Serialize restore recovery and rebase manifest paths

docs/internal/command-restore.md

@@ -8,8 +8,8 @@ reporting flow in `internal/app`. User invocation belongs in
 physical restore scope belong in
 [Operations](../operations.md#restore-workflow).
 
-Restore is split into explicit phases so remote authority, local conflict
-policy, and filesystem mutation can be tested independently.
+Restore separates remote authority, local conflict policy, and filesystem
+mutation so each remains testable independently.
 
 ## Discovery Contract
 
@@ -40,6 +40,9 @@ Planner behavior:
 - force converts differing eligible regular files from conflicts to downloads;
   directories and other non-regular targets remain conflicts.
 
+For a non-dry-run restore, planning/classification happens only after acquiring
+the session lock. Runner manifest/reuse checks acquire that same lock first.
+
 Previous-cache files are planned separately through `previouscache.BuildPlan`
 when configured previous-session requirements exist.
 
@@ -54,6 +57,13 @@ Execution order and safety:
 - each committed object is verified against its declared checksum, size, and
   generation before installation;
 - failed installs do not roll back files already written in the same execution.
+- a durable `.restore-incomplete.json` marker is written before installation.
+  It blocks runners until a restore retry completes all verified installs and
+  the local manifest replacement, at which point it is removed.
+- restored manifest local references are rebased beneath the selected local
+  session root. Unsafe relative references and producer-machine absolute paths
+  outside the manifest's producer session root are rejected; producer-local
+  spool/cache and cleanup locations are not restored as authority.
 
 Audio restore path: