@@ -60,9 +60,15 @@ func ContainmentProblem(p string) string {
 	return ""
 }
 
-// hasVolumeName spots a Windows volume prefix such as "C:". filepath.VolumeName
-// answers for the system this build runs on, which is exactly what must not
-// decide it here.
+// HasVolumeName spots a Windows volume prefix such as "C:".
+//
+// filepath.VolumeName answers for the system this build runs on, which is
+// exactly what must not decide it. Measured on 2026-08-04: the name "a:b.txt"
+// was accepted on Linux and refused on Windows as an absolute path, from one
+// recipe - so a fixture set written on one machine failed on the next, which
+// is the thing the separator rule beside it exists to prevent.
+func HasVolumeName(p string) bool { return hasVolumeName(p) }
+
 func hasVolumeName(p string) bool {
 	if len(p) < 2 || p[1] != ':' {
 		return false
 
@@ -11,6 +11,7 @@ import (
 	"errors"
 	"fmt"
 	"io"
+	"io/fs"
 	"os"
 	"path/filepath"
 	"runtime"
@@ -254,7 +255,7 @@ func settleTarget(t *Target, opt Options, seen map[string]bool) (format.Descript
 func Plan(targets []Target, opt Options) ([]PlannedFile, error) {
 	var out []PlannedFile
 	seen := map[string]bool{}
-	names := map[string]string{}
+	names := map[string]nameOwner{}
 
 	// The running total of the whole run, kept here rather than worked out
 	// afterwards. Both of these used to be settled too late to help: the file
@@ -318,12 +319,33 @@ func Plan(targets []Target, opt Options) ([]PlannedFile, error) {
 			// destroyed by the other, and the manifest would still describe
 			// both. A manifest that quietly lost a file looks complete and
 			// reaches the test suite as a false truth.
-			if owner, clash := names[name]; clash {
-				return nil, &RecipeError{Detail: fmt.Sprintf(
-					"targets %q and %q both produce a file named %s - give one of them a --name template containing {index:04}",
-					owner, t.ID, name)}
+			//
+			// "One name" is not "the same string", and reading it that way cost
+			// exactly what this check exists to prevent. Most filesystems people
+			// run this on keep the case somebody typed and match without it -
+			// NTFS, APFS and exFAT do, ext4 does not - so "report.txt" and
+			// "REPORT.TXT" are two files on one machine and one file on the
+			// next. Measured on Windows, 2026-08-03: exit 0, two entries in the
+			// manifest, one file on the disk, and "tfg verify" failing on the
+			// tool's own output a second later.
+			//
+			// Refused everywhere rather than only where it bites, the same as a
+			// path separator and for the same reason: a recipe travels between
+			// machines by design, and one that quietly loses a file on somebody
+			// else's is worse than one refused on both. Producing such a pair on
+			// purpose belongs to the name laboratory and its archive mode, D10.
+			key := strings.ToLower(name)
+			if owner, clash := names[key]; clash {
+				detail := fmt.Sprintf("targets %q and %q both produce a file named %s", owner.id, t.ID, name)
+				if owner.name != name {
+					detail = fmt.Sprintf(
+						"targets %q and %q produce the names %s and %s, which differ only in case. Most filesystems treat those as one file, so one would be written over the other and the manifest would describe both",
+						owner.id, t.ID, owner.name, name)
+				}
+				return nil, &RecipeError{Detail: detail +
+					" - give one of them a --name template containing " + indexToken}
 			}
-			names[name] = t.ID
+			names[key] = nameOwner{id: t.ID, name: name}
 
 			if totalBytes, err = core.AddSizes(totalBytes, p.Bytes); err != nil {
 				return nil, &RecipeError{Detail: fmt.Sprintf(
@@ -447,6 +469,13 @@ func tempPathFor(outDir, name string) string {
 	return fmt.Sprintf("%s%s%d", filepath.Join(outDir, name), core.PartialMarker, os.Getpid())
 }
 
