,101 @@
+package cli
+
+import (
+	"errors"
+	"testing"
+	"time"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/app"
+)
+
+func TestReportDatePolicy(t *testing.T) {
+	location, err := time.LoadLocation("America/New_York")
+	if err != nil {
+		t.Fatal(err)
+	}
+	now := time.Date(2026, 5, 30, 2, 30, 0, 0, time.UTC)
+
+	for _, tt := range []struct {
+		name      string
+		report    app.ReportKind
+		value     string
+		wantDay   string
+		wantErr   error
+		malformed bool
+	}{
+		{name: "DailyRequiresDate", report: app.ReportDaily, wantErr: errReportDateRequired},
+		{name: "DailyParsesDate", report: app.ReportDaily, value: "2026-05-30", wantDay: "2026-05-30"},
+		{name: "TodayDefaultsInConfiguredTimezone", report: app.ReportToday, wantDay: "2026-05-29"},
+		{name: "TodayParsesDate", report: app.ReportToday, value: "2026-05-30", wantDay: "2026-05-30"},
+		{name: "TodayRejectsMalformedDate", report: app.ReportToday, value: "not-a-date", malformed: true},
+		{name: "TomorrowHasNoDate", report: app.ReportTomorrow},
+		{name: "TomorrowRejectsDate", report: app.ReportTomorrow, value: "2026-05-30", wantErr: errReportDateNotAccepted},
+		{name: "HourlyHasNoDate", report: app.ReportHourly},
+		{name: "HourlyRejectsDate", report: app.ReportHourly, value: "2026-05-30", wantErr: errReportDateNotAccepted},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			date, err := resolveReportDate(tt.report, tt.value, location, now)
+			if tt.malformed {
+				if err == nil {
+					t.Fatal("resolveReportDate() error = nil")
+				}
+				return
+			}
+			if tt.wantErr != nil {
+				if !errors.Is(err, tt.wantErr) {
+					t.Fatalf("resolveReportDate() error = %v, want %v", err, tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("resolveReportDate() error = %v", err)
+			}
+			if tt.wantDay == "" {
+				if !date.IsZero() {
+					t.Fatalf("resolveReportDate() = %v, want zero date", date)
+				}
+				return
+			}
+			if date.Location() != location || date.Format("2006-01-02") != tt.wantDay {
+				t.Fatalf("resolveReportDate() = %v, want %s in %s", date, tt.wantDay, location)
+			}
+		})
+	}
+}
+
+func TestReportDateFlagsFollowPolicy(t *testing.T) {
+	for _, tt := range []struct {
+		report      app.ReportKind
+		acceptsDate bool
+	}{
+		{report: app.ReportDaily, acceptsDate: true},
+		{report: app.ReportToday, acceptsDate: true},
+		{report: app.ReportTomorrow},
+		{report: app.ReportHourly},
+	} {
+		t.Run(string(tt.report), func(t *testing.T) {
+			_, generateErr := parseGenerateFlags(tt.report, []string{"--date", "2026-05-30"})
+			_, comparisonErr := parseComparisonFlags(tt.report, []string{"--date", "2026-05-30"})
+			if tt.acceptsDate && (generateErr != nil || comparisonErr != nil) {
+				t.Fatalf("date flag errors = %v/%v, want accepted", generateErr, comparisonErr)
+			}
+			if !tt.acceptsDate && (generateErr == nil || comparisonErr == nil) {
+				t.Fatalf("date flag errors = %v/%v, want rejected", generateErr, comparisonErr)
+			}
+		})
+	}
+}
+
+func TestResolveActionReportDateKeepsActionSpecificMissingDateErrors(t *testing.T) {
+	location := time.UTC
+	now := time.Date(2026, 5, 30, 2, 30, 0, 0, time.UTC)
+	for _, action := range []string{"generate", "compare"} {
+		t.Run(action, func(t *testing.T) {
+			_, err := resolveActionReportDate(action, app.ReportDaily, "", location, now)
+			want := action + " daily requires --date YYYY-MM-DD"
+			if err == nil || err.Error() != want {
+				t.Fatalf("error = %v, want %q", err, want)
+			}
+		})
+	}
+}

internal/cli/result.go

@@ -1,9 +1,16 @@
 package cli
 
 import (
+	"context"
+	"errors"
+	"fmt"
+	"strconv"
+	"strings"
 	"time"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/app"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/timeutil"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/weatherdata"
@@ -12,6 +19,7 @@ import (
 const (
 	commandGenerate = "generate"
 	commandRun      = "run"
+	commandCompare  = "compare"
 
 	summaryStatusSucceeded = "succeeded"
 	summaryStatusFailed    = "failed"
@@ -62,11 +70,47 @@ type batchSummary struct {
 	Total        int                          `json:"total"`
 	Succeeded    int                          `json:"succeeded"`
 	Failed       int                          `json:"failed"`
+	Canceled     int                          `json:"canceled,omitempty"`
 	Notification *app.BatchNotificationResult `json:"notification,omitempty"`
 	Reports      []app.BatchReportResult      `json:"reports"`
 	Error        string                       `json:"error,omitempty"`
 }
 
+type comparisonSummary struct {
+	Command         string                     `json:"command"`
+	ComparisonID    string                     `json:"comparisonId"`
+	ReportID        report.ID                  `json:"reportId"`
+	ReportName      string                     `json:"reportName"`
+	PromptID        string                     `json:"promptId"`
+	PromptVersion   string                     `json:"promptVersion"`
+	PromptHash      string                     `json:"promptHash"`
+	Status          string                     `json:"status"`
+	StartedAt       time.Time                  `json:"startedAt"`
+	FinishedAt      time.Time                  `json:"finishedAt"`
+	Timezone        string                     `json:"timezone"`
+	ValidPeriod     timeutil.Period            `json:"validPeriod"`
+	OutputDirectory string                     `json:"outputDirectory"`
+	ManifestPath    string                     `json:"manifestPath,omitempty"`
+	DataPackagePath string                     `json:"dataPackagePath,omitempty"`
+	Total           int                        `json:"total"`
+	Succeeded       int                        `json:"succeeded"`
+	Failed          int                        `json:"failed"`
+	Results         []comparisonProfileSummary `json:"results"`
+	Error           *comparison.SafeError      `json:"error,omitempty"`
+}
+
+type comparisonProfileSummary struct {
+	Position         int                   `json:"position"`
+	ProfileID        string                `json:"profileId"`
+	BackendID        string                `json:"backendId,omitempty"`
+	ModelName        string                `json:"modelName"`
+	Status           string                `json:"status"`
+	ValidationStatus string                `json:"validationStatus,omitempty"`
+	ReportPath       string                `json:"reportPath,omitempty"`
+	LLMDebugPath     string                `json:"llmDebugPath,omitempty"`
+	Error            *comparison.SafeError `json:"error,omitempty"`
+}
+
 func newGenerateSummary(result *app.ReportResult, err error) generateSummary {
 	summary := generateSummary{Command: commandGenerate}
 	if result == nil {
@@ -118,7 +162,7 @@ func newGenerateNotificationSummary(result *app.NotificationResult) *generateNot
 	return summary
 }
 
-func newBatchSummary(result *app.BatchResult) batchSummary {
+func newBatchSummary(result *app.BatchResult, err error) batchSummary {
 	summary := batchSummary{Command: commandRun}
 	if result == nil {
 		return summary
@@ -131,19 +175,114 @@ func newBatchSummary(result *app.BatchResult) batchSummary {
 	summary.Total = result.Total
 	summary.Succeeded = result.Succeeded
 	summary.Failed = result.Failed
+	summary.Canceled = result.Canceled
 	summary.Notification = result.Notification
 	summary.Reports = append([]app.BatchReportResult(nil), result.Reports...)
 	if summary.Status == summaryStatusFailed {
-		summary.Error = app.BatchError{Result: result}.Error()
+		summary.Error = app.BatchError{Result: result, Cause: err}.Error()
 	}
 	return summary
 }
 
+func newComparisonSummary(result *app.ComparisonResult, err error) comparisonSummary {
+	summary := comparisonSummary{Command: commandCompare, Results: []comparisonProfileSummary{}}
+	if result == nil {
+		return summary
+	}
+	summary.ComparisonID = result.ComparisonID
+	summary.ReportID, summary.ReportName = result.ReportID, result.ReportName
+	summary.PromptID, summary.PromptVersion, summary.PromptHash = result.PromptID, result.PromptVersion, result.PromptHash
+	summary.StartedAt, summary.FinishedAt = result.StartedAt, result.FinishedAt
+	summary.Timezone, summary.ValidPeriod = result.Timezone, result.ValidPeriod
+	summary.OutputDirectory = result.OutputDirectory
+	summary.ManifestPath, summary.DataPackagePath = result.ManifestPath, result.DataPackagePath
+	summary.Total, summary.Succeeded, summary.Failed = result.Total, result.Succeeded, result.Failed
+	for _, profile := range result.Results {
+		summary.Results = append(summary.Results, comparisonProfileSummary{
+			Position: profile.Position, ProfileID: profile.ProfileID, BackendID: profile.BackendID, ModelName: profile.ModelName,
+			Status: profile.Status, ValidationStatus: string(profile.ValidationStatus), ReportPath: profile.ReportPath,
+			LLMDebugPath: profile.LLMDebugPath, Error: profile.Error,
+		})
+	}
+	summary.Status = comparisonSummaryStatus(result, err)
+	if err != nil {
+		summary.Error = safeComparisonSummaryError(err)
+	}
+	return summary
+}
+
+func comparisonSummaryStatus(result *app.ComparisonResult, err error) string {
+	if result == nil || err != nil || result.Total < 2 || result.Succeeded != result.Total || result.Failed != 0 || result.ManifestPath == "" || result.DataPackagePath == "" {
+		return summaryStatusFailed
+	}
+	return summaryStatusSucceeded
+}
+
+func safeComparisonSummaryError(err error) *comparison.SafeError {
+	if aggregate, ok := comparisonAggregateErrorMessage(err); ok {
+		safe := comparison.NewSafeError("application", aggregate)
+		return &safe
+	}
+	var cleanupErr *comparison.PublicationCleanupError
+	if errors.As(err, &cleanupErr) {
+		safe := comparison.NewSafeError("publication_cleanup", publicationCleanupMessage(cleanupErr.RecoveryState))
+		return &safe
+	}
+	var destinationErr *comparison.DestinationError
+	if errors.As(err, &destinationErr) {
+		safe := comparison.NewSafeError("destination_"+string(destinationErr.Kind), "comparison destination preflight failed")
+		return &safe
+	}
+	if category := promptexec.CategoryOf(err); category != "" {
+		safe := comparison.NewSafeError(string(category), "comparison prompt operation failed")
+		return &safe
+	}
+	if errors.Is(err, context.DeadlineExceeded) {
+		safe := comparison.NewSafeError("deadline_exceeded", "comparison deadline exceeded")
+		return &safe
+	}
+	if errors.Is(err, context.Canceled) {
+		safe := comparison.NewSafeError("canceled", "comparison canceled")
+		return &safe
+	}
+	safe := comparison.NewSafeError("application", "comparison did not complete")
+	return &safe
+}
+
+func publicationCleanupMessage(state comparison.BackupRecoveryState) string {
+	switch state {
+	case comparison.BackupRecoveryComplete:
+		return "comparison published but a complete prior bundle remains"
+	case comparison.BackupRecoveryPartial:
+		return "comparison published but partial cleanup remnants remain"
+	case comparison.BackupRecoveryAbsent:
+		return "comparison published but no prior bundle remains"
+	default:
+		return "comparison published but cleanup recovery state is unknown"
+	}
+}
+
+func comparisonAggregateErrorMessage(err error) (string, bool) {
+	const prefix = "comparison completed with "
+	const suffix = " failed profiles"
+	for candidate := err; candidate != nil; candidate = errors.Unwrap(candidate) {
+		value := candidate.Error()
+		if !strings.HasPrefix(value, prefix) || !strings.HasSuffix(value, suffix) {
+			continue
+		}
+		count, parseErr := strconv.Atoi(strings.TrimSuffix(strings.TrimPrefix(value, prefix), suffix))
+		if parseErr == nil && count > 0 {
+			return fmt.Sprintf("comparison completed with %d failed profiles", count), true
+		}
+	}
+	return "", false
+}
+
 func batchSummaryStatus(result *app.BatchResult) string {
 	if result == nil {
 		return ""
 	}
-	if result.Failed > 0 || (result.Notification != nil && result.Notification.Status == summaryStatusFailed) {
+	if result.Failed > 0 || result.Canceled > 0 || (result.Notification != nil && result.Notification.Status == summaryStatusFailed) {
 		return summaryStatusFailed
 	}
 	return summaryStatusSucceeded

