Remove retired cleanup manifest state

docs/internal/command-restore.md

@@ -78,7 +78,9 @@ Execution order and safety:
 - restored manifest local references are rebased beneath the selected local
   session root. Unsafe relative references and producer-machine absolute paths
   outside the manifest's producer session root are rejected; producer-local
-  spool/cache and cleanup locations are not restored as authority.
+  spool paths and run-local diagnostic references are not restored as
+  authority. Cleanup remains ordinary restored stage state and is not reset or
+  synthesized by restore.
 
 Audio restore path:
 

docs/internal/manifest.md

@@ -16,16 +16,18 @@ manifest placement belongs in
 - remote identity metadata (`s3_bucket`, `s3_session_prefix`, `s3_run_prefix`)
 - `inputs` records
 - durable `artifacts` records
-- per-stage `stages` map
-- an optional `post_publish_cleanup` obligation, which binds a committed run,
-  remote commit identity, and each exact root-confined local target to its
-  completion evidence
+- per-stage `stages` map, including the ordinary cleanup stage record
 
 Session, campaign, and run identities in local and downloaded manifests must be
 portable opaque segments. Unsafe legacy identities are rejected with migration
 guidance rather than being normalized into a different workspace or remote
 namespace.
 
+Decoding is strict at every typed manifest field. Unknown fields are rejected;
+the schema version remains `narratio.session-manifest.v1` and there is no
+compatibility reader that silently drops retired state. Cleanup progress uses
+only the cleanup entry in `stages`.
+
 Every persisted session manifest has a non-nil `stages` map. Each entry is
 non-nil and its embedded `name` exactly matches its map key; loading never
 invents either marker. A missing or unsupported schema version, or incomplete
@@ -145,6 +147,7 @@ establish a current immutable snapshot.
 `manifest.LocalStore`:
 
 - accepts only the exact supported session-manifest schema version;
+- rejects unknown fields and multiple JSON values;
 - validates stage-map identity without synthesizing missing maps, records, or
   names;
 - retains only representation-preserving collection normalization;

docs/operations.md

@@ -610,6 +610,14 @@ also available when the manifest has valid publish evidence. A range ending at
 `notify` or earlier and the standalone `publish` command never delete local
 state.
 
+Older local manifests that contain the retired cleanup-obligation field are
+intentionally incompatible with strict manifest decoding. If such an
+obligation is still outstanding, complete it with the pre-upgrade binary.
+Otherwise verify that the remote publication is committed, move aside or
+regenerate the incompatible local manifest (or restore the verified remote
+snapshot), and then use the cleanup stage. Manual JSON editing is not the
+normal migration path.
+
 ## Operational Caveats
 
 - Local and S3 audio modes are mutually exclusive.

docs/roadmap/implementation.md

@@ -246,7 +246,7 @@ post-loop deletion path.
 
 ## Stage 4 — Remove The Cleanup Obligation From Manifest State
 
-**Status:** Pending
+**Status:** Completed
 
 ### Goal
 

docs/troubleshooting.md

@@ -73,6 +73,11 @@ Safe fix:
   regenerate it; restore a verified current committed snapshot or republish
   healthy regenerated state when appropriate. Do not add version or stage
   markers by hand.
+- if an older manifest is rejected for its retired cleanup-obligation field,
+  finish outstanding cleanup with the pre-upgrade binary. Otherwise verify the
+  remote commit, move aside or regenerate the incompatible manifest, and use
+  the cleanup stage. Do not treat manual JSON editing as the normal migration
+  path.
 
 Relevant reference: [Configuration](./config.md).