Validate downloads before installing workspace files

internal/audio/s3_audio_test.go

@@ -288,6 +288,30 @@ func TestMaterializeS3AudioDownloadFailureLeavesDestinationMissing(t *testing.T)
 	assertMissing(t, req.DestPath)
 }
 
+func TestMaterializeS3AudioRejectsSizeMismatchBeforeReplacingSpool(t *testing.T) {
+	root := t.TempDir()
+	fake := &storage.FakeBackend{}
+	key := "dnd/campaigns/forsaken/sessions/2026-04-19/audio/alice.flac"
+	fake.SeedObject(storage.FakeObject{Key: key, Data: []byte("audio")})
+	req := testMaterializeRequest(t, root, fake, key, int64(len("audio")+1))
+	writeAudioTestFile(t, req.SpoolPath, "existing-audio")
+
+	_, err := MaterializeS3Audio(context.Background(), req)
+	if err == nil || !strings.Contains(err.Error(), "size") {
+		t.Fatalf("error = %v, want size validation failure", err)
+	}
+	assertFileEquals(t, req.SpoolPath, "existing-audio")
+	entries, err := os.ReadDir(filepath.Dir(req.SpoolPath))
+	if err != nil {
+		t.Fatalf("read spool directory: %v", err)
+	}
+	for _, entry := range entries {
+		if strings.HasPrefix(entry.Name(), ".alice.flac.tmp-") {
+			t.Fatalf("unexpected temporary file residue: %q", entry.Name())
+		}
+	}
+}
+
 func testMaterializeRequest(t *testing.T, root string, fake *storage.FakeBackend, key string, size int64) S3MaterializeRequest {
 	t.Helper()
 	return S3MaterializeRequest{