Add versioned analysis fingerprint reconciliation

docs/config.md

@@ -310,7 +310,7 @@ For each `pipeline.scriptorium.artifacts.<name>`:
 | Field | Type | Required | Rule |
 | --- | --- | --- | --- |
 | `enabled` | bool | No | `false` if omitted |
-| `depends_on[]` | list[string] | No | must reference configured artifact keys; no self-reference; enabled graph must be acyclic |
+| `depends_on[]` | list[string] | No | must reference configured artifact keys; no self-reference; configured graph must be acyclic |
 | `render_debug` | bool | No | per-artifact override |
 | `prompt_id` | string | Conditional | required when artifact is enabled |
 | `profile_id` | string | No | empty |

docs/internal/stage-analyze.md

@@ -59,6 +59,20 @@ Supported source families:
   configured-artifact evidence. Other resolved inputs are hashed as confined
   regular files with streaming reads and the central resolved-artifact size
   limit.
+- owns a versioned SHA-256 fingerprint contract with one fixed-field canonical
+  JSON payload and no map serialization. Configured artifacts are fingerprinted
+  in deterministic dependency order.
+- fingerprints the normalized artifact key, prompt and profile identifiers,
+  normalized Scriptorium executable and config logical identities, effective
+  render-debug behavior, session-relative output identity, sorted dependency
+  keys, ordered input declarations and semantic identities, validated current
+  dependency-output identities, and sorted effective Scriptorium variables
+  (including Narratio's sticky session variable).
+- provides read-only reconciliation that classifies each configured record as
+  current, stale, missing, failed, legacy, or otherwise non-resumable, and
+  separately identifies manifest records removed from current configuration.
+  A record is current only when its fingerprint version and value match and its
+  configured output still passes manifest-authoritative evidence validation.
 - resolves previous-session sources from local `previous/` cache only.
 - runs optional render-debug, then artifact execution.
 - validates non-empty output files and materializes canonical outputs.
@@ -79,6 +93,11 @@ Supported source families:
 - `analyze` performs no remote storage calls for previous-session source resolution.
 - input-identity resolution is read-only: it does not invoke adapters,
   materialize outputs, update status, or create run records.
+- fingerprints exclude timeouts, retries, timestamps, producer and Narratio run
+  IDs, absolute executable/config/workspace roots, diagnostic locations, and
+  executable or private transitive configuration contents. A change that is
+  visible only inside Scriptorium—such as a file privately loaded by its config
+  path—requires an explicit forced regeneration.
 - output provenance and metadata are deterministic per execution.
 
 ## Related Contracts And Tests
@@ -89,4 +108,8 @@ Supported source families:
 - [Scriptorium](../integrations/scriptorium.md) owns the subprocess contract.
 - Implementation and tests: `internal/stage/analyze.go`,
   `internal/stage/analyze_input_identity.go`, `internal/stage/analyze_test.go`,
-  `internal/stage/analyze_input_identity_test.go`
+  `internal/stage/analyze_input_identity_test.go`,
+  `internal/stage/analyze_fingerprint.go`,
+  `internal/stage/analyze_fingerprint_test.go`,
+  `internal/stage/analyze_reconciliation.go`, and
+  `internal/stage/analyze_reconciliation_test.go`

docs/roadmap/implementation.md

@@ -491,6 +491,8 @@ producer runs.
 
 ## Stage 10 — Versioned Analysis Fingerprints And Reconciliation
 
+**Status: Completed**
+
 ### Goal
 
 Classify configured artifacts as current or requiring work from one deterministic