Publish immutable remote commits

docs/internal/artifacts.md

@@ -102,10 +102,9 @@ restore, status and validation checks, and previous-cache planning.
 
 Core helpers:
 
-- `LoadCurrentRunPointer`
-- `LoadCurrentManifest`
 - `LoadCurrentState`
 - `ValidateCurrentStateIdentity`
+- `RemoteCommitManifest` and `CurrentCommitPointer`
 
 Typed missing-state errors:
 
@@ -133,6 +132,12 @@ Caller policy is intentionally outside artifacts helpers:
 - spool/cache paths;
 - S3 session/run/current-state key layout.
 
+New publication creates run-scoped immutable objects, including
+`runs/{run_id}/commit.json` and `runs/{run_id}/session-manifest.json`. The sole
+mutable selector is `current/commit-pointer.json`; readers verify its selected
+commit and declared object generations/checksums. Legacy current-pair loading
+is confined to `current_state_legacy.go` for migration only.
+
 Campaign, session, and Narratio run IDs are validated as portable opaque
 segments at configuration and artifact boundaries before they can be used in a
 workspace or S3 namespace. Previous-artifact destinations remain typed,

docs/internal/stage-publish.md

@@ -16,8 +16,8 @@ Upload run/session outputs to object storage and atomically advance remote curre
 
 - uploaded invocation record and selected publish outputs;
 - uploaded durable previous-session cache files when present;
-- updated remote current manifest; and
-- remote current-run commit marker, written last.
+- immutable run-scoped commit manifest; and
+- current commit pointer, written last.
 
 Exact remote placement and the operator workflow belong in
 [Operations](../operations.md#publish-workflow).
@@ -40,7 +40,10 @@ Exact remote placement and the operator workflow belong in
 - selected artifact filter applies to configured artifact sources only.
 - locked outputs are skipped intentionally (including required ones).
 - optional missing outputs are skipped; required missing unlocked outputs fail.
-- writes remote current manifest before current run pointer.
+- creates one complete immutable source-to-destination mapping before upload;
+- uploads and verifies every declared immutable object and the commit manifest;
+- updates `current/commit-pointer.json` exactly once, last; and
+- does not write the legacy `current/manifest.json` or `current/run_id.txt` pair.
 
 ## Metadata Signals
 
@@ -51,12 +54,13 @@ Includes counts/lists for:
 - skipped optional outputs
 - skipped unselected outputs
 - locked outputs
-- current-state key paths
-- `current_pointer_written`
+- remote commit and current-pointer key paths
 
 ## Invariants
 
-- `current/run_id.txt` is the remote commit marker and is written last.
+- `current/commit-pointer.json` is the remote commit marker and is written last.
+- run files, selected outputs, previous-cache files, and the committed session
+  manifest are all declared by an immutable commit under the run prefix.
 - run and previous uploads contain only manifest-declared regular files opened
   from verified descriptors; symlinks, special files, replacement races, and
   undeclared entries are rejected or ignored before uploads begin.

docs/internal/workspace.md

@@ -55,7 +55,8 @@ lock only while their context remains active, and report a release failure.
 Automatic post-publish cleanup:
 
 - only runs when publish actually executed and succeeded;
-- requires `uploaded=true` and `current_pointer_written=true` metadata;
+- requires `uploaded=true`, a remote commit key, and a current commit-pointer
+  key in publish metadata;
 - consumes the resolved cleanup policy described in
   [Configuration](../config.md);
 - refuses unsafe deletes (root delete, out-of-root delete, and symlinked