internal/cli/result_test.go

@@ -1,12 +1,16 @@
 package cli
 
 import (
+	"context"
 	"encoding/json"
+	"errors"
+	"fmt"
 	"strings"
 	"testing"
 	"time"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/app"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/promptexec"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/timeutil"
@@ -29,3 +33,203 @@ func TestGenerateSummaryUsesActiveResultFields(t *testing.T) {
 		}
 	}
 }
+
+func TestComparisonSummaryUsesLockedOrderAndSafeFields(t *testing.T) {
+	started := time.Date(2026, 5, 29, 13, 30, 0, 0, time.UTC)
+	profileFailure := comparison.NewSafeError("generation", "execute prompt failed")
+	result := &app.ComparisonResult{
+		ComparisonID: "comparison_run-123", ReportID: report.Daily, ReportName: "Daily Report",
+		PromptID: "weather.daily_generated_text", PromptVersion: "2.0.0", PromptHash: strings.Repeat("a", 64),
+		StartedAt: started, FinishedAt: started.Add(time.Minute), Timezone: "America/Chicago",
+		ValidPeriod: timeutil.Period{Start: started, End: started.Add(24 * time.Hour)}, OutputDirectory: "/reports/comparison-daily",
+		ManifestPath: "/reports/comparison-daily/comparison.json", DataPackagePath: "/reports/comparison-daily/data-package.yml",
+		Total: 2, Succeeded: 1, Failed: 1,
+		Results: []app.ComparisonProfileResult{
+			{Position: 1, ProfileID: "weather-light", BackendID: "local", ModelName: "light", Status: comparison.StatusSucceeded, ValidationStatus: promptexec.ValidationPassed, ReportPath: "/reports/comparison-daily/01-weather-light.md"},
+			{Position: 2, ProfileID: "weather-deep", BackendID: "cloud", ModelName: "deep", Status: comparison.StatusFailed, Error: &profileFailure},
+		},
+	}
+	summary := newComparisonSummary(result, errors.New("comparison completed with 1 failed profiles"))
+	if summary.Command != commandCompare || summary.Status != summaryStatusFailed || summary.Error == nil || summary.Error.Message != "comparison completed with 1 failed profiles" || len(summary.Results) != 2 || summary.Results[0].ReportPath == "" || summary.Results[1].Error == nil {
+		t.Fatalf("summary = %#v", summary)
+	}
+	data, err := json.Marshal(summary)
+	if err != nil {
+		t.Fatal(err)
+	}
+	previous := -1
+	for _, field := range []string{"command", "comparisonId", "reportId", "reportName", "promptId", "promptVersion", "promptHash", "status", "startedAt", "finishedAt", "timezone", "validPeriod", "outputDirectory", "manifestPath", "dataPackagePath", "total", "succeeded", "failed", "results", "error"} {
+		position := strings.Index(string(data), `"`+field+`":`)
+		if field == "error" {
+			position = strings.LastIndex(string(data), `"`+field+`":`)
+		}
+		if position <= previous {
+			t.Fatalf("field order for %q in %s", field, data)
+		}
+		previous = position
+	}
+	for _, unsafe := range []string{"provider response", "rawOutput", "renderedPrompt", "endpoint"} {
+		if strings.Contains(string(data), unsafe) {
+			t.Fatalf("summary includes unsafe content %q: %s", unsafe, data)
+		}
+	}
+}
+
+func TestComparisonSummaryOmitsUnpublishedArtifactsAndBoundsErrors(t *testing.T) {
+	result := &app.ComparisonResult{ComparisonID: "comparison_run-123", ReportID: report.Daily, Results: []app.ComparisonProfileResult{{Position: 1, ProfileID: "weather-light", ModelName: "light", Status: comparison.StatusFailed}}}
+	summary := newComparisonSummary(result, context.Canceled)
+	if summary.Status != summaryStatusFailed || summary.Error == nil || summary.Error.Message != "comparison canceled" || summary.Results == nil {
+		t.Fatalf("summary = %#v", summary)
+	}
+	data, err := json.Marshal(summary)
+	if err != nil {
+		t.Fatal(err)
+	}
+	var fields map[string]json.RawMessage
+	if err := json.Unmarshal(data, &fields); err != nil {
+		t.Fatal(err)
+	}
+	for _, omitted := range []string{"manifestPath", "dataPackagePath"} {
+		if _, exists := fields[omitted]; exists {
+			t.Fatalf("summary includes unpublished %s: %s", omitted, data)
+		}
+	}
+	publicationResult := &app.ComparisonResult{
+		ComparisonID: "comparison_run-123", ReportID: report.Daily, OutputDirectory: "/reports/comparison-daily", Total: 2, Succeeded: 2,
+		Results: []app.ComparisonProfileResult{
+			{Position: 1, ProfileID: "weather-light", ModelName: "light", Status: comparison.StatusSucceeded},
+			{Position: 2, ProfileID: "weather-deep", ModelName: "deep", Status: comparison.StatusSucceeded},
+		},
+	}
+	unsafe := errors.New("comparison completed with 1 failed profiles; provider response contains sensitive material")
+	publicationSummary := newComparisonSummary(publicationResult, unsafe)
+	if publicationSummary.Status != summaryStatusFailed || publicationSummary.Error == nil || publicationSummary.Error.Message != "comparison did not complete" || strings.Contains(publicationSummary.Error.Message, "sensitive") || publicationSummary.ManifestPath != "" || publicationSummary.DataPackagePath != "" {
+		safe := publicationSummary.Error
+		t.Fatalf("safe error = %#v", safe)
+	}
+}
+
+func TestComparisonSummaryClassifiesCompleteAndAllFailedResults(t *testing.T) {
+	started := time.Date(2026, 5, 29, 13, 30, 0, 0, time.UTC)
+	failure := comparison.NewSafeError("generation", "execute prompt failed")
+	complete := &app.ComparisonResult{
+		ComparisonID: "comparison_run-123", ReportID: report.Daily, PromptID: "weather.daily_generated_text", PromptVersion: "2.0.0", PromptHash: strings.Repeat("a", 64),
+		StartedAt: started, FinishedAt: started, Timezone: "America/Chicago", ValidPeriod: timeutil.Period{Start: started, End: started.Add(time.Hour)},
+		OutputDirectory: "/reports/comparison-daily", ManifestPath: "/reports/comparison-daily/comparison.json", DataPackagePath: "/reports/comparison-daily/data-package.yml",
+		Total: 2, Succeeded: 2,
+		Results: []app.ComparisonProfileResult{
+			{Position: 1, ProfileID: "weather-light", ModelName: "light", Status: comparison.StatusSucceeded, ValidationStatus: promptexec.ValidationPassed, ReportPath: "/reports/comparison-daily/01-weather-light.md"},
+			{Position: 2, ProfileID: "weather-deep", ModelName: "deep", Status: comparison.StatusSucceeded, ValidationStatus: promptexec.ValidationPassed, ReportPath: "/reports/comparison-daily/02-weather-deep.md"},
+		},
+	}
+	if summary := newComparisonSummary(complete, nil); summary.Status != summaryStatusSucceeded || summary.Error != nil {
+		t.Fatalf("complete summary = %#v", summary)
+	}
+	allFailed := *complete
+	allFailed.Succeeded, allFailed.Failed = 0, 2
+	allFailed.Results = []app.ComparisonProfileResult{
+		{Position: 1, ProfileID: "weather-light", ModelName: "light", Status: comparison.StatusFailed, Error: &failure},
+		{Position: 2, ProfileID: "weather-deep", ModelName: "deep", Status: comparison.StatusFailed, Error: &failure},
+	}
+	summary := newComparisonSummary(&allFailed, errors.New("comparison completed with 2 failed profiles"))
+	if summary.Status != summaryStatusFailed || summary.Error == nil || summary.Error.Message != "comparison completed with 2 failed profiles" || summary.Results[0].ReportPath != "" || summary.Results[1].Error == nil {
+		t.Fatalf("all-failed summary = %#v", summary)
+	}
+}
+
+func TestSafeComparisonSummaryErrorClassifiesWrappedFailures(t *testing.T) {
+	unsafeDetail := "unsafe filesystem and provider detail"
+	unsafeCause := errors.New(unsafeDetail)
+	for _, test := range []struct {
+		name     string
+		err      error
+		category string
+		message  string
+	}{
+		{
+			name:     "aggregate profile failure",
+			err:      fmt.Errorf("outer wrapper: %w", errors.New("comparison completed with 2 failed profiles")),
+			category: "application",
+			message:  "comparison completed with 2 failed profiles",
+		},
+		{
+			name:     "canceled",
+			err:      fmt.Errorf("outer wrapper: %w", context.Canceled),
+			category: "canceled",
+			message:  "comparison canceled",
+		},
+		{
+			name:     "deadline exceeded",
+			err:      fmt.Errorf("outer wrapper: %w", context.DeadlineExceeded),
+			category: "deadline_exceeded",
+			message:  "comparison deadline exceeded",
+		},
+		{
+			name:     "prompt operation",
+			err:      fmt.Errorf("outer wrapper: %w", promptexec.NewError(promptexec.Generation, "unsafe prompt detail", fmt.Errorf("%w: %s", context.Canceled, unsafeDetail))),
+			category: string(promptexec.Generation),
+			message:  "comparison prompt operation failed",
+		},
+		{
+			name: "destination preflight",
+			err: fmt.Errorf("outer wrapper: %w", &comparison.DestinationError{
+				Kind: comparison.DestinationNotEmpty, Target: "/tmp/" + unsafeDetail, Err: fmt.Errorf("%w: %s", context.Canceled, unsafeDetail),
+			}),
+			category: "destination_not_empty",
+			message:  "comparison destination preflight failed",
+		},
+		{
+			name: "complete cleanup recovery",
+			err: fmt.Errorf("outer wrapper: %w", &comparison.PublicationCleanupError{
+				RecoveryState: comparison.BackupRecoveryComplete, RecoveryPath: "/tmp/" + unsafeDetail, Err: fmt.Errorf("%w: %s", context.Canceled, unsafeDetail),
+			}),
+			category: "publication_cleanup",
+			message:  "comparison published but a complete prior bundle remains",
+		},
+		{
+			name: "partial cleanup remnants",
+			err: fmt.Errorf("outer wrapper: %w", &comparison.PublicationCleanupError{
+				RecoveryState: comparison.BackupRecoveryPartial, RecoveryPath: "/tmp/" + unsafeDetail, Err: fmt.Errorf("%w: %s", context.Canceled, unsafeDetail),
+			}),
+			category: "publication_cleanup",
+			message:  "comparison published but partial cleanup remnants remain",
+		},
+		{
+			name: "absent cleanup recovery",
+			err: fmt.Errorf("outer wrapper: %w", &comparison.PublicationCleanupError{
+				RecoveryState: comparison.BackupRecoveryAbsent, Err: fmt.Errorf("%w: %s", context.Canceled, unsafeDetail),
+			}),
+			category: "publication_cleanup",
+			message:  "comparison published but no prior bundle remains",
+		},
+		{
+			name: "unknown cleanup recovery",
+			err: fmt.Errorf("outer wrapper: %w", &comparison.PublicationCleanupError{
+				RecoveryState: comparison.BackupRecoveryUnknown, Err: fmt.Errorf("%w: %s", context.Canceled, unsafeDetail),
+			}),
+			category: "publication_cleanup",
+			message:  "comparison published but cleanup recovery state is unknown",
+		},
+		{
+			name:     "unknown",
+			err:      fmt.Errorf("outer wrapper: %w", unsafeCause),
+			category: "application",
+			message:  "comparison did not complete",
+		},
+	} {
+		t.Run(test.name, func(t *testing.T) {
+			result := &app.ComparisonResult{ComparisonID: "comparison_test", ReportID: report.Daily}
+			summary := newComparisonSummary(result, test.err)
+			if summary.Error == nil || summary.Error.Category != test.category || summary.Error.Message != test.message {
+				t.Fatalf("summary error = %#v, want %q/%q", summary.Error, test.category, test.message)
+			}
+			data, err := json.Marshal(summary)
+			if err != nil {
+				t.Fatal(err)
+			}
+			if strings.Contains(string(data), unsafeDetail) {
+				t.Fatalf("summary includes unsafe detail: %s", data)
+			}
+		})
+	}
+}

internal/cli/root.go

@@ -10,6 +10,7 @@ import (
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/app"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/buildinfo"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/comparison"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/timeutil"
@@ -26,6 +27,7 @@ Usage:
   weatherreporter generate hourly [--config PATH] [--units VALUE] [--tz NAME] [--out PATH] [--llm-debug-dir PATH] [--quiet]
   weatherreporter run morning [--config PATH] [--units VALUE] [--tz NAME] [--out-dir PATH] [--llm-debug-dir PATH] [--quiet]
   weatherreporter run evening [--config PATH] [--units VALUE] [--tz NAME] [--out-dir PATH] [--llm-debug-dir PATH] [--quiet]
+  weatherreporter compare REPORT --profile PROFILE --profile PROFILE [--config PATH] [--units VALUE] [--tz NAME] [--date YYYY-MM-DD] [--out-dir PATH] [--replace] [--llm-debug-dir PATH] [--quiet]
 
 Options:
   -h, --help       Show this help message.
@@ -34,9 +36,12 @@ Options:
   --units VALUE    Override weather API units.
   --tz NAME        Override weather API timezone.
   --out PATH       Write the generated Markdown report to PATH.
-  --llm-debug-dir PATH  Write sensitive prompt debug artifacts under PATH.
-  --out-dir PATH   Write generated Markdown reports beneath PATH for run commands.
-  --quiet          Suppress successful generate and run output.
+  --llm-debug-dir PATH  Write sensitive prompt debug artifacts under PATH (Unix only).
+  --profile PROFILE  Select a prompt profile for compare; repeat for every profile.
+  --date YYYY-MM-DD  Required for generate/compare daily; optional for generate/compare today.
+  --out-dir PATH   Write generated Markdown reports beneath PATH for run commands, or select the exact comparison directory.
+  --replace        Authorize replacement of a recognized comparison bundle.
+  --quiet          Suppress action summaries and routine batch status output.
 `
 
 type Runner struct {
@@ -44,7 +49,9 @@ type Runner struct {
 	ExecutorFactory  ExecutorFactory
 	Version          string
 	WorkingDir       string
+	generateDetailed func(context.Context, app.GenerateRequest) (*app.ReportResult, error)
 	runBatchDetailed func(context.Context, app.BatchRequest) (*app.BatchResult, error)
+	compareDetailed  func(context.Context, app.ComparisonRequest) (*app.ComparisonResult, error)
 }
 
 func Run(ctx context.Context, args []string, stdout io.Writer, stderr io.Writer) error {
@@ -59,6 +66,10 @@ func (r Runner) Run(ctx context.Context, args []string, stdout io.Writer, stderr
 		_, err := fmt.Fprint(stdout, helpText)
 		return err
 	}
+	if len(args) == 2 && args[0] == "compare" && (args[1] == "--help" || args[1] == "-h") {
+		_, err := fmt.Fprint(stdout, helpText)
+		return err
+	}
 	if args[0] == "--version" {
 		if len(args) != 1 {
 			return fmt.Errorf("--version does not accept arguments")
@@ -77,7 +88,11 @@ func (r Runner) Run(ctx context.Context, args []string, stdout io.Writer, stderr
 		if err != nil {
 			return err
 		}
-		result, err := app.GenerateDetailed(ctx, req)
+		generateDetailed := r.generateDetailed
+		if generateDetailed == nil {
+			generateDetailed = app.GenerateDetailed
+		}
+		result, err := generateDetailed(ctx, req)
 		if result != nil {
 			summary := newGenerateSummary(result, err)
 			if encodeErr := writeActionResult(stdout, stderr, summary, outputOptions{Quiet: opts.Quiet}, nil); encodeErr != nil {
@@ -96,17 +111,37 @@ func (r Runner) Run(ctx context.Context, args []string, stdout io.Writer, stderr
 		}
 		result, err := runBatchDetailed(ctx, req)
 		if result != nil {
-			summary := newBatchSummary(result)
+			summary := newBatchSummary(result, err)
 			if encodeErr := writeActionResult(stdout, stderr, summary, outputOptions{Quiet: opts.Quiet}, func(w io.Writer) {
 				writeBatchStatus(w, result)
 			}); encodeErr != nil {
 				return encodeErr
 			}
+			if err != nil {
+				return err
+			}
 			if summary.Status == summaryStatusFailed {
 				return app.BatchError{Result: result}
 			}
 		}
 		return err
+	case "compare":
+		req, opts, err := r.resolveComparisonAction(args[1:])
+		if err != nil {
+			return err
+		}
+		compareDetailed := r.compareDetailed
+		if compareDetailed == nil {
+			compareDetailed = app.CompareDetailed
+		}
+		result, err := compareDetailed(ctx, req)
+		if result != nil {
+			summary := newComparisonSummary(result, err)
+			if encodeErr := writeActionResult(stdout, stderr, summary, outputOptions{Quiet: opts.Quiet}, nil); encodeErr != nil {
+				return encodeErr
+			}
+		}
+		return err
 	default:
 		return fmt.Errorf("unknown command %q", args[0])
 	}
@@ -127,6 +162,24 @@ type generateOptions struct {
 	Date string
 }
 
+type comparisonOptions struct {
+	commonOptions
+	Date       string
+	ProfileIDs profileValues
+	Replace    bool
+}
+
+type profileValues []string
+
+func (values *profileValues) String() string {
+	return ""
+}
+
+func (values *profileValues) Set(value string) error {
+	*values = append(*values, value)
+	return nil
+}
+
 func (r Runner) resolveGenerate(args []string) (app.GenerateRequest, error) {
 	req, _, err := r.resolveGenerateAction(args)
 	return req, err
@@ -148,6 +201,9 @@ func (r Runner) resolveGenerateAction(args []string) (app.GenerateRequest, commo
 	if err != nil {
 		return app.GenerateRequest{}, commonOptions{}, err
 	}
+	if err := reportDateRequiredError("generate", reportKind, opts.Date); err != nil {
+		return app.GenerateRequest{}, commonOptions{}, err
+	}
 	cfg, err := config.Load(config.LoadOptions{
 		Path:     opts.ConfigPath,
 		Units:    opts.Units,
@@ -156,11 +212,19 @@ func (r Runner) resolveGenerateAction(args []string) (app.GenerateRequest, commo
 	if err != nil {
 		return app.GenerateRequest{}, commonOptions{}, err
 	}
-	executor, err := r.promptExecutor(cfg.Promptkit)
+	location, err := timeutil.LoadLocation(cfg.WeatherAPI.Timezone)
 	if err != nil {
 		return app.GenerateRequest{}, commonOptions{}, err
 	}
-	location, err := timeutil.LoadLocation(cfg.WeatherAPI.Timezone)
+	now := r.Clock.Now()
+	req := app.GenerateRequest{
+		Config:      cfg,
+		Report:      reportKind,
+		LLMDebugDir: opts.LLMDebugDir,
+		Now:         now,
+	}
+
+	req.Date, err = resolveActionReportDate("generate", reportKind, opts.Date, location, now)
 	if err != nil {
 		return app.GenerateRequest{}, commonOptions{}, err
 	}
@@ -173,36 +237,12 @@ func (r Runner) resolveGenerateAction(args []string) (app.GenerateRequest, commo
 	if err != nil {
 		return app.GenerateRequest{}, commonOptions{}, err
 	}
-
-	req := app.GenerateRequest{
-		Config:      cfg,
-		Report:      reportKind,
-		WorkingDir:  workingDir,
-		OutputPath:  outputPath,
-		LLMDebugDir: opts.LLMDebugDir,
-		Now:         r.Clock.Now(),
-		Executor:    executor,
-	}
-
-	switch reportKind {
-	case app.ReportDaily:
-		if opts.Date == "" {
-			return app.GenerateRequest{}, commonOptions{}, fmt.Errorf("generate daily requires --date YYYY-MM-DD")
-		}
-		req.Date, err = timeutil.ParseLocalDate(opts.Date, location)
-		if err != nil {
-			return app.GenerateRequest{}, commonOptions{}, err
-		}
-	case app.ReportToday:
-		if opts.Date == "" {
-			req.Date = timeutil.LocalDate(r.Clock.Now(), location)
-		} else {
-			req.Date, err = timeutil.ParseLocalDate(opts.Date, location)
-			if err != nil {
-				return app.GenerateRequest{}, commonOptions{}, err
-			}
-		}
+	req.WorkingDir, req.OutputPath = workingDir, outputPath
+	executor, err := r.promptExecutor(cfg.Promptkit)
+	if err != nil {
+		return app.GenerateRequest{}, commonOptions{}, err
 	}
+	req.Executor = executor
 
 	return req, opts.commonOptions, nil
 }
@@ -212,6 +252,64 @@ func (r Runner) resolveRun(args []string) (app.BatchRequest, error) {
 	return req, err
 }
 
+func (r Runner) resolveComparisonAction(args []string) (app.ComparisonRequest, commonOptions, error) {
+	if r.Clock == nil {
+		r.Clock = timeutil.SystemClock{}
+	}
+	if len(args) == 0 {
+		return app.ComparisonRequest{}, commonOptions{}, fmt.Errorf("compare requires a report name")
+	}
+	if _, err := report.IDForCommandName(args[0]); err != nil {
+		return app.ComparisonRequest{}, commonOptions{}, fmt.Errorf("unknown compare report %q", args[0])
+	}
+	reportKind := app.ReportKind(args[0])
+	opts, err := parseComparisonFlags(reportKind, args[1:])
+	if err != nil {
+		return app.ComparisonRequest{}, commonOptions{}, err
+	}
+	if err := comparison.ValidateProfileIDs(opts.ProfileIDs); err != nil {
+		return app.ComparisonRequest{}, commonOptions{}, err
+	}
+	cfg, err := config.Load(config.LoadOptions{
+		Path:     opts.ConfigPath,
+		Units:    opts.Units,
+		Timezone: opts.Timezone,
+	})
+	if err != nil {
+		return app.ComparisonRequest{}, commonOptions{}, err
+	}
+	location, err := timeutil.LoadLocation(cfg.WeatherAPI.Timezone)
+	if err != nil {
+		return app.ComparisonRequest{}, commonOptions{}, err
+	}
+	workingDir, err := r.workingDir()
+	if err != nil {
+		return app.ComparisonRequest{}, commonOptions{}, err
+	}
+	outputDir, err := resolveOutputOverride(workingDir, opts.OutputDir)
+	if err != nil {
+		return app.ComparisonRequest{}, commonOptions{}, err
+	}
+
+	req := app.ComparisonRequest{
+		Config: cfg, Report: reportKind, ProfileIDs: append([]string(nil), opts.ProfileIDs...),
+		WorkingDir: workingDir, OutputDir: outputDir, Replace: opts.Replace, LLMDebugDir: opts.LLMDebugDir, Clock: r.Clock,
+	}
+	req.Date, err = resolveActionReportDate("compare", reportKind, opts.Date, location, r.Clock.Now())
+	if err != nil {
+		return app.ComparisonRequest{}, commonOptions{}, err
+	}
+
+	promptkitConfig := cfg.Promptkit
+	promptkitConfig.Profile = ""
+	executor, err := r.promptExecutor(promptkitConfig)
+	if err != nil {
+		return app.ComparisonRequest{}, commonOptions{}, err
+	}
+	req.Executor = executor
+	return req, opts.commonOptions, nil
+}
+
 func (r Runner) resolveRunAction(args []string) (app.BatchRequest, commonOptions, error) {
 	if r.Clock == nil {
 		r.Clock = timeutil.SystemClock{}
@@ -259,10 +357,8 @@ func parseGenerateFlags(report app.ReportKind, args []string) (generateOptions,
 	fs.SetOutput(io.Discard)
 	opts := generateOptions{}
 	addCommonFlags(fs, &opts.commonOptions, true)
-	fs.BoolVar(&opts.Quiet, "quiet", false, "suppress successful action output")
-	if report == app.ReportDaily || report == app.ReportToday {
-		fs.StringVar(&opts.Date, "date", "", "report date in YYYY-MM-DD")
-	}
+	fs.BoolVar(&opts.Quiet, "quiet", false, "suppress action summaries and routine batch status output")
+	addReportDateFlag(fs, report, &opts.Date)
 	if err := fs.Parse(args); err != nil {
 		return generateOptions{}, err
 	}
@@ -278,7 +374,7 @@ func parseRunFlags(args []string) (commonOptions, error) {
 	opts := commonOptions{}
 	addCommonFlags(fs, &opts, false)
 	fs.StringVar(&opts.OutputDir, "out-dir", "", "generated Markdown report directory")
-	fs.BoolVar(&opts.Quiet, "quiet", false, "suppress successful action output")
+	fs.BoolVar(&opts.Quiet, "quiet", false, "suppress action summaries and routine batch status output")
 	if err := fs.Parse(args); err != nil {
 		return commonOptions{}, err
 	}
@@ -288,11 +384,30 @@ func parseRunFlags(args []string) (commonOptions, error) {
 	return opts, nil
 }
 
+func parseComparisonFlags(report app.ReportKind, args []string) (comparisonOptions, error) {
+	fs := flag.NewFlagSet("compare "+string(report), flag.ContinueOnError)
+	fs.SetOutput(io.Discard)
+	opts := comparisonOptions{}
+	addCommonFlags(fs, &opts.commonOptions, false)
+	fs.StringVar(&opts.OutputDir, "out-dir", "", "comparison bundle directory")
+	fs.BoolVar(&opts.Replace, "replace", false, "replace a recognized comparison bundle")
+	fs.BoolVar(&opts.Quiet, "quiet", false, "suppress action summaries and routine batch status output")
+	fs.Var(&opts.ProfileIDs, "profile", "prompt profile ID")
+	addReportDateFlag(fs, report, &opts.Date)
+	if err := fs.Parse(args); err != nil {
+		return comparisonOptions{}, err
+	}
+	if fs.NArg() > 0 {
+		return comparisonOptions{}, fmt.Errorf("unexpected argument %q", fs.Arg(0))
+	}
+	return opts, nil
+}
+
 func addCommonFlags(fs *flag.FlagSet, opts *commonOptions, includeOutput bool) {
 	fs.StringVar(&opts.ConfigPath, "config", "", "configuration file path")
 	fs.StringVar(&opts.Units, "units", "", "weather API units")
 	fs.StringVar(&opts.Timezone, "tz", "", "weather API timezone")
-	fs.StringVar(&opts.LLMDebugDir, "llm-debug-dir", "", "write sensitive prompt debug artifacts under PATH")
+	fs.StringVar(&opts.LLMDebugDir, "llm-debug-dir", "", "write sensitive prompt debug artifacts under PATH (Unix only)")
 	if includeOutput {
 		fs.StringVar(&opts.Output, "out", "", "generated Markdown report path")
 	}

internal/cli/run_test.go

@@ -7,6 +7,7 @@ import (
 	"errors"
 	"os"
 	"path/filepath"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
@@ -50,7 +51,8 @@ func TestResolveRunActionConstructsOneExecutor(t *testing.T) {
 func TestResolveGenerateActionUsesInjectedWorkingDirectoryForOutputOverrides(t *testing.T) {
 	workingDir := t.TempDir()
 	configPath := filepath.Join(t.TempDir(), "config.yml")
-	if err := os.WriteFile(configPath, []byte("weather_api:\n  base_url: https://weather.api.example.com/\n"), 0o600); err != nil {
+	const configuredDirectory = "configured/../reports"
+	if err := os.WriteFile(configPath, []byte("weather_api:\n  base_url: https://weather.api.example.com/\noutput:\n  directory: "+configuredDirectory+"\n"), 0o600); err != nil {
 		t.Fatal(err)
 	}
 	absoluteOutput := filepath.Join(t.TempDir(), "daily.md")
@@ -76,13 +78,76 @@ func TestResolveGenerateActionUsesInjectedWorkingDirectoryForOutputOverrides(t *
 				args = append(args, "--out", scenario.out)
 			}
 			req, _, err := runner.resolveGenerateAction(args)
-			if err != nil || req.WorkingDir != workingDir || req.OutputPath != scenario.want {
+			if err != nil || req.WorkingDir != workingDir || req.OutputPath != scenario.want || req.Config.Output.Directory != configuredDirectory {
 				t.Fatalf("resolveGenerateAction() request/error = %#v/%v", req, err)
 			}
 		})
 	}
 }
 
+func TestResolveActionsPreserveConfiguredOutputDirectoryWithoutAnOverride(t *testing.T) {
+	workingDir := t.TempDir()
+	absoluteDirectory := filepath.Join(t.TempDir(), "reports")
+	for _, configuredDirectory := range []string{"configured/../reports", absoluteDirectory} {
+		t.Run(configuredDirectory, func(t *testing.T) {
+			configPath := filepath.Join(t.TempDir(), "config.yml")
+			contents := "weather_api:\n  base_url: https://weather.api.example.com/\noutput:\n  directory: " + strconv.Quote(configuredDirectory) + "\n"
+			if err := os.WriteFile(configPath, []byte(contents), 0o600); err != nil {
+				t.Fatal(err)
+			}
+			runner := Runner{
+				Clock:      timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 0, 0, 0, time.UTC)},
+				WorkingDir: workingDir,
+				ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+					return &factoryExecutor{}, nil
+				},
+			}
+
+			generateReq, _, generateErr := runner.resolveGenerateAction([]string{"daily", "--date", "2026-05-29", "--config", configPath})
+			if generateErr != nil || generateReq.Config.Output.Directory != configuredDirectory || generateReq.OutputPath != "" {
+				t.Fatalf("resolveGenerateAction() request/error = %#v/%v", generateReq, generateErr)
+			}
+
+			batchReq, _, batchErr := runner.resolveRunAction([]string{"morning", "--config", configPath})
+			if batchErr != nil || batchReq.Config.Output.Directory != configuredDirectory || batchReq.OutputDir != "" {
+				t.Fatalf("resolveRunAction() request/error = %#v/%v", batchReq, batchErr)
+			}
+		})
+	}
+}
+
+func TestResolveRunActionUsesInjectedWorkingDirectoryForOutputOverrides(t *testing.T) {
+	workingDir := t.TempDir()
+	configPath := filepath.Join(t.TempDir(), "config.yml")
+	const configuredDirectory = "configured/../reports"
+	if err := os.WriteFile(configPath, []byte("weather_api:\n  base_url: https://weather.api.example.com/\noutput:\n  directory: "+configuredDirectory+"\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	absoluteOutput := filepath.Join(t.TempDir(), "reports")
+	for _, scenario := range []struct {
+		name string
+		out  string
+		want string
+	}{
+		{name: "relative", out: "reports/../published", want: filepath.Join(workingDir, "published")},
+		{name: "absolute", out: absoluteOutput, want: absoluteOutput},
+	} {
+		t.Run(scenario.name, func(t *testing.T) {
+			runner := Runner{
+				Clock:      timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 0, 0, 0, time.UTC)},
+				WorkingDir: workingDir,
+				ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+					return &factoryExecutor{}, nil
+				},
+			}
+			req, _, err := runner.resolveRunAction([]string{"morning", "--config", configPath, "--out-dir", scenario.out})
+			if err != nil || req.WorkingDir != workingDir || req.OutputDir != scenario.want || req.Config.Output.Directory != configuredDirectory {
+				t.Fatalf("resolveRunAction() request/error = %#v/%v", req, err)
+			}
+		})
+	}
+}
+
 func TestRunActionReturnsFailureForBatchNotificationFailure(t *testing.T) {
 	configPath := filepath.Join(t.TempDir(), "config.yml")
 	if err := os.WriteFile(configPath, []byte("weather_api:\n  base_url: https://weather.api.example.com/\n"), 0o600); err != nil {
@@ -128,6 +193,103 @@ func TestRunActionReturnsFailureForBatchNotificationFailure(t *testing.T) {
 	}
 }
 
+func TestRunActionPreservesBatchCancellation(t *testing.T) {
+	configPath := actionConfigPath(t)
+	for _, cause := range []error{context.Canceled, context.DeadlineExceeded} {
+		t.Run(cause.Error(), func(t *testing.T) {
+			result := &app.BatchResult{
+				Batch: app.BatchMorning, Total: 2, Succeeded: 1, Canceled: 1,
+				Reports: []app.BatchReportResult{
+					{ReportID: "today", Status: "succeeded", OutputPath: "/reports/today.md"},
+					{ReportID: "tomorrow", Status: "canceled"},
+				},
+				Notification: &app.BatchNotificationResult{Status: "skipped", Reason: "batch canceled"},
+			}
+			var stdout, stderr bytes.Buffer
+			runner := Runner{
+				Clock: timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 0, 0, 0, time.UTC)},
+				ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+					return &factoryExecutor{}, nil
+				},
+				runBatchDetailed: func(context.Context, app.BatchRequest) (*app.BatchResult, error) {
+					return result, cause
+				},
+			}
+			err := runner.Run(context.Background(), []string{"run", "morning", "--config", configPath}, &stdout, &stderr)
+			if !errors.Is(err, cause) {
+				t.Fatalf("Run() error = %v", err)
+			}
+			var summary batchSummary
+			if decodeErr := json.Unmarshal(stdout.Bytes(), &summary); decodeErr != nil {
+				t.Fatal(decodeErr)
+			}
+			if summary.Status != summaryStatusFailed || summary.Total != 2 || summary.Succeeded != 1 || summary.Failed != 0 || summary.Canceled != 1 || summary.Error == "" || len(summary.Reports) != 2 || summary.Reports[1].Status != "canceled" || !strings.Contains(stderr.String(), "report=tomorrow status=canceled") || !strings.Contains(stderr.String(), "canceled=1") {
+				t.Fatalf("summary/stderr = %#v/%q", summary, stderr.String())
+			}
+		})
+	}
+}
+
+func TestRunCommandProjectsSuccessAndReportFailure(t *testing.T) {
+	configPath := actionConfigPath(t)
+	for _, tt := range []struct {
+		name       string
+		result     *app.BatchResult
+		wantStatus string
+		wantError  bool
+		statusLine string
+	}{
+		{
+			name:       "Success",
+			result:     &app.BatchResult{Batch: app.BatchMorning, Total: 1, Succeeded: 1, Reports: []app.BatchReportResult{{ReportID: "today", Status: "succeeded", OutputPath: "/reports/today.md"}}},
+			wantStatus: summaryStatusSucceeded,
+			statusLine: `report=today status=succeeded output="/reports/today.md"`,
+		},
+		{
+			name:       "ReportFailure",
+			result:     &app.BatchResult{Batch: app.BatchMorning, Total: 1, Failed: 1, Reports: []app.BatchReportResult{{ReportID: "today", Status: "failed", Error: "prompt execution failed"}}},
+			wantStatus: summaryStatusFailed,
+			wantError:  true,
+			statusLine: `report=today status=failed error="prompt execution failed"`,
+		},
+	} {
+		t.Run(tt.name, func(t *testing.T) {
+			factoryCalls, applicationCalls := 0, 0
+			runner := Runner{
+				Clock: timeutil.FixedClock{Time: time.Date(2026, 5, 29, 8, 0, 0, 0, time.UTC)},
+				ExecutorFactory: func(PromptExecutorConfig) (promptexec.Executor, error) {
+					factoryCalls++
+					return &factoryExecutor{}, nil
+				},
+				runBatchDetailed: func(context.Context, app.BatchRequest) (*app.BatchResult, error) {
+					applicationCalls++
+					return tt.result, nil
+				},
+			}
+			var stdout, stderr bytes.Buffer
+			err := runner.Run(context.Background(), []string{"run", "morning", "--config", configPath}, &stdout, &stderr)
+			if factoryCalls != 1 || applicationCalls != 1 || !strings.Contains(stderr.String(), tt.statusLine) {
+				t.Fatalf("calls/stderr = %d/%d/%q", factoryCalls, applicationCalls, stderr.String())
+			}
+			if tt.wantError {
+				var batchErr app.BatchError
+				if !errors.As(err, &batchErr) {
+					t.Fatalf("Run() error = %v, want BatchError", err)
+				}
+			} else if err != nil {
+				t.Fatalf("Run() error = %v", err)
+			}
+			var summary batchSummary
+			if err := json.Unmarshal(stdout.Bytes(), &summary); err != nil {
+				t.Fatalf("decode summary: %v", err)
+			}
+			if summary.Command != commandRun || summary.Status != tt.wantStatus || (summary.Error != "") != tt.wantError {
+				t.Fatalf("summary = %#v", summary)
+			}
+		})
+	}
+}
+
 func TestInspectCommandIsUnknownAndAbsentFromHelp(t *testing.T) {
 	var stdout, stderr bytes.Buffer
 	err := (Runner{}).Run(context.Background(), []string{"inspect", "reports"}, &stdout, &stderr)

internal/collect/collect_test.go

@@ -5,13 +5,19 @@ import (
 	"net/http"
 	"net/http/httptest"
 	"strings"
+	"sync/atomic"
 	"testing"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
 )
 
 func TestRunFetchesBundle(t *testing.T) {
-	server := collectionTestServer(t, nil)
+	var currentRequests atomic.Int32
+	server := collectionTestServer(t, nil, func(r *http.Request) {
+		if r.URL.Path == "/conditions/current" {
+			currentRequests.Add(1)
+		}
+	})
 	defer server.Close()
 
 	cfg := config.Defaults()
@@ -30,6 +36,9 @@ func TestRunFetchesBundle(t *testing.T) {
 	if result.Bundle.WeatherStory == nil || result.Bundle.WeatherStory.Title != "Several Chances for Rain Through Monday" {
 		t.Fatalf("WeatherStory = %#v, want fetched weather story", result.Bundle.WeatherStory)
 	}
+	if got := currentRequests.Load(); got != 1 {
+		t.Fatalf("conditions/current requests = %d, want 1", got)
+	}
 }
 
 func TestRunWrapsAdapterConstructionError(t *testing.T) {
@@ -50,7 +59,7 @@ func TestRunWrapsAdapterConstructionError(t *testing.T) {
 }
 
 func TestRunWrapsFetchError(t *testing.T) {
-	server := collectionTestServer(t, map[string]int{"/observations": http.StatusBadGateway})
+	server := collectionTestServer(t, map[string]int{"/observations": http.StatusBadRequest}, nil)
 	defer server.Close()
 
 	cfg := config.Defaults()
@@ -68,9 +77,12 @@ func TestRunWrapsFetchError(t *testing.T) {
 	}
 }
 
-func collectionTestServer(t *testing.T, statusByPath map[string]int) *httptest.Server {
+func collectionTestServer(t *testing.T, statusByPath map[string]int, onRequest func(*http.Request)) *httptest.Server {
 	t.Helper()
 	return httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if onRequest != nil {
+			onRequest(r)
+		}
 		if status := statusByPath[r.URL.Path]; status != 0 {
 			http.Error(w, "upstream failure", status)
 			return

