Implement ADR-0007

docs/operations.md

@@ -13,8 +13,9 @@ Notarius uses three independent filesystem surfaces:
 - debug is explicitly requested inspection data.
 
 Choose separate roots and access controls for each surface. A normal run writes
-durable output and may use the chunk-plan cache. It does not create checkpoint
-or debug state unless its invocation includes `--resume` or `--debug`.
+durable output, may use the chunk-plan cache, and records checkpoints when
+`cache.checkpoints.enabled` is true. It does not create debug state unless its
+invocation includes `--debug`.
 
 ## Output
 
@@ -73,10 +74,14 @@ cache:
 
 ## Checkpoint Cache
 
-Checkpoint state is used only by an invocation with `--resume`. That invocation
-loads compatible completed work and records checkpoints for work it executes.
-Without `--resume`, Notarius neither resolves nor creates the checkpoint root,
-and neither loads nor records checkpoints.
+Checkpoint recording is controlled by `cache.checkpoints.enabled`, which
+defaults to `false`. When enabled, every run records running, succeeded, and
+failed transitions and reusable validator-approved results. Successful,
+rejected, and failed runs may therefore all leave checkpoint state. The
+`--resume` flag additionally loads compatible completed work before executing
+missing or incompatible stages. Without `--resume`, a recording-enabled run
+never loads checkpoints. Using `--resume` while recording is disabled is an
+error.
 
 Checkpoints use the selected root and the existing identity hierarchy:
 
@@ -102,6 +107,7 @@ For a Linux service account, independently provision:
 ```yaml
 cache:
   checkpoints:
+    enabled: true
     directory: /var/cache/notarius/checkpoints
 ```