Add semantic configuration resume evidence

docs/internal/manifest.md

@@ -156,7 +156,9 @@ durable; callers must reload it before retrying.
 
 The application runner marks an executing stage running and then succeeded or
 failed in both manifests, persisting each transition. On success it records
-outputs, logs, generated configuration references, and metadata. Artifact
+outputs, logs, generated configuration references, metadata, and—when the
+stage implements the optional contract—a versioned semantic-configuration
+fingerprint. Artifact
 records may include optional contract and external provenance objects; old
 manifests remain compatible when those fields are absent. A successful forced
 rerun marks only succeeded transitive dependent session-stage records stale.
@@ -165,7 +167,8 @@ dependents are returned in canonical order. Render and extract therefore never
 stale one another, while either can stale analyze, publish, and notify.
 
 Starting an execution clears the current session-stage record's prior outputs,
-logs, generated configuration references, and metadata. Failed and skipped
+logs, generated configuration references, metadata, and semantic fingerprint.
+Failed and skipped
 transitions enforce the same clearing rule directly, while success repopulates
 only fields returned by the new result. Marking a record stale does not clear
 those details because resume validation and diagnosis may still require them
@@ -184,12 +187,21 @@ session-stage record along with older logs, generated configuration references,
 and metadata, then applies any bounded details from the current skip and
 continues. This self-skip is distinct from deciding not to execute an
 already-succeeded stage and is reconsidered on later runs. Skipped results
-cannot contain outputs.
+cannot contain outputs. An intentional self-skip records the current semantic
+fingerprint because it is a completed, reusable stage result; failed or
+interrupted work never promotes one.
 
 When an already-succeeded stage is skipped, the invocation run manifest records
 the `skip` action and reason. The session manifest deliberately retains its
 existing succeeded record because it remains the cross-invocation progress
-authority. Extraction and analyze have resume validators and may reject an
+authority. If a stage supplies semantic configuration evidence, reuse first
+requires the persisted positive schema version and lowercase SHA-256 digest to
+match the current resolved stage semantics. Missing legacy evidence, malformed
+evidence, or a mismatch makes the stage and its fixed transitive dependents
+stale. The invocation skip copies the matched fingerprint for provenance but
+does not rewrite session authority. The existing stage-specific resume
+validator runs only after this semantic check succeeds; both checks are
+required. Extraction and analyze have resume validators and may reject an
 otherwise eligible skip when their selected durable evidence is obsolete; the
 runner marks the aggregate record stale and executes it. Analyze's validator
 can still accept a partial selection when only unrelated artifact records are
@@ -198,6 +210,14 @@ stale.
 Session manifest is the authoritative stage-progress ledger across invocations.
 Run manifest is invocation-scoped audit state.
 
+`session plan` computes the same current fingerprint and applies the same
+comparison and invalidation rules to a cloned manifest. It predicts the runner
+decision without persisting session or invocation state. The shared helper
+hashes deterministic JSON from stage-owned typed structs; stage providers must
+exclude secrets, complete effective-configuration dumps, and operational
+values that cannot affect canonical results. Concrete stage coverage is owned
+by the focused stage documents as providers are added.
+
 Before an explicitly bounded execution starts after `prepare`, the application
 reads the session manifest and accepts only `succeeded` or `skipped` for every
 excluded canonical prefix stage. The first other status or absent record fails
@@ -228,6 +248,9 @@ where a durable running record can require operator interpretation.
 ## Invariants
 
 - stage resume/skip decisions are session-manifest driven.
+- semantic fingerprint comparison precedes stage-specific resume validation.
+- only successful and intentional-skipped results promote current semantic
+  evidence; invocation reuse copies evidence without replacing session state.
 - running, failed, and self-skipped stages do not retain result payloads from
   an earlier success.
 - stale stages retain prior details until replacement execution starts.