Strengthen validation retries and checkpoint safety

internal/framework/pipeline/handoff.go

@@ -41,6 +41,54 @@ func operationReferenceSet(input RunInput, target ResolvedReferenceTarget) contr
 	return CloneReferenceSet(target.ReferenceSet)
 }
 
+// referenceTargetReuseEligible reports whether every generated artifact in a
+// stage's reference set descends exclusively from fully validated work. Static
+// references and callers that do not supply lineage metadata are reusable.
+func referenceTargetReuseEligible(input RunInput, target ResolvedReferenceTarget) bool {
+	if input.referenceReuseEligibility == nil {
+		return true
+	}
+	eligible, ok := input.referenceReuseEligibility[keyForReferenceTarget(target)]
+	return !ok || eligible
+}
+
+func laneReferencesReuseEligible(input RunInput, lane ResolvedArtifactLane) bool {
+	return referenceTargetReuseEligible(input, lane.ExtractReferences) &&
+		referenceTargetReuseEligible(input, lane.MergeReferences) &&
+		referenceTargetReuseEligible(input, lane.NormalizeReferences)
+}
+
+// buildStepReferenceReuseEligibility carries validation completeness alongside
+// generated references without exposing the internal lineage flag in artifact
+// payloads. A target becomes ineligible when any generated input is ineligible.
+func buildStepReferenceReuseEligibility(step PreparedPipelineStep, outputs map[generatedOutputKey]bool) map[referenceTargetKey]bool {
+	eligibility := make(map[referenceTargetKey]bool)
+	for _, prepared := range step.lanes {
+		lane := prepared.resolved
+		for _, target := range []ResolvedReferenceTarget{lane.ExtractReferences, lane.MergeReferences, lane.NormalizeReferences} {
+			generated := false
+			eligible := true
+			for _, binding := range target.Bindings {
+				if binding.Artifact == nil {
+					continue
+				}
+				generated = true
+				producer := generatedOutputKeyFor(binding.Artifact.Step, binding.Artifact.Lane)
+				if reusable, ok := outputs[producer]; ok && !reusable {
+					eligible = false
+				}
+			}
+			if generated {
+				eligibility[keyForReferenceTarget(target)] = eligible
+			}
+		}
+	}
+	if len(eligibility) == 0 {
+		return nil
+	}
+	return eligibility
+}
+
 // buildStepReferenceSets resolves every generated binding for a step before
 // any lane in that step is allowed to start. Each returned set is a fresh
 // operation-time view; prepared reference sets are never modified.