Confine local file installation paths

docs/internal/fileops.md

@@ -4,6 +4,20 @@
 byte file. Callers keep ownership of serialization, validation, cancellation,
 and destination-directory policy.
 
+## Destination Confinement
+
+Before it creates, replaces, or installs a destination file, `fileops` opens
+each ancestor from the filesystem root and rejects symbolic links or components
+that change during traversal. The resulting parent-directory handle is retained
+for sibling temporary-file creation and rename, so a later pathname swap cannot
+redirect the replacement. Existing destination symlinks are replaced as leaf
+entries; their targets are never followed.
+
+Remote object acquisition uses a writer supplied by the storage owner. The
+writer receives a `fileops`-owned, already-open sibling temporary file rather
+than a mutable destination path. Callers still own remote object selection,
+validation, conflict handling, and final mode.
+
 ## Replacement Contract
 
 `ReplaceFileAtomic` requires an existing destination directory. It creates a

docs/roadmap/implementation.md

@@ -19,7 +19,7 @@ All stages are pending when this plan is created.
 | 1 | Align data classification and group workspace modes | RSK-004 | Completed |
 | 2 | Enforce safe identifiers and fuzz path/source contracts | COR-002, TST-013 | Completed |
 | 3 | Consolidate crash-durable atomic file replacement | RSK-002, DUP-001, DUP-005 | Completed |
-| 4 | Add confined destination and download/install capabilities | COR-003, DUP-003, TST-003 | Pending |
+| 4 | Add confined destination and download/install capabilities | COR-003, DUP-003, TST-003 | Completed |
 | 5 | Confine recursive cleanup and replace sentinel locks | RSK-003 | Pending |
 | 6 | Harden API-key file acquisition | RSK-010 | Pending |
 | 7 | Bound and verify external result acquisition | RSK-013, TST-007 | Pending |