1 files changed, 35 insertions, 0 deletions
diff --git a/internal/apply/fs.go b/internal/apply/fs.go
index 205089f..823d5c8 100644
--- a/internal/apply/fs.go
+++ b/internal/apply/fs.go
@@ -108,6 +108,16 @@ func moveFile(src, dst string) error {
 	if err := os.MkdirAll(filepath.Dir(dst), 0o755); err != nil {
 		return err
 	}
+	// Item 16 (fix round 2026-09-12, plan 5 Task 2): this guard must hold
+	// independently of runFileStep's own pre-check, layered rather than
+	// moved - the exact arrangement that produced plan 4's Task 5 Critical,
+	// where a helper that replaced silently was trusted because some caller
+	// had checked. Placed immediately before the operation that would
+	// otherwise clobber dst, the same way copyFile's own guard sits right
+	// before its rename into place.
+	if err := refuseIfExists(dst); err != nil {
+		return err
+	}
 	err := os.Rename(src, dst)
 	if err == nil {
 		return nil
@@ -121,6 +131,31 @@ func moveFile(src, dst string) error {
 	return os.Remove(src)
 }
 
+// renameFile renames src to dst, refusing on its own when dst already
+// exists rather than trusting that a caller checked first (item 16, same
+// reasoning as moveFile's guard above): a bare os.Rename silently replaces
+// an occupied destination, and runFileStep's own pre-check must not be the
+// only thing standing between a rename step and that.
+func renameFile(src, dst string) error {
+	if err := refuseIfExists(dst); err != nil {
+		return err
+	}
+	return os.Rename(src, dst)
+}
+
+// refuseIfExists reports an error naming dst if something is already there
+// (os.Lstat succeeds, following no symlink), and propagates any other stat
+// failure. A nil return means dst was confirmed absent at the moment of the
+// check.
+func refuseIfExists(dst string) error {
+	if _, err := os.Lstat(dst); err == nil {
+		return fmt.Errorf("destination already exists: %s", dst)
+	} else if !os.IsNotExist(err) {
+		return err
+	}
+	return nil
+}
+
 // maxSuffixAttempts bounds nextFreeName. internal/plan/conflict.go and
 // internal/trash/trash.go each have their own cap of the same size, for the
 // same reason given below: nextFreeName solves yet another, independent