Persist retryable post-publish cleanup obligations

internal/app/runner.go

@@ -376,12 +376,6 @@ func executeStages(ctx context.Context, cfg *config.Config, stages []stage.Stage
 		env.Logger.Info("stage succeeded", "stage", s.Name())
 	}
 
-	if err := runPostPublishCleanup(ctx, env, manifestPath, m, executed); err != nil {
-		return nil, persistTerminalFailure(
-			ctx, env.ManifestStore, manifestPath, m, runManifestStore, runManifestPath, runManifest,
-			fmt.Errorf("post-publish cleanup: %w", err),
-		)
-	}
 	completedAt := nowUTC()
 	runManifest.MarkSucceeded(completedAt)
 	identity.applyToRunManifest(runManifest, manifestPath)
@@ -391,6 +385,15 @@ func executeStages(ctx context.Context, cfg *config.Config, stages []stage.Stage
 			fmt.Errorf("save final run manifest %q: %w", runManifestPath, err),
 		)
 	}
+	// The run record lives inside the run work directory, which cleanup may
+	// remove. Persist its completed publishing result before cleanup starts so a
+	// successful deletion cannot be undone by a later diagnostic write.
+	if err := runPostPublishCleanup(ctx, env, manifestPath, m, executed); err != nil {
+		return nil, persistPostPublishCleanupFailure(
+			ctx, env.ManifestStore, manifestPath, m,
+			fmt.Errorf("post-publish cleanup incomplete: %w", err),
+		)
+	}
 
 	return &RunSummary{
 		SessionID:       cfg.Session.SessionID,
@@ -403,6 +406,27 @@ func executeStages(ctx context.Context, cfg *config.Config, stages []stage.Stage
 	}, nil
 }
 
+func persistPostPublishCleanupFailure(
+	ctx context.Context,
+	sessionStore manifest.Store,
+	sessionManifestPath string,
+	sessionManifest *manifest.Manifest,
+	operationErr error,
+) error {
+	if operationErr == nil {
+		return nil
+	}
+	if sessionManifest != nil {
+		sessionManifest.RecordFailure(nowUTC(), operationErr.Error())
+	}
+	// Do not rewrite the run manifest here: cleanup may have deliberately
+	// removed the directory that contains it. The completed run record remains
+	// the authoritative evidence of the remote publish; the session manifest
+	// records the outstanding local cleanup for the next invocation.
+	sessionErr := sessionStore.Save(ctx, sessionManifestPath, sessionManifest)
+	return errors.Join(operationErr, wrapTerminalPersistenceError("save terminal session manifest", sessionErr))
+}
+
 func persistTerminalFailure(
 	ctx context.Context,
 	sessionStore manifest.Store,