Complete stateless execution remediation

docs/policy/architecture.md

@@ -17,9 +17,10 @@ uploaded through Distributor.
 
 The supported report products are Daily, Today, Tomorrow, and Hourly. A batch
 collects once, validates its complete candidate prompt/profile set before
-collection, then executes planned reports sequentially with one executor. It
-continues after independent report failures and sends a batch notification only
-after every planned report succeeds.
+collection, then determines and validates every planned output destination
+before executing reports sequentially with one executor. It continues after
+independent report failures and sends a batch notification only after every
+planned report succeeds.
 
 ## Ownership And Boundaries
 
@@ -58,11 +59,14 @@ directly.
   text, and render context in memory and creates no application-owned durable
   state.
 - Markdown writes are atomic at an operator-selected destination. A
-  pre-publication failure does not replace an existing destination; a
-  notification failure does not remove a newly published output.
+  pre-publication failure, including cancellation observed immediately before
+  publication, does not replace an existing destination; a notification failure
+  does not remove a newly published output.
 - Distributor uploads use only the published Markdown output, never a scan of
   local files. Single notification follows publication; batch notification
-  follows publication of every selected report.
+  follows publication of every selected report. Batch counters describe report
+  outcomes only; a failed batch notification is represented separately at the
+  batch level.
 - Default tests are deterministic, offline, and use Promptkit/provider fakes
   rather than live provider calls. See the [testing policy](testing.md).