Reconcile Notarius extraction documentation

docs/roadmap/implementation.md

@@ -2,8 +2,8 @@
 
 ## Status And Audience
 
-Remediation planned. Stages 1 through 9 are complete; Stages 10 through 14
-address gaps found during the post-implementation architecture review.
+Complete. Stages 1 through 9 delivered the feature, and Stages 10 through 14
+closed the gaps found during the post-implementation architecture review.
 
 This plan is written for a GPT-5.6 Terra coding agent. Implement incomplete
 stages in strict numerical order. Do not skip ahead, combine stages merely to
@@ -31,7 +31,7 @@ implementation sequence.
 | Stage 11 | Complete |
 | Stage 12 | Complete |
 | Stage 13 | Complete |
-| Stage 14 | Pending |
+| Stage 14 | Complete |
 
 After completing and validating a stage, update only that stage's row to
 `Complete` and record any material deviation in the relevant stage section.

docs/roadmap/notarius-extract-stage.md

@@ -68,9 +68,10 @@ prepare -> transcribe -> merge -> polish -> normalize -> trim
 `extract` consumes `narratio.transcript.final_trimmed`, produced by `trim`. It
 does not consume rendered Markdown.
 
-Narratio currently invalidates succeeded stages by canonical downstream order.
-Placing `extract` before `render` means forcing extraction may rerun the less
-expensive deterministic render stage, while forcing render does not rerun the
+Narratio invalidates succeeded stages by canonical downstream order whenever a
+forced run or a different executed upstream outcome replaces current state.
+Placing `extract` before `render` means replacing extraction may rerun the less
+expensive deterministic render stage, while replacing render does not rerun the
 more expensive Notarius pipeline. This is preferable to placing extraction
 after render and does not require dependency-aware scheduling or a DAG.
 
@@ -127,8 +128,8 @@ The adapter owns:
 - validation of required receipt fields;
 - confinement of the receipt's absolute `output_directory` beneath the
   absolute output root Narratio supplied for this invocation;
-- confinement of `index_file` beneath the receipt's absolute
-  `output_directory`;
+- requiring receipt `index_file` to be exactly `index.json` beneath the
+  receipt's absolute `output_directory`;
 - tolerant decoding of the supported `index.json` contract;
 - confinement of every index descriptor path beneath the bundle root; and
 - bounded tolerant decoding of `rejected.json` and `warnings.json` into
@@ -163,8 +164,9 @@ The initial compatibility baseline is:
 - `notarius run <pipeline-id> --config ... --input ... --output-dir ... --json`;
 - successful receipt schema `notarius.run-result.v1`;
 - an absolute receipt `output_directory`;
-- logical `index_file` discovery beneath that directory;
-- the production JSON `index.json` descriptor model; and
+- receipt `index_file` exactly `index.json` beneath that directory;
+- the production JSON `index.json` descriptor model with management files
+  exactly `manifest.json`, `rejected.json`, and `warnings.json`; and
 - the exact media type and schema identity configured for each required lane.
 
 Compatibility is decided from these published contracts, not by parsing
@@ -287,8 +289,15 @@ transitive content of files owned by Notarius.
 - Forcing `trim` or an earlier stage stales succeeded `extract` and all later
   stages.
 - Forcing `extract` stales succeeded `render`, `analyze`, `publish`, and
-  `notify` under the existing canonical-order rule.
+  `notify` under the canonical-order rule, even if extraction later skips or
+  fails.
 - Forcing `render` does not stale `extract` because extraction precedes it.
+- A non-forced extraction failure, changed self-skip, or success replacing a
+  different effective outcome stales succeeded downstream stages. Repeating
+  the same `notarius_disabled` self-skip with no outputs does not stale them
+  again.
+- Reusing a resumable succeeded result does not invalidate downstream stages;
+  a resume-validation error stops without mutating either result.
 - A failed, skipped, stale, or interrupted extract stage never supplies current
   extraction sources.
 
@@ -314,6 +323,11 @@ temporary directory on the same filesystem, recursively copies only regular
 files and directories, rejects symlinks and special files, preserves relative
 layout, and renames the completed temporary tree into place.
 
+Atomic no-replace promotion is implemented on Linux, macOS, and Windows. On
+other operating systems extraction reports an unsupported-capability error
+before creating the sibling temporary tree. This limitation is confined to
+extraction bundle promotion and does not define a broader platform guarantee.
+
 The promoted tree preserves `index.json`, `manifest.json`, `rejected.json`,
 `warnings.json`, `lanes/`, and any emitted pipeline-wide artifacts such as
 `chunk-map.json` and `evidence-context.json`. Unknown regular files may be
@@ -434,10 +448,13 @@ Publish source validation and resolution accept configured
 catalog. Operators may publish individual structured lanes without manually
 copying files.
 
-The Notarius bundle is not automatically published wholesale. Bundle files or
-lanes are published only through explicit configured publish rules. Existing
-publish locking, destination safety, commit ordering, and required/unselected
-artifact behavior remain unchanged.
+The run-record upload excludes the run-local
+`extract/notarius-output/**` staging bundle while retaining its receipt and
+stderr diagnostics as eligible run files. Durable Notarius bundles are not
+scanned or automatically published wholesale. Only lanes named by explicit
+configured publish rules are uploaded. Existing publish locking, destination
+safety, commit ordering, and required/unselected artifact behavior remain
+unchanged.
 
 ## Failure And Diagnostic Semantics
 
@@ -568,14 +585,22 @@ required after focused tests pass.
 - Extraction consumes the manifest-resolved final trimmed Seriatim JSON.
 - Disabled extraction is recorded as skipped and runs normally if later
   enabled.
+- Different executed extraction outcomes stale succeeded downstream stages,
+  while an identical repeated disabled self-skip remains stable.
 - Successful resume requires valid manifest-recorded immutable outputs rather
   than filesystem presence alone.
 - The complete bundle is promoted to a unique immutable directory without
   following symlinks or exposing a partial destination.
+- Atomic no-replace bundle promotion is supported on Linux, macOS, and Windows;
+  unsupported operating systems fail before a temporary promotion tree is
+  created.
 - Every configured lane is discovered by lane ID, contract-checked, checksummed,
   and recorded with explicit source identity and external provenance.
 - Analysis and publish resolve extraction sources only from a current
   successful extract manifest record.
+- Run-record uploads exclude the staged Notarius bundle, and only explicitly
+  configured extraction lanes are published; receipt and stderr diagnostics
+  remain eligible run files.
 - Failed, skipped, stale, partial, rejected, unsafe, incompatible, or tampered
   output never becomes a current input.
 - The complete D&D example maps all ten current lanes and demonstrates curated