Remove retired cleanup manifest state

docs/internal/command-restore.md

@@ -78,7 +78,9 @@ Execution order and safety:
 - restored manifest local references are rebased beneath the selected local
   session root. Unsafe relative references and producer-machine absolute paths
   outside the manifest's producer session root are rejected; producer-local
-  spool/cache and cleanup locations are not restored as authority.
+  spool paths and run-local diagnostic references are not restored as
+  authority. Cleanup remains ordinary restored stage state and is not reset or
+  synthesized by restore.
 
 Audio restore path:
 

docs/internal/manifest.md

@@ -16,16 +16,18 @@ manifest placement belongs in
 - remote identity metadata (`s3_bucket`, `s3_session_prefix`, `s3_run_prefix`)
 - `inputs` records
 - durable `artifacts` records
-- per-stage `stages` map
-- an optional `post_publish_cleanup` obligation, which binds a committed run,
-  remote commit identity, and each exact root-confined local target to its
-  completion evidence
+- per-stage `stages` map, including the ordinary cleanup stage record
 
 Session, campaign, and run identities in local and downloaded manifests must be
 portable opaque segments. Unsafe legacy identities are rejected with migration
 guidance rather than being normalized into a different workspace or remote
 namespace.
 
+Decoding is strict at every typed manifest field. Unknown fields are rejected;
+the schema version remains `narratio.session-manifest.v1` and there is no
+compatibility reader that silently drops retired state. Cleanup progress uses
+only the cleanup entry in `stages`.
+
 Every persisted session manifest has a non-nil `stages` map. Each entry is
 non-nil and its embedded `name` exactly matches its map key; loading never
 invents either marker. A missing or unsupported schema version, or incomplete
@@ -145,6 +147,7 @@ establish a current immutable snapshot.
 `manifest.LocalStore`:
 
 - accepts only the exact supported session-manifest schema version;
+- rejects unknown fields and multiple JSON values;
 - validates stage-map identity without synthesizing missing maps, records, or
   names;
 - retains only representation-preserving collection normalization;