@@ -1,5 +1,14 @@
 import { spawnSync } from 'node:child_process'
-import { mkdirSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs'
+import {
+  existsSync,
+  mkdirSync,
+  mkdtempSync,
+  readdirSync,
+  readFileSync,
+  rmSync,
+  symlinkSync,
+  writeFileSync,
+} from 'node:fs'
 import { tmpdir } from 'node:os'
 import path from 'node:path'
 import { afterEach, expect, test } from 'vitest'
@@ -58,6 +67,8 @@ afterEach(() => {
 
 test('CLI discovers new APIs, narrows recipe variants to public props and is byte deterministic', () => {
   const root = fixture()
+  expect(run(root, '--check').status).toBe(1)
+  expect(existsSync(path.join(root, 'scripts'))).toBe(false)
   const first = run(root)
   expect(first.status, first.stderr).toBe(0)
   const bytes = readFileSync(path.join(root, artifact), 'utf8')
@@ -73,6 +84,112 @@ test('CLI discovers new APIs, narrows recipe variants to public props and is byt
   expect(readFileSync(path.join(root, artifact), 'utf8')).toBe('{}')
 }, 60_000)
 
+test.each(['file', 'dangling', 'scripts', 'design-conformance'])(
+  'generation rejects a linked %s output boundary without modifying external files',
+  (kind) => {
+    const root = fixture()
+    const external = mkdtempSync(path.join(tmpdir(), 'design-output-target-'))
+    roots.push(external)
+    const sentinel = path.join(external, 'sentinel')
+    writeFileSync(sentinel, 'external bytes must survive')
+    if (kind === 'file' || kind === 'dangling') {
+      mkdirSync(path.dirname(path.join(root, artifact)), { recursive: true })
+      symlinkSync(
+        kind === 'file' ? sentinel : path.join(external, 'missing'),
+        path.join(root, artifact)
+      )
+    } else {
+      const parent = kind === 'scripts' ? 'scripts' : path.dirname(artifact)
+      mkdirSync(path.dirname(path.join(root, parent)), { recursive: true })
+      symlinkSync(external, path.join(root, parent), 'dir')
+    }
+    const child = run(root)
+    expect(readFileSync(sentinel, 'utf8')).toBe('external bytes must survive')
+    expect(readdirSync(external)).toEqual(['sentinel'])
+    expect(child.status, child.stderr).toBe(2)
+    expect(run(root, '--check').status).toBe(2)
+    expect(readdirSync(external)).toEqual(['sentinel'])
+  },
+  60_000
+)
+
+test.each(['symlink', 'fifo', 'nonregular', 'invalid-descriptor'])(
+  'generation refuses an output changed to %s at descriptor opening',
+  (kind) => {
+    const root = fixture()
+    const external = mkdtempSync(path.join(tmpdir(), 'design-output-race-'))
+    roots.push(external)
+    const sentinel = path.join(external, 'sentinel')
+    writeFileSync(sentinel, 'external bytes must survive')
+    write(root, artifact, 'existing output must survive validation failure')
+    const output = path.join(root, artifact)
+    const preload = path.join(external, 'replace-output.cjs')
+    const attack =
+      kind === 'symlink'
+        ? `fs.unlinkSync(output);fs.symlinkSync(${JSON.stringify(sentinel)},output);`
+        : kind === 'invalid-descriptor'
+          ? 'const descriptor=open(file,flags,mode);fs.closeSync(descriptor);return descriptor;'
+          : `fs.unlinkSync(output);require('node:child_process').execFileSync('mkfifo',[output]);${kind === 'nonregular' ? 'open(output,fs.constants.O_RDWR|fs.constants.O_NONBLOCK);' : ''}`
+    writeFileSync(
+      preload,
+      `
+const fs=require('node:fs');const requested=${JSON.stringify(output)};const output=fs.realpathSync(requested);const open=fs.openSync;const write=fs.writeFileSync;
+fs.openSync=(file,flags,mode)=>{if((file===output||file===requested)&&(flags&fs.constants.O_WRONLY)){process.stderr.write('Output replacement applied\\n');${attack}}return open(file,flags,mode)};
+fs.writeFileSync=(file,...args)=>{if(file===output||file===requested){const descriptor=fs.openSync(file,fs.constants.O_WRONLY|fs.constants.O_CREAT|fs.constants.O_TRUNC,0o644);try{return write(descriptor,...args)}finally{fs.closeSync(descriptor)}}return write(file,...args)};
+`
+    )
+    const child = spawnSync(
+      bun,
+      ['--no-env-file', '--preload', preload, cli, '--repo', root, '--ref', 'HEAD'],
+      {
+        encoding: 'utf8',
+        timeout: 5000,
+      }
+    )
+    expect(child.stderr).toContain('Output replacement applied')
+    expect(child.status, child.stderr).toBe(2)
+    expect(readFileSync(sentinel, 'utf8')).toBe('external bytes must survive')
+    if (kind === 'invalid-descriptor')
+      expect(readFileSync(output, 'utf8')).toBe('existing output must survive validation failure')
+    if (kind === 'nonregular') expect(child.stderr).toContain('not a regular file')
+  },
+  15_000
+)
+
+test('generation rejects a directory output and preserves immutable checks through a repository alias', () => {
+  const root = fixture()
+  mkdirSync(path.join(root, artifact), { recursive: true })
+  write(root, `${artifact}/sentinel`, 'directory bytes must survive')
+  expect(run(root, '--ref', 'HEAD').status).toBe(2)
+  expect(readFileSync(path.join(root, artifact, 'sentinel'), 'utf8')).toBe(
+    'directory bytes must survive'
+  )
+  rmSync(path.join(root, artifact), { recursive: true })
+  expect(run(root).status).toBe(0)
+  git(root, 'add', '.')
+  git(
+    root,
+    '-c',
+    'user.name=Test',
+    '-c',
+    'user.email=test@example.com',
+    'commit',
+    '-qm',
+    'generated'
+  )
+  const external = mkdtempSync(path.join(tmpdir(), 'design-output-alias-'))
+  roots.push(external)
+  const alias = path.join(external, 'repo')
+  symlinkSync(root, alias, 'dir')
+  expect(run(alias).status).toBe(0)
+  const sentinel = path.join(external, 'sentinel')
+  writeFileSync(sentinel, 'external bytes must survive')
+  rmSync(path.join(root, artifact))
+  symlinkSync(sentinel, path.join(root, artifact))
+  expect(run(alias, '--check', '--ref', 'HEAD').status).toBe(0)
+  expect(readFileSync(sentinel, 'utf8')).toBe('external bytes must survive')
+}, 60_000)
+
 test('nested finite style lookups own only the selected slot chrome', () => {
   const root = fixture()
   write(
 
