Harden report output publication

docs/policy/architecture.md

@@ -72,6 +72,9 @@ directly.
   pre-publication failure, including cancellation observed immediately before
   publication, does not replace an existing destination; a notification failure
   does not remove a newly published output.
+- A single-report final destination is either absent or a regular file.
+  Symlinks and special filesystem objects are rejected during preflight and
+  rechecked immediately before the atomic replacement.
 - Configuration or explicit CLI input selects that operator-owned destination;
   it does not create an application-owned state boundary.
 - Comparison bundles are flat, versioned operator outputs. Their guarded