Implemented operations helper commands for validation, locking, and status

docs/operations.md

@@ -6,7 +6,7 @@ For field-level configuration, see [docs/config.md](./config.md). For full comma
 
 ## Normal workflow (S3-first path)
 
-1. Upload `session.yml` to the configured session prefix, or pass a local `session.yml` explicitly.
+1. Create or upload `session.yml`, or pass a local `session.yml` explicitly.
 2. Upload session `.flac` files to object storage under the configured session audio prefix.
 3. Run Narratio:
 
@@ -23,6 +23,20 @@ Notes:
 - when local `session.yml` discovery misses, `--session-id` loads remote `session.yml` from `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml`.
 - S3 audio mode requires `session.inputs.audio_s3.prefix` and valid object-store access.
 
+Initialize a remote session skeleton:
+
+```bash
+narratio session init --config /etc/narratio/pipeline.yml --campaign /etc/narratio/campaign.yml --session-id 2026-04-04 --remote
+```
+
+Remote init writes `{root_prefix}/campaigns/{campaign}/sessions/{session_id}/session.yml`. It fails if the object already exists unless `--force` is passed.
+
+Validate before running:
+
+```bash
+narratio session validate --session-id 2026-04-04
+```
+
 ## Restore workflow
 
 Use restore when local durable session state is missing or stale and archive current state is authoritative.
@@ -119,6 +133,7 @@ When archive is enabled and run upload is enabled, archive publishes under:
 Archive uploads:
 - run record files from run root (excluding `audio/`).
 - promoted files from explicit `archive.promote_artifacts` rules.
+- mutable session locks from helper commands live at `{session_prefix}/locks.yml`.
 
 Publish order:
 1. upload `current/manifest.json`
@@ -133,8 +148,17 @@ Archive promotion is explicit and source-based:
 - missing optional promotion sources are skipped.
 - invalid resolved artifacts fail archive stage.
 - `archive.locks` skips top-level promotion overwrites for locked sources while run-local uploads still publish.
+- remote locks from `{session_prefix}/locks.yml` are merged with static `archive.locks`; static locks win on duplicate sources.
 - locked required promotions are treated as intentional successful skips and are recorded in archive metadata.
 
+Lock helper behavior:
+- `narratio locks --session-id <id>` lists effective static and remote locks.
+- `narratio lock <source> --session-id <id> --reason <text>` writes or updates a remote lock.
+- `narratio unlock <source> --session-id <id>` removes only a remote lock.
+- `lock --force` is required to update an existing remote lock reason.
+- `unlock` cannot remove static pipeline locks.
+- remote lock writes check whether the lock store exists, but are not compare-and-swap atomic.
+
 ## Resume, retry, restore, and safe rerun behavior
 
 Default skip:
@@ -191,18 +215,24 @@ Recommended recovery:
 
 1. inspect state:
 
+```bash
+narratio status --session-id 2026-04-04
+```
+
+2. for one manifest file, run:
+
 ```bash
 narratio status --manifest <manifest-path>
 ```
 
-2. for restore-specific checks, run:
+3. for restore-specific checks, run:
 
 ```bash
 narratio restore --session-id 2026-04-04 --dry-run
 ```
 
-3. fix root cause (config/input/credentials/storage/service availability).
-4. continue with `resume`, or targeted `run-stage --force` followed by `resume`.
+4. fix root cause (config/input/credentials/storage/service availability).
+5. continue with `resume`, or targeted `run-stage --force` followed by `resume`.
 
 ## Restore report
 
@@ -219,7 +249,8 @@ Dry-run does not write restore report files.
 
 ## Operational caveats
 
-- `status` requires explicit `--manifest`; there is no session-id lookup command.
+- `status` with no config/session flags still requires explicit `--manifest`.
+- `status --session-id <id>` uses normal config/session loading, including remote session fallback.
 - local and S3 audio input modes are mutually exclusive.
 - archive publish requires upstream stages through `analyze` to be `succeeded`.
 - required promotion rules can fail when selected analyze artifacts did not generate a required file path.