[FLO-13.4a] Revalidate dependency graphs before durable resume and execution

[szmyty]

Complete: PR #67 merged as 83f1ea161aa5aba03da5de6b287005252000cd4b; main CI passed. #64 is closed and #65 is dependency-ready. #31 remains open.

Parent: #31
Suite roadmap: #11
Depends on: #49 (merged through PR #63)

Outcome

Provide deterministic, read-only assessment of every step in an immutable durable plan, and require fresh ancestor evidence before executing a dependent step. A recorded successful dependency is historical evidence, not proof that it remains reusable.

Acceptance criteria

• Add a typed, versioned assessment report tied to the saved plan and state identity, with ready, reusable, invalidated, dependency-blocked, approval-required, and abandoned decisions.
• Freshly check completed prerequisite inputs, provider/configuration/authority identities, validator identity, and accepted artifacts; propagate stale evidence to all descendants while keeping independent valid branches reusable.
• Require complete current context inventory and exact expected-plan identity; refuse omissions, mismatches, corrupt state, and attempts to bypass dependency validation through the single-step API.
• Execute a caller-selected ready step only after recomputing current evidence; serialized assessment reports never grant execution authority.
• Prove reopen/reuse, branching and transitive invalidation, no repeated successful launches, blocked dependencies, and preserved history with real hermetic providers and deterministic assertions.
• Update canonical architecture, ADR rationale, schema examples, public API documentation, and required CI checks.

Boundaries

Reuse #49 state and acceptance gates. Assessments describe current eligibility without rewriting accepted history or deleting artifacts. No automatic graph scheduler, cross-plan cache migration, automatic retry, or real provider adapter. Changed plans require a separate explicit future planning/migration path.

Handoff

This is checkpoint 1 of #31. The next checkpoints add the full lifecycle trace corpus and authority/effect/cleanup proofs. Keep #31 open until all three are reconciled.

Verification and next checkpoint

• Eight graph regressions pass on Rust 1.85 and stable, including fresh-root deterministic reports, restart/reuse, branch and transitive invalidation, all local stale boundaries, complete-context and exact-plan refusals, stale-report non-authority, single-step bypass refusal, blocked dependencies, corrupt retained history, and preserved snapshots/no repeated successful launch.
• Both full all-targets acceptance runs also passed all 81 existing scenarios twice. Their source identities include the new graph tests. Formatting, Clippy with warnings denied, schemas/negative fixtures, repository validators, documentation, examples, and package verification passed.
• Durable execution guide documents API migration, eligibility meanings, report non-authority, sequential observation limits, and validation-implementation invalidation. ADR-0012 remains proposed for maintainer review.
• PR feat(flow): revalidate dependency graphs before durable execution #67 is merged and main CI is green. [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65 is now dependency-ready; [FLO-13.4c] Prove authority, duplicate-effect prevention, and recovery residuals #66 follows [FLO-13.4b] Add deterministic durable lifecycle traces and recovery scenarios #65. Keep [FLO-13.4] Prove interruption, retry, resume, and authority state transitions #31 open and preserve one bounded review PR at a time.