Make debug evidence opt-in and retain all candidates

internal/core/diagnostics/output_session_test.go

@@ -199,3 +199,30 @@ func TestFinalizationCollectsFailuresAndRetainsPublishedTranscript(t *testing.T)
 		}
 	}
 }
+
+func TestDebugRunDirectoryUsesSuppliedIDAndIsRetained(t *testing.T) {
+	parent := filepath.Join(t.TempDir(), "debug")
+	if _, err := os.Stat(parent); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("unexpected parent: %v", err)
+	}
+	run, err := NewRunDirectory(parent, "run-123", "secret")
+	if err != nil {
+		t.Fatal(err)
+	}
+	if run.Path() != filepath.Join(parent, "run-123") {
+		t.Fatalf("run ID changed: %s", run.Path())
+	}
+	if _, err := NewRunDirectory(parent, "run-123"); err == nil {
+		t.Fatal("duplicate run ID accepted")
+	}
+	if err := run.WriteJSONArtifact(ArtifactCorrectionLedger, map[string]string{"proposal": "secret"}); err != nil {
+		t.Fatal(err)
+	}
+	contents, err := os.ReadFile(filepath.Join(run.Path(), ArtifactCorrectionLedger))
+	if err != nil || strings.Contains(string(contents), "secret") {
+		t.Fatalf("debug artifact: %s %v", contents, err)
+	}
+	if _, err := os.Stat(run.Path()); err != nil {
+		t.Fatalf("debug directory removed: %v", err)
+	}
+}