Hydrate accepted producer checkpoints

docs/internal/pipeline.md

@@ -313,12 +313,31 @@ bytes, and decode failures become explicit reuse misses and execute the lane
 normally. Dependency fingerprints and debug content digests use the same stable
 codec bytes that cross those boundaries.
 
+That progressive extract, merge, and normalize reuse is the ordinary resume
+path. A lane marked as a required predecessor for selective recomputation takes
+a separate accepted-output path before extract scheduling. The loader reads the
+existing successful normalize manifest and payload by step, lane, and
+normalizer, without consulting extract or merge dependencies. It requires the
+current non-empty checkpoint identity to match, so the invocation identity
+still binds the input, resolved topology and configuration, references, runtime
+overrides, profiles, and component fingerprints.
+
+The runner decodes that accepted normalized artifact with the prepared codec,
+re-encodes it, and requires exact kind, schema identity and digest, media type,
+canonical bytes, content digest, and producer provenance. A valid result becomes
+a runner-owned cloned normalized output, restores only normalize-checkpoint
+warnings, and records one `accepted_artifact_reused` normalize decision. It does
+not invoke or record extract, merge, normalize, or their validators. Invalid or
+unavailable accepted state records its decision and fails the producer step;
+the dependent step never starts and the producer is not implicitly rerun.
+
 Generated references add downstream dependencies containing the producer's
 artifact kind, complete schema identity, media type, canonical content digest,
-and size. Compatible producer checkpoints may therefore feed a later step
-without re-executing the producer. A missing, rejected, corrupt, incompatible,
-or changed producer invalidates every transitive dependent lane while leaving
-independent work eligible for reuse. The runner records bounded decision
+and size. Compatible accepted producer outputs may therefore feed a later step
+without re-executing the producer. Forced lanes bypass accepted-output
+hydration and execute normally. A missing, rejected, corrupt, incompatible, or
+changed producer blocks its dependent while leaving independent work eligible
+for reuse. The runner records bounded decision
 categories: `reused`, `executed`, `forced_recompute`, and
 `dependency_invalidated`.
 

docs/internal/state.md

@@ -43,6 +43,17 @@ not permit stale downstream reuse. The CLI's selective recomputation policy
 records `forced_recompute` for the selected step and its dependents while
 requiring compatible predecessor checkpoints.
 
+Ordinary resume loads extract, merge, and normalize checkpoints progressively
+and may execute later lane stages after an earlier cache miss. Selective
+recomputation instead asks the loader for the required producer's accepted
+normalize artifact. That lookup reuses the existing normalize files, requires
+workspace schema v3 plus an exact non-empty invocation identity, and deliberately
+does not require extract or merge checkpoint files or dependency fingerprints.
+The runner performs canonical codec and producer-provenance validation before
+cloning the artifact into normal step output. Success restores only stored
+normalize warnings and emits one normalize decision; failure retains the files,
+records the decision, and stops without executing the producer or consumer.
+
 The loader assigns a typed category and reason code at each validation site;
 diagnostic prose is not classified after the fact. The runner then applies
 forced-execution policy, validates reusable artifact bytes through the prepared

docs/operations.md

@@ -151,7 +151,8 @@ recomputation is acceptable.
 
 `--resume` loads compatible accepted work only when checkpoint recording is
 enabled. A normal resumed run may reuse source, extract, merge, and normalize
-checkpoints independently. Generated references add a dependency fingerprint
+checkpoints independently and may recompute a stage after a cache miss.
+Generated references add a dependency fingerprint
 for the producer's artifact kind, schema identity, media type, canonical
 content digest, and size. If that fingerprint changes or the producer is
 missing, dependent checkpoints are invalidated; unrelated work remains eligible
@@ -165,14 +166,22 @@ persistent identity of otherwise identical checkpoints. Decisions are bounded
 and categorized as `reused`, `executed`, `forced_recompute`, or
 `dependency_invalidated`.
 
-If a required predecessor cannot be reused during selective recomputation, the
-run fails before the dependent step starts. The failure manifest retains the
-completed upstream outcomes and dependency context but not generated reference
-content. For diagnosis, first check the failed step and lane in the manifest,
-then inspect checkpoint decision categories and reason codes. A
-`dependency_invalidated` decision means the stored producer, codec identity,
-schema, or canonical content no longer matches; a missing or rejected producer
-requires rerunning it rather than copying an artifact into the checkpoint root.
+For an unselected producer required by a recomputed step, Notarius loads the
+accepted normalized artifact directly. Valid normalize state is sufficient even
+when that producer's extract or merge checkpoint is missing or corrupt. The
+normalize manifest must be successful and match workspace schema v3, the exact
+current invocation identity, step, lane, and normalizer; its payload digest and
+canonical codec representation must also validate. A forced producer bypasses
+this lookup and executes.
+
+If a required predecessor's accepted normalized artifact is missing, rejected,
+corrupt, non-canonical, or incompatible, the run fails before the dependent
+step starts. It does not fall back to rerunning that predecessor. The failure
+manifest retains completed upstream outcomes and dependency context but not
+generated reference content. For diagnosis, first check the producer step and
+lane in the manifest, then inspect checkpoint decision categories and reason
+codes. Rerun the producer explicitly rather than copying an artifact into the
+checkpoint root.
 The decision that caused a required-predecessor failure is retained before the
 run returns, and the CLI error identifies its step, lane, and reason code.
 
@@ -195,6 +204,7 @@ Checkpoint reason codes are stable diagnostic identifiers:
 | `artifact_codec_incompatible` | Stored artifact identity is incomplete or incompatible with the codec contract. |
 | `artifact_not_canonical` | The codec can decode the artifact, but its bytes are not canonical. |
 | `checkpoint_reused` | The stored checkpoint passed validation and was reused. |
+| `accepted_artifact_reused` | A required producer's accepted normalized artifact was canonically validated and hydrated. |
 | `recompute_step` | Selective recomputation forced execution of this lane. |
 
 Decision detail is bounded explanatory text, not a data-recovery channel. It