test: add TDD bug-capture test for #991 — AuditService TOCTOU race

Rebase onto latest master to resolve CHANGELOG.md merge conflict.
All test files unchanged from the approved PR commit (6c411be1).
CHANGELOG entry added to the ### Added section under ## [Unreleased].

ISSUES CLOSED: #1095

features/audit_session_race.feature

@@ -0,0 +1,27 @@
+# This test captures bug #991 — AuditService._ensure_session() TOCTOU race.
+#
+# The @tdd_expected_fail tag inverts the test result: the underlying assertion
+# fails (proving the bug exists) but CI reports the scenario as passed.
+# When #991 is fixed, the @tdd_expected_fail tag must be removed.
+#
+# See: https://git.cleverthis.com/cleveragents/cleveragents-core/issues/991
+
+@tdd_expected_fail @tdd_bug @tdd_bug_991 @tdd_issue @tdd_issue_991
+Feature: TDD Bug #991 — AuditService._ensure_session() TOCTOU race
+  AuditService._ensure_session() checks ``if self._session is None``, then
+  creates an engine, runs create_all, builds a sessionmaker, and assigns
+  self._session — all without a threading.Lock.  If two threads call
+  _ensure_session() concurrently, both see self._session is None, both
+  create separate engines and sessions, and the second assignment wins,
+  leaking the first engine/session.
+
+  This test proves the race exists by launching multiple threads that call
+  _ensure_session() simultaneously via a threading.Barrier and verifying
+  that create_engine is called exactly once (the correct, thread-safe
+  behavior).  Without the fix, create_engine is called multiple times.
+
+  Scenario: Concurrent _ensure_session() calls must create only one engine
+    Given an AuditService with no pre-injected session and a temp database
+    When 10 threads call _ensure_session concurrently through a barrier
+    Then create_engine should have been called exactly once
+    And all 10 threads should have completed with a session or error