Separate publish source and output planning

docs/internal/stage-publish.md

@@ -26,6 +26,12 @@ Exact remote placement and the operator workflow belong in
 
 ## Key Behavior
 
+`publish.go` retains the transaction-owning `Run` path. Source discovery,
+manifest-derived archive metadata, confined opening, and checksum validation
+live in `publish_sources.go`; artifact-catalog matching, selection, required
+and optional rules, destination resolution, and collision inputs live in
+`publish_outputs.go`.
+
 - when publishing or run upload is disabled, completes successfully with no
   outputs and records explanatory metadata. This is not an explicit self-skip:
   the session manifest records success. Enablement and upload policy are
@@ -115,6 +121,7 @@ The commit boundary and cleanup gate are normative architecture invariants; see
 - [Artifact Internals](artifacts.md) explains source resolution and current-state
   helpers.
 - Implementation and tests: `internal/stage/publish.go`,
+  `internal/stage/publish_sources.go`, `internal/stage/publish_outputs.go`,
   `internal/stage/publish_test.go`,
   `internal/stage/semantic_contracts_delivery.go`,
   `internal/app/operator_helpers_test.go`, and