Document completed workspace behavior

docs/internal/pipeline.md

@@ -80,13 +80,17 @@ workspace paths and do not write checkpoint files directly.
 For `run --resume`, the CLI also passes a checkpoint loader. The runner consults
 the loader in workflow order and reuses only checkpoints whose manifest schema,
 status, identity digest, dependency fingerprints, payload files, and payload
-digests validate for the current invocation. Missing or invalid checkpoints fall
-back to normal execution and are refreshed by the recorder.
+digests validate for the current invocation. The identity includes the resolved
+pipeline, selected lanes, source/input digest, runtime overrides that affect
+execution, and materialized reference digests. Missing or invalid checkpoints
+fall back to normal execution and are refreshed by the recorder.
 
 When workspace debug output is enabled, the CLI passes a debug recorder for the
 current run ID. The runner writes framework-boundary inputs, outputs,
 structured LLM calls, validator calls, timing, and retry attempt metadata
-through that interface. Concrete modules still do not receive workspace paths.
+through that interface. Debug output is not used for resume and can contain
+sensitive source, reference, prompt, and model-output material. Concrete modules
+still do not receive workspace paths.
 
 ## Registries And Module Specs