Report comparison cleanup recovery state

docs/cli.md

@@ -154,16 +154,18 @@ when available. The safe error includes only a category and message: aggregate
 and unclassified application failures use `application`; cancellation uses
 `canceled`; deadlines use `deadline_exceeded`; prompt execution uses its
 published Promptkit category; destination failures use `destination_<kind>`;
-and committed cleanup failures use `publication_cleanup`. It does not expose
+and committed cleanup failures use `publication_cleanup` with a message that
+states whether a complete prior bundle, partial remnants, or no prior bundle
+remains, or that recovery state could not be inspected. It does not expose
 provider diagnostics, filesystem causes, or recovery paths. See the
 [comparison bundle contract](integrations/comparison-bundle.md) for durable
 artifact fields and failure invariants.
 
 If the bundle is published but cleanup of its replaced prior bundle fails, the
 summary still includes the published artifact paths and has status `failed`.
-Its JSON error is `publication_cleanup` with the message `comparison published
-but cleanup did not complete`; the returned command error identifies the
-retained backup path for operator recovery.
+Its JSON error is `publication_cleanup`; the returned command error identifies
+a recovery path only when cleanup left a sibling behind. Only a reported
+complete prior bundle is a rollback artifact.
 
 ## Flag Reference
 

docs/integrations/comparison-bundle.md

@@ -92,6 +92,11 @@ When replacing a recognized bundle, cancellation observed before the new
 bundle is installed preserves the prior bundle rather than committing the
 replacement.
 
+Cleanup of a prior bundle occurs only after its replacement is committed and
+does not affect the new bundle's compatibility. A cleanup error may identify a
+complete recovery bundle, partial remnants, no remaining sibling, or an
+uninspectable state; this operational state is not recorded in the manifest.
+
 The manifest contains safe operational provenance, but `data-package.yml` and
 the generated Markdown can contain sensitive weather or location context. Do
 not assume these artifacts are safe for public distribution. Handle retention,

docs/internal/app-orchestration.md

@@ -56,7 +56,8 @@ When publication has committed its new bundle, application results contain the
 absolute manifest, data-package, and successful report paths even if removal of
 the previous sibling backup then fails. That cleanup failure is still returned
 as an operational error rather than treating the new bundle as unpublished;
-the returned error retains the recovery path and underlying filesystem cause.
+the returned error identifies the observed recovery state and includes a path
+only when cleanup left a sibling behind.
 
 ## Boundaries And Verification
 

docs/internal/comparison-publication.md

@@ -31,9 +31,11 @@ not incorporate its basename.
 The new bundle is committed only after the staged directory has been installed
 at the target. From that point its artifact paths are authoritative: a failure
 to remove the retained sibling backup does not roll back the new bundle.
-Publication returns an inspectable cleanup error with the absolute backup path
-and underlying filesystem cause so an operator can recover or remove that
-backup manually.
+After a cleanup failure, publication inspects the sibling without masking the
+original filesystem cause. Its inspectable cleanup result distinguishes a
+complete recognized recovery bundle, partial remnants, an absent sibling, or
+an uninspectable state. A recovery path is reported only when something
+remains; only a complete recognized bundle is suitable for rollback recovery.
 
 The application preflights before prompt inspection and collection, then
 preflights again before publication. A cancellation or any failure before the

docs/operations.md

@@ -188,10 +188,13 @@ cancellation and pre-publication errors leave the prior destination unchanged.
 
 If a replacement commits but cleanup of its prior sibling backup fails, the new
 bundle remains valid and its artifact paths appear in the failed command
-summary. The summary records a safe `publication_cleanup` error, while the
-returned command error reports the retained backup path. Preserve that backup
-until it has been inspected and cleaned up manually; do not remove the new
-bundle to retry that cleanup.
+summary. The summary records a safe `publication_cleanup` error that indicates
+whether a complete prior bundle remains, only partial remnants remain, or no
+prior bundle remains; it also identifies when the sibling cannot be inspected.
+The returned command error includes a recovery path only when a sibling remains.
+Preserve a complete recognized recovery bundle until it has been inspected and
+cleaned up manually; partial remnants are not a rollback artifact. Do not
+remove the new bundle to retry cleanup.
 
 Enable explicit debug capture only when content-rich Promptkit diagnostics are
 necessary.