Write the GUI text and CSV exports atomically

[amrali-eg]

Summary

• The GUI text-list and CSV exports opened the chosen file directly with new StreamWriter(path, false, encoding), which truncates an existing report before the new one is complete. A failed write showed the warning, but the previous report was already gone.
• Both exports now write through MainForm.WriteExportFile, which uses AtomicArtifactFile.Write: the report is staged in a temporary file and installed only when complete. Save dialog, encodings, BOM policy, row scope and menu labels are unchanged.

Behaviour decisions

• Read-only destination: refused. The atomic install would clear the read-only flag and replace the file; a direct write failed. WriteExportFile returns "is read-only" and leaves the file and its flag alone.
• Link destination: refused. The atomic install would swap a link for a regular file; a direct write went through it. WriteExportFile returns "is a link" and writes nothing. Conversion already refuses reparse points.
• A fault of an argument or invalid-operation kind raised inside the write callback is now reported as a failed export (the atomic writer's catch is wider than the old one).

Testability

• The text export's encoding and line format moved into MainForm.TextExportEncoding and MainForm.WriteTextExport, which the handler and the tests both use, so the tests no longer duplicate the handler and compare exact bytes.

Ledger

BL-24 claimed all saved report types used the atomic writer. Its note now records this GUI gap, why it is folded into BL-24, and that GuiExportWriteTests never ran against the original code (the method they call did not exist); with the direct write re-created behind the same method, the mid-write failure tests fail.

Verification

• GuiExportWriteTests (12): exact bytes for new and replaced reports (TXT and CSV), the line format, a write that fails part way leaves the previous bytes and no staging file, a failed new report leaves nothing, a held-open report, a missing folder, a read-only report, a linked destination.
• Mutation-tested, each caught: read-only refusal off, link refusal off, direct write restored, BOM removed, line format changed.
• Full suite 929/929, 0 warnings. Backlog checker passes.

Limits

• The SaveFileDialog around the write is not exercised. WriteExportFile is the step both handlers call.
• The link case uses a junction, which carries the same reparse-point attribute as a file symlink; no file symlink was created.
• No live GUI run and no real disk-full fault was injected.

🤖 Generated with Claude Code