docs: make schema v3 the only workspace contract

docs/install/local-workspace-registry.md

@@ -213,9 +213,14 @@ Use `POST /workspace-registry/pull` to fetch later revisions. Run workspace diag
 required DWH bindings are mounted. Schema-v3 diagnostics probe the internal Qdrant/Ollama
 services through backend config; ordinary diagnostics are read-only.
 
-Schema-v3 is the only operational descriptor format. Schema-v1/v2 descriptors remain
-`migration_required` until an explicit reviewed migration writes schema version 3. One workspace owns one Qdrant collection; schema, Evidence, and Memory records share that collection and remain
+<!-- workspace-descriptor-contract:start -->
+Schema v3 is the only accepted workspace descriptor. Schema v1 and v2 workspace descriptors are
+rejected before activation. Candidate snapshot validation makes bootstrap activation or a pull fail
+atomically and leaves the prior active snapshot unchanged. There is no in-product migrator or
+automatic conversion. The repository must already contain reviewed v3 descriptors. One workspace
+owns one Qdrant collection; schema, Evidence, and Memory records share that collection and remain
 isolated by payload `kind`.
+<!-- workspace-descriptor-contract:end -->
 
 ## Semantic index ownership contract
 
@@ -223,16 +228,9 @@ isolated by payload `kind`.
 | --- | --- | --- |
 | Workspace semantic index | Each workspace reserves a single Qdrant collection. | Schema, Evidence, and Memory stay in that one collection and remain isolated by payload `kind`. |
 
-To migrate an existing legacy descriptor, create/clone an empty private remote, set the absolute
-`THT_SOURCE_ROOT`, transform with absolute paths, review the schema-v1 result, explicitly produce
-the reviewed schema-v3 contract, then commit/push. The transformer never imports `${ENV}` values
-or secrets.
-
-```sh
-THT_SOURCE_ROOT=/absolute/path/to/ThothII
-npm --prefix "$THT_SOURCE_ROOT/backend" run build
-node "$THT_SOURCE_ROOT/backend/dist/workspaces/migrate-legacy.js" --input /absolute/path/legacy.yaml --output /absolute/path/thoth-workspaces
-```
+If source material needs conversion, perform it outside ThothII in a separate reviewed process.
+Commit only the resulting reviewed v3 descriptors. That external process must not import `${ENV}`
+values, secret values, certificates, keys, or secret files into the repository.
 
 ## Publish, update, backup, outage recovery, and rollback
 

docs/install/server-workspace-registry.md

@@ -60,9 +60,9 @@ use `ssh://git@git.example.invalid/platform/thoth-workspaces.git`. For HTTPS, cr
 machine credential in the secret manager and mount the Gitea/private CA separately. Never use a
 Gitea admin credential in the application.
 
-Bootstrap an empty remote from a temporary review clone: migrate legacy descriptors, review their
-schema-v3 identity and generated artifacts, commit, and push `main`. The running server is not an
-authoring environment for migration.
+Bootstrap an empty remote from a temporary review clone only after its canonical v3 descriptors
+and generated public artifacts have been reviewed; commit and push `main`. The running server is
+not a descriptor authoring or conversion environment.
 
 ## Curator flow for shared-registry Evidence
 
@@ -258,14 +258,18 @@ For upgrades, record active status/head, finish active work, use the documented
 --check-only`, deploy the compatible image through `thothctl`, verify health/status, then resume
 proxy traffic.
 
-For legacy descriptor migration, use a temporary review clone and the legacy transformer with absolute paths.
-Its schema-v1 output is `migration_required`; explicitly supply collection identity, diagnostics,
-and the reviewed v3 contract before commit. Never import `${ENV}` values or
-copy secret files.
+<!-- workspace-descriptor-contract:start -->
+Schema v3 is the only accepted workspace descriptor. Schema v1 and v2 workspace descriptors are
+rejected before activation. Candidate snapshot validation makes initial activation or a pull fail
+atomically and leaves the prior active snapshot unchanged. There is no in-product migrator or
+automatic conversion. The repository must already contain reviewed v3 descriptors. One workspace
+owns one Qdrant collection; schema, Evidence, and Memory records share it and stay separated by
+payload `kind`.
+<!-- workspace-descriptor-contract:end -->
 
-Schema-v3 is the only operational descriptor contract. Schema-v1/v2 descriptors remain
-`migration_required` until an explicit reviewed migration writes version 3. One workspace owns one Qdrant collection; schema, Evidence, and Memory records share it and stay separated by payload
-`kind`.
+If source material needs conversion, perform it outside ThothII in a separate reviewed process.
+Commit only the resulting reviewed v3 descriptors. That external process must not import `${ENV}`
+values, secret values, certificates, keys, or secret files into the repository.
 
 ## Semantic index ownership contract
 
@@ -312,9 +316,10 @@ Use the repository helpers for Qdrant backup/restore:
 
 Qdrant backup/restore targets exactly one labeled `qdrant-data` volume for the named Compose
 project. Restore requires the exact repeated project confirmation, validates the archive before
-stopping `qdrant`, stages rollback content, and restores in place only for that project-scoped
-volume. It does not migrate schema-v1/v2 workspaces, rename collections, or resolve semantic-index
-incompatibilities.
+stopping `qdrant`, stages rollback content, and restores semantic storage in place only for that
+project-scoped volume. Before recovery, the registry must already contain a reviewed v3 descriptor
+revision compatible with the restored collection. The helper does not restore descriptors, rename
+collections, or resolve semantic-index incompatibilities.
 
 The Ollama model cache is a recoverable local cache, not the canonical semantic source of truth.
 You may back up `embedding-models` for faster offline recovery, but a cache loss is recoverable by

docs/workspace-diagnostic-protocol.md

@@ -7,9 +7,12 @@ response body belongs in the descriptor, generated `.env.example` files, or diag
 
 ## Scope and safety rules
 
-- The operational descriptor is schema version 3.
-- Schema-v1/v2 descriptors are readable only and remain `migration_required` until an explicit
-  reviewed migration writes schema version 3.
+<!-- workspace-descriptor-contract:start -->
+Schema v3 is the only accepted workspace descriptor.
+Schema v1 and v2 workspace descriptors are rejected before activation.
+- Diagnostics do not run for a rejected descriptor. There is no in-product migrator or automatic
+  conversion; the Git repository must already contain reviewed v3 descriptors.
+<!-- workspace-descriptor-contract:end -->
 - One workspace owns one Qdrant collection.
 - Qdrant and Ollama are internal services. Operators do not bind external vector or embedding
   transports for active manuals or supported diagnostics.