Centralize extraction bundle evidence

docs/internal/artifacts.md

@@ -65,11 +65,13 @@ Configured sources (`narratio.artifact.*`):
 
 Extraction sources (`narratio.extraction.*`):
 
-- use the shared registration and manifest hydration path in
-  `extraction_catalog.go`;
+- use the shared typed bundle evidence inspection in `extraction_evidence.go`;
 - require a current successful extract record with the exact configured source,
   compatible contract and Notarius provenance, a confined regular durable
-  payload, and matching checksum; and
+  payload, and matching checksum;
+- remain unavailable unless catalog hydration receives valid evidence. Resume
+  treats absent or obsolete evidence as a rerun decision and unsafe evidence as
+  an error; and
 - are never inferred by scanning the Notarius bundle directory.
 
 Previous-session sources (`narratio.previous_session.artifact.*`):
@@ -166,7 +168,8 @@ physical layout.
 
 - Registry and resolution: `internal/artifacts/artifact_resolver.go`,
   `internal/artifacts/catalog.go`, `internal/artifacts/transcripts.go`,
-  `internal/artifacts/extraction_catalog.go`
+  `internal/artifacts/extraction_catalog.go`,
+  `internal/artifacts/extraction_evidence.go`
 - Current state: `internal/artifacts/current_state.go`
 - Paths and keys: `internal/artifacts/paths.go`,
   `internal/artifacts/s3_keys.go`

docs/roadmap/implementation.md

@@ -896,6 +896,8 @@ policy decisions made by resume and catalog consumers.
 consumers and assert their intentionally different outcomes for every typed state.
 Include unsafe root, symlink, incomplete, obsolete-version, and valid cases.
 
+**Status:** Completed.
+
 ## Stage 27 — Bind extraction reuse to direct transcript identity
 
 **Read first:** `audit-findings.md` lines 2380–2423 (COR-020) and 3744–3774