internal/comparison/comparison.go

@@ -0,0 +1,389 @@
+// Package comparison owns logical profile-comparison bundle contracts and
+// guarded filesystem destination planning and publication.
+package comparison
+
+import (
+	"crypto/sha256"
+	"encoding/hex"
+	"encoding/json"
+	"fmt"
+	"path"
+	"strings"
+	"time"
+	"unicode/utf8"
+)
+
+const (
+	// SchemaVersion identifies the supported comparison manifest schema.
+	SchemaVersion = "weatherreporter.comparison.v1"
+
+	// ManifestFilename is the canonical name of a comparison manifest.
+	ManifestFilename = "comparison.json"
+	// DataPackageFilename is the canonical name of the shared prompt input.
+	DataPackageFilename = "data-package.yml"
+
+	// StatusSucceeded identifies a profile that produced a validated report.
+	StatusSucceeded = "succeeded"
+	// StatusFailed identifies a profile that did not produce a report.
+	StatusFailed = "failed"
+
+	maxProfileSlugBytes  = 64
+	maxErrorMessageBytes = 1024
+)
+
+// Manifest is the versioned, authoritative index of a comparison bundle.
+// Field declaration order is the JSON field order.
+type Manifest struct {
+	SchemaVersion string               `json:"schemaVersion"`
+	ComparisonID  string               `json:"comparisonId"`
+	StartedAt     time.Time            `json:"startedAt"`
+	FinishedAt    time.Time            `json:"finishedAt"`
+	ReportID      string               `json:"reportId"`
+	ValidPeriod   ValidPeriod          `json:"validPeriod"`
+	Timezone      string               `json:"timezone"`
+	PromptID      string               `json:"promptId"`
+	PromptVersion string               `json:"promptVersion"`
+	PromptHash    string               `json:"promptHash"`
+	DataPackage   DataPackageReference `json:"dataPackage"`
+	Total         int                  `json:"total"`
+	Succeeded     int                  `json:"succeeded"`
+	Failed        int                  `json:"failed"`
+	Results       []Result             `json:"results"`
+}
+
+// ValidPeriod records the report's resolved half-open period.
+type ValidPeriod struct {
+	Start time.Time `json:"start"`
+	End   time.Time `json:"end"`
+}
+
+// DataPackageReference identifies and verifies the shared prompt input.
+type DataPackageReference struct {
+	Path   string `json:"path"`
+	SHA256 string `json:"sha256"`
+}
+
+// Result records one explicitly selected profile in selection order.
+type Result struct {
+	Position         int        `json:"position"`
+	ProfileID        string     `json:"profileId"`
+	BackendID        string     `json:"backendId,omitempty"`
+	ModelName        string     `json:"modelName"`
+	Status           string     `json:"status"`
+	ValidationStatus string     `json:"validationStatus,omitempty"`
+	ReportPath       string     `json:"reportPath,omitempty"`
+	Error            *SafeError `json:"error,omitempty"`
+}
+
+// SafeError contains bounded, operator-safe failure information only.
+type SafeError struct {
+	Category string `json:"category"`
+	Message  string `json:"message"`
+}
+
+// LogicalBundle contains every byte required to publish a comparison without
+// coupling the comparison contract to a filesystem implementation.
+type LogicalBundle struct {
+	Manifest    Manifest
+	DataPackage []byte
+	Reports     []BundleReport
+}
+
+// BundleReport is one rendered Markdown document in a logical bundle.
+type BundleReport struct {
+	Position int
+	Path     string
+	Markdown []byte
+}
+
+// ValidateProfileIDs requires at least two distinct, nonblank profile IDs. It
+// intentionally preserves accepted IDs unchanged and treats case distinctly.
+func ValidateProfileIDs(profileIDs []string) error {
+	if len(profileIDs) < 2 {
+		return fmt.Errorf("comparison requires at least two profile IDs")
+	}
+
+	seen := make(map[string]struct{}, len(profileIDs))
+	for _, profileID := range profileIDs {
+		if strings.TrimSpace(profileID) == "" {
+			return fmt.Errorf("profile ID must not be blank")
+		}
+		if _, duplicate := seen[profileID]; duplicate {
+			return fmt.Errorf("duplicate profile ID %q", profileID)
+		}
+		seen[profileID] = struct{}{}
+	}
+
+	return nil
+}
+
+// ProfileSlug returns a deterministic, filesystem-safe representation of a
+// logical profile ID. The logical ID remains authoritative in the manifest.
+func ProfileSlug(profileID string) string {
+	var builder strings.Builder
+	lastReplacement := false
+	for _, r := range profileID {
+		if isSlugRune(r) {
+			builder.WriteRune(r)
+			lastReplacement = false
+			continue
+		}
+		if !lastReplacement {
+			builder.WriteByte('-')
+			lastReplacement = true
+		}
+	}
+
+	slug := strings.Trim(builder.String(), "-_")
+	if len(slug) > maxProfileSlugBytes {
+		slug = strings.Trim(slug[:maxProfileSlugBytes], "-_")
+	}
+	if slug == "" {
+		return "profile"
+	}
+	return slug
+}
+
+func isSlugRune(r rune) bool {
+	return r >= 'a' && r <= 'z' ||
+		r >= 'A' && r <= 'Z' ||
+		r >= '0' && r <= '9' ||
+		r == '-' || r == '_'
+}
+
+// OrdinalWidth returns the zero-padding width for a comparison of count
+// profiles.
+func OrdinalWidth(count int) int {
+	width := 2
+	for value := count; value >= 100; value /= 10 {
+		width++
+	}
+	return width
+}
+
+// ReportFilename derives a report's deterministic bundle filename.
+func ReportFilename(position, profileCount int, profileID string) (string, error) {
+	if profileCount < 1 {
+		return "", fmt.Errorf("profile count must be positive")
+	}
+	if position < 1 || position > profileCount {
+		return "", fmt.Errorf("profile position %d is outside 1..%d", position, profileCount)
+	}
+	return fmt.Sprintf("%0*d-%s.md", OrdinalWidth(profileCount), position, ProfileSlug(profileID)), nil
+}
+
+// BuildComparisonID derives the stable comparison identity for a resolved
+// report run.
+func BuildComparisonID(reportRunID string) (string, error) {
+	if strings.TrimSpace(reportRunID) == "" {
+		return "", fmt.Errorf("report run ID must not be blank")
+	}
+	return "comparison_" + reportRunID, nil
+}
+
+// DefaultDirectoryName derives the bundle directory name for a resolved report
+// output filename.
+func DefaultDirectoryName(reportOutputName string) (string, error) {
+	if !strings.HasSuffix(reportOutputName, ".md") {
+		return "", fmt.Errorf("report output name %q must end in .md", reportOutputName)
+	}
+	if !isArtifactBasename(reportOutputName) {
+		return "", fmt.Errorf("report output name %q must be a basename", reportOutputName)
+	}
+	stem := strings.TrimSuffix(reportOutputName, ".md")
+	if stem == "" {
+		return "", fmt.Errorf("report output name %q has an empty stem", reportOutputName)
+	}
+	return "comparison-" + stem, nil
+}
+
+// SHA256 returns a lowercase hexadecimal SHA-256 digest.
+func SHA256(content []byte) string {
+	digest := sha256.Sum256(content)
+	return hex.EncodeToString(digest[:])
+}
+
+// NewSafeError returns bounded, valid UTF-8 error information suitable for a
+// comparison manifest.
+func NewSafeError(category, message string) SafeError {
+	return SafeError{Category: category, Message: TruncateErrorMessage(message)}
+}
+
+// TruncateErrorMessage returns a valid UTF-8 message of at most 1,024 bytes.
+func TruncateErrorMessage(message string) string {
+	message = strings.ToValidUTF8(message, "\uFFFD")
+	if len(message) <= maxErrorMessageBytes {
+		return message
+	}
+
+	end := maxErrorMessageBytes
+	for end > 0 && !utf8.RuneStart(message[end]) {
+		end--
+	}
+	return message[:end]
+}
+
+// Validate checks every invariant required for a current comparison manifest.
+func (manifest Manifest) Validate() error {
+	if manifest.SchemaVersion != SchemaVersion {
+		return fmt.Errorf("unsupported comparison schema version %q", manifest.SchemaVersion)
+	}
+	if strings.TrimSpace(manifest.ComparisonID) == "" {
+		return fmt.Errorf("comparison ID must not be blank")
+	}
+	if manifest.StartedAt.IsZero() || manifest.FinishedAt.IsZero() {
+		return fmt.Errorf("comparison timestamps must be nonzero")
+	}
+	if manifest.StartedAt.Location() != time.UTC || manifest.FinishedAt.Location() != time.UTC {
+		return fmt.Errorf("comparison timestamps must use UTC")
+	}
+	if manifest.FinishedAt.Before(manifest.StartedAt) {
+		return fmt.Errorf("comparison finish time precedes start time")
+	}
+	if manifest.ValidPeriod.Start.IsZero() || manifest.ValidPeriod.End.IsZero() || !manifest.ValidPeriod.End.After(manifest.ValidPeriod.Start) {
+		return fmt.Errorf("valid period must have a nonempty increasing range")
+	}
+	if strings.TrimSpace(manifest.ReportID) == "" || strings.TrimSpace(manifest.Timezone) == "" {
+		return fmt.Errorf("report ID and timezone must not be blank")
+	}
+	if strings.TrimSpace(manifest.PromptID) == "" || strings.TrimSpace(manifest.PromptVersion) == "" || !isSHA256(manifest.PromptHash) {
+		return fmt.Errorf("prompt identity is invalid")
+	}
+	if manifest.DataPackage.Path != DataPackageFilename || !isSHA256(manifest.DataPackage.SHA256) {
+		return fmt.Errorf("data package reference is invalid")
+	}
+	if manifest.Total < 2 || manifest.Total != len(manifest.Results) {
+		return fmt.Errorf("comparison result count is invalid")
+	}
+	if manifest.Succeeded < 0 || manifest.Failed < 0 || manifest.Succeeded+manifest.Failed != manifest.Total {
+		return fmt.Errorf("comparison result totals are inconsistent")
+	}
+
+	profiles := make(map[string]struct{}, len(manifest.Results))
+	reportPaths := make(map[string]struct{}, len(manifest.Results))
+	succeeded, failed := 0, 0
+	for index, result := range manifest.Results {
+		if result.Position != index+1 {
+			return fmt.Errorf("result position %d is not ordered", result.Position)
+		}
+		if strings.TrimSpace(result.ProfileID) == "" {
+			return fmt.Errorf("result %d has a blank profile ID", result.Position)
+		}
+		if _, duplicate := profiles[result.ProfileID]; duplicate {
+			return fmt.Errorf("result %d duplicates profile ID %q", result.Position, result.ProfileID)
+		}
+		profiles[result.ProfileID] = struct{}{}
+		if strings.TrimSpace(result.ModelName) == "" {
+			return fmt.Errorf("result %d has a blank model name", result.Position)
+		}
+
+		switch result.Status {
+		case StatusSucceeded:
+			succeeded++
+			if result.ValidationStatus != "passed" {
+				return fmt.Errorf("successful result %d did not pass validation", result.Position)
+			}
+			expectedPath, err := ReportFilename(result.Position, manifest.Total, result.ProfileID)
+			if err != nil {
+				return fmt.Errorf("successful result %d has invalid report identity: %w", result.Position, err)
+			}
+			if result.Error != nil || result.ReportPath != expectedPath {
+				return fmt.Errorf("successful result %d has invalid report details", result.Position)
+			}
+			if _, duplicate := reportPaths[result.ReportPath]; duplicate {
+				return fmt.Errorf("result %d duplicates report path %q", result.Position, result.ReportPath)
+			}
+			reportPaths[result.ReportPath] = struct{}{}
+		case StatusFailed:
+			failed++
+			if result.ReportPath != "" || result.Error == nil || !isValidationStatus(result.ValidationStatus) {
+				return fmt.Errorf("failed result %d has invalid failure details", result.Position)
+			}
+			if err := result.Error.validate(); err != nil {
+				return fmt.Errorf("failed result %d: %w", result.Position, err)
+			}
+		default:
+			return fmt.Errorf("result %d has unsupported status %q", result.Position, result.Status)
+		}
+	}
+	if succeeded != manifest.Succeeded || failed != manifest.Failed {
+		return fmt.Errorf("comparison status counts do not match results")
+	}
+
+	return nil
+}
+
+func (safeError SafeError) validate() error {
+	if strings.TrimSpace(safeError.Category) == "" || strings.TrimSpace(safeError.Message) == "" {
+		return fmt.Errorf("safe error category and message must not be blank")
+	}
+	if !utf8.ValidString(safeError.Message) || len(safeError.Message) > maxErrorMessageBytes {
+		return fmt.Errorf("safe error message is not bounded UTF-8")
+	}
+	return nil
+}
+
+func isValidationStatus(status string) bool {
+	return status == "" || status == "failed" || status == "skipped"
+}
+
+func isSHA256(value string) bool {
+	if len(value) != sha256.Size*2 {
+		return false
+	}
+	for _, r := range value {
+		if (r < '0' || r > '9') && (r < 'a' || r > 'f') {
+			return false
+		}
+	}
+	return true
+}
+
+func isReportPath(value string) bool {
+	return strings.HasSuffix(value, ".md") && isArtifactBasename(value) && value != ManifestFilename && value != DataPackageFilename
+}
+
+func isArtifactBasename(value string) bool {
+	return value != "" && value != "." && value != ".." &&
+		!strings.ContainsAny(value, "/\\") && path.Base(value) == value
+}
+
+// Validate checks that the manifest and in-memory bundle payloads agree.
+func (bundle LogicalBundle) Validate() error {
+	if err := bundle.Manifest.Validate(); err != nil {
+		return err
+	}
+	if SHA256(bundle.DataPackage) != bundle.Manifest.DataPackage.SHA256 {
+		return fmt.Errorf("data package digest does not match manifest")
+	}
+
+	if len(bundle.Reports) != bundle.Manifest.Succeeded {
+		return fmt.Errorf("bundle report count does not match manifest")
+	}
+	reportIndex := 0
+	for _, result := range bundle.Manifest.Results {
+		if result.Status != StatusSucceeded {
+			continue
+		}
+		report := bundle.Reports[reportIndex]
+		if report.Position != result.Position || report.Path != result.ReportPath || !isReportPath(report.Path) {
+			return fmt.Errorf("bundle report for result %d does not match manifest", result.Position)
+		}
+		reportIndex++
+	}
+
+	return nil
+}
+
+// EncodeManifest validates and deterministically encodes a manifest as the
+// canonical two-space-indented JSON document with one trailing newline.
+func EncodeManifest(manifest Manifest) ([]byte, error) {
+	if err := manifest.Validate(); err != nil {
+		return nil, err
+	}
+	encoded, err := json.MarshalIndent(manifest, "", "  ")
+	if err != nil {
+		return nil, fmt.Errorf("encode comparison manifest: %w", err)
+	}
+	return append(encoded, '\n'), nil
+}

