We now document that Session.lock() accepts a managed instance. Historically, lock() could be used to reassociate a detached instance, so that’s why there is an overloaded version which accepts an entity name. Since that’s no longer relevant, we should have deprecated that overload in 6.0, but I missed it.