Implement ADR-0007

docs/config.md

@@ -48,6 +48,7 @@ Built-in defaults:
 - `cache.chunk_plans.mode`: `auto`
 - `cache.chunk_plans.directory`: unset, selecting
   `<os.UserCacheDir>/notarius/chunk-plans`
+- `cache.checkpoints.enabled`: `false`
 - `cache.checkpoints.directory`: unset, selecting
   `<os.UserCacheDir>/notarius/checkpoints`
 - `debug.directory`: `./notarius-debug`
@@ -349,6 +350,7 @@ cache:
     directory: ""
     mode: auto
   checkpoints:
+    enabled: false
     directory: ""
 debug:
   directory: ./notarius-debug
@@ -372,9 +374,11 @@ no CLI cache-root override. The defaults are
 uses an absolute `$XDG_CACHE_HOME` or falls back to `$HOME/.cache`. A relative
 `XDG_CACHE_HOME` is an error.
 
-Checkpoint I/O occurs only for `notarius run --resume`. That invocation loads
-compatible checkpoints and records work it executes. Without `--resume`,
-Notarius does not resolve, create, load, or record the checkpoint root.
+`cache.checkpoints.enabled` defaults to `false`. When `true`, every run records
+checkpoint transitions and reusable approved results. When `false`, Notarius
+does not resolve or create the checkpoint root, and `--resume` is rejected.
+The `--resume` flag authorizes loading compatible checkpoints; it does not
+control recording.
 
 `debug.directory` chooses a root but never enables debug capture. Its precedence
 is `--debug-dir`, `NOTARIUS_DEBUG_DIR`, the file value, then the default.
@@ -418,13 +422,15 @@ cache:
     directory: /srv/notarius/chunk-plans
     mode: auto
   checkpoints:
+    enabled: true
     directory: /srv/notarius/state/checkpoints
 debug:
   directory: /srv/notarius/debug
 ```
 
-Run the migrated configuration with `--resume` when checkpoint reuse or
-recording is wanted, and with `--debug` when a debug bundle is wanted.
+Run the migrated configuration with `--resume` when checkpoint reuse is wanted,
+and with `--debug` when a debug bundle is wanted. Enabled checkpoint recording
+occurs with or without `--resume`.
 
 The removed fields are `workspace.directory`, `workspace.resume.enabled`,
 `workspace.debug.enabled`, `workspace.chunk_cache.mode`,
@@ -452,7 +458,8 @@ Configuration validation checks:
 - supported stage-worker keys and an effective extract worker count in the
   inclusive range `1..concurrency.total_llm`;
 - non-empty output and debug directories;
-- a supported chunk-cache mode and state-surface directories without NUL bytes;
+- a supported chunk-cache mode, Boolean checkpoint enablement, and state-surface
+  directories without NUL bytes;
 - stale removed fields such as `llm_profiles`.
 
 Pipeline resolution additionally checks: