Require committed remote current state

docs/internal/artifacts.md

@@ -173,17 +173,13 @@ authority markers.
 
 For a new-protocol current state, the pointer-selected immutable commit is the
 complete restore authority. Callers receive its declared object identities and
-must not supplement them by listing mutable session prefixes. The legacy reader
-is intentionally separate and remains migration-only support.
+must not supplement them by listing mutable session prefixes.
 
 The reader opens each small control object directly and enforces owner-specific
 limits before decoding: 64 KiB for the mutable commit pointer, 4 MiB for the
-immutable commit manifest, and 8 MiB for the selected session manifest. Legacy
-compatibility applies a 4 KiB limit to `current/run_id.txt` and the same 8 MiB
-manifest limit to `current/manifest.json`. These are exposed as
-`MaxCurrentCommitPointerBytes`, `MaxRemoteCommitManifestBytes`,
-`MaxRemoteSessionManifestBytes`, `MaxLegacyCurrentRunPointerBytes`, and
-`MaxLegacyCurrentManifestBytes`.
+immutable commit manifest, and 8 MiB for the selected session manifest. These
+are exposed as `MaxCurrentCommitPointerBytes`,
+`MaxRemoteCommitManifestBytes`, and `MaxRemoteSessionManifestBytes`.
 
 Each read uses the generation and size metadata returned with its opened body.
 Actual bytes remain subject to a limit-plus-one read even if size metadata is
@@ -228,8 +224,7 @@ Caller policy is intentionally outside artifacts helpers:
 New publication creates run-scoped immutable objects, including
 `runs/{run_id}/commit.json` and `runs/{run_id}/session-manifest.json`. The sole
 mutable selector is `current/commit-pointer.json`; readers verify its selected
-commit and declared object generations/checksums. Legacy current-pair loading
-is confined to `current_state_legacy.go` for migration only.
+commit and declared object generations/checksums.
 
 Campaign, session, and Narratio run IDs are validated as portable opaque
 segments at configuration and artifact boundaries before they can be used in a

docs/internal/command-restore.md

@@ -100,9 +100,7 @@ Audio restore path:
   loaded at discovery; later pointer changes cannot add objects or substitute a
   different run into its plan;
 - a verified `current/commit-pointer.json` and its selected immutable commit
-  establish new-protocol remote commitment; coherent legacy
-  `current/run_id.txt` plus `current/manifest.json` remains read-only migration
-  support;
+  establish remote commitment; when absent, republish the session;
 - restore does not execute pipeline stages.
 
 ## Implementation And Tests

docs/internal/manifest.md

@@ -153,9 +153,8 @@ binds that object by checksum, size, and generation. Readers strictly reject
 unknown fields, version mismatches, pointer/commit identity mismatches, and
 objects that do not match their declaration.
 
-The reader retains a temporary, clearly isolated compatibility path for a
-coherent legacy `current/manifest.json` plus `current/run_id.txt` pair. That
-path is removable after migration and is never used to write new state.
+An absent commit pointer means no remote state is published. Republish to
+establish a current immutable snapshot.
 
 ## Persistence Semantics
 

docs/internal/stage-publish.md

@@ -53,7 +53,7 @@ Exact remote placement and the operator workflow belong in
 - creates one complete immutable source-to-destination mapping before upload;
 - uploads and verifies every declared immutable object and the commit manifest;
 - updates `current/commit-pointer.json` exactly once, last; and
-- does not write the legacy `current/manifest.json` or `current/run_id.txt` pair.
+- writes only the selected `current/commit-pointer.json` control record.
 - rechecks remote lock state immediately before the pointer update. A newly
   committed lock aborts selection, leaving any uploaded immutable attempt
   unselected.

docs/operations.md

@@ -379,10 +379,9 @@ commit by version, checksum, size, and storage generation; committed artifacts
 are also checksum- and generation-bound. Readers accept this contract now and
 strictly reject mismatched or unknown data.
 
-Legacy reads are limited to a coherent `current/manifest.json` and
-`current/run_id.txt` pair; a torn pair is rejected. New publication does not
-write that pair and remote commit state does not carry local
-`current_pointer_written` metadata.
+When the pointer is absent, remote state is not published; republish the
+session to establish a committed snapshot. Remote commit state does not carry
+local `current_pointer_written` metadata.
 
 ## Publish Locks
 

docs/roadmap/implementation.md

@@ -232,7 +232,7 @@ explicitly derived value.
 
 ## Stage 4 — Make Remote Current State Commit-Only
 
-**Status: Pending**
+**Status: Completed**
 
 ### Goal