Validate artifact candidates before final encoding

docs/internal/pipeline.md

@@ -236,6 +236,13 @@ never used as a checkpoint source. Typed artifact debug envelopes are
 domain-neutral, redact sensitive metadata and bytes through the common debug
 policy, and record codec identity plus schema and content digests.
 
+Merge and normalize attempts serialize their in-memory candidate with the
+codec's candidate encoder before typed validation. Serialized validators and
+attempt debug use that candidate representation, which carries the codec media
+type and schema identity but is never checkpointed or passed downstream. Only
+a validator-approved value is encoded through the strict final codec and made
+eligible for a checkpoint or stage output.
+
 Checkpoint identity, physical layout, reuse behavior, and debug artifact
 handling are operator contracts in [Operations](../operations.md). Serialization
 and recorder implementation are inventoried in