fix: address independent review findings

docs/ARCHITECTURE.md

@@ -49,8 +49,9 @@ Work packages move through:
 
 `HOLD` leaves a reviewed package in `REVIEWED`. A new review can be requested
 after a completed review. This MVP treats corrections after
-`CHANGES_REQUESTED` as a new work package or a new explicitly governed
-iteration; it does not silently overwrite submitted result evidence.
+`CHANGES_REQUESTED` as a new work package. It does not support replacing the
+result on the reviewed work package and never silently overwrites submitted
+result evidence.
 
 ## Trust boundaries
 
@@ -58,4 +59,3 @@ iteration; it does not silently overwrite submitted result evidence.
 - The database is trusted to enforce integrity and append-only triggers.
 - Artifact URIs and commit hashes are references, not trusted content.
 - Reverse proxy identity headers are not consumed by the built-in adapter.
-