Harden pipeline state and plan release upgrades

docs/internal/stage-prepare.md

@@ -73,8 +73,12 @@ evidence rerun once when selected.
 Workspace, spool, and cache placement and absolute source relocation are not
 semantic when logical selection, canonical names, and bytes are equivalent.
 The fingerprint deliberately does not read or rehash large audio. Prepared
-input checksums remain the content provenance; force prepare after changing
-source bytes that are not otherwise reflected by the semantic selection.
+input checksums remain the content provenance. Before reusing success, prepare
+validates every durable prepared copy and compares current stable-input bytes,
+canonical party and derived-player bytes, local audio membership/checksums, or
+S3 key/size/entity-tag identity with that provenance. Source relocation with
+equivalent names and bytes remains reusable; changed or unavailable evidence
+causes a normal prepare rerun.
 
 ## Related Contracts And Tests
 
@@ -86,6 +90,8 @@ source bytes that are not otherwise reflected by the semantic selection.
   the internal collaborators.
 - Implementation and tests: `internal/stage/prepare.go`,
   `internal/stage/prepare_test.go`,
+  `internal/stage/prepare_resume.go`,
+  `internal/stage/prepare_resume_test.go`,
   `internal/stage/semantic_contracts_initial.go`,
   `internal/stage/semantic_contracts_initial_test.go`,
   `internal/audio/s3_audio_test.go`,