Separating who originates content from what gets distributed holds only if distribution is gated on an exact, attested source. "Any newer state" is an open gate. The contract is a pinned hash, and moving it is a reviewed event.
A publishing lane that reads "the current substrate" has no gate. It distributes whatever the upstream happens to contain at fetch time, including a mistake merged a minute ago. Decoupling origination from distribution is safe only when distribution names the exact source it trusts — a pinned hash, file by file — rather than tracking a moving head.
Gated substrate means the lane consumes a specific attested state, and a change to that pin is a deliberate, reviewed event, not a side effect of upstream activity. "Greater than or equal to the last good version" is not a contract; it is a hope. The pin makes distribution refuse anything it was not explicitly told to trust.