Harden checkpoint reuse and combat validation

docs/internal/state.md

@@ -57,14 +57,14 @@ records the decision, and stops without executing the producer or consumer.
 The loader assigns a typed category and reason code at each validation site;
 diagnostic prose is not classified after the fact. The runner then applies
 forced-execution policy, validates reusable artifact bytes through the prepared
-codec, and records the final decision before enforcing a required-predecessor
-failure. That failure names only the step, lane, and stable reason code. Decision
-detail passes through one UTF-8-safe bounded sanitizer and contains only
-allowlisted diagnostic context, never payloads, references, credentials,
-environment values, or physical paths. Typed categories and codes remain intact
-through pipeline events and become strings only in manifest and debug-summary
-JSON. [Operations](../operations.md#resume-and-selective-recompute) is the
-canonical operator-facing reason-code reference.
+codec once, returns the canonical hydrated value to the stage, and records the
+final decision before enforcing a required-predecessor failure. That failure
+names only the step, lane, and stable reason code. Decision detail is selected
+from code-owned descriptions by reason code and then UTF-8 normalized and
+bounded; callers cannot supply arbitrary diagnostic prose. Typed categories and
+codes remain intact through pipeline events and become strings only in manifest
+and debug-summary JSON. [Operations](../operations.md#resume-and-selective-recompute)
+is the canonical operator-facing reason-code reference.
 
 `internal/core/fileio` provides confined atomic file writes used by state
 collaborators. The chunk-plan store retains its stronger entry validation.