internal/comparison/comparison_test.go

@@ -0,0 +1,323 @@
+package comparison
+
+import (
+	"strings"
+	"testing"
+	"time"
+	"unicode/utf8"
+)
+
+func TestValidateProfileIDs(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name       string
+		profileIDs []string
+		wantErr    bool
+	}{
+		{name: "accepts exact case distinct IDs", profileIDs: []string{"weather-light", "Weather-Light"}},
+		{name: "preserves surrounding whitespace", profileIDs: []string{" weather-light", "weather-deep "}},
+		{name: "rejects one ID", profileIDs: []string{"weather-light"}, wantErr: true},
+		{name: "rejects blank ID", profileIDs: []string{"weather-light", " \t\n"}, wantErr: true},
+		{name: "rejects exact duplicate", profileIDs: []string{"weather-light", "weather-light"}, wantErr: true},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			err := ValidateProfileIDs(test.profileIDs)
+			if (err != nil) != test.wantErr {
+				t.Fatalf("ValidateProfileIDs(%q) error = %v, want error %t", test.profileIDs, err, test.wantErr)
+			}
+		})
+	}
+}
+
+func TestProfileSlug(t *testing.T) {
+	t.Parallel()
+
+	long := strings.Repeat("a", 62) + "-_more"
+	tests := []struct {
+		profileID string
+		want      string
+	}{
+		{profileID: "weather-light", want: "weather-light"},
+		{profileID: "model.v1", want: "model-v1"},
+		{profileID: "nested/path\\name", want: "nested-path-name"},
+		{profileID: "  weather\tlight\n", want: "weather-light"},
+		{profileID: "\x00\x01", want: "profile"},
+		{profileID: "météo-東京", want: "m-t-o"},
+		{profileID: "___", want: "profile"},
+		{profileID: long, want: strings.Repeat("a", 62)},
+	}
+
+	for _, test := range tests {
+		t.Run(test.profileID, func(t *testing.T) {
+			t.Parallel()
+			if got := ProfileSlug(test.profileID); got != test.want {
+				t.Fatalf("ProfileSlug(%q) = %q, want %q", test.profileID, got, test.want)
+			}
+		})
+	}
+}
+
+func TestReportNaming(t *testing.T) {
+	t.Parallel()
+
+	if got := OrdinalWidth(99); got != 2 {
+		t.Fatalf("OrdinalWidth(99) = %d, want 2", got)
+	}
+	if got := OrdinalWidth(100); got != 3 {
+		t.Fatalf("OrdinalWidth(100) = %d, want 3", got)
+	}
+	if got, err := ReportFilename(1, 3, "weather.light"); err != nil || got != "01-weather-light.md" {
+		t.Fatalf("ReportFilename() = %q, %v, want %q, nil", got, err, "01-weather-light.md")
+	}
+	if got, err := ReportFilename(100, 100, "weather-light"); err != nil || got != "100-weather-light.md" {
+		t.Fatalf("ReportFilename() = %q, %v, want %q, nil", got, err, "100-weather-light.md")
+	}
+	first, err := ReportFilename(1, 2, "model.v1")
+	if err != nil {
+		t.Fatalf("first ReportFilename() error = %v", err)
+	}
+	second, err := ReportFilename(2, 2, "model/v1")
+	if err != nil {
+		t.Fatalf("second ReportFilename() error = %v", err)
+	}
+	if first == second {
+		t.Fatalf("normalized profile collisions produced the same filename %q", first)
+	}
+	if _, err := ReportFilename(0, 2, "weather-light"); err == nil {
+		t.Fatal("ReportFilename accepted position zero")
+	}
+	if _, err := ReportFilename(1, 0, "weather-light"); err == nil {
+		t.Fatal("ReportFilename accepted zero profile count")
+	}
+	if got, err := BuildComparisonID("daily-2026-08-24"); err != nil || got != "comparison_daily-2026-08-24" {
+		t.Fatalf("BuildComparisonID() = %q, %v", got, err)
+	}
+	if _, err := BuildComparisonID(" \t"); err == nil {
+		t.Fatal("BuildComparisonID accepted blank run ID")
+	}
+	if got, err := DefaultDirectoryName("daily-2026-08-24.md"); err != nil || got != "comparison-daily-2026-08-24" {
+		t.Fatalf("DefaultDirectoryName() = %q, %v", got, err)
+	}
+	for _, name := range []string{"daily.txt", "nested/daily.md", ".md"} {
+		if _, err := DefaultDirectoryName(name); err == nil {
+			t.Fatalf("DefaultDirectoryName(%q) accepted invalid name", name)
+		}
+	}
+}
+
+func TestManifestEncodingAndRoundTrip(t *testing.T) {
+	t.Parallel()
+
+	manifest := validManifest()
+	encoded, err := EncodeManifest(manifest)
+	if err != nil {
+		t.Fatalf("EncodeManifest() error = %v", err)
+	}
+	want := "{\n" +
+		"  \"schemaVersion\": \"weatherreporter.comparison.v1\",\n" +
+		"  \"comparisonId\": \"comparison_daily-2026-08-24\",\n" +
+		"  \"startedAt\": \"2026-08-24T12:00:00Z\",\n" +
+		"  \"finishedAt\": \"2026-08-24T12:01:00Z\",\n" +
+		"  \"reportId\": \"daily\",\n" +
+		"  \"validPeriod\": {\n" +
+		"    \"start\": \"2026-08-24T00:00:00-04:00\",\n" +
+		"    \"end\": \"2026-08-25T00:00:00-04:00\"\n" +
+		"  },\n" +
+		"  \"timezone\": \"America/New_York\",\n" +
+		"  \"promptId\": \"daily-report\",\n" +
+		"  \"promptVersion\": \"2026-08-01\",\n" +
+		"  \"promptHash\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\",\n" +
+		"  \"dataPackage\": {\n" +
+		"    \"path\": \"data-package.yml\",\n" +
+		"    \"sha256\": \"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa\"\n" +
+		"  },\n" +
+		"  \"total\": 2,\n" +
+		"  \"succeeded\": 1,\n" +
+		"  \"failed\": 1,\n" +
+		"  \"results\": [\n" +
+		"    {\n" +
+		"      \"position\": 1,\n" +
+		"      \"profileId\": \"weather-light\",\n" +
+		"      \"backendId\": \"openai\",\n" +
+		"      \"modelName\": \"gpt-5-mini\",\n" +
+		"      \"status\": \"succeeded\",\n" +
+		"      \"validationStatus\": \"passed\",\n" +
+		"      \"reportPath\": \"01-weather-light.md\"\n" +
+		"    },\n" +
+		"    {\n" +
+		"      \"position\": 2,\n" +
+		"      \"profileId\": \"weather-deep\",\n" +
+		"      \"modelName\": \"gpt-5\",\n" +
+		"      \"status\": \"failed\",\n" +
+		"      \"error\": {\n" +
+		"        \"category\": \"application\",\n" +
+		"        \"message\": \"generated text was rejected\"\n" +
+		"      }\n" +
+		"    }\n" +
+		"  ]\n" +
+		"}\n"
+	if string(encoded) != want {
+		t.Fatalf("EncodeManifest() =\n%s\nwant\n%s", encoded, want)
+	}
+
+	decoded, err := decodeManifest(encoded)
+	if err != nil {
+		t.Fatalf("decodeManifest() error = %v", err)
+	}
+	if err := decoded.Validate(); err != nil {
+		t.Fatalf("decoded manifest validation error = %v", err)
+	}
+}
+
+func TestManifestValidateRejectsInvariants(t *testing.T) {
+	t.Parallel()
+
+	tests := []struct {
+		name   string
+		mutate func(*Manifest)
+	}{
+		{name: "schema version", mutate: func(manifest *Manifest) { manifest.SchemaVersion = "v0" }},
+		{name: "non UTC timestamp", mutate: func(manifest *Manifest) { manifest.StartedAt = manifest.StartedAt.In(time.FixedZone("UTC", 0)) }},
+		{name: "reversed timestamps", mutate: func(manifest *Manifest) { manifest.FinishedAt = manifest.StartedAt.Add(-time.Second) }},
+		{name: "empty valid period", mutate: func(manifest *Manifest) { manifest.ValidPeriod.End = manifest.ValidPeriod.Start }},
+		{name: "bad prompt hash", mutate: func(manifest *Manifest) { manifest.PromptHash = "ABC" }},
+		{name: "bad data package path", mutate: func(manifest *Manifest) { manifest.DataPackage.Path = "nested/data-package.yml" }},
+		{name: "inconsistent totals", mutate: func(manifest *Manifest) { manifest.Succeeded = 2 }},
+		{name: "unordered position", mutate: func(manifest *Manifest) { manifest.Results[1].Position = 3 }},
+		{name: "duplicate profile", mutate: func(manifest *Manifest) { manifest.Results[1].ProfileID = manifest.Results[0].ProfileID }},
+		{name: "unsupported status", mutate: func(manifest *Manifest) { manifest.Results[1].Status = "skipped" }},
+		{name: "successful result without report", mutate: func(manifest *Manifest) { manifest.Results[0].ReportPath = "" }},
+		{name: "arbitrary report name", mutate: func(manifest *Manifest) { manifest.Results[0].ReportPath = "arbitrary.md" }},
+		{name: "wrong report position", mutate: func(manifest *Manifest) { manifest.Results[0].ReportPath = "02-weather-light.md" }},
+		{name: "wrong report ordinal width", mutate: func(manifest *Manifest) { manifest.Results[0].ReportPath = "1-weather-light.md" }},
+		{name: "wrong report profile slug", mutate: func(manifest *Manifest) { manifest.Results[0].ReportPath = "01-weather.md" }},
+		{name: "successful result with error", mutate: func(manifest *Manifest) {
+			manifest.Results[0].Error = &SafeError{Category: "application", Message: "bad"}
+		}},
+		{name: "successful result without passed validation", mutate: func(manifest *Manifest) { manifest.Results[0].ValidationStatus = "failed" }},
+		{name: "failed result with report", mutate: func(manifest *Manifest) { manifest.Results[1].ReportPath = "02-weather-deep.md" }},
+		{name: "failed result without error", mutate: func(manifest *Manifest) { manifest.Results[1].Error = nil }},
+		{name: "traversal report path", mutate: func(manifest *Manifest) { manifest.Results[0].ReportPath = "../report.md" }},
+		{name: "duplicate report path", mutate: func(manifest *Manifest) {
+			manifest.Results[1] = Result{Position: 2, ProfileID: "weather-deep", ModelName: "gpt-5", Status: StatusSucceeded, ValidationStatus: "passed", ReportPath: manifest.Results[0].ReportPath}
+			manifest.Succeeded = 2
+			manifest.Failed = 0
+		}},
+		{name: "oversized error", mutate: func(manifest *Manifest) { manifest.Results[1].Error.Message = strings.Repeat("x", 1025) }},
+	}
+
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			t.Parallel()
+			manifest := validManifest()
+			test.mutate(&manifest)
+			if err := manifest.Validate(); err == nil {
+				t.Fatal("Manifest.Validate() succeeded for invalid manifest")
+			}
+		})
+	}
+}
+
+func TestLogicalBundleValidate(t *testing.T) {
+	t.Parallel()
+
+	dataPackage := []byte("report: daily\n")
+	manifest := validManifest()
+	manifest.DataPackage.SHA256 = SHA256(dataPackage)
+	bundle := LogicalBundle{
+		Manifest:    manifest,
+		DataPackage: dataPackage,
+		Reports: []BundleReport{{
+			Position: 1,
+			Path:     "01-weather-light.md",
+			Markdown: []byte("# Daily\n"),
+		}},
+	}
+	if err := bundle.Validate(); err != nil {
+		t.Fatalf("LogicalBundle.Validate() error = %v", err)
+	}
+
+	bundle.Reports[0].Path = "other.md"
+	if err := bundle.Validate(); err == nil {
+		t.Fatal("LogicalBundle.Validate() accepted mismatched report path")
+	}
+	bundle.Reports[0].Path = "01-weather-light.md"
+	bundle.Reports[0].Position = 2
+	if err := bundle.Validate(); err == nil {
+		t.Fatal("LogicalBundle.Validate() accepted unordered report position")
+	}
+	bundle.Reports[0].Position = 1
+	bundle.Reports[0].Path = "arbitrary.md"
+	bundle.Manifest.Results[0].ReportPath = "arbitrary.md"
+	if err := bundle.Validate(); err == nil {
+		t.Fatal("LogicalBundle.Validate() accepted a noncanonical report path")
+	}
+}
+
+func TestSHA256AndTruncateErrorMessage(t *testing.T) {
+	t.Parallel()
+
+	if got, want := SHA256([]byte("weather")), "e5e72beb4e3c6926d3dc9e3e2ef7833ba50cd919c2460a782b244fd071e920de"; got != want {
+		t.Fatalf("SHA256() = %q, want %q", got, want)
+	}
+	message := strings.Repeat("€", 400)
+	got := TruncateErrorMessage(message)
+	if len(got) > 1024 || !utf8.ValidString(got) {
+		t.Fatalf("TruncateErrorMessage() returned %d bytes of valid UTF-8 = %t", len(got), utf8.ValidString(got))
+	}
+	if want := strings.Repeat("€", 341); got != want {
+		t.Fatalf("TruncateErrorMessage() = %q, want %q", got, want)
+	}
+	invalid := string([]byte{'x', 0xff, 'y'})
+	if got := TruncateErrorMessage(invalid); !utf8.ValidString(got) {
+		t.Fatal("TruncateErrorMessage() retained invalid UTF-8")
+	}
+}
+
+func validManifest() Manifest {
+	newYork := time.FixedZone("-0400", -4*60*60)
+	return Manifest{
+		SchemaVersion: SchemaVersion,
+		ComparisonID:  "comparison_daily-2026-08-24",
+		StartedAt:     time.Date(2026, time.August, 24, 12, 0, 0, 0, time.UTC),
+		FinishedAt:    time.Date(2026, time.August, 24, 12, 1, 0, 0, time.UTC),
+		ReportID:      "daily",
+		ValidPeriod: ValidPeriod{
+			Start: time.Date(2026, time.August, 24, 0, 0, 0, 0, newYork),
+			End:   time.Date(2026, time.August, 25, 0, 0, 0, 0, newYork),
+		},
+		Timezone:      "America/New_York",
+		PromptID:      "daily-report",
+		PromptVersion: "2026-08-01",
+		PromptHash:    strings.Repeat("a", 64),
+		DataPackage: DataPackageReference{
+			Path:   DataPackageFilename,
+			SHA256: strings.Repeat("a", 64),
+		},
+		Total:     2,
+		Succeeded: 1,
+		Failed:    1,
+		Results: []Result{
+			{
+				Position:         1,
+				ProfileID:        "weather-light",
+				BackendID:        "openai",
+				ModelName:        "gpt-5-mini",
+				Status:           StatusSucceeded,
+				ValidationStatus: "passed",
+				ReportPath:       "01-weather-light.md",
+			},
+			{
+				Position:  2,
+				ProfileID: "weather-deep",
+				ModelName: "gpt-5",
+				Status:    StatusFailed,
+				Error:     &SafeError{Category: "application", Message: "generated text was rejected"},
+			},
+		},
+	}
+}

internal/comparison/publish.go

@@ -0,0 +1,757 @@
+package comparison
+
+import (
+	"bytes"
+	"context"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+)
+
+// DestinationErrorKind identifies a comparison destination safety failure.
+type DestinationErrorKind string
+
+const (
+	DestinationInvalidPath      DestinationErrorKind = "invalid_path"
+	DestinationFilesystemRoot   DestinationErrorKind = "filesystem_root"
+	DestinationWorkingDirectory DestinationErrorKind = "working_directory"
+	DestinationSymlink          DestinationErrorKind = "symlink"
+	DestinationNotDirectory     DestinationErrorKind = "not_directory"
+	DestinationNotEmpty         DestinationErrorKind = "not_empty"
+	DestinationUnrecognized     DestinationErrorKind = "unrecognized"
+	DestinationInspection       DestinationErrorKind = "inspection"
+
+	maxComparisonComponentBytes = 255
+	temporaryRandomBytes        = 10
+	stagingDirectoryPattern     = ".weatherreporter-staging-*"
+	backupDirectoryPattern      = ".weatherreporter-backup-*"
+)
+
+// DestinationError provides inspectable context without making filesystem
+// implementation details part of a manifest or command-result schema.
+type DestinationError struct {
+	Kind   DestinationErrorKind
+	Target string
+	Err    error
+}
+
+func (err *DestinationError) Error() string {
+	if err.Err == nil {
+		return fmt.Sprintf("comparison destination %q is %s", err.Target, err.Kind)
+	}
+	return fmt.Sprintf("comparison destination %q is %s: %v", err.Target, err.Kind, err.Err)
+}
+
+func (err *DestinationError) Unwrap() error {
+	return err.Err
+}
+
+// DestinationPlan records a preflighted, exact bundle directory. Callers must
+// pass it to Publish rather than recreating destination policy themselves.
+type DestinationPlan struct {
+	WorkingDirectory string
+	Target           string
+	Replace          bool
+	state            destinationState
+}
+
+type destinationState uint8
+
+const (
+	destinationAbsent destinationState = iota
+	destinationEmpty
+	destinationBundle
+)
+
+// ErrUnrecognizedBundle marks a directory that is not a valid current-schema
+// Weatherreporter comparison bundle.
+var ErrUnrecognizedBundle = errors.New("unrecognized comparison bundle")
+
+// PlanDestination performs the read-only comparison destination preflight.
+func PlanDestination(workingDirectory, target string, replace bool) (DestinationPlan, error) {
+	return planDestination(workingDirectory, target, replace, RecognizeBundle)
+}
+
+func planDestination(workingDirectory, target string, replace bool, recognize func(string) (Manifest, error)) (DestinationPlan, error) {
+	plan, err := newDestinationPlan(workingDirectory, target, replace)
+	if err != nil {
+		return DestinationPlan{}, err
+	}
+	return inspectDestination(plan, recognize)
+}
+
+func newDestinationPlan(workingDirectory, target string, replace bool) (DestinationPlan, error) {
+	workingDirectory, err := absoluteCleanPath(workingDirectory)
+	if err != nil {
+		return DestinationPlan{}, newDestinationError(DestinationInvalidPath, workingDirectory, err)
+	}
+	target, err = absoluteCleanPath(target)
+	if err != nil {
+		return DestinationPlan{}, newDestinationError(DestinationInvalidPath, target, err)
+	}
+	if filepath.Dir(target) == target {
+		return DestinationPlan{}, newDestinationError(DestinationFilesystemRoot, target, nil)
+	}
+	if target == workingDirectory {
+		return DestinationPlan{}, newDestinationError(DestinationWorkingDirectory, target, nil)
+	}
+	if err := validateTransactionSiblingNames(target); err != nil {
+		return DestinationPlan{}, newDestinationError(DestinationInvalidPath, target, err)
+	}
+
+	return DestinationPlan{WorkingDirectory: workingDirectory, Target: target, Replace: replace}, nil
+}
+
+func reauthorizeDestination(plan DestinationPlan) (DestinationPlan, error) {
+	plan, err := newDestinationPlan(plan.WorkingDirectory, plan.Target, plan.Replace)
+	if err != nil {
+		return DestinationPlan{}, err
+	}
+	return inspectDestination(plan, nil)
+}
+
+func inspectDestination(plan DestinationPlan, recognize func(string) (Manifest, error)) (DestinationPlan, error) {
+	target := plan.Target
+	info, err := os.Lstat(target)
+	if err != nil {
+		if !errors.Is(err, os.ErrNotExist) {
+			return DestinationPlan{}, newDestinationError(DestinationInspection, target, err)
+		}
+		if err := inspectMissingDestinationParent(target); err != nil {
+			return DestinationPlan{}, err
+		}
+		return plan, nil
+	}
+	if info.Mode()&os.ModeSymlink != 0 {
+		return DestinationPlan{}, newDestinationError(DestinationSymlink, target, nil)
+	}
+	if !info.IsDir() {
+		return DestinationPlan{}, newDestinationError(DestinationNotDirectory, target, nil)
+	}
+
+	entries, err := os.ReadDir(target)
+	if err != nil {
+		return DestinationPlan{}, newDestinationError(DestinationInspection, target, err)
+	}
+	if len(entries) == 0 {
+		plan.state = destinationEmpty
+		return plan, nil
+	}
+	if !plan.Replace {
+		return DestinationPlan{}, newDestinationError(DestinationNotEmpty, target, nil)
+	}
+	if recognize != nil {
+		if _, err := recognize(target); err != nil {
+			return DestinationPlan{}, newDestinationError(DestinationUnrecognized, target, err)
+		}
+	}
+	plan.state = destinationBundle
+	return plan, nil
+}
+
+func validateTransactionSiblingNames(target string) error {
+	if len(filepath.Base(target)) > maxComparisonComponentBytes {
+		return fmt.Errorf("destination name exceeds the %d-byte limit", maxComparisonComponentBytes)
+	}
+	for _, pattern := range []string{stagingDirectoryPattern, backupDirectoryPattern} {
+		if !temporaryPatternFitsComponentLimit(pattern) {
+			return fmt.Errorf("comparison transaction sibling pattern exceeds the %d-byte limit", maxComparisonComponentBytes)
+		}
+	}
+	return nil
+}
+
+func temporaryPatternFitsComponentLimit(pattern string) bool {
+	return len(strings.Replace(pattern, "*", strings.Repeat("0", temporaryRandomBytes), 1)) <= maxComparisonComponentBytes
+}
+
+func absoluteCleanPath(value string) (string, error) {
+	if strings.TrimSpace(value) == "" {
+		return "", fmt.Errorf("path is required")
+	}
+	if !filepath.IsAbs(value) {
+		return "", fmt.Errorf("path %q must be absolute", value)
+	}
+	return filepath.Clean(value), nil
+}
+
+func inspectMissingDestinationParent(target string) error {
+	for parent := filepath.Dir(target); ; parent = filepath.Dir(parent) {
+		info, err := os.Lstat(parent)
+		if err == nil {
+			if info.Mode()&os.ModeSymlink != 0 {
+				resolved, statErr := os.Stat(parent)
+				if statErr != nil {
+					return newDestinationError(DestinationInspection, target, statErr)
+				}
+				if !resolved.IsDir() {
+					return newDestinationError(DestinationNotDirectory, target, nil)
+				}
+				return nil
+			}
+			if !info.IsDir() {
+				return newDestinationError(DestinationNotDirectory, target, nil)
+			}
+			return nil
+		}
+		if !errors.Is(err, os.ErrNotExist) {
+			return newDestinationError(DestinationInspection, target, err)
+		}
+		if filepath.Dir(parent) == parent {
+			return newDestinationError(DestinationInspection, target, fmt.Errorf("no existing directory ancestor"))
+		}
+	}
+}
+
+func newDestinationError(kind DestinationErrorKind, target string, err error) error {
+	return &DestinationError{Kind: kind, Target: target, Err: err}
+}
+
+// RecognizeBundle verifies that directory contains exactly one valid current
+// comparison bundle. It never follows bundle entries through symlinks.
+func RecognizeBundle(directory string) (Manifest, error) {
+	return recognizeBundle(directory, defaultRecognitionOperations)
+}
+
+type recognitionOperations struct {
+	lstat   func(string) (os.FileInfo, error)
+	readDir func(string) ([]os.DirEntry, error)
+	open    func(string) (io.ReadCloser, error)
+}
+
+var defaultRecognitionOperations = recognitionOperations{
+	lstat:   os.Lstat,
+	readDir: os.ReadDir,
+	open: func(path string) (io.ReadCloser, error) {
+		return os.Open(path)
+	},
+}
+
+func recognizeBundle(directory string, operations recognitionOperations) (Manifest, error) {
+	info, err := operations.lstat(directory)
+	if err != nil {
+		return Manifest{}, unrecognizedBundleError("inspect directory", err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.IsDir() {
+		return Manifest{}, unrecognizedBundleError("directory is not a real directory", nil)
+	}
+
+	entries, err := operations.readDir(directory)
+	if err != nil {
+		return Manifest{}, unrecognizedBundleError("read directory", err)
+	}
+	manifestData, err := readBundleFile(directory, ManifestFilename, operations)
+	if err != nil {
+		return Manifest{}, err
+	}
+	manifest, err := decodeManifest(manifestData)
+	if err != nil {
+		return Manifest{}, err
+	}
+	if err := manifest.Validate(); err != nil {
+		return Manifest{}, unrecognizedBundleError("validate manifest", err)
+	}
+
+	expected := map[string]struct{}{
+		ManifestFilename:    {},
+		DataPackageFilename: {},
+	}
+	for _, result := range manifest.Results {
+		if result.Status == StatusSucceeded {
+			expected[result.ReportPath] = struct{}{}
+		}
+	}
+	if len(entries) != len(expected) {
+		return Manifest{}, unrecognizedBundleError("directory entries do not match manifest", nil)
+	}
+	for _, entry := range entries {
+		if _, ok := expected[entry.Name()]; !ok {
+			return Manifest{}, unrecognizedBundleError("directory has an undeclared entry", nil)
+		}
+		if entry.Name() == ManifestFilename || entry.Name() == DataPackageFilename {
+			continue
+		}
+		if err := inspectBundleFile(directory, entry.Name(), operations); err != nil {
+			return Manifest{}, err
+		}
+	}
+
+	dataPackage, err := readBundleFile(directory, DataPackageFilename, operations)
+	if err != nil {
+		return Manifest{}, err
+	}
+	if SHA256(dataPackage) != manifest.DataPackage.SHA256 {
+		return Manifest{}, unrecognizedBundleError("data package digest does not match manifest", nil)
+	}
+	return manifest, nil
+}
+
+func readBundleFile(directory, name string, operations recognitionOperations) ([]byte, error) {
+	file, err := openBundleFile(directory, name, operations)
+	if err != nil {
+		return nil, err
+	}
+	defer file.Close()
+	data, err := io.ReadAll(file)
+	if err != nil {
+		return nil, unrecognizedBundleError("read bundle entry", err)
+	}
+	return data, nil
+}
+
+func inspectBundleFile(directory, name string, operations recognitionOperations) error {
+	file, err := openBundleFile(directory, name, operations)
+	if err != nil {
+		return err
+	}
+	if err := file.Close(); err != nil {
+		return unrecognizedBundleError("close bundle entry", err)
+	}
+	return nil
+}
+
+func openBundleFile(directory, name string, operations recognitionOperations) (io.ReadCloser, error) {
+	if !isArtifactBasename(name) {
+		return nil, unrecognizedBundleError("bundle entry name is unsafe", nil)
+	}
+	filePath := filepath.Join(directory, name)
+	info, err := operations.lstat(filePath)
+	if err != nil {
+		return nil, unrecognizedBundleError("inspect bundle entry", err)
+	}
+	if info.Mode()&os.ModeSymlink != 0 || !info.Mode().IsRegular() {
+		return nil, unrecognizedBundleError("bundle entry is not a regular file", nil)
+	}
+	file, err := operations.open(filePath)
+	if err != nil {
+		return nil, unrecognizedBundleError("read bundle entry", err)
+	}
+	return file, nil
+}
+
+func decodeManifest(data []byte) (Manifest, error) {
+	if err := validateManifestJSON(data); err != nil {
+		return Manifest{}, unrecognizedBundleError("decode manifest", err)
+	}
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	decoder.DisallowUnknownFields()
+	var manifest Manifest
+	if err := decoder.Decode(&manifest); err != nil {
+		return Manifest{}, unrecognizedBundleError("decode manifest", err)
+	}
+	var trailing any
+	if err := decoder.Decode(&trailing); err != io.EOF {
+		if err == nil {
+			return Manifest{}, unrecognizedBundleError("manifest has multiple JSON values", nil)
+		}
+		return Manifest{}, unrecognizedBundleError("decode manifest", err)
+	}
+	return manifest, nil
+}
+
+var manifestFields = map[string]jsonValueValidator{
+	"schemaVersion": nil,
+	"comparisonId":  nil,
+	"startedAt":     nil,
+	"finishedAt":    nil,
+	"reportId":      nil,
+	"validPeriod":   validateValidPeriodJSON,
+	"timezone":      nil,
+	"promptId":      nil,
+	"promptVersion": nil,
+	"promptHash":    nil,
+	"dataPackage":   validateDataPackageJSON,
+	"total":         nil,
+	"succeeded":     nil,
+	"failed":        nil,
+	"results":       validateResultsJSON,
+}
+
+var validPeriodFields = map[string]jsonValueValidator{
+	"start": nil,
+	"end":   nil,
+}
+
+var dataPackageFields = map[string]jsonValueValidator{
+	"path":   nil,
+	"sha256": nil,
+}
+
+var resultFields = map[string]jsonValueValidator{
+	"position":         nil,
+	"profileId":        nil,
+	"backendId":        nil,
+	"modelName":        nil,
+	"status":           nil,
+	"validationStatus": nil,
+	"reportPath":       nil,
+	"error":            validateSafeErrorJSON,
+}
+
+var safeErrorFields = map[string]jsonValueValidator{
+	"category": nil,
+	"message":  nil,
+}
+
+type jsonValueValidator func(*json.Decoder) error
+
+func validateManifestJSON(data []byte) error {
+	decoder := json.NewDecoder(bytes.NewReader(data))
+	if err := validateJSONObject(decoder, manifestFields); err != nil {
+		return err
+	}
+	if _, err := decoder.Token(); err != io.EOF {
+		if err == nil {
+			return fmt.Errorf("manifest has multiple JSON values")
+		}
+		return err
+	}
+	return nil
+}
+
+func validateValidPeriodJSON(decoder *json.Decoder) error {
+	return validateJSONObject(decoder, validPeriodFields)
+}
+
+func validateDataPackageJSON(decoder *json.Decoder) error {
+	return validateJSONObject(decoder, dataPackageFields)
+}
+
+func validateResultsJSON(decoder *json.Decoder) error {
+	token, err := decoder.Token()
+	if err != nil {
+		return err
+	}
+	if delimiter, ok := token.(json.Delim); !ok || delimiter != '[' {
+		return fmt.Errorf("results must be an array")
+	}
+	for decoder.More() {
+		if err := validateJSONObject(decoder, resultFields); err != nil {
+			return err
+		}
+	}
+	token, err = decoder.Token()
+	if err != nil {
+		return err
+	}
+	if delimiter, ok := token.(json.Delim); !ok || delimiter != ']' {
+		return fmt.Errorf("results has an invalid array terminator")
+	}
+	return nil
+}
+
+func validateSafeErrorJSON(decoder *json.Decoder) error {
+	token, err := decoder.Token()
+	if err != nil {
+		return err
+	}
+	if token == nil {
+		return nil
+	}
+	if delimiter, ok := token.(json.Delim); !ok || delimiter != '{' {
+		return fmt.Errorf("error must be an object")
+	}
+	return validateJSONObjectBody(decoder, safeErrorFields)
+}
+
+func validateJSONObject(decoder *json.Decoder, fields map[string]jsonValueValidator) error {
+	token, err := decoder.Token()
+	if err != nil {
+		return err
+	}
+	if delimiter, ok := token.(json.Delim); !ok || delimiter != '{' {
+		return fmt.Errorf("manifest value must be an object")
+	}
+	return validateJSONObjectBody(decoder, fields)
+}
+
+func validateJSONObjectBody(decoder *json.Decoder, fields map[string]jsonValueValidator) error {
+	seen := make(map[string]struct{}, len(fields))
+	for decoder.More() {
+		token, err := decoder.Token()
+		if err != nil {
+			return err
+		}
+		name, ok := token.(string)
+		if !ok {
+			return fmt.Errorf("manifest field name is invalid")
+		}
+		validator, known := fields[name]
+		if !known {
+			return fmt.Errorf("manifest field %q is not canonical", name)
+		}
+		if _, duplicate := seen[name]; duplicate {
+			return fmt.Errorf("manifest field %q is duplicated", name)
+		}
+		seen[name] = struct{}{}
+		if validator == nil {
+			var value json.RawMessage
+			if err := decoder.Decode(&value); err != nil {
+				return err
+			}
+			continue
+		}
+		if err := validator(decoder); err != nil {
+			return err
+		}
+	}
+	token, err := decoder.Token()
+	if err != nil {
+		return err
+	}
+	if delimiter, ok := token.(json.Delim); !ok || delimiter != '}' {
+		return fmt.Errorf("manifest object has an invalid terminator")
+	}
+	return nil
+}
+
+func unrecognizedBundleError(action string, err error) error {
+	if err == nil {
+		return fmt.Errorf("%w: %s", ErrUnrecognizedBundle, action)
+	}
+	return fmt.Errorf("%w: %s: %v", ErrUnrecognizedBundle, action, err)
+}
+
+// BackupRecoveryState describes what remains of a prior bundle after cleanup
+// reports an error.
+type BackupRecoveryState string
+
+const (
+	BackupRecoveryComplete BackupRecoveryState = "complete"
+	BackupRecoveryPartial  BackupRecoveryState = "partial"
+	BackupRecoveryAbsent   BackupRecoveryState = "absent"
+	BackupRecoveryUnknown  BackupRecoveryState = "unknown"
+)
+
+// PublicationResult describes the durable state of a publication attempt.
+type PublicationResult struct {
+	Committed     bool
+	RecoveryState BackupRecoveryState
+	RecoveryPath  string
+}
+
+// PublicationCleanupError reports that a committed bundle could not completely
+// remove its prior sibling backup. The new bundle remains installed; recovery
+// fields describe the state observed after cleanup failed.
+type PublicationCleanupError struct {
+	RecoveryState BackupRecoveryState
+	RecoveryPath  string
+	Err           error
+}
+
+func (err *PublicationCleanupError) Error() string {
+	switch err.RecoveryState {
+	case BackupRecoveryComplete:
+		return fmt.Sprintf("remove comparison backup %q: %v; complete recovery bundle remains", err.RecoveryPath, err.Err)
+	case BackupRecoveryPartial:
+		return fmt.Sprintf("remove comparison backup %q: %v; partial remnants remain", err.RecoveryPath, err.Err)
+	case BackupRecoveryAbsent:
+		return fmt.Sprintf("remove comparison backup: %v; no recovery bundle remains", err.Err)
+	default:
+		return fmt.Sprintf("remove comparison backup: %v; recovery state is unknown", err.Err)
+	}
+}
+
+func (err *PublicationCleanupError) Unwrap() error {
+	return err.Err
+}
+
+// Publish writes a complete logical bundle through a private sibling directory
+// and atomically installs it at a preflighted destination.
+func Publish(ctx context.Context, plan DestinationPlan, bundle LogicalBundle) (PublicationResult, error) {
+	return publish(ctx, plan, bundle, publishOperations{rename: os.Rename, removeAll: os.RemoveAll})
+}
+
+type publishOperations struct {
+	rename       func(string, string) error
+	removeAll    func(string) error
+	beforeCommit func()
+	recognize    func(string) (Manifest, error)
+}
+
+func publish(ctx context.Context, plan DestinationPlan, bundle LogicalBundle, operations publishOperations) (PublicationResult, error) {
+	if operations.rename == nil {
+		operations.rename = os.Rename
+	}
+	if operations.removeAll == nil {
+		operations.removeAll = os.RemoveAll
+	}
+	if operations.recognize == nil {
+		operations.recognize = RecognizeBundle
+	}
+	if err := bundle.Validate(); err != nil {
+		return PublicationResult{}, fmt.Errorf("validate comparison bundle: %w", err)
+	}
+	manifestData, err := EncodeManifest(bundle.Manifest)
+	if err != nil {
+		return PublicationResult{}, err
+	}
+	if err := ctx.Err(); err != nil {
+		return PublicationResult{}, err
+	}
+	plan, err = reauthorizeDestination(plan)
+	if err != nil {
+		return PublicationResult{}, err
+	}
+
+	if err := os.MkdirAll(filepath.Dir(plan.Target), 0o755); err != nil {
+		return PublicationResult{}, fmt.Errorf("create comparison destination parent %q: %w", filepath.Dir(plan.Target), err)
+	}
+	temporaryDirectory, err := os.MkdirTemp(filepath.Dir(plan.Target), stagingDirectoryPattern)
+	if err != nil {
+		return PublicationResult{}, fmt.Errorf("create comparison staging directory: %w", err)
+	}
+	if err := os.Chmod(temporaryDirectory, 0o700); err != nil {
+		os.RemoveAll(temporaryDirectory)
+		return PublicationResult{}, fmt.Errorf("secure comparison staging directory: %w", err)
+	}
+	defer func() {
+		if temporaryDirectory != "" {
+			_ = os.RemoveAll(temporaryDirectory)
+		}
+	}()
+
+	if err := writeLogicalBundle(ctx, temporaryDirectory, bundle, manifestData); err != nil {
+		return PublicationResult{}, err
+	}
+
+	currentPlan, err := reauthorizeDestination(plan)
+	if err != nil {
+		return PublicationResult{}, err
+	}
+	if operations.beforeCommit != nil {
+		operations.beforeCommit()
+	}
+	if err := ctx.Err(); err != nil {
+		return PublicationResult{}, err
+	}
+	if currentPlan.state == destinationAbsent {
+		if err := operations.rename(temporaryDirectory, currentPlan.Target); err != nil {
+			return PublicationResult{}, fmt.Errorf("publish comparison bundle to %q: %w", currentPlan.Target, err)
+		}
+		temporaryDirectory = ""
+		return PublicationResult{Committed: true}, nil
+	}
+
+	backupDirectory, err := uniqueSiblingPath(filepath.Dir(currentPlan.Target), backupDirectoryPattern)
+	if err != nil {
+		return PublicationResult{}, err
+	}
+	if err := operations.rename(currentPlan.Target, backupDirectory); err != nil {
+		return PublicationResult{}, fmt.Errorf("back up comparison destination %q: %w", currentPlan.Target, err)
+	}
+	if err := authorizeMovedDestination(currentPlan, backupDirectory, operations.recognize); err != nil {
+		return PublicationResult{}, restoreMovedDestination(operations, backupDirectory, currentPlan.Target, err)
+	}
+	if err := ctx.Err(); err != nil {
+		return PublicationResult{}, restoreMovedDestination(operations, backupDirectory, currentPlan.Target, err)
+	}
+	if err := operations.rename(temporaryDirectory, currentPlan.Target); err != nil {
+		return PublicationResult{}, restoreMovedDestination(operations, backupDirectory, currentPlan.Target, fmt.Errorf("replace comparison destination %q: %w", currentPlan.Target, err))
+	}
+	temporaryDirectory = ""
+	if err := operations.removeAll(backupDirectory); err != nil {
+		recoveryState, recoveryPath := inspectBackupRecovery(backupDirectory)
+		cleanupErr := &PublicationCleanupError{RecoveryState: recoveryState, RecoveryPath: recoveryPath, Err: err}
+		return PublicationResult{Committed: true, RecoveryState: recoveryState, RecoveryPath: recoveryPath}, cleanupErr
+	}
+	return PublicationResult{Committed: true}, nil
+}
+
+func inspectBackupRecovery(backupDirectory string) (BackupRecoveryState, string) {
+	if _, err := os.Lstat(backupDirectory); err != nil {
+		if errors.Is(err, os.ErrNotExist) {
+			return BackupRecoveryAbsent, ""
+		}
+		return BackupRecoveryUnknown, ""
+	}
+	if _, err := RecognizeBundle(backupDirectory); err == nil {
+		return BackupRecoveryComplete, backupDirectory
+	}
+	return BackupRecoveryPartial, backupDirectory
+}
+
+func authorizeMovedDestination(plan DestinationPlan, backupDirectory string, recognize func(string) (Manifest, error)) error {
+	backupPlan, err := planDestination(plan.WorkingDirectory, backupDirectory, plan.Replace, recognize)
+	if err != nil {
+		return fmt.Errorf("authorize moved comparison destination %q: %w", backupDirectory, err)
+	}
+	if backupPlan.state != destinationEmpty && backupPlan.state != destinationBundle {
+		return fmt.Errorf("authorize moved comparison destination %q: destination disappeared", backupDirectory)
+	}
+	return nil
+}
+
+func restoreMovedDestination(operations publishOperations, backupDirectory, target string, cause error) error {
+	if _, err := os.Lstat(target); err == nil {
+		return errors.Join(
+			cause,
+			fmt.Errorf("restore prior comparison destination from %q: destination %q reappeared", backupDirectory, target),
+		)
+	} else if !errors.Is(err, os.ErrNotExist) {
+		return errors.Join(
+			cause,
+			fmt.Errorf("inspect comparison destination %q before restoring from %q: %w", target, backupDirectory, err),
+		)
+	}
+	if restoreErr := operations.rename(backupDirectory, target); restoreErr != nil {
+		return errors.Join(
+			cause,
+			fmt.Errorf("restore prior comparison destination from %q: %w", backupDirectory, restoreErr),
+		)
+	}
+	return cause
+}
+
+func writeLogicalBundle(ctx context.Context, directory string, bundle LogicalBundle, manifestData []byte) error {
+	if err := writeBundleFile(ctx, filepath.Join(directory, DataPackageFilename), bundle.DataPackage); err != nil {
+		return err
+	}
+	for _, report := range bundle.Reports {
+		if err := writeBundleFile(ctx, filepath.Join(directory, report.Path), report.Markdown); err != nil {
+			return err
+		}
+	}
+	if err := writeBundleFile(ctx, filepath.Join(directory, ManifestFilename), manifestData); err != nil {
+		return err
+	}
+	return nil
+}
+
+func writeBundleFile(ctx context.Context, filePath string, content []byte) error {
+	if err := ctx.Err(); err != nil {
+		return err
+	}
+	file, err := os.OpenFile(filePath, os.O_WRONLY|os.O_CREATE|os.O_EXCL, 0o600)
+	if err != nil {
+		return fmt.Errorf("create comparison bundle file %q: %w", filePath, err)
+	}
+	if _, err := file.Write(content); err != nil {
+		file.Close()
+		return fmt.Errorf("write comparison bundle file %q: %w", filePath, err)
+	}
+	if err := file.Close(); err != nil {
+		return fmt.Errorf("close comparison bundle file %q: %w", filePath, err)
+	}
+	return nil
+}
+
+func uniqueSiblingPath(parent, prefix string) (string, error) {
+	file, err := os.CreateTemp(parent, prefix)
+	if err != nil {
+		return "", fmt.Errorf("reserve comparison backup path: %w", err)
+	}
+	path := file.Name()
+	if err := file.Close(); err != nil {
+		os.Remove(path)
+		return "", fmt.Errorf("close comparison backup reservation: %w", err)
+	}
+	if err := os.Remove(path); err != nil {
+		return "", fmt.Errorf("release comparison backup reservation: %w", err)
+	}
+	return path, nil
+}

internal/config/config.go

@@ -21,10 +21,38 @@ const (
 	NotifyFailureError NotifyFailurePolicy = "error"
 )
 
+const (
+	MissingSourceObservations          = "observations"
+	MissingSourceCurrent               = "current"
+	MissingSourceNarrative             = "narrative"
+	MissingSourceAlerts                = "alerts"
+	MissingSourceDiscussion            = "discussion"
+	MissingSourceWeatherStory          = "weather_story"
+	MissingSourceSPCConvectiveOutlooks = "spc_convective_outlooks"
+)
+
+var supportedMissingSources = map[string]struct{}{
+	MissingSourceObservations:          {},
+	MissingSourceCurrent:               {},
+	MissingSourceNarrative:             {},
+	MissingSourceAlerts:                {},
+	MissingSourceDiscussion:            {},
+	MissingSourceWeatherStory:          {},
+	MissingSourceSPCConvectiveOutlooks: {},
+}
+
+// IsSupportedMissingSource reports whether source accepts a missing-source
+// policy override. Required sources, including hourly, are not configurable.
+func IsSupportedMissingSource(source string) bool {
+	_, ok := supportedMissingSources[source]
+	return ok
+}
+
 type Config struct {
 	WeatherAPI    WeatherAPIConfig        `yaml:"weather_api"`
 	Location      LocationConfig          `yaml:"location"`
 	Secrets       SecretsConfig           `yaml:"secrets"`
+	Output        OutputConfig            `yaml:"output"`
 	Notify        NotifyConfig            `yaml:"notify"`
 	MissingSource MissingSourceConfig     `yaml:"missing_source"`
 	Promptkit     PromptkitConfig         `yaml:"promptkit"`
@@ -51,6 +79,10 @@ type SecretsConfig struct {
 	Directory string `yaml:"directory"`
 }
 
