Validate normalize retry diagnostics

docs/internal/pipeline.md

@@ -331,6 +331,14 @@ normalize retry budget: `retries` permits that many additional attempts after
 the initial attempt. It neither creates a normalizer-local retry loop nor
 records an accepted checkpoint for the discarded attempt.
 
+Before adding a normalize retry directive to attempt debug data, the runner
+requires a nonblank, valid UTF-8 reason code of at most 128 bytes and a
+nonblank, valid UTF-8 message of at most 4,096 bytes. These are encoded-byte
+limits. The framework rejects an invalid directive without truncating or
+rewriting either field. It validates only this mechanical contract; normalizers
+remain responsible for ensuring their otherwise valid diagnostics do not expose
+source material, credentials, paths, names, or other sensitive content.
+
 When a later normalize attempt succeeds, its candidate alone proceeds through
 the usual validation and checkpoint path. When the final attempt still returns
 a directive, the runner validates its supplied safe fallback through that same