Secure prompt debug filesystem writes

internal/promptdebug/debug_writer_test.go

@@ -233,6 +233,48 @@ func TestPromptDebugWriterCreatesSharedMissingAncestorsConcurrently(t *testing.T
 	}
 }
 
+func TestPromptDebugWriterKeepsWritesAnchoredToOpenedRoot(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		t.Skip("directory replacement behavior is covered on Unix hosts")
+	}
+	parent := t.TempDir()
+	root := filepath.Join(parent, "debug")
+	writer, err := NewPromptDebugWriter(root)
+	if err != nil {
+		t.Fatalf("NewPromptDebugWriter() error = %v", err)
+	}
+	defer writer.Close()
+
+	anchoredRoot := filepath.Join(parent, "anchored-debug")
+	outside := filepath.Join(parent, "outside")
+	if err := os.Mkdir(outside, debugDirectoryMode); err != nil {
+		t.Fatalf("create outside directory: %v", err)
+	}
+	if err := os.Rename(root, anchoredRoot); err != nil {
+		t.Fatalf("replace opened root: %v", err)
+	}
+	if err := os.Symlink(outside, root); err != nil {
+		t.Skipf("symlink creation is unavailable: %v", err)
+	}
+
+	ref := promptDebugRef()
+	ref.RunID = "run-anchored"
+	if _, err := writer.WritePreparation(ref, promptDebugPreparationFixture(), nil); err != nil {
+		t.Fatalf("WritePreparation() error = %v", err)
+	}
+	anchoredArtifact := filepath.Join(anchoredRoot, "daily", "2026-05-29", "run-anchored", "preparation.json")
+	if _, err := os.Stat(anchoredArtifact); err != nil {
+		t.Fatalf("anchored preparation artifact: %v", err)
+	}
+	entries, err := os.ReadDir(outside)
+	if err != nil {
+		t.Fatalf("read outside directory: %v", err)
+	}
+	if len(entries) != 0 {
+		t.Fatalf("outside directory received debug artifacts: %#v", entries)
+	}
+}
+
 func TestPromptDebugWriterDisabledDoesNotAccessFilesystem(t *testing.T) {
 	writer, err := NewPromptDebugWriter("")
 	if err != nil {