Verify the integrated resilient processing contract

internal/core/diagnostics/output_session_test.go

@@ -83,6 +83,26 @@ func TestPrepareOutputPreservesExistingTranscriptAndChecksParent(t *testing.T) {
 	}
 }
 
+func TestAtomicReplacementCleansTemporaryFileAfterRenameFailure(t *testing.T) {
+	dir := t.TempDir()
+	blocked := filepath.Join(dir, "directory-target")
+	if err := os.Mkdir(blocked, 0700); err != nil {
+		t.Fatal(err)
+	}
+	if err := atomicReplace(blocked, []byte("new content")); err == nil {
+		t.Fatal("directory replacement unexpectedly succeeded")
+	}
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatal(err)
+	}
+	for _, entry := range entries {
+		if strings.HasPrefix(entry.Name(), ".audita-write-") {
+			t.Fatalf("replacement left temporary file: %s", entry.Name())
+		}
+	}
+}
+
 func TestDisabledReportingIgnoresUnusableDirectory(t *testing.T) {
 	dir := t.TempDir()
 	session, err := PrepareOutput(OutputSelection{TranscriptPath: filepath.Join(dir, "out.json"), ReportDir: filepath.Join(dir, "missing"), ReportingEnabled: false})