Complete downstream semantic resume coverage

docs/internal/stage-publish.md

@@ -27,8 +27,8 @@ Exact remote placement and the operator workflow belong in
 
 - when publishing or run upload is disabled, completes successfully with no
   outputs and records explanatory metadata. This is not an explicit self-skip:
-  both manifests record success, and an ordinary later run reuses that result
-  until publish is forced.
+  both manifests record success. Enablement and upload policy are fingerprinted,
+  so changing either automatically makes the prior result non-resumable.
 - validates prerequisite stage success and object-store availability.
 - derives a deterministic run-archive allowlist from the validated run
   `manifest.json`: declared run-local outputs, logs, generated configs, and the
@@ -89,6 +89,16 @@ Includes counts/lists for:
 - post-commit local cleanup is authorized by the committed publish metadata and
   is durably recorded by the application lifecycle before any local deletion.
 
+## Resume Semantics
+
+The versioned semantic fingerprint covers enabled behavior, run-upload policy,
+normalized source/destination/required output rules, static lock policy, and
+the remote backend, bucket, region, endpoint, and root-prefix identity. Rule
+and lock ordering is canonicalized. Credential environment names,
+path-addressing transport mode, local workspace placement, and run identifiers
+are excluded. Remote locks remain mutable state and are still revalidated at
+the commit boundary; semantic evidence does not replace that safety check.
+
 The commit boundary and cleanup gate are normative architecture invariants; see
 [Architecture](../policy/architecture.md#publish-commit-boundary).
 
@@ -101,5 +111,7 @@ The commit boundary and cleanup gate are normative architecture invariants; see
 - [Artifact Internals](artifacts.md) explains source resolution and current-state
   helpers.
 - Implementation and tests: `internal/stage/publish.go`,
-  `internal/stage/publish_test.go`, `internal/app/operator_helpers_test.go`,
+  `internal/stage/publish_test.go`,
+  `internal/stage/semantic_contracts_delivery.go`,
+  `internal/app/operator_helpers_test.go`, and
   `internal/app/post_publish_cleanup_test.go`