@@ -1,4 +1,15 @@
-import { mkdirSync, readFileSync, writeFileSync } from 'node:fs'
+import {
+  closeSync,
+  constants,
+  fstatSync,
+  ftruncateSync,
+  lstatSync,
+  mkdirSync,
+  openSync,
+  readFileSync,
+  realpathSync,
+  writeFileSync,
+} from 'node:fs'
 import path from 'node:path'
 import { parseArgs } from 'node:util'
 import {
@@ -8,6 +19,29 @@ import {
 } from '#design-conformance/generated-contracts'
 import { GitSource } from '#design-conformance/worktree-source'
 
+/** Validate each parent before creating descendants; linked parents can redirect missing outputs. */
+function outputParents(repo: string, create = false): string {
+  let parent = repo
+  for (const part of path.dirname(GENERATED_FILE).split('/')) {
+    parent = path.join(parent, part)
+    let stat = lstatSync(parent, { throwIfNoEntry: false })
+    if (!stat && create) {
+      mkdirSync(parent)
+      stat = lstatSync(parent)
+    }
+    if (stat && !stat.isDirectory())
+      throw new Error(`Generated output has an unsafe parent directory: ${parent}`)
+  }
+  return path.join(repo, GENERATED_FILE)
+}
+
+/** Preflight before working-tree inventory so unsafe outputs are never read as source inputs. */
+function checkedOutput(repo: string): void {
+  const output = outputParents(repo)
+  const stat = lstatSync(output, { throwIfNoEntry: false })
+  if (stat && !stat.isFile()) throw new Error('Generated output is not a regular file')
+}
+
 export async function main(argv = process.argv.slice(2)): Promise<number> {
   try {
     const { values } = parseArgs({
@@ -20,30 +54,57 @@ export async function main(argv = process.argv.slice(2)): Promise<number> {
       },
     })
     const start = performance.now()
-    const source = new GitSource(values.repo, values.ref ?? 'HEAD', !values.ref)
+    const repo = realpathSync(values.repo)
+    if (!values.check || !values.ref) checkedOutput(repo)
+    const source = new GitSource(repo, values.ref ?? 'HEAD', !values.ref)
     const generated = await generateContracts(source.central())
     source.assertUnchanged()
-    const output = path.join(values.repo, GENERATED_FILE)
+    const output = path.join(source.repo, GENERATED_FILE)
     const bytes = generatedBytes(generated)
     if (values.check) {
       let actual: string | undefined
       try {
         const entry = source.entries.find((e) => e.path === GENERATED_FILE)
-        actual = values.ref
-          ? entry
-            ? source.read(entry)
-            : undefined
-          : readFileSync(output, 'utf8')
-      } catch {}
+        if (values.ref) actual = entry ? source.read(entry) : undefined
+        else {
+          const descriptor = openSync(
+            output,
+            constants.O_RDONLY | constants.O_NOFOLLOW | constants.O_NONBLOCK
+          )
+          try {
+            if (!fstatSync(descriptor).isFile())
+              throw new Error('Generated output is not a regular file')
+            outputParents(source.repo)
+            actual = readFileSync(descriptor, 'utf8')
+          } finally {
+            closeSync(descriptor)
+          }
+        }
+      } catch {
+        actual = undefined
+      }
       if (actual !== bytes) {
         process.stderr.write(
           'Design infrastructure is missing, malformed or stale. Run bun run design:generate and commit contracts.generated.json.\n'
         )
         return 1
       }
     } else {
-      mkdirSync(path.dirname(output), { recursive: true })
-      writeFileSync(output, bytes)
+      outputParents(source.repo, true)
+      const descriptor = openSync(
+        output,
+        constants.O_WRONLY | constants.O_CREAT | constants.O_NOFOLLOW | constants.O_NONBLOCK,
+        0o644
+      )
+      try {
+        if (!fstatSync(descriptor).isFile())
+          throw new Error('Generated output is not a regular file')
+        outputParents(source.repo)
+        ftruncateSync(descriptor, 0)
+        writeFileSync(descriptor, bytes)
+      } finally {
+        closeSync(descriptor)
+      }
     }
     process.stdout.write(
       `${values.check ? 'Verified' : 'Generated'} ${Object.keys(generated.exports).length} exports, ${Object.keys(generated.recipes).length} recipes, ${Object.keys(generated.tokens).length} tokens, ${generated.diagnostics.length} diagnostics; ${Buffer.byteLength(bytes)} bytes; ${Math.round(performance.now() - start)}ms; ${process.resourceUsage().maxRSS} KiB max RSS\n`