Strengthen validation retries and checkpoint safety

docs/policy/architecture.md

@@ -184,6 +184,13 @@ the configured `warn_continue` policy, advance a structurally valid candidate
 with explicit incomplete-validation provenance. Validators report findings;
 they do not choose candidate disposition.
 
+A completed rejection supplies a stable reason code for internal provenance
+and bounded actionable correction guidance for the candidate producer. Reason
+codes, validator keys, and operator-facing messages remain diagnostic data;
+they are not model instructions. The framework constructs model-facing retry
+text only from the semantic guidance and fails the contract rather than
+inventing or truncating missing guidance.
+
 Default validator chains are production composition policy and are registered
 centrally by stage and module. Configuration may replace a stage-local default,
 including with an explicitly empty chain. Configured validator order is
@@ -270,7 +277,10 @@ collaborator interfaces and never physical roots.
 Only accepted, completely validated producer output is reusable checkpoint or
 chunk-plan state. Rejected, structurally invalid, and validation-incomplete
 results cannot become cache or checkpoint inputs, even when a
-`warn_continue` result is allowed to advance in the current run.
+`warn_continue` result is allowed to advance in the current run. This
+ineligibility follows derived merge and normalize results and generated
+references for the remainder of the run: current-run handoff remains allowed,
+but no dependent cache or checkpoint may be loaded or published.
 
 Writes are atomic where practical. Paths for writes, moves, overwrites, and
 deletion must be narrow and explicit. Notarius never automatically deletes