Expand family publish policies into concrete rules

docs/config.md

@@ -439,7 +439,7 @@ For each `pipeline.scriptorium.artifact_families.<name>`:
 | `output_path_pattern` | string | Yes | safe path beneath `artifacts/` with exactly one `{character_id}` token and no other brace syntax |
 | `member_vars` | map | No | maps an ordinary Scriptorium variable name to a supported canonical character selector |
 | `member_dependencies` | list | No | unique family keys; each generated member depends on the corresponding generated member of each listed family |
-| `publish` | map | No | typed family publish metadata (`enabled`, `required`, `dest_pattern`); it does not yet create publish outputs |
+| `publish` | map | No | typed family publish policy (`enabled`, `required`, `dest_pattern`) expanded into concrete publish outputs when enabled |
 
 Generated keys are `<family>_<character_id>` and generated output paths must
 not collide with explicit artifacts or another generated artifact. Families

docs/internal/artifacts.md

@@ -64,6 +64,8 @@ Configuration may normalize a family selection into its concrete generated
 members before this resolver runs. The effective set retains optional family
 and character origin metadata, but its keys, catalog sources, and runtime
 lookups remain concrete configured-artifact identities.
+Family publish policies are likewise expanded into ordinary configured-source
+publish rules during configuration resolution.
 Configured outputs, including non-executable prerequisites, become available
 only when the versioned analyze state identifies a current result whose source,
 contract, canonical configured path, size, and checksum match a confined

docs/internal/configuration.md

@@ -134,4 +134,6 @@ the family-only `narratio.member_artifact.<family>` input form is rewritten to
 the matching ordinary configured-artifact source. The catalog records those
 resolved dependency and input identities with their declaring family and party
 member. No member-artifact source is registered as a runtime policy source.
-The typed publish declaration still does not create a publish rule here.
+An enabled family publish declaration expands to ordinary configured-artifact
+publish rules before the existing publish and lock validators run. Runtime
+publication consequently receives no family wildcard or special matcher.

docs/roadmap/implementation.md

@@ -911,7 +911,7 @@ concrete execution, artifact-granular fingerprints, and manifest authority.
 
 ## Stage 16 — Family Publish Rule Expansion
 
-**Status: Pending**
+**Status: Completed**
 
 ### Goal