test(store): assert stamped receipt cannot be overwritten in append-only store - #58

Thank you for taking #55 — the heart of this is right. Reviewed and verified locally on your branch merged onto current main. Before the detail: the property you set out to pin is pinned. I broke the append-only path five ways — stamp writing non-exclusively, exclusive-write silently overwriting, the store damaging the existing file before returning its refusal, a duplicate stamp succeeding as a silent no-op, and the refusal message changing — and your test caught every one.

Four required changes:

1. DCO. Your commit has no Signed-off-by trailer, and the DCO check fails on it. Amend and force-push: git commit --amend -s --no-edit then git push -f.

2. gofmt. The ubuntu CI leg fails because teeth_test.go ends with a trailing blank line; cd go && gofmt -w teeth_test.go fixes it.

3. #55's third checkbox is missing, and it is provably the load-bearing one. Nothing in the test enumerates the session directory — it only ever reads the one path it wrote. I deleted store.go's temp-file cleanup so every write leaks a .tmp scratch file next to the receipt, and neither your test nor the entire existing suite noticed. Asserting the directory holds exactly one entry after the refusal is the assertion that catches it.

4. #55's fourth checkbox is missing. The test never stamps a second callIndex, so it cannot show the refusal is about the collision rather than the session. I made the receipt filename ignore the index entirely — every call in a session colliding with the first — and your test passed. A stamp at the next index, asserted to succeed, pins it.

Two smaller asks, per the issue's scope text: build the store with the existing testStore(t) helper instead of hand-assembling paths, and stamp a production-shape core — the current one carries argumentsCommitment, which appears nowhere in SPEC.md, and omits receiptVersion, prevSignature, servedAt, and authority, which every receipt the gateway actually stamps carries.

None of this changes the verdict on your approach: the exclusive-link refusal, the byte-comparison of the surviving receipt, and driving the unexported layer directly are all sound instincts for this file. Fix the four, and consider the two, and this merges.

Re-verified in full — all six review points addressed; details in the comment above.