Decouple publish from run manifests

docs/internal/stage-publish.md

@@ -30,9 +30,10 @@ Exact remote placement and the operator workflow belong in
   both manifests record success. Enablement and upload policy are fingerprinted,
   so changing either automatically makes the prior result non-resumable.
 - validates prerequisite stage success and object-store availability.
-- derives a deterministic run-archive allowlist from the validated run
-  `manifest.json`: declared run-local outputs, logs, generated configs, and the
-  manifest itself. Unlisted workspace files are not archive candidates.
+- derives a deterministic run-archive allowlist from the session manifest's
+  declared current-run outputs, logs, and generated configurations. References
+  outside the current run root, including canonical session files and prior-run
+  diagnostics, are not archive candidates. No run manifest is read or uploaded.
 - opens each archive candidate beneath its archive root without following
   symlinked ancestors or leaf entries, verifies that it is a regular file and
   checks a declared checksum when present, then streams the opened descriptor.
@@ -82,7 +83,8 @@ Includes counts/lists for:
   from verified descriptors; symlinks, special files, replacement races, and
   undeclared entries are rejected or ignored before uploads begin.
 - run-local diagnostics, including Notarius receipt and stderr files, are
-  archived only when recorded by the run manifest.
+  archived only when recorded by the session manifest. A run with no declared
+  current-run diagnostics legitimately uploads none.
 - publish locks are not overridden by `--force`; remote locks are revalidated
   immediately before current-state selection.
 - post-commit local cleanup is authorized by the committed publish metadata and

docs/operations.md

@@ -308,12 +308,15 @@ Run-local diagnostics are:
 - `runs/{run_id}/extract/notarius.stderr.log`
 - `runs/{run_id}/extract/notarius-output/` before durable promotion
 
-The run-record upload is an allowlist derived from the validated run manifest,
-not a workspace scan. Each declared source is opened without following
-symlinked ancestors or the leaf, verified as a regular file, and streamed from
-that verified descriptor. Unlisted files and unsafe entries are never uploaded.
-The durable bundle is never scanned for implicit publication; only lanes named
-by explicit `pipeline.publish.outputs` rules are uploaded.
+The run upload is an allowlist derived from the session manifest's declared
+current-run outputs, logs, and generated configurations, not a workspace scan.
+References to canonical session files and prior-run paths are excluded. Each
+declared source is opened without following symlinked ancestors or the leaf,
+verified as a regular file, and streamed from that verified descriptor.
+Unlisted files and unsafe entries are never uploaded; a run with no declared
+current-run diagnostics uploads no run-local files. No run manifest is
+uploaded. The durable bundle is never scanned for implicit publication; only
+lanes named by explicit `pipeline.publish.outputs` rules are uploaded.
 
 To intentionally replace the current extraction result, run:
 

docs/roadmap/implementation.md

@@ -114,7 +114,7 @@ During every stage:
 
 ## Stage 1 — Decouple Publish From The Run Manifest
 
-**Status: Pending**
+**Status: Completed**
 
 ### Goal