@@ -0,0 +1,18 @@
+---
+'create-objectstack': patch
+---
+
+fix(create-objectstack)!: a scaffold into the current directory refuses, writing nothing, when a template file would overwrite one already there (#29134)
+
+Clause-②: no (narrowing) — `create-objectstack` with no name (or an empty one) in a current directory holding a file the template writes (`README.md`, `package.json`, …) refuses with exit 1 and leaves the directory untouched, where it overwrote those files and exited 0 before. Nothing is widened.
+Metadata-protocol: none
+
+<!-- adr-0087: not-required (no-migration-prescription) No key of any schema, no export of a published entry and no stored shape changes: the scaffolder's command line refuses one more case before it writes, so there is nothing for a migration to rewrite and no tombstone. -->
+
+**BREAKING** for a script that runs `create-objectstack` with no name inside a directory that already holds files the template writes.
+
+- **Before.** A named directory that was not empty was refused (`Directory already exists and is not empty`, exit 1), but the current directory was not checked at all: the template was copied over whatever was there, so an existing project's `README.md` and `package.json` were replaced without a word and the run exited 0.
+- **Now.** Before anything is written, the run compares the template's files with what the current directory holds. If any template file would replace an existing file (or a file stands where the template needs a directory), it refuses with exit 1, names each of those paths, and writes nothing.
+- **Unchanged.** A current directory that holds only files the template does not write (a `.git/`, a notes file) still scaffolds, and those files are left as they were; the closing summary still says the directory already had contents. An empty current directory and a named directory behave as before.
+
+**The remedy.** Move the named files aside and re-run, or scaffold into a new directory: `create-objectstack my-app`.
@@ -71,7 +71,7 @@ import { detectPackageManager } from './detect-package-manager.js';
 import { fileURLToPath } from 'node:url';
 
 import { syncObjectStackDeps } from './pkg-utils.js';
-import { copyDir } from './template-copy.js';
+import { copyDir, findTemplateCollisions } from './template-copy.js';
 import {
   deriveManifestId,
   sanitizeNamespace,
@@ -132,13 +132,17 @@ function printWarning(msg: string) { console.log(chalk.yellow(`  ⚠ ${msg}`));
 
 // ─── Loading: bundled (fs copy) ─────────────────────────────────────
 
-function loadBundled(templateDir: string, targetDir: string): string[] {
+function bundledTemplateDir(templateDir: string): string {
   const src = path.join(BUNDLED_TEMPLATES_DIR, templateDir);
   if (!fs.existsSync(src)) {
     throw new Error(`Bundled template missing on disk: ${src}`);
   }
+  return src;
+}
+
+function loadBundled(templateDir: string, targetDir: string): string[] {
   const collected: string[] = [];
-  copyDir(src, targetDir, collected);
+  copyDir(bundledTemplateDir(templateDir), targetDir, collected);
   return collected;
 }
 
@@ -560,6 +564,31 @@ const program = new Command()
     const targetWasEmpty = topLevelNames(targetDir).size === 0;
 
     try {
+      // The current directory gets the named directory's protection, