Nice catch and a clean fix. The comment block above the old_hints binding is exactly the kind of "why, not what" explanation that would have prevented this in the first place — solve_cluster reads from self.integrals, so validation has to happen after the write, with rollback on failure.

The regression test is well-scoped: Broadcast on the outer input of a left join is a real user-visible bug path (SQL /*+ broadcast(pt) */ hint), and asserting the circuit still steps cleanly after rejection confirms the rollback actually restored state rather than leaving self.integrals in a half-updated shape.

One small observation, non-blocking: Size and Skew hints are still applied without validation, matching the previous behavior. If those can also produce infeasible cluster states down the line, they'd want the same treatment — but that's a separate question and not something this PR needs to answer.