Bind restore to committed remote snapshots

docs/internal/artifacts.md

@@ -100,6 +100,11 @@ Validation by content type:
 Artifacts package owns shared remote current-state loading mechanics used by
 restore, status and validation checks, and previous-cache planning.
 
+For a new-protocol current state, the pointer-selected immutable commit is the
+complete restore authority. Callers receive its declared object identities and
+must not supplement them by listing mutable session prefixes. The legacy reader
+is intentionally separate and remains migration-only support.
+
 Core helpers:
 
 - `LoadCurrentState`

docs/internal/command-restore.md

@@ -18,6 +18,7 @@ Discovery delegates current-state pointer and manifest loading to
 
 - campaign must match;
 - session ID must match.
+- run ID must match the pointer-selected committed run.
 
 Restore treats any missing or invalid remote current state as a command error.
 
@@ -31,10 +32,13 @@ Restore planner action kinds:
 
 Planner behavior:
 
-- remote list scope is the resolved session prefix;
+- a new-protocol restore uses only the selected commit's declared artifact set;
+  each action carries that artifact's immutable key, checksum, size, and
+  generation. Coherent legacy state remains on the isolated compatibility path;
 - remote-to-local mapping is traversal-safe;
 - actions are sorted by local relative path and then remote key;
-- force converts differing local targets from conflicts to downloads.
+- force converts differing eligible regular files from conflicts to downloads;
+  directories and other non-regular targets remain conflicts.
 
 Previous-cache files are planned separately through `previouscache.BuildPlan`
 when configured previous-session requirements exist.
@@ -47,6 +51,8 @@ Execution order and safety:
 - `manifest.json` installs last;
 - downloads use sibling temp files plus atomic rename;
 - manifest replacement is validated before rename;
+- each committed object is verified against its declared checksum, size, and
+  generation before installation;
 - failed installs do not roll back files already written in the same execution.
 
 Audio restore path:
@@ -65,6 +71,9 @@ Audio restore path:
 ## Invariants
 
 - restore uses committed remote current state as authority;
+- one restore or status inspection observes the single pointer-selected commit
+  loaded at discovery; later pointer changes cannot add objects or substitute a
+  different run into its plan;
 - a verified `current/commit-pointer.json` and its selected immutable commit
   establish new-protocol remote commitment; coherent legacy
   `current/run_id.txt` plus `current/manifest.json` remains read-only migration