Function publish 

pub fn publish(
    root: &Path,
    how: &Publish<'_>,
    notes_ref: &str,
    items: &[(String, String)],
    log: &mut Vec<String>,
) -> Published

Attach each (object, block) on the REMOTE’s copy of notes_ref (short name, under refs/notes/) and push. Never notes add -f, which erases every other producer’s block, and never a push of the local ref, which would re-publish a block origin revoked:

1. fetch the remote’s ref into a temporary ref;
2. append each block that is not already there (ed25519 signatures are deterministic, so a re-run produces the same bytes);
3. push the temporary ref; a lost race goes back to 1.

After a push to origin the local ref is set to what was published; another remote’s content never enters it. The temporary ref is removed on every path. log gets one line per retry or refusal, credentials in a remote URL removed.