docs: make schema v3 the only workspace contract

README.md

@@ -58,7 +58,7 @@ diagnostics are exposed by `tht doctor` and do not prevent the UI from starting.
 Workspace descriptors are shared through a validated Git repository while endpoint bindings and
 secret files remain installation-local. Use the [local Mac/PC installation manual](docs/install/local-workspace-registry.md)
 for Docker Desktop or a local engine, and the [server installation manual](docs/install/server-workspace-registry.md)
-for the Gitea, reverse-proxy, backup, migration, and recovery workflow. The isolated deployment
+for the Gitea, reverse-proxy, backup, upgrade, and recovery workflow. The isolated deployment
 exercise is `./scripts/workspace-registry-smoke.sh`; both manuals are checked with
 `./scripts/verify-workspace-install-docs.sh --profile local` or `--profile server`.
 
@@ -70,10 +70,15 @@ every revision referenced by an open, closed, or failed unarchived session. It r
 single local installation list or from a server administrator's complete session list, never from
 a remote user's partial list.
 
-Schema-v3 is the operational descriptor contract. Schema-v1/v2 descriptors remain
-`migration_required` until an explicit reviewed migration writes schema version 3. One workspace
-owns one Qdrant collection; schema, Evidence, and Memory records share that collection and stay
-separated by indexed payload `kind`.
+<!-- workspace-descriptor-contract:start -->
+Schema v3 is the only accepted workspace descriptor. Schema v1 and v2 workspace descriptors are
+rejected before activation. Candidate snapshot validation therefore makes activation or a pull fail
+atomically while the prior valid snapshot remains active. There is no in-product migrator or
+automatic conversion. A repository must already contain reviewed v3 descriptors. One workspace
+owns one Qdrant collection;
+schema, Evidence, and Memory records share that collection and stay separated by indexed payload
+`kind`.
+<!-- workspace-descriptor-contract:end -->
 
 Connector `ssh_tunnel` bindings are diagnostic-only in this release: their bounded probe always
 cleans up the loopback forward and returns `workspace_not_activatable`; session creation is rejected
@@ -228,10 +233,11 @@ Compose project name by passing `--confirm-project`:
 
 The restore script stops `qdrant`, validates the exact labeled target, stages the current volume
 contents for rollback, extracts the requested archive into the volume, and then returns the
-service to its prior running state. After restore, run the backend health checks and a known
-retrieval query before reopening write traffic. Restore does not migrate schema-v1/v2 workspace
-descriptors, does not rename collections, and does not reconcile an incompatible collection
-contract; those remain explicit reviewed recovery steps outside the helper.
+service to its prior running state. It restores semantic storage only. Before reopening write
+traffic, the workspace registry must already be at a reviewed v3 descriptor revision compatible
+with the restored collection; then run backend health checks and a known retrieval query. The
+helper does not restore descriptors, rename collections, or reconcile an incompatible collection
+contract.
 
 ## Production trust boundary and secrets