Cover bounded reads and cancelled replacements

internal/fileops/fileops_test.go

@@ -3,6 +3,7 @@ package fileops
 import (
 	"crypto/sha256"
 	"encoding/hex"
+	"errors"
 	"os"
 	"path/filepath"
 	"strings"
@@ -45,6 +46,33 @@ func TestWriteFileAtomicCleansTempFileOnInstallFailure(t *testing.T) {
 	assertNoMatchingTempFiles(t, root, ".blocked.tmp-")
 }
 
+func TestReplaceFileAtomicCancellationPreservesDestinationAndCleansTemp(t *testing.T) {
+	root := t.TempDir()
+	dst := filepath.Join(root, "value.txt")
+	if err := os.WriteFile(dst, []byte("old"), 0o644); err != nil {
+		t.Fatalf("WriteFile(destination) error = %v", err)
+	}
+	wantErr := errors.New("cancel replacement")
+
+	err := ReplaceFileAtomic(dst, []byte("new"), ReplaceFileOptions{
+		Mode: WorkspaceFileMode,
+		BeforeRename: func() error {
+			return wantErr
+		},
+	})
+	if !errors.Is(err, wantErr) {
+		t.Fatalf("ReplaceFileAtomic() error = %v, want wrapped cancellation", err)
+	}
+	data, err := os.ReadFile(dst)
+	if err != nil {
+		t.Fatalf("ReadFile(destination) error = %v", err)
+	}
+	if string(data) != "old" {
+		t.Fatalf("destination content = %q, want old content", data)
+	}
+	assertNoMatchingTempFiles(t, root, ".value.txt.tmp-")
+}
+
 func TestCopyFileAtomicWithChecksumMatchesDestination(t *testing.T) {
 	root := t.TempDir()
 	src := filepath.Join(root, "source.txt")