+// nameOwner remembers who took a name and how it was spelled, so a refusal can
+// show both names as they were written rather than as they were compared.
+type nameOwner struct {
+	id   string
+	name string
+}
+
 func exists(path string) bool {
 	_, err := os.Stat(path)
 	return err == nil
@@ -478,12 +507,12 @@ func Run(ctx context.Context, files []PlannedFile, opt Options) (*Result, error)
 	if err := preflight(files, opt); err != nil {
 		return res, err
 	}
-	res.Started = true
 
 	if opt.DryRun {
 		// Nothing is written. Every entry is what would have been produced,
 		// which is the same planning path the real run uses rather than a
 		// separate one that can drift away from it.
+		res.Started = true
 		for _, f := range files {
 			m.Add(entryFor(f, "", false, nil))
 		}
@@ -505,8 +534,26 @@ func Run(ctx context.Context, files []PlannedFile, opt Options) (*Result, error)
 	// Taking the name here turns that into a refusal before anything is written.
 	manifestPath := filepath.Join(opt.OutDir, manifestNameOf(opt))
 	if err := manifest.Claim(manifestPath); err != nil {
-		return res, &CollisionError{Path: manifestPath, Manifest: true}
+		// Only a name that is genuinely taken is a collision. Reporting every
+		// failure that way said "manifest.json already exists ... it is the
+		// only record of what an earlier run wrote" about an empty directory
+		// the user simply had no permission to write in - a sentence that is
+		// untrue and sends somebody looking for a run that never happened.
+		// Measured on 2026-08-04 with write denied on the output directory.
+		if errors.Is(err, fs.ErrExist) {
+			return res, &CollisionError{Path: manifestPath, Manifest: true}
+		}
+		return res, fmt.Errorf("cannot start a run in %s: %w", opt.OutDir, err)
 	}
+
+	// Past this point the run owns the name and may write. Started says so, and
+	// it is what tells the caller a manifest is worth saving - set here rather
+	// than before the claim, because a run that could not take the name has
+	// written nothing and has nothing to record. It used to be set earlier, so
+	// a refused claim was followed by a second message about failing to write
+	// the manifest it had just been told it could not have.
+	res.Started = true
+
 	// Given back if this run ends without writing one, or the name would stay
 	// taken by a run that never happened.
 	defer func() {
@@ -743,6 +790,25 @@ func checkFileName(where, name string) error {
 			"%s produces the name %q, which is a path rather than a file name. Names stay inside the output directory, and a separator is refused on every system so that a recipe works everywhere. Use --out or the output section to choose the directory",
 			where, name)}
 
+	// A colon, on every system, for the same reason as a separator.
+	//
+	// Windows reads it as the start of an alternate data stream, so
+	// "AB:c.txt" names a stream called c.txt inside a file called AB.
+	// Measured on 2026-08-04: the run reported the file as not produced and
+	// ended with the partial code, and an empty file called AB was left in the
+	// directory anyway - not in the manifest, reported by verify as something
+	// nobody asked for, and beyond the reach of cleanup for good. A single
+	// letter in front of it is read as a drive instead, which is how the same
+	// recipe came to be accepted on Linux and refused on Windows.
+	//
+	// Legal in a name on Linux and macOS, and refused there too. A recipe
+	// travels between machines by design, and one that quietly leaves debris on
+	// somebody else's is worse than one refused on all of them.
+	case strings.Contains(name, ":"):
+		return &RecipeError{Detail: fmt.Sprintf(
+			"%s produces the name %q, which holds a colon. Windows reads that as a drive or as an alternate data stream rather than as part of the name, so the file arrives called something else or not at all. It is refused on every system so that a recipe means one thing everywhere - take the colon out, or ask for the file inside an archive where the name survives",
+			where, name)}
+
 	case name == "." || name == "..":
 		return &RecipeError{Detail: fmt.Sprintf(
 			"%s produces the name %q, which names a directory rather than a file", where, name)}
@@ -765,7 +831,13 @@ func checkFileName(where, name string) error {
 			"%s produces the name %q, which ends in a dot or a space. Windows stores such a name without it, so the file on disk would not be the file the manifest describes and verify would report both. Take the last character off, or ask for the file inside an archive where the name survives",
 			where, name)}
 
-	case filepath.IsAbs(name) || filepath.VolumeName(name) != "":
+	// Judged the same way on every system, like the separator above. Using
+	// filepath here asks the machine this build runs on, and the answer
+	// differs: measured on 2026-08-04, "a:b.txt" was accepted on Linux and
+	// refused on Windows from one recipe, so a fixture set written on one
+	// machine failed on the next. That is the failure this rule exists to
+	// prevent, arriving through the rule itself.
+	case filepath.IsAbs(name) || core.HasVolumeName(name):
 		return &RecipeError{Detail: fmt.Sprintf(
 			"%s produces the absolute path %q. A recipe carries no absolute paths, because then it only works on the machine it was written on. Use --out or the output section to choose the directory",
 			where, name)}
 
