Check the exact publication record filename before writing

internal/publish/record_test.go

@@ -157,6 +157,47 @@ func TestSaveEvidenceRejectsUnignoredOverrideInsideWorktree(t *testing.T) {
 	}
 }
 
+func TestSaveEvidenceChecksEachActualFilename(t *testing.T) {
+	repo := recordRepo(t)
+	if err := os.WriteFile(filepath.Join(repo, ".gitignore"), []byte("selective/attempt-[0-7]*.json\n"), 0600); err != nil {
+		t.Fatal(err)
+	}
+	recordGit(t, repo, "add", ".gitignore")
+	recordGit(t, repo, "commit", "-qm", "Selective ignore")
+	dir := filepath.Join(repo, "selective")
+	next := func(name string) func(string) (string, error) {
+		return func(directory string) (string, error) { return filepath.Join(directory, name), nil }
+	}
+	path, err := saveEvidenceNamed(repo, repo, dir, dir, Evidence{Tag: "v1.0.0"}, next("attempt-0.json"))
+	if err != nil {
+		t.Fatal(err)
+	}
+	recordGit(t, repo, "check-ignore", "--", path)
+	// A collision must validate the replacement name as well.
+	calls := 0
+	_, err = saveEvidenceNamed(repo, repo, dir, dir, Evidence{Tag: "v2.0.0"}, func(directory string) (string, error) {
+		calls++
+		name := "attempt-0.json"
+		if calls > 1 {
+			name = "attempt-c.json"
+		}
+		return filepath.Join(directory, name), nil
+	})
+	if err == nil || calls != 2 {
+		t.Fatalf("unignored replacement: calls=%d error=%v", calls, err)
+	}
+	if _, err := os.Stat(filepath.Join(dir, "attempt-c.json")); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("unignored file was created: %v", err)
+	}
+	if status := recordGit(t, repo, "status", "--porcelain"); status != "" {
+		t.Fatalf("recording dirtied candidate: %s", status)
+	}
+	loaded, err := LoadEvidence(path)
+	if err != nil || loaded.Tag != "v1.0.0" {
+		t.Fatalf("collision changed original record: %#v, %v", loaded, err)
+	}
+}
+
 func TestListAttemptsReturnsReadableRecordsAndDiagnosticsInPathOrder(t *testing.T) {
 	repo := recordRepo(t)
 	directory := filepath.Join(t.TempDir(), "attempts")