Complete analyze checkpoint recovery

docs/internal/stage-analyze.md

@@ -89,9 +89,9 @@ Supported source families:
   rebuilt when required, while unrelated disabled artifacts are excluded.
 - the work plan carries explicit targets, prerequisite-only work, deterministic
   execution and reuse lists, invalidated and removed records, and a cloned
-  projected record collection. Valid unrelated configured records survive the
-  projection, removed records are omitted, and incidental files never become
-  current without manifest-backed regeneration.
+  reconciled starting collection. Valid unrelated configured records survive
+  reconciliation, removed records are omitted, and incidental files never
+  become current without manifest-backed regeneration.
 - implements aggregate resume validation by running the same read-only catalog,
   fingerprint reconciliation, and work planner used by execution. A succeeded
   aggregate record is reusable exactly when the selected closure schedules no
@@ -112,15 +112,16 @@ Supported source families:
 - records each successful artifact's freshly computed fingerprint, canonical
   relative output path, contract, checksum, size, producer run ID, bounded
   Scriptorium provenance, logs, and generated configuration references in the
-  analyze-owned projection.
+  analyze-owned manifest collection.
 - preserves valid unrelated current records during partial execution. If a
   rebuilt output's bytes and contract are unchanged, unselected dependents may
   remain current. If that semantic identity changes, unselected transitive
   dependents become stale without being executed; dependents included in the
   invocation are evaluated in dependency order instead.
-- returns one complete reconciled session collection. The runner reconstructs
-  aggregate session outputs from every current session record; unrelated stale
-  records do not make an otherwise successful partial invocation fail.
+- returns aggregate outputs from every current session record in normalized-key
+  order after the complete reconciled collection has been checkpointed;
+  unrelated stale records do not make an otherwise successful partial
+  invocation fail.
 - resolves previous-session sources from local `previous/` cache only.
 - runs optional render-debug, then artifact execution.
 - validates non-empty output files and materializes canonical outputs.
@@ -135,20 +136,20 @@ Supported source families:
   guidance.
 - dependency cycles or unavailable required dependencies fail.
 - adapter validation failures fail stage.
-- a scheduled artifact failure returns the restricted analyze-state projection
+- a scheduled artifact failure installs a retry collection on the live manifest
   with the active artifact marked `failed`, a bounded error, and no output
   authority. Current transitive dependents become stale without execution.
 - earlier artifacts remain current only after their run-local output passed
-  validation and canonical materialization; unattempted later artifacts retain
-  their reconciled session state.
+  validation, canonical materialization, and a successful complete-collection
+  manifest checkpoint; unattempted later artifacts retain their reconciled
+  session state.
 - unrelated current records survive a partial failure. Old canonical bytes for
-  the failed artifact and newly materialized bytes whose projection cannot be
-  persisted are incidental, not current evidence.
-- the runner applies one valid partial projection at the existing end-of-stage
-  save boundary before it marks aggregate analyze failed and invalidates publish
-  and notify through the application dependency relation. Projection-persistence
-  errors retain the last durable per-artifact authority and are joined with the
-  original failure context. Per-artifact checkpoint persistence is future work.
+  the failed artifact and newly materialized bytes whose checkpoint fails are
+  incidental, not current evidence.
+- the runner's ordinary error path marks aggregate analyze failed, clears its
+  aggregate outputs, invalidates publish and notify through the application
+  dependency relation, and persists the live retry collection. Terminal-save
+  errors are joined with the original artifact or checkpoint failure.
 
 ## Invariants