@@ -0,0 +1,189 @@
+package guard
+
+import (
+	"encoding/json"
+	"os"
+	"path/filepath"
+	"runtime"
+	"strings"
+	"testing"
+	"time"
+	"unicode/utf8"
+
+	"github.com/donislawdev/TestingFilesGenerator/internal/cli"
+)
+
+// What the machine underneath is allowed to change about a run, and what it is
+// not. Every case here was measured on 2026-08-04 while going through the
+// environment questions the owner raised.
+
+// A directory somebody cannot write in is a permission problem and says so.
+//
+// It used to say "manifest.json already exists ... it is the only record of
+// what an earlier run wrote" about an empty directory, because every failure
+// to claim the manifest name was reported as a collision. That sends a person
+// looking for a run that never happened. A second message about failing to
+// write the manifest followed it, for one fault.
+func TestADirectoryWeCannotWriteInIsAPermissionProblem(t *testing.T) {
+	if runtime.GOOS == "windows" {
+		// os.Chmod on Windows only toggles the read only bit, which does not
+		// stop a file being created in a directory. Denying it needs an ACL,
+		// which is not something a test should be installing. Measured by hand
+		// there instead, and this runs on the other two systems in the matrix.
+		t.Skip("a directory that refuses writes needs an ACL on Windows")
+	}
+	dir := t.TempDir()
+	out := filepath.Join(dir, "ro")
+	if err := os.Mkdir(out, 0o555); err != nil {
+		t.Fatalf("making a directory nobody can write in: %v", err)
+	}
+	t.Cleanup(func() { _ = os.Chmod(out, 0o755) })
+
+	code, stdout, errOut := run(t, "generate", "--format", "txt", "--size", "1kb", "--out", out)
+
+	if code == cli.ExitOK {
+		t.Fatal("a run into a directory it cannot write in reported success")
+	}
+	if strings.Contains(errOut, "already exists") {
+		t.Errorf("a permission problem is reported as a name that is taken:\n%s", errOut)
+	}
+	if n := strings.Count(errOut, "tfg: "); n != 1 {
+		t.Errorf("one fault produced %d messages:\n%s", n, errOut)
+	}
+	if stdout != "" {
+		t.Errorf("a failed run wrote to stdout:\n%s", stdout)
+	}
+}
+
+// The time the manifest records does not move with the clock of the machine.
+//
+// It is written as UTC with the Z on it, so a run in Tokyo and a run in
+// California describe the same instant the same way. A local time would make
+// two manifests of the same run look like different runs, and a reader
+// comparing them has no way to tell which.
+func TestTheRecordedTimeDoesNotDependOnTheLocalZone(t *testing.T) {
+	dir := t.TempDir()
+	code, stdout, errOut := run(t,
+		"generate", "--format", "txt", "--size", "1kb", "--json", "--out", dir)
+	if code != cli.ExitOK {
+		t.Fatalf("exit %d:\n%s", code, errOut)
+	}
+	var m struct {
+		GeneratedAt string `json:"generated_at"`
+	}
+	if err := json.Unmarshal([]byte(stdout), &m); err != nil {
+		t.Fatalf("the manifest did not parse: %v", err)
+	}
+	if !strings.HasSuffix(m.GeneratedAt, "Z") {
+		t.Errorf("generated_at is %q - it has to be UTC, or two machines describe one run differently", m.GeneratedAt)
+	}
+	if _, err := time.Parse(time.RFC3339, m.GeneratedAt); err != nil {
+		t.Errorf("generated_at is not a time anything can read: %v", err)
+	}
+}
+
+// A recipe is UTF-8 and anything else is refused rather than guessed at.
+//
+// Measured on 2026-08-04: a recipe saved as cp1250 with Polish letters in a
+// name was accepted with exit 0, and the file arrived called "za" followed by
+// four replacement characters. The manifest agreed with the disk, so nothing
+// downstream noticed - the tool had simply produced a different name from the
+// one that was asked for, silently. Notepad on Windows still offers ANSI, and
+// this tool is aimed at testers on Windows.
+func TestARecipeThatIsNotUTF8IsRefused(t *testing.T) {
+	dir := t.TempDir()
+	path := filepath.Join(dir, "r.yaml")
+
+	// "zażółć.txt" in cp1250 - valid text in that encoding, not valid UTF-8.
+	body := []byte("version: 1\ntargets:\n  - id: t\n    format: txt\n    size: 1kb\n    name: za")
+	body = append(body, 0xbf, 0xf3, 0xb3, 0xe6) // ż ó ł ć
+	body = append(body, []byte(".txt\n")...)
+	if utf8.Valid(body) {
+		t.Fatal("the fixture is valid UTF-8, so it cannot show what it was written to show")
+	}
+	if err := os.WriteFile(path, body, 0o644); err != nil {
+		t.Fatalf("writing: %v", err)
+	}
+
+	code, _, errOut := run(t, "validate", path)
+	if code == cli.ExitOK {
+		t.Fatal("a recipe that is not UTF-8 was accepted, so a name comes back with replacement characters in it")
+	}
+	if !strings.Contains(errOut, "UTF-8") {
+		t.Errorf("the refusal does not say what is wrong with the file:\n%s", errOut)
+	}
+	if !strings.Contains(strings.ToLower(errOut), "save") && !strings.Contains(errOut, "encoding") {
+		t.Errorf("the refusal does not say what to do about it:\n%s", errOut)
+	}
+}
+
+// A name is judged the same way on every system.
+//
+// The rule about separators says so in as many words - a recipe that only
+// works on the machine it was written on is not portable - and the rule beside
+// it about absolute paths was asking the local machine. Measured on
+// 2026-08-04: "a:b.txt" was accepted on Linux and refused on Windows from one
+// recipe, because filepath.VolumeName answers for the system it runs on.
+//
+// The name below is the same on every run of this test, so a disagreement
+// between two systems shows up as one of them failing rather than as nobody
+// noticing.
+func TestANameIsJudgedTheSameWayOnEverySystem(t *testing.T) {
+	for _, name := range []string{"a:b.txt", "C:x.txt", "z:", "AB:c.txt"} {
+		t.Run(name, func(t *testing.T) {
+			dir := t.TempDir()
+			code, _, errOut := run(t,
+				"generate", "--format", "txt", "--size", "1kb",
+				"--name", name, "--dry-run", "--out", dir)
+			if code == cli.ExitOK {
+				t.Errorf("the name %q was accepted here, and a machine with drive letters refuses it - so one recipe gives two answers", name)
+			}
+			_ = errOut
+		})
+	}
+
+	// The other direction: a colon is not the only thing with a letter in
+	// front of it, and an ordinary name has to survive.
+	for _, name := range []string{"ab.txt", "a-b.txt", "a.b.txt"} {
+		t.Run("still works "+name, func(t *testing.T) {
+			dir := t.TempDir()
+			if code, _, errOut := run(t,
+				"generate", "--format", "txt", "--size", "1kb",
+				"--name", name, "--dry-run", "--out", dir); code != cli.ExitOK {
+				t.Errorf("an ordinary name was refused: exit %d\n%s", code, errOut)
+			}
+		})
+	}
+}
+
+// And a recipe that is UTF-8 keeps working, with the letters intact all the
+// way to the name on the disk.
+func TestARecipeInUTF8KeepsItsLetters(t *testing.T) {
+	dir := t.TempDir()
+	out := filepath.Join(dir, "out")
+	path := writeRecipe(t, dir, "version: 1\ntargets:\n  - id: t\n    format: txt\n    size: 1kb\n    name: za\u017c\u00f3\u0142\u0107.txt\noutput:\n  dir: "+filepath.ToSlash(out)+"\n")
+
+	if code, _, errOut := run(t, "generate", path); code != cli.ExitOK {
+		t.Fatalf("exit %d:\n%s", code, errOut)
+	}
+	entries, err := os.ReadDir(out)
+	if err != nil {
+		t.Fatalf("reading the output: %v", err)
+	}
+	found := false
+	for _, e := range entries {
+		if e.Name() == "za\u017c\u00f3\u0142\u0107.txt" {
+			found = true
+		}
+		if strings.ContainsRune(e.Name(), '\uFFFD') {
+			t.Errorf("the name came back with a replacement character in it: %q", e.Name())
+		}
+	}
+	if !found {
+		var names []string
+		for _, e := range entries {
+			names = append(names, e.Name())
+		}
+		t.Errorf("the file is not there under the name that was asked for: %v", names)
+	}
+}