Persist retryable post-publish cleanup obligations

docs/internal/stage-publish.md

@@ -59,6 +59,7 @@ Includes counts/lists for:
 - skipped unselected outputs
 - locked outputs
 - remote commit and current-pointer key paths
+- the run identifier selected by the commit
 
 ## Invariants
 
@@ -72,6 +73,8 @@ Includes counts/lists for:
   archived only when recorded by the run manifest.
 - publish locks are not overridden by `--force`; remote locks are revalidated
   immediately before current-state selection.
+- post-commit local cleanup is authorized by the committed publish metadata and
+  is durably recorded by the application lifecycle before any local deletion.
 
 The commit boundary and cleanup gate are normative architecture invariants; see
 [Architecture](../policy/architecture.md#publish-commit-boundary).