feat(datasources): publish durable artifact outputs

docs/QUALITY_POLICY.md

@@ -96,6 +96,26 @@ This makes concurrent retries from separate API or worker nodes converge on the
 same publication and materialization rather than relying on a late uniqueness
 failure after output rows have already been persisted.
 
+## Durable artifact publications
+
+Outputs larger than the inline row and byte limits use an immutable artifact
+reference. The reference pins its backend and locator together with SHA-256
+checksum, schema, datasource fingerprint, row count, byte count, media type,
+and optional resume checkpoint. Datasources persists that reference as the
+materialization payload and asks the installed Core-contract artifact backend
+to verify it before creating catalogue state. Reads remain bounded and are
+re-authorized by Datasources before reaching the backend.
+
+Schema rules are evaluated by Datasources. Content-level rules such as
+uniqueness or range require producer evidence bound to the exact payload
+checksum and current quality-policy hash, including all evaluated rule IDs.
+Missing or explicitly deferred evidence produces a `review_required`
+publication and an immutable, addressable materialization, but it does not
+replace the Datasource's current state. Valid warnings produce
+`published_with_warnings`; failed evidence blocks the publication without a
+catalogue side effect. These terminal states are preserved for Dataflow and
+Workflow handoffs instead of being collapsed into generic success.
+
 Approval authority, approval expiry, and retention/deletion execution remain
 separate work under `govoplan-datasources#2`. Until those contracts are added,
 no JSON flag is treated as an approval and no stage is deleted automatically.