Harden Go SDK head store persistence

heads_test.go

@@ -81,6 +81,32 @@ func TestFileHeadStorePersistsAndIs0600(t *testing.T) {
 	}
 }
 
+func TestFileHeadStorePersistenceFailureReturned(t *testing.T) {
+	path := t.TempDir()
+	store := NewFileHeadStore(path)
+	if err := checkAndAdvanceHead(store, receipt(1, "h1", "")); err == nil {
+		t.Fatal("expected persistence failure when head-store path is a directory")
+	}
+}
+
+func TestFileHeadStoreCorruptFileFailsClosed(t *testing.T) {
+	path := filepath.Join(t.TempDir(), "heads.json")
+	if err := os.WriteFile(path, []byte("{not-json"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	store := NewFileHeadStore(path)
+	if err := store.SetWithError("str_demo", 1, "h1"); err == nil {
+		t.Fatal("expected corrupt head store to fail closed")
+	}
+	raw, err := os.ReadFile(path)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(raw) != "{not-json" {
+		t.Fatal("corrupt head store must not be silently overwritten")
+	}
+}
+
 func TestExactReplayOfStoredHeadIsBenign(t *testing.T) {
 	// [P3.3 regression] A deduplicated resend returns the same receipt; the
 	// head tracker must treat (same seqNo, same eventHash) as a no-op.