+type OutputConfig struct {
+	Directory string `yaml:"directory"`
+}
+
 type NotifyConfig struct {
 	Distributor DistributorNotifyConfig `yaml:"distributor"`
 }
@@ -241,7 +273,11 @@ func (c *ReportDistributorConfig) UnmarshalYAML(value *yaml.Node) error {
 }
 
 func (c ReportDistributorConfig) PathTemplatesSet() bool {
-	return c.pathTemplatesSet
+	return c.pathTemplatesSet || c.PathTemplates != nil
+}
+
+func (c ReportConfig) deterministicModulesConfigured() bool {
+	return c.deterministicModulesSet || c.DeterministicModules != nil
 }
 
 func (m *ModuleConfigItem) UnmarshalYAML(value *yaml.Node) error {

internal/config/config_test.go

@@ -4,12 +4,14 @@ import (
 	"os"
 	"path/filepath"
 	"reflect"
+	"strconv"
 	"strings"
 	"testing"
 	"time"
 
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/module"
 	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/testutil"
 	"gopkg.in/yaml.v3"
 )
 
@@ -37,6 +39,9 @@ func TestDefaults(t *testing.T) {
 	if cfg.Secrets.Directory != "" {
 		t.Fatalf("Secrets.Directory = %q, want empty", cfg.Secrets.Directory)
 	}
+	if cfg.Output.Directory != "" {
+		t.Fatalf("Output.Directory = %q, want empty", cfg.Output.Directory)
+	}
 	if cfg.Notify.Distributor.Enabled {
 		t.Fatalf("Notify.Distributor.Enabled = true, want false")
 	}
@@ -78,6 +83,184 @@ func TestDefaults(t *testing.T) {
 	}
 }
 
+func TestDaypartNamesMustHaveDistinctCanonicalIdentities(t *testing.T) {
+	tests := []struct {
+		name    string
+		names   []string
+		wantErr string
+	}{
+		{name: "exact duplicate", names: []string{"morning", "morning"}, wantErr: "conflicts with"},
+		{name: "case-only duplicate", names: []string{"morning", "MORNING"}, wantErr: "conflicts with"},
+		{name: "punctuation-normalized duplicate", names: []string{"morning", "morning!"}, wantErr: "conflicts with"},
+		{name: "distinct Unicode names", names: []string{"mañana", "manana"}},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := Defaults()
+			cfg.Dayparts = make([]DaypartConfig, 0, len(tt.names))
+			for _, name := range tt.names {
+				cfg.Dayparts = append(cfg.Dayparts, DaypartConfig{Name: name, Start: "06:00", End: "12:00"})
+			}
+
+			err := Validate(cfg)
+			if tt.wantErr == "" {
+				if err != nil {
+					t.Fatalf("Validate() error = %v", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("Validate() error = %v, want %q", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestWeatherAPIBaseURLValidation(t *testing.T) {
+	tests := []struct {
+		name    string
+		baseURL string
+		wantErr string
+	}{
+		{name: "local HTTP", baseURL: "http://127.0.0.1:8080/weather/"},
+		{name: "local HTTPS", baseURL: "https://127.0.0.1:8443/weather/"},
+		{name: "unsupported scheme", baseURL: "ftp://weather.example.test/", wantErr: "weather_api.base_url must use http or https"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := Defaults()
+			cfg.WeatherAPI.BaseURL = tt.baseURL
+
+			err := Validate(cfg)
+			if tt.wantErr == "" {
+				if err != nil {
+					t.Fatalf("Validate() error = %v", err)
+				}
+				return
+			}
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("Validate() error = %v, want %q", err, tt.wantErr)
+			}
+		})
+	}
+}
+
+func TestOutputDirectoryLoading(t *testing.T) {
+	tests := []struct {
+		name      string
+		yaml      string
+		wantValue string
+		wantErr   string
+	}{
+		{
+			name:      "omitted",
+			yaml:      "{}\n",
+			wantValue: "",
+		},
+		{
+			name: "explicit empty",
+			yaml: `
+output:
+  directory: ""
+`,
+			wantValue: "",
+		},
+		{
+			name: "absolute path",
+			yaml: `
+output:
+  directory: /var/lib/weatherreporter/reports
+`,
+			wantValue: "/var/lib/weatherreporter/reports",
+		},
+		{
+			name: "relative path",
+			yaml: `
+output:
+  directory: reports/../published
+`,
+			wantValue: "reports/../published",
+		},
+		{
+			name: "whitespace only",
+			yaml: `
+output:
+  directory: "  \t  "
+`,
+			wantErr: "output.directory",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg, err := LoadFile(writeConfig(t, tt.yaml))
+			if tt.wantErr != "" {
+				if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+					t.Fatalf("LoadFile() error = %v, want %q", err, tt.wantErr)
+				}
+				return
+			}
+			if err != nil {
+				t.Fatalf("LoadFile() error = %v", err)
+			}
+			if cfg.Output.Directory != tt.wantValue {
+				t.Fatalf("Output.Directory = %q, want %q", cfg.Output.Directory, tt.wantValue)
+			}
+		})
+	}
+}
+
+func TestOutputDirectoryValidationIsConsistentForLoadedAndConstructedConfigs(t *testing.T) {
+	tests := []struct {
+		name      string
+		directory string
+		wantErr   string
+	}{
+		{name: "empty"},
+		{name: "absolute path", directory: "/var/lib/weatherreporter/reports"},
+		{name: "relative path", directory: "reports/../published"},
+		{name: "whitespace only", directory: " \t ", wantErr: "output.directory"},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			yaml := "output:\n  directory: " + strconv.Quote(tt.directory) + "\n"
+			_, loadErr := LoadFile(writeConfig(t, yaml))
+
+			cfg := Defaults()
+			cfg.Output.Directory = tt.directory
+			validateErr := Validate(cfg)
+
+			if (loadErr == nil) != (validateErr == nil) {
+				t.Fatalf("LoadFile() error = %v, Validate() error = %v", loadErr, validateErr)
+			}
+			if tt.wantErr != "" {
+				if loadErr == nil || !strings.Contains(loadErr.Error(), tt.wantErr) {
+					t.Fatalf("LoadFile() error = %v, want %q", loadErr, tt.wantErr)
+				}
+				if validateErr == nil || !strings.Contains(validateErr.Error(), tt.wantErr) {
+					t.Fatalf("Validate() error = %v, want %q", validateErr, tt.wantErr)
+				}
+			}
+		})
+	}
+}
+
+func TestOutputDirectoryRejectsUnknownFields(t *testing.T) {
+	_, err := LoadFile(writeConfig(t, `
+output:
+  location: reports
+`))
+	if err == nil {
+		t.Fatal("LoadFile() error = nil, want strict decoding error")
+	}
+	if !strings.Contains(err.Error(), "field location not found") {
+		t.Fatalf("LoadFile() error = %q, want output field rejection", err.Error())
+	}
+}
+
 func TestLoadExampleConfig(t *testing.T) {
 	cfg, err := LoadFile(filepath.Join("..", "..", "examples", "config.yml"))
 	if err != nil {
@@ -96,6 +279,9 @@ func TestLoadExampleConfig(t *testing.T) {
 	if cfg.Location.ID != "home" || cfg.Location.Name != "Brentwood" || cfg.Location.Region != "St. Louis Metro" {
 		t.Fatalf("Location = %#v, want example location", cfg.Location)
 	}
+	if cfg.Output.Directory != "/var/lib/weatherreporter/reports" {
+		t.Fatalf("Output.Directory = %q, want maintained example value", cfg.Output.Directory)
+	}
 	if cfg.Notify.Distributor.PipelineIDTemplate != "weatherreporter.{report_id}" {
 		t.Fatalf("PipelineIDTemplate = %q, want example pipeline template", cfg.Notify.Distributor.PipelineIDTemplate)
 	}
@@ -412,6 +598,35 @@ func TestReportModuleOverridesNormalizesConstructedOptionsWithoutMutatingConfig(
 	}
 }
 
+func TestReportModuleOverridesCanonicalizesTypedPointerOptions(t *testing.T) {
+	cfg := Defaults()
+	options := &module.AreaForecastDiscussionOptions{Sections: []string{"short_term"}}
+	cfg.Reports = map[string]ReportConfig{
+		"daily": {
+			DeterministicModules: []ModuleConfigItem{
+				{ID: module.Metadata},
+				{ID: module.AreaForecastDiscussion, Options: options},
+			},
+			deterministicModulesSet: true,
+		},
+	}
+
+	overrides, err := cfg.ReportModuleOverrides()
+	if err != nil {
+		t.Fatalf("ReportModuleOverrides() error = %v", err)
+	}
+	got, ok := overrides[report.Daily][1].Options.(module.AreaForecastDiscussionOptions)
+	if !ok {
+		t.Fatalf("override options type = %T, want AreaForecastDiscussionOptions", overrides[report.Daily][1].Options)
+	}
+	if !reflect.DeepEqual(got, *options) {
+		t.Fatalf("override options = %#v, want %#v", got, *options)
+	}
+	if cfg.Reports["daily"].DeterministicModules[1].Options != options {
+		t.Fatalf("config options = %#v, want original pointer %#v", cfg.Reports["daily"].DeterministicModules[1].Options, options)
+	}
+}
+
 func TestValidateReportModuleAliasesDirectly(t *testing.T) {
 	retiredDailyKey := retiredDailyReportKeyForTest()
 	tests := []struct {
@@ -945,6 +1160,44 @@ func TestInvalidConfigProducesActionableError(t *testing.T) {
 	}
 }
 
+func TestMissingSourcePoliciesOnlyAllowSupportedOptionalSources(t *testing.T) {
+	for _, source := range []string{
+		MissingSourceObservations,
+		MissingSourceCurrent,
+		MissingSourceNarrative,
+		MissingSourceAlerts,
+		MissingSourceDiscussion,
+		MissingSourceWeatherStory,
+		MissingSourceSPCConvectiveOutlooks,
+	} {
+		t.Run("supported_"+source, func(t *testing.T) {
+			cfg := Defaults()
+			cfg.MissingSource.Sources = map[string]MissingSourcePolicy{source: MissingSourceNone}
+			if err := Validate(cfg); err != nil {
+				t.Fatalf("Validate() error = %v", err)
+			}
+			loaded, err := LoadFile(writeConfig(t, "missing_source:\n  sources:\n    "+source+": none\n"))
+			if err != nil {
+				t.Fatalf("LoadFile() error = %v", err)
+			}
+			if loaded.MissingSource.Sources[source] != MissingSourceNone {
+				t.Fatalf("loaded source policy = %q, want none", loaded.MissingSource.Sources[source])
+			}
+		})
+	}
+
+	for _, source := range []string{"alert", "unknown", "hourly", ""} {
+		t.Run("unsupported_"+source, func(t *testing.T) {
+			cfg := Defaults()
+			cfg.MissingSource.Sources = map[string]MissingSourcePolicy{source: MissingSourceWarn}
+			err := Validate(cfg)
+			if err == nil || !strings.Contains(err.Error(), "missing_source.sources") {
+				t.Fatalf("Validate() error = %v, want unsupported source error", err)
+			}
+		})
+	}
+}
+
 func TestLoadAppliesOverrides(t *testing.T) {
 	cfg, err := Load(LoadOptions{Units: "metric", Timezone: "+09:30"})
 	if err != nil {
@@ -1059,9 +1312,10 @@ func TestDisabledDistributorNotifyAcceptsMalformedBatchTemplates(t *testing.T) {
 
 func TestEnabledDistributorNotifyValidation(t *testing.T) {
 	tests := []struct {
-		name    string
-		mutate  func(*Config)
-		wantErr string
+		name       string
+		mutate     func(*Config)
+		wantErr    string
+		wantAbsent string
 	}{
 		{
 			name: "Endpoint",
@@ -1070,6 +1324,35 @@ func TestEnabledDistributorNotifyValidation(t *testing.T) {
 			},
 			wantErr: "notify.distributor.endpoint",
 		},
+		{
+			name: "UnsupportedEndpointScheme",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.Endpoint = "ftp://distributor.example.test"
+			},
+			wantErr: "notify.distributor.endpoint",
+		},
+		{
+			name: "EndpointUserinfo",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.Endpoint = "https://userinfo-secret@distributor.example.test"
+			},
+			wantErr:    "notify.distributor.endpoint",
+			wantAbsent: "userinfo-secret",
+		},
+		{
+			name: "EndpointQuery",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.Endpoint = "https://distributor.example.test?preview=1"
+			},
+			wantErr: "notify.distributor.endpoint",
+		},
+		{
+			name: "EndpointFragment",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.Endpoint = "https://distributor.example.test#status"
+			},
+			wantErr: "notify.distributor.endpoint",
+		},
 		{
 			name: "TokenEnvEmpty",
 			mutate: func(cfg *Config) {
@@ -1126,6 +1409,13 @@ func TestEnabledDistributorNotifyValidation(t *testing.T) {
 			},
 			wantErr: "notify.distributor.bundle_id_template",
 		},
+		{
+			name: "BundleTemplateRenderedEmpty",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.BundleIDTemplate = "   "
+			},
+			wantErr: "notify.distributor.bundle_id_template",
+		},
 		{
 			name: "IdempotencyTemplate",
 			mutate: func(cfg *Config) {
@@ -1133,6 +1423,13 @@ func TestEnabledDistributorNotifyValidation(t *testing.T) {
 			},
 			wantErr: "notify.distributor.idempotency_key_template",
 		},
+		{
+			name: "IdempotencyTemplateRenderedEmpty",
+			mutate: func(cfg *Config) {
+				cfg.Notify.Distributor.IdempotencyKeyTemplate = "   "
+			},
+			wantErr: "notify.distributor.idempotency_key_template",
+		},
 		{
 			name: "BatchTemplate",
 			mutate: func(cfg *Config) {
@@ -1156,6 +1453,27 @@ func TestEnabledDistributorNotifyValidation(t *testing.T) {
 			if !strings.Contains(err.Error(), tt.wantErr) {
 				t.Fatalf("error = %q, want %q", err.Error(), tt.wantErr)
 			}
+			if tt.wantAbsent != "" && strings.Contains(err.Error(), tt.wantAbsent) {
+				t.Fatalf("error = %q, must not contain endpoint userinfo", err.Error())
+			}
+		})
+	}
+}
+
+func TestEnabledDistributorNotifyAcceptsHTTPBasePaths(t *testing.T) {
+	for _, endpoint := range []string{
+		"http://distributor.example.test/archive",
+		"https://distributor.example.test/archive/",
+	} {
+		t.Run(endpoint, func(t *testing.T) {
+			cfg := Defaults()
+			cfg.Notify.Distributor.Enabled = true
+			cfg.Notify.Distributor.Endpoint = endpoint
+			cfg.Notify.Distributor.PipelineIDTemplate = "weatherreporter.{artifact_group}"
+
+			if err := Validate(cfg); err != nil {
+				t.Fatalf("Validate() error = %v", err)
+			}
 		})
 	}
 }
@@ -1408,43 +1726,59 @@ func TestDistributorBatchTemplateRendering(t *testing.T) {
 	}
 }
 
-func TestDistributorBatchTemplateRejectsUnknownAndMalformedVariables(t *testing.T) {
+func TestDistributorTemplateRejectsUnknownVariables(t *testing.T) {
 	tests := []struct {
 		name     string
 		template string
+		render   func(string) error
 	}{
-		{name: "Unknown", template: "{report_id}"},
-		{name: "Unclosed", template: "{batch"},
-		{name: "Unopened", template: "batch}"},
-		{name: "Empty", template: "{}"},
+		{
+			name:     "SingleReport",
+			template: "{unknown}",
+			render: func(template string) error {
+				_, err := RenderDistributorBundleID(template, DistributorTemplateValues{})
+				return err
+			},
+		},
+		{
+			name:     "Batch",
+			template: "{report_id}",
+			render: func(template string) error {
+				_, err := RenderDistributorBatchBundleID(template, DistributorBatchTemplateValues{})
+				return err
+			},
+		},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			_, err := RenderDistributorBatchBundleID(tt.template, DistributorBatchTemplateValues{})
+			err := tt.render(tt.template)
 			if err == nil {
-				t.Fatal("RenderDistributorBatchBundleID() error = nil, want error")
+				t.Fatal("rendering error = nil, want error")
 			}
 		})
 	}
 }
 
-func TestDistributorTemplateRejectsUnknownAndMalformedVariables(t *testing.T) {
+func TestDistributorTemplateParserRejectsMalformedVariables(t *testing.T) {
+	const name = "notify.distributor.bundle_id_template"
 	tests := []struct {
 		name     string
 		template string
+		wantErr  string
 	}{
-		{name: "Unknown", template: "{unknown}"},
-		{name: "Unclosed", template: "{location_id"},
-		{name: "Unopened", template: "location_id}"},
-		{name: "Empty", template: "{}"},
+		{name: "Unclosed", template: "{location_id", wantErr: name + " contains an unclosed template variable"},
+		{name: "Unopened", template: "location_id}", wantErr: name + " contains an unopened template variable"},
+		{name: "Empty", template: "{}", wantErr: name + " contains an empty template variable"},
 	}
 
 	for _, tt := range tests {
 		t.Run(tt.name, func(t *testing.T) {
-			_, err := RenderDistributorBundleID(tt.template, DistributorTemplateValues{})
-			if err == nil {
-				t.Fatal("RenderDistributorBundleID() error = nil, want error")
+			_, err := renderDistributorTemplate(name, tt.template, func(variable string) (string, bool) {
+				return "value", variable == "location_id"
+			})
+			if err == nil || err.Error() != tt.wantErr {
+				t.Fatalf("error = %v, want %q", err, tt.wantErr)
 			}
 		})
 	}
@@ -1547,9 +1881,13 @@ func TestLoadFileLoadsSecretsBeforeReturningNotifyConfig(t *testing.T) {
 func TestLoadSecretsDisabledLeavesEnvironmentUnchanged(t *testing.T) {
 	t.Setenv("WEATHERREPORTER_DISABLED_SECRET", "original")
 
-	if err := loadSecrets(SecretsConfig{}); err != nil {
+	secrets, err := loadSecrets(SecretsConfig{})
+	if err != nil {
 		t.Fatalf("loadSecrets() error = %v", err)
 	}
+	if len(secrets) != 0 {
+		t.Fatalf("staged secrets = %#v, want none", secrets)
+	}
 	if got := os.Getenv("WEATHERREPORTER_DISABLED_SECRET"); got != "original" {
 		t.Fatalf("environment value = %q, want original", got)
 	}
@@ -1585,9 +1923,13 @@ func TestLoadSecretsOverwritesExistingEnvironment(t *testing.T) {
 	}
 	t.Setenv("WEATHERREPORTER_SECRET", "existing")
 
-	if err := loadSecrets(SecretsConfig{Directory: dir}); err != nil {
+	secrets, err := loadSecrets(SecretsConfig{Directory: dir})
+	if err != nil {
 		t.Fatalf("loadSecrets() error = %v", err)
 	}
+	if err := applySecrets(secrets); err != nil {
+		t.Fatalf("applySecrets() error = %v", err)
+	}
 	if got := os.Getenv("WEATHERREPORTER_SECRET"); got != "from-file" {
 		t.Fatalf("environment value = %q, want from-file", got)
 	}
@@ -1614,9 +1956,13 @@ func TestLoadSecretsTrimsOneTrailingLineEnding(t *testing.T) {
 			}
 			t.Setenv("WEATHERREPORTER_SECRET", "")
 
-			if err := loadSecrets(SecretsConfig{Directory: dir}); err != nil {
+			secrets, err := loadSecrets(SecretsConfig{Directory: dir})
+			if err != nil {
 				t.Fatalf("loadSecrets() error = %v", err)
 			}
+			if err := applySecrets(secrets); err != nil {
+				t.Fatalf("applySecrets() error = %v", err)
+			}
 			if got := os.Getenv("WEATHERREPORTER_SECRET"); got != tt.want {
 				t.Fatalf("environment value = %q, want %q", got, tt.want)
 			}
@@ -1655,9 +2001,7 @@ func TestLoadSecretsRejectsInvalidDirectoryEntries(t *testing.T) {
 				if err := os.WriteFile(target, []byte("secret-value"), 0o600); err != nil {
 					t.Fatalf("write target: %v", err)
 				}
-				if err := os.Symlink(target, filepath.Join(dir, "SYMLINK")); err != nil {
-					t.Fatalf("create symlink: %v", err)
-				}
+				testutil.RequireSymlink(t, target, filepath.Join(dir, "SYMLINK"))
 			},
 			wantErr: "not a symlink",
 		},
@@ -1687,7 +2031,7 @@ func TestLoadSecretsRejectsInvalidDirectoryEntries(t *testing.T) {
 			dir := t.TempDir()
 			tt.setup(t, dir)
 
-			err := loadSecrets(SecretsConfig{Directory: dir})
+			_, err := loadSecrets(SecretsConfig{Directory: dir})
 			if err == nil {
 				t.Fatal("loadSecrets() error = nil, want error")
 			}
@@ -1702,7 +2046,7 @@ func TestLoadSecretsRejectsInvalidDirectoryEntries(t *testing.T) {
 }
 
 func TestLoadSecretsRejectsMissingDirectory(t *testing.T) {
-	err := loadSecrets(SecretsConfig{Directory: filepath.Join(t.TempDir(), "missing")})
+	_, err := loadSecrets(SecretsConfig{Directory: filepath.Join(t.TempDir(), "missing")})
 	if err == nil {
 		t.Fatal("loadSecrets() error = nil, want missing directory error")
 	}
@@ -1710,3 +2054,82 @@ func TestLoadSecretsRejectsMissingDirectory(t *testing.T) {
 		t.Fatalf("error = %q, want read secrets directory context", err.Error())
 	}
 }
+
+func TestLoadFileSecretDirectoryFailureLeavesEnvironmentUnchanged(t *testing.T) {
+	dir := t.TempDir()
+	secretsDir := filepath.Join(dir, "secrets")
+	if err := os.Mkdir(secretsDir, 0o700); err != nil {
+		t.Fatalf("create secrets directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(secretsDir, "A_SECRET"), []byte("new-value"), 0o600); err != nil {
+		t.Fatalf("write secret: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(secretsDir, "Z-INVALID"), []byte("unused"), 0o600); err != nil {
+		t.Fatalf("write invalid secret: %v", err)
+	}
+	path := writeConfig(t, "secrets:\n  directory: "+secretsDir+"\n")
+	t.Setenv("A_SECRET", "original-value")
+
+	_, err := LoadFile(path)
+	if err == nil || !strings.Contains(err.Error(), "invalid environment variable name") {
+		t.Fatalf("LoadFile() error = %v, want invalid secret filename", err)
+	}
+	if got := os.Getenv("A_SECRET"); got != "original-value" {
+		t.Fatalf("environment value = %q, want original-value after rejected load", got)
+	}
+}
+
+func TestLoadFileValidationFailureLeavesSecretEnvironmentUnset(t *testing.T) {
+	dir := t.TempDir()
+	secretsDir := filepath.Join(dir, "secrets")
+	if err := os.Mkdir(secretsDir, 0o700); err != nil {
+		t.Fatalf("create secrets directory: %v", err)
+	}
+	if err := os.WriteFile(filepath.Join(secretsDir, "WEATHERREPORTER_SECRET"), []byte("new-value"), 0o600); err != nil {
+		t.Fatalf("write secret: %v", err)
+	}
+	path := writeConfig(t, "secrets:\n  directory: "+secretsDir+"\nmissing_source:\n  default: invalid\n")
+	unsetEnvironment(t, "WEATHERREPORTER_SECRET")
+
+	_, err := LoadFile(path)
+	if err == nil || !strings.Contains(err.Error(), "missing_source.default") {
+		t.Fatalf("LoadFile() error = %v, want configuration validation error", err)
+	}
+	if _, set := os.LookupEnv("WEATHERREPORTER_SECRET"); set {
+		t.Fatal("WEATHERREPORTER_SECRET was set by a rejected configuration")
+	}
+}
+
+func TestApplySecretsRollsBackOnEnvironmentFailure(t *testing.T) {
+	t.Setenv("A_SECRET", "original-value")
+	unsetEnvironment(t, "Z_SECRET")
+
+	err := applySecrets([]secretValue{
+		{name: "A_SECRET", value: "new-value"},
+		{name: "Z_SECRET", value: "invalid\x00value"},
+	})
+	if err == nil || !strings.Contains(err.Error(), `secret file "Z_SECRET"`) {
+		t.Fatalf("applySecrets() error = %v, want Z_SECRET context", err)
+	}
+	if got := os.Getenv("A_SECRET"); got != "original-value" {
+		t.Fatalf("A_SECRET = %q, want original-value after rollback", got)
+	}
+	if _, set := os.LookupEnv("Z_SECRET"); set {
+		t.Fatal("Z_SECRET was set after failed environment application")
+	}
+}
+
+func unsetEnvironment(t *testing.T, name string) {
+	t.Helper()
+	value, set := os.LookupEnv(name)
+	if err := os.Unsetenv(name); err != nil {
+		t.Fatalf("unset environment variable %q: %v", name, err)
+	}
+	t.Cleanup(func() {
+		if set {
+			_ = os.Setenv(name, value)
+			return
+		}
+		_ = os.Unsetenv(name)
+	})
+}

internal/config/defaults.go

@@ -21,6 +21,9 @@ func Defaults() Config {
 		Secrets: SecretsConfig{
 			Directory: "",
 		},
+		Output: OutputConfig{
+			Directory: "",
+		},
 		Notify: NotifyConfig{
 			Distributor: DistributorNotifyConfig{
 				Enabled:                false,

internal/config/load.go

@@ -40,13 +40,17 @@ func Load(opts LoadOptions) (Config, error) {
 		return Config{}, err
 	}
 
-	if err := loadSecrets(cfg.Secrets); err != nil {
+	secrets, err := loadSecrets(cfg.Secrets)
+	if err != nil {
 		return Config{}, err
 	}
 
 	if err := Validate(cfg); err != nil {
 		return Config{}, err
 	}
+	if err := applySecrets(secrets); err != nil {
+		return Config{}, err
+	}
 
 	return cfg, nil
 }

internal/config/notify_templates.go

@@ -78,11 +78,18 @@ var distributorBatchIdempotencyTemplateVariables = map[string]struct{}{
 var distributorBatchPipelineTemplateVariables = distributorBatchTemplateVariables
 
 func RenderDistributorBundleID(template string, values DistributorTemplateValues) (string, error) {
-	return renderDistributorTemplate("notify.distributor.bundle_id_template", template, values, distributorTemplateVariables)
+	rendered, err := renderDistributorTemplate("notify.distributor.bundle_id_template", template, newDistributorTemplateResolver(values, distributorTemplateVariables))
+	if err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(rendered) == "" {
+		return "", fmt.Errorf("notify.distributor.bundle_id_template renders an empty bundle id")
+	}
+	return rendered, nil
 }
 
 func RenderDistributorPipelineID(template string, values DistributorTemplateValues) (string, error) {
-	rendered, err := renderDistributorTemplate("notify.distributor.pipeline_id_template", template, values, distributorPipelineTemplateVariables)
+	rendered, err := renderDistributorTemplate("notify.distributor.pipeline_id_template", template, newDistributorTemplateResolver(values, distributorPipelineTemplateVariables))
 	if err != nil {
 		return "", err
 	}
@@ -93,11 +100,18 @@ func RenderDistributorPipelineID(template string, values DistributorTemplateValu
 }
 
 func RenderDistributorIdempotencyKey(template string, values DistributorTemplateValues) (string, error) {
-	return renderDistributorTemplate("notify.distributor.idempotency_key_template", template, values, distributorIdempotencyTemplateVariables)
+	rendered, err := renderDistributorTemplate("notify.distributor.idempotency_key_template", template, newDistributorTemplateResolver(values, distributorIdempotencyTemplateVariables))
+	if err != nil {
+		return "", err
+	}
+	if strings.TrimSpace(rendered) == "" {
+		return "", fmt.Errorf("notify.distributor.idempotency_key_template renders an empty idempotency key")
+	}
+	return rendered, nil
 }
 
 func RenderDistributorBatchBundleID(template string, values DistributorBatchTemplateValues) (string, error) {
-	rendered, err := renderDistributorBatchTemplate("notify.distributor.batch.bundle_id_template", template, values, distributorBatchTemplateVariables)
+	rendered, err := renderDistributorTemplate("notify.distributor.batch.bundle_id_template", template, newDistributorBatchTemplateResolver(values, distributorBatchTemplateVariables))
 	if err != nil {
 		return "", err
 	}
@@ -108,7 +122,7 @@ func RenderDistributorBatchBundleID(template string, values DistributorBatchTemp
 }
 
 func RenderDistributorBatchPipelineID(template string, values DistributorBatchTemplateValues) (string, error) {
-	rendered, err := renderDistributorBatchTemplate("notify.distributor.batch.pipeline_id_template", template, values, distributorBatchPipelineTemplateVariables)
+	rendered, err := renderDistributorTemplate("notify.distributor.batch.pipeline_id_template", template, newDistributorBatchTemplateResolver(values, distributorBatchPipelineTemplateVariables))
 	if err != nil {
 		return "", err
 	}
@@ -119,7 +133,7 @@ func RenderDistributorBatchPipelineID(template string, values DistributorBatchTe
 }
 
 func RenderDistributorBatchIdempotencyKey(template string, values DistributorBatchTemplateValues) (string, error) {
-	rendered, err := renderDistributorBatchTemplate("notify.distributor.batch.idempotency_key_template", template, values, distributorBatchIdempotencyTemplateVariables)
+	rendered, err := renderDistributorTemplate("notify.distributor.batch.idempotency_key_template", template, newDistributorBatchTemplateResolver(values, distributorBatchIdempotencyTemplateVariables))
 	if err != nil {
 		return "", err
 	}
@@ -137,7 +151,7 @@ func RenderDistributorReportPaths(name string, templates []string, values Distri
 	seen := make(map[string]struct{}, len(templates))
 	for i, template := range templates {
 		itemName := fmt.Sprintf("%s[%d]", name, i)
-		rendered, err := renderDistributorTemplate(itemName, template, values, distributorTemplateVariables)
+		rendered, err := renderDistributorTemplate(itemName, template, newDistributorTemplateResolver(values, distributorTemplateVariables))
 		if err != nil {
 			return nil, err
 		}
@@ -154,16 +168,18 @@ func RenderDistributorReportPaths(name string, templates []string, values Distri
 }
 
 func validateDistributorTemplate(name, template string, allowed map[string]struct{}) error {
-	_, err := renderDistributorTemplate(name, template, DistributorTemplateValues{}, allowed)
+	_, err := renderDistributorTemplate(name, template, newDistributorTemplateResolver(DistributorTemplateValues{}, allowed))
 	return err
 }
 
 func validateDistributorBatchTemplate(name, template string, allowed map[string]struct{}) error {
-	_, err := renderDistributorBatchTemplate(name, template, DistributorBatchTemplateValues{}, allowed)
+	_, err := renderDistributorTemplate(name, template, newDistributorBatchTemplateResolver(DistributorBatchTemplateValues{}, allowed))
 	return err
 }
 
-func renderDistributorTemplate(name, template string, values DistributorTemplateValues, allowed map[string]struct{}) (string, error) {
+type distributorTemplateResolver func(string) (string, bool)
+
+func renderDistributorTemplate(name, template string, resolve distributorTemplateResolver) (string, error) {
 	var rendered strings.Builder
 	for i := 0; i < len(template); {
 		switch template[i] {
@@ -176,10 +192,11 @@ func renderDistributorTemplate(name, template string, values DistributorTemplate
 			if variable == "" {
 				return "", fmt.Errorf("%s contains an empty template variable", name)
 			}
-			if _, ok := allowed[variable]; !ok {
+			value, ok := resolve(variable)
+			if !ok {
 				return "", fmt.Errorf("%s contains unknown template variable %q", name, variable)
 			}
-			rendered.WriteString(distributorTemplateValue(variable, values))
+			rendered.WriteString(value)
 			i += end + 2
 		case '}':
 			return "", fmt.Errorf("%s contains an unopened template variable", name)
@@ -191,32 +208,22 @@ func renderDistributorTemplate(name, template string, values DistributorTemplate
 	return rendered.String(), nil
 }
 
-func renderDistributorBatchTemplate(name, template string, values DistributorBatchTemplateValues, allowed map[string]struct{}) (string, error) {
-	var rendered strings.Builder
-	for i := 0; i < len(template); {
-		switch template[i] {
-		case '{':
-			end := strings.IndexByte(template[i+1:], '}')
-			if end < 0 {
-				return "", fmt.Errorf("%s contains an unclosed template variable", name)
-			}
-			variable := template[i+1 : i+1+end]
-			if variable == "" {
-				return "", fmt.Errorf("%s contains an empty template variable", name)
-			}
-			if _, ok := allowed[variable]; !ok {
-				return "", fmt.Errorf("%s contains unknown template variable %q", name, variable)
-			}
-			rendered.WriteString(distributorBatchTemplateValue(variable, values))
-			i += end + 2
-		case '}':
-			return "", fmt.Errorf("%s contains an unopened template variable", name)
-		default:
-			rendered.WriteByte(template[i])
-			i++
+func newDistributorTemplateResolver(values DistributorTemplateValues, allowed map[string]struct{}) distributorTemplateResolver {
+	return func(variable string) (string, bool) {
+		if _, ok := allowed[variable]; !ok {
+			return "", false
 		}
+		return distributorTemplateValue(variable, values), true
+	}
+}
+
+func newDistributorBatchTemplateResolver(values DistributorBatchTemplateValues, allowed map[string]struct{}) distributorTemplateResolver {
+	return func(variable string) (string, bool) {
+		if _, ok := allowed[variable]; !ok {
+			return "", false
+		}
+		return distributorBatchTemplateValue(variable, values), true
 	}
-	return rendered.String(), nil
 }
 
 func distributorTemplateValue(variable string, values DistributorTemplateValues) string {

internal/config/overrides_external_test.go

@@ -0,0 +1,75 @@
+package config_test
+
+import (
+	"strings"
+	"testing"
+
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/config"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/module"
+	"gitea.maximumdirect.net/eric/weatherreporter/internal/report"
+)
+
+func TestConstructedReportOverridesUseExportedFields(t *testing.T) {
+	cfg := config.Defaults()
+	cfg.Reports = map[string]config.ReportConfig{
+		"daily": {
+			DeterministicModules: []config.ModuleConfigItem{
+				{ID: module.Metadata},
+				{ID: module.AreaForecastDiscussion},
+			},
+			Distributor: config.ReportDistributorConfig{
+				PathTemplates: []string{"daily/{valid_start_date}/index.md"},
+			},
+		},
+	}
+
+	if err := config.Validate(cfg); err != nil {
+		t.Fatalf("Validate() error = %v", err)
+	}
+	modules, err := cfg.ReportModuleOverrides()
+	if err != nil {
+		t.Fatalf("ReportModuleOverrides() error = %v", err)
+	}
+	if got := modules[report.Daily]; len(got) != 2 || got[0].ID != module.Metadata || got[1].ID != module.AreaForecastDiscussion {
+		t.Fatalf("module override = %#v, want exported daily modules", got)
+	}
+	paths, err := cfg.ReportDistributorPathOverrides()
+	if err != nil {
+		t.Fatalf("ReportDistributorPathOverrides() error = %v", err)
+	}
+	if got := paths[report.Daily]; len(got) != 1 || got[0] != "daily/{valid_start_date}/index.md" {
+		t.Fatalf("path override = %#v, want exported daily path", got)
+	}
+}
+
+func TestConstructedExplicitEmptyReportOverridesAreRejected(t *testing.T) {
+	tests := []struct {
+		name    string
+		report  config.ReportConfig
+		wantErr string
+	}{
+		{
+			name:    "modules",
+			report:  config.ReportConfig{DeterministicModules: []config.ModuleConfigItem{}},
+			wantErr: "reports.daily.deterministic_modules must contain at least one entry",
+		},
+		{
+			name: "paths",
+			report: config.ReportConfig{Distributor: config.ReportDistributorConfig{
+				PathTemplates: []string{},
+			}},
+			wantErr: "reports.daily.distributor.path_templates must contain at least one entry",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			cfg := config.Defaults()
+			cfg.Reports = map[string]config.ReportConfig{"daily": tt.report}
+			err := config.Validate(cfg)
+			if err == nil || !strings.Contains(err.Error(), tt.wantErr) {
+				t.Fatalf("Validate() error = %v, want %q", err, tt.wantErr)
+			}
+		})
+	}
+}