Complete filesystem simplification workstream

docs/internal/overview.md

@@ -35,7 +35,7 @@ progress and artifact services resolve durable inputs and outputs.
 | Artifacts and paths | `internal/artifacts`, `internal/pathsafe` | Artifact identities and resolution, local and remote path/key models, current-state discovery, and confined relative destinations. |
 | Previous-session cache | `internal/previouscache` | Deterministic planning and materialization requirements for configured previous-session inputs. |
 | Artifact policy | `internal/artifactpolicy` | Source and destination policy, configured artifact identity validation, and publish destination safety. |
-| Shared models and file operations | `internal/artifactmodel`, `internal/contracts`, [`internal/fileops`](fileops.md) | Transcript and artifact data contracts plus durable single-file replacement helpers; unsupported directory syncing is reported explicitly. |
+| Shared models and file operations | `internal/artifactmodel`, `internal/contracts`, [`internal/fileops`](fileops.md) | Transcript and artifact data contracts plus atomic single-file replacement, bounded reads, workspace modes, and root-scoped cleanup helpers. |
 | Logging | `internal/logging` | Application logger construction and shared structured logging behavior. |
 
 The application boundary composes concrete implementations. Stages depend on

docs/internal/stage-extract.md

@@ -46,8 +46,8 @@ invocation-local snapshot path, never payload contents. Snapshot bytes must
 match the prepared identity both before and after Notarius runs, so a concurrent
 prepared-file replacement cannot make recorded provenance describe different
 bytes from those supplied to Notarius.
-Validation completes before
-promotion, so a rejected result cannot expose a partial durable bundle.
+Validation completes before the single durable rename, so a rejected result
+cannot expose a partial durable bundle.
 
 Any executed extraction outcome that replaces a different effective outcome
 marks succeeded analysis and delivery dependents stale. Render is an independent
@@ -92,11 +92,11 @@ identifier.
 Adapter startup, timeout, nonzero exit, receipt decoding, path confinement,
 index compatibility, inconsistent warning or diagnostic envelopes,
 required-lane rejection or incomplete validation, payload inspection,
-checksum, or promotion errors fail the stage through ordinary manifest
+checksum, or installation errors fail the stage through ordinary manifest
 transition handling.
 Stdout receipt and stderr diagnostics remain separate. Downstream stages are
 not given selectable extraction sources unless the complete configured result
-has passed validation and promotion.
+has passed validation and installation.
 
 When a replacement attempt begins, the current session-stage record no longer
 advertises payload from the previous success. A failed replacement therefore

docs/internal/workspace.md

@@ -33,13 +33,8 @@ previous-session cache paths remain session-durable and are never redirected
 into run-local output space.
 
 Extraction uses run-local receipt, stderr, and output-root helpers, then
-promotes the validated external bundle to the unique immutable Notarius bundle
-path supplied by `internal/artifacts`. `internal/fileops.PromoteDirectory`
-copies only regular files and directories to a same-filesystem temporary
-sibling. Source traversal uses confined directory handles and identity checks
-so replacing an inspected root, directory, or file is rejected rather than
-followed. The completed tree is atomically renamed without replacing an
-existing destination. Exact physical paths belong in
+validates and renames the external bundle to the unique immutable Notarius
+bundle path supplied by `internal/artifacts`. Exact physical paths belong in
 [Operations](../operations.md#extraction-workflow).
 
 ## Locking
@@ -84,12 +79,12 @@ syntax and exact deletion scope belong in [CLI](../cli.md#clean) and
 - Path model and local store: `internal/artifacts/paths.go`,
   `internal/artifacts/local.go`
 - Run-local materialization: `internal/stage/run_local.go`
-- Immutable bundle promotion: `internal/fileops/directory.go`
+- Immutable bundle installation: `internal/stage/extract.go`
 - Workspace modes: `internal/fileops/modes.go`
 - Cleanup confinement: `internal/fileops/cleanup.go`,
   `internal/app/cleanup_targets.go`, `internal/app/post_publish_cleanup.go`
 - Tests: `internal/artifacts/paths_model_test.go`,
   `internal/artifacts/local_test.go`, `internal/stage/run_local_test.go`,
-  `internal/fileops/directory_test.go`, `internal/fileops/modes_posix_test.go`,
+  `internal/fileops/modes_posix_test.go`,
   `internal/fileops/cleanup_test.go`, `internal/app/cleanup_targets_test.go`,
   `internal/app/post_publish_cleanup_test.go`

docs/roadmap/implementation.md

@@ -604,7 +604,7 @@ directory-promotion machinery.
 
 ## Stage 8 — Finish The Filesystem Contract And Validate The Workstream
 
-**Status: Pending**
+**Status: Completed**
 
 ### Goal
 

docs/roadmap/refactoring.md

@@ -96,7 +96,7 @@ new external subprocess library during this refactor.
 
 ### Workstream 2 — Filesystem simplification and restore correctness
 
-**Status:** Pending
+**Status:** Complete
 
 **Audit sources:** H02, H06, H07, H18, H20, H21, H29, H45, H46, C04,
 L02, L05a, and L05c. Supporting filesystem rationale and policy are recorded