Integrate cleanup into pipeline execution

docs/operations.md

@@ -98,6 +98,7 @@ Canonical stage order:
 9. `analyze`
 10. `publish`
 11. `notify`
+12. `cleanup`
 
 Execution rules:
 
@@ -154,7 +155,7 @@ narratio run 2026-04-04 --from extract --through analyze --force
 ```
 
 Omitting `--from` selects from `prepare`; omitting `--through` selects through
-`notify`. Force applies only within the selected range. Repeating `--from`,
+`cleanup`. Force applies only within the selected range. Repeating `--from`,
 `--through`, or `--force` is rejected instead of resolving by argument order.
 The plan command uses the same selection contract and prints only the selected
 range. Planning is read-only: it clones the loaded manifest, models selected
@@ -194,8 +195,8 @@ This command is a transparent expansion to a forced bounded `run` from
 `extract` through `analyze`. Extraction always rebuilds its complete configured
 bundle. Analysis rebuilds the selected targets and their required analysis
 prerequisites, or uses the normal default selection when no artifact names are
-given. The command does not run publish or notify; delivery remains a separate
-operator action.
+given. The command does not run publish, notify, or cleanup; delivery and
+retention remain separate operator actions.
 
 Inspect current artifact evidence, then publish explicitly when the regenerated
 set is ready:
@@ -365,6 +366,9 @@ Equivalent:
 narratio run-stage publish 2026-04-04 --force
 ```
 
+This standalone command stops after publish and does not invoke cleanup. A
+default full `run` continues through notify and cleanup.
+
 Publish commit model:
 
 - uploads eligible run files under `{session_prefix}/runs/{run_id}/`, excluding
@@ -591,16 +595,20 @@ Rules:
 - cache is preserved unless `--clear-cache` is set;
 - each deletion is confined beneath its configured workspace, spool, or cache
   root; root, traversal, and out-of-root targets are refused;
-- automatic post-publish cleanup is gated by successful publish commit plus:
+- the final cleanup stage is gated by successful publish evidence plus:
   - `pipeline.spool.delete_audio_after_publish=true`
   - `pipeline.workspace.cleanup_after_publish=true`
-  - Narratio first records the exact run-scoped cleanup obligation. If cleanup
-    reports incomplete, the remote committed snapshot remains current; rerun
-    publish to retry only the outstanding confined local cleanup.
+  - the manifest publish record has `uploaded=true`, the published run ID, the
+    exact remote commit key, and the current commit-pointer key.
 
-Post-publish cleanup is evaluated only when `publish` actually executes in the
-current invocation. A bounded range that excludes publish does not replay a
-cleanup obligation as an unrelated side effect.
+Cleanup derives only the configured run-scoped spool and workspace targets,
+uses root-confined deletion, and does not read or mutate object storage. A
+failure leaves publish succeeded and the remote committed snapshot current.
+Retry with a normal full run: valid upstream work, including publish and notify,
+is skipped while the failed cleanup stage runs again. `run-stage cleanup` is
+also available when the manifest has valid publish evidence. A range ending at
+`notify` or earlier and the standalone `publish` command never delete local
+state.
 
 ## Operational Caveats