Require explicit manifest schemas

docs/internal/artifacts.md

@@ -165,6 +165,12 @@ Validation by content type:
 Artifacts package owns shared remote current-state loading mechanics used by
 restore, status and validation checks, and previous-cache planning.
 
+The selected session manifest is accepted only with
+`schema_version: narratio.session-manifest.v1` and complete stage identity.
+An unsupported local or downloaded manifest must be replaced by regeneration,
+verified restore, or republication; artifact resolution never fills in missing
+authority markers.
+
 For a new-protocol current state, the pointer-selected immutable commit is the
 complete restore authority. Callers receive its declared object identities and
 must not supplement them by listing mutable session prefixes. The legacy reader

docs/internal/manifest.md

@@ -10,6 +10,7 @@ Explain the session-progress and invocation-audit models implemented by
 
 `manifest.Manifest` records:
 
+- required `schema_version: narratio.session-manifest.v1`
 - identity (`session_id`, `campaign`, `run_id`)
 - local path metadata (`local_workdir`, `local_spool_dir`)
 - remote identity metadata (`s3_bucket`, `s3_session_prefix`, `s3_run_prefix`)
@@ -25,6 +26,12 @@ portable opaque segments. Unsafe legacy identities are rejected with migration
 guidance rather than being normalized into a different workspace or remote
 namespace.
 
+Every persisted session manifest has a non-nil `stages` map. Each entry is
+non-nil and its embedded `name` exactly matches its map key; loading never
+invents either marker. A missing or unsupported schema version, or incomplete
+stage identity, is unsupported local state: move it aside and regenerate it,
+or restore a verified current committed snapshot when that is authoritative.
+
 Prepare records independent `party` and `players` input checksums. In canonical
 party mode, the party record retains its campaign source identity while the
 players record uses `derived_from_party`; raw roster content is never embedded
@@ -43,11 +50,11 @@ The model admits these stage states:
 
 ### Analyze-owned artifact state
 
-The `analyze` stage record may carry `analyze_state_version: 1` and an
+Every `analyze` stage record carries `analyze_state_version: 1` and an
 `analyze_artifacts` map keyed by normalized configured artifact key. The
 version is the authority marker: version 1 with no entries is a valid evaluated
-empty set, while an absent version is legacy aggregate-only state and provides
-no current configured-artifact evidence.
+empty set. An absent or unsupported version is unsupported local state and is
+rejected rather than being treated as aggregate-only authority.
 
 Each analyze artifact record has one disposition:
 
@@ -123,6 +130,7 @@ does not turn incidental canonical bytes into manifest authority.
 
 `manifest.RunManifest` is created for each invocation and records:
 
+- required `schema_version: narratio.run-manifest.v1`
 - invocation identity and `force` flag
 - the selected profile (when any) and secret-free effective configuration digest
 - requested stages
@@ -153,8 +161,10 @@ path is removable after migration and is never used to write new state.
 
 `manifest.LocalStore`:
 
-- validates loaded documents;
-- normalizes missing maps/stage records;
+- accepts only the exact supported schema version for each manifest kind;
+- validates stage-map identity without synthesizing missing maps, records, or
+  names;
+- retains only representation-preserving collection normalization;
 - writes through a sibling temporary file and atomic replacement visibility;
 - updates `updated_at` on save.