# Tiering, checkpoint, and resume control

This revision adds a fail-closed validation control plane without changing the
product runtime.  It prevents a long validation job from restarting at row one
after an interruption while preserving terminal validation authority.

## Tier selection

`src/reliability_core/validation_tiering.py` classifies a declared change from
T0 through T4 using the immutable policy in
`validation/validation_policy.json`.  Malformed input, an unknown dependency,
or a runner/orchestrator/authority/policy change is always T4.  A caller may
raise the minimum tier but cannot lower the policy result.

## Checkpoint contract

`src/reliability_core/validation_control.py` creates one immutable `plan.json`
and an append-only sequence of hashed events.  Every task receipt binds the
source, candidate, runner, orchestrator, authority, runtime-readiness session,
previous PASS receipt, run ID, challenge, process identity, evidence digest,
and cleanup result.  A failed or blocked task remains the next task; only an
immutable complete clean PASS advances the plan.

## Resume contract

Resume is allowed only when the complete event chain verifies and all immutable
bindings and the original change definition still match.  A fresh readiness
session is required before another result can be recorded.  A higher newly
classified tier requires a new plan, and a lower redefinition is blocked rather
than silently downgrading the existing plan.

## Commands

Run commands from the source root:

```text
python scripts/validation_controller.py init --state STATE --policy validation/validation_policy.json --change CHANGE.json --bindings BINDINGS.json
python scripts/validation_controller.py status --state STATE --policy validation/validation_policy.json --change CHANGE.json --bindings BINDINGS.json
python scripts/validation_controller.py session --state STATE --readiness READINESS.json
python scripts/validation_controller.py record --state STATE --receipt RECEIPT.json
python scripts/validation_controller.py inspect --state STATE
```

State and evidence directories must remain outside the source tree.  Do not
edit a checkpoint, reuse a runtime identity, or turn a partial PASS into a final
PASS.  T4 still requires the complete authority, platform, order/seed/
temperature, rollback, packaging, and external-verifier gates.
