Remove retired cleanup manifest state

internal/app/restore_manifest_paths.go

@@ -122,9 +122,6 @@ func rebaseRestoredManifestPaths(cfg *config.Config, m *manifest.Manifest, desti
 		m.LocalWorkDir = destinationRoot
 	}
 	m.LocalSpoolDir = ""
-	// A post-publish cleanup record is authority to delete producer-local
-	// directories. It must never cross a restore boundary.
-	m.PostPublishCleanup = nil
 	return nil
 }
 

internal/app/restore_recovery_test.go

@@ -168,6 +168,7 @@ func TestRebaseRestoredManifestPathsRejectsUnsafeReferencesAndRebasesPortablePat
 			m.RunID = "20260519T010203Z-a1b2c3d4"
 			m.LocalWorkDir = test.workDir
 			m.Stages["analyze"] = &manifest.StageRecord{Outputs: []manifest.ArtifactRecord{{Kind: "recap", LocalPath: test.output}}}
+			m.MarkStageFailed("cleanup", nowUTC(), "retry local deletion")
 			destination := artifacts.SessionWorkDirForCampaign(cfg.Pipeline.Workspace.Root, cfg.Session.Campaign, cfg.Session.SessionID)
 
 			err := rebaseRestoredManifestPaths(cfg, m, destination)
@@ -183,6 +184,9 @@ func TestRebaseRestoredManifestPathsRejectsUnsafeReferencesAndRebasesPortablePat
 			if got, want := m.Stages["analyze"].Outputs[0].LocalPath, filepath.Join(destination, test.wantPath); got != want {
 				t.Fatalf("rebased local path = %q, want %q", got, want)
 			}
+			if got := m.Stages["cleanup"].Status; got != manifest.StatusFailed {
+				t.Fatalf("cleanup status = %q, want preserved failed state", got)
+			}
 		})
 	}
 }