Fence provisional writes against durable terminal state
When an asynchronous publisher offloads storage to a worker thread, cancelling its task does not cancel a database request already in flight. Stop the publisher before saving the authoritative final state, and make every provisional write conditional on the durable record still b…