Add crash-consistent State Anchor maintenance

docs/schema.md

@@ -383,6 +383,20 @@ classDiagram
         state
     }
 
+    class StateResetIntentV1 {
+        <<serialized>>
+        schema
+        domain_id
+        scope
+    }
+
+    class StateResetScopeV1 {
+        <<serialized>>
+        <<union>>
+        All
+        Selected
+    }
+
     DomainStore "1" *-- "1" StoreMetadata
     DomainStore "1" *-- "1" Domain
     Domain "1" --> "0..*" Generation
@@ -394,6 +408,8 @@ classDiagram
     SessionTerminal --> SessionTerminalState
     Generation "1" --> "0..1" Mailbox
     Mailbox --> ParticipantState
+    DomainStore "1" *-- "0..1" StateResetIntentV1
+    StateResetIntentV1 --> StateResetScopeV1
 ```
 
 `durable_decision` and `session_phase` contain values defined by the application
@@ -403,6 +419,20 @@ identity is `lazaret-domain-store-v1` with version `1`. Unknown, unversioned,
 older, and newer metadata refuses before any row is interpreted. The
 Storage Catalog remains `lazaret-storage-catalog-v1` with version `1`.
 
+The reset-intent schema is exactly `lazaret-state-reset-v1`. `Selected` contains
+one exact configured persistent container path as pathname bytes. The singleton
+intent is committed before physical quarantine begins and removed only after
+confined cleanup completes. Unknown schemas and mismatched Domain or scope
+bindings refuse before physical state is interpreted.
+
+### State maintenance output
+
+Machine output uses schema `lazaret-state-output-v1`. It contains the operation,
+Domain ID, profile, hexadecimal canonical-workspace bytes, a list of configured
+State Anchors, structural change metadata, and `contents_included = false`.
+Each change contains hexadecimal pathname bytes, entry kind, mode, owner UID and
+GID, and size. It never contains persisted file contents.
+
 ### Host process identity and staged ownership
 
 ```mermaid