Make remote publish locks generation-safe

docs/policy/architecture.md

@@ -173,7 +173,9 @@ the immutable commit manifest, and finally the current commit pointer.
 `current/commit-pointer.json` is the sole mutable selector and must be written
 exactly once, last. Failed, incomplete, skipped, or uncommitted publish attempts
 must not be presented as current remote state. Publish locks remain authoritative
-and are not bypassed by a forced run.
+and are not bypassed by a forced run. Mutable remote locks use provider-enforced
+generation preconditions and are revalidated immediately before pointer
+selection; loss of that check leaves the prior committed snapshot current.
 
 Automatic local cleanup is permitted only after a successful publish commit,
 only when explicitly configured, and only through the path-safety guardrails.