feat(diagnostics): split error and shutdown messages

docs/src/architecture.md

@@ -63,15 +63,17 @@ persistence, authenticated ingress, durable audit logging, disarmed
 activation, and atomic consumer reconstruction remain separate reviewed work
 and cannot be implied by a valid CBOR file or CRC.
 
-The MAVLink dialect root includes `kaptan/config.xml` and `kaptan/log.xml`.
+The MAVLink dialect root includes `kaptan/config.xml`, `kaptan/log.xml`,
+`kaptan/error.xml`, and `kaptan/shutdown.xml`.
 The build watches every fragment and generates one `message::kaptan` module;
 fragments are never separately generated Rust modules. `kaptan-log` itself has
 no MAVLink, platform, time, allocation, filesystem, or configuration
 dependency. It assigns bounded Critical and BestEffort queues for text logs.
-The platform drains a record only after TX admission; the diagnostic wire
-contract deliberately contains only severity, flags, bounded text length, and
-text. Local saturation accounting remains inside the hub, facade, and producer
-mailboxes; heartbeat and safety telemetry remain separate from diagnostic text.
+The platform drains a record only after TX admission. `KAPTAN_LOG` carries
+severity plus one bounded text field; `KAPTAN_ERROR` carries flags plus bounded
+path and additional-information fields. Local saturation accounting remains
+inside the hub, facade, and producer mailboxes; heartbeat and safety telemetry
+remain separate from diagnostics.
 
 See [Configuration](configuration.md) for the deployment matrix and GCS upload
 contract, [Logs](logs.md) for the receiver contract, and [Errors](errors.md)