docs: separate public manual from internal project documentation

PROJECT_STATE.md

@@ -1,6 +1,6 @@
 # ThothII — Project State
 
-Last updated: 2026-09-14.
+Last updated: 2026-09-15.
 
 This file is the short operational snapshot. Stable commands and the architecture mental model
 live in `AGENTS.md`; current design and runtime contracts live under `docs/architecture/`,
@@ -12,6 +12,17 @@ Authentik, internal catalog/embedding services, and the PSD workspace repository
 `docs/operations/server-upgrade-gitea-workspace-v2.md`. Treat its operator gates and rollback
 requirements as mandatory; do not replace the running server stack in place.
 
+## Public documentation boundary — 2026-09-15
+
+MkDocs now publishes only its explicit public-manual allowlist: 20 product, installation,
+usage and administration pages, plus approved assets. Internal developer/project documents
+remain in Git but are excluded from generated pages and search. The build and publication
+workflow enforce this boundary with `scripts/verify-public-docs.py` and negative fixtures.
+The critical review and proposed (not executed) source-file retirements are in
+`docs/maintenance/2026-09-15-documentation-cleanup.md`. It also records pre-existing stale
+paths later in this snapshot and obsolete authentication/DWH documentation verifiers;
+those require a separate reference/test cleanup, not restoration of superseded guides.
+
 ## Session review layout deployed — 2026-09-14
 
 Session-only dialogs now use the visible app bounds: artifact/column review grows