Make atomic file replacement crash durable

internal/manifest/store_test.go

@@ -3,6 +3,7 @@ package manifest
 import (
 	"context"
 	"encoding/json"
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -205,6 +206,30 @@ func TestLocalStoreSaveAtomicPractical(t *testing.T) {
 	}
 }
 
+func TestWriteJSONAtomicallyChecksCancellationBeforeReplacement(t *testing.T) {
+	ctx, cancel := context.WithCancel(context.Background())
+	cancel()
+
+	dir := t.TempDir()
+	path := filepath.Join(dir, "manifest.json")
+	err := writeJSONAtomically(ctx, path, []byte("{\"session_id\":\"session\"}\n"))
+	if !errors.Is(err, context.Canceled) {
+		t.Fatalf("writeJSONAtomically() error = %v, want context cancellation", err)
+	}
+	if _, err := os.Stat(path); !os.IsNotExist(err) {
+		t.Fatalf("replacement destination exists after cancellation: stat err = %v", err)
+	}
+	entries, err := os.ReadDir(dir)
+	if err != nil {
+		t.Fatalf("ReadDir() error = %v", err)
+	}
+	for _, entry := range entries {
+		if strings.HasPrefix(entry.Name(), ".manifest.json.tmp-") {
+			t.Fatalf("temporary manifest remained after cancellation: %s", entry.Name())
+		}
+	}
+}
+
 func TestLoadRejectsInvalidManifest(t *testing.T) {
 	store := &LocalStore{}
 	ctx := context.Background()