Model publish output outcomes

docs/internal/stage-publish.md

@@ -33,7 +33,8 @@ and optional rules, destination resolution, and collision inputs live in
 `publish_outputs.go`. Copying, hashing, immutable upload, reuse checks, and
 remote verification live in `publish_transfer.go`; committed-manifest,
 immutable-commit, and current-pointer encoding and writes live in
-`publish_commit.go`.
+`publish_commit.go`. `publish_output_plan.go` owns the deterministic, I/O-free
+five-outcome model and its secret-free metadata projection.
 
 - when publishing or run upload is disabled, completes successfully with no
   outputs and records explanatory metadata. This is not an explicit self-skip:
@@ -125,6 +126,7 @@ The commit boundary and cleanup gate are normative architecture invariants; see
   helpers.
 - Implementation and tests: `internal/stage/publish.go`,
   `internal/stage/publish_sources.go`, `internal/stage/publish_outputs.go`,
+  `internal/stage/publish_output_plan.go`,
   `internal/stage/publish_transfer.go`, `internal/stage/publish_commit.go`,
   `internal/stage/publish_test.go`,
   `internal/stage/semantic_contracts_delivery.go`,