Make remote publish locks generation-safe

docs/internal/stage-publish.md

@@ -9,7 +9,8 @@ Upload run/session outputs to object storage and atomically advance remote curre
 - successful preceding stages from the [canonical stage set](overview.md#pipeline-stage-set)
 - invocation-scoped run files
 - resolved publish output rules
-- effective publish locks (static + remote merged lock set)
+- effective publish locks (static + remote merged lock set), revalidated at the
+  remote commit boundary
 - durable previous-session cache files when present
 
 ## Outputs
@@ -44,6 +45,9 @@ Exact remote placement and the operator workflow belong in
 - uploads and verifies every declared immutable object and the commit manifest;
 - updates `current/commit-pointer.json` exactly once, last; and
 - does not write the legacy `current/manifest.json` or `current/run_id.txt` pair.
+- rechecks remote lock state immediately before the pointer update. A newly
+  committed lock aborts selection, leaving any uploaded immutable attempt
+  unselected.
 
 ## Metadata Signals
 
@@ -66,7 +70,8 @@ Includes counts/lists for:
   undeclared entries are rejected or ignored before uploads begin.
 - run-local diagnostics, including Notarius receipt and stderr files, are
   archived only when recorded by the run manifest.
-- publish locks are not overridden by `--force`.
+- publish locks are not overridden by `--force`; remote locks are revalidated
+  immediately before current-state selection.
 
 The commit boundary and cleanup gate are normative architecture invariants; see
 [Architecture](../policy/architecture.md#publish-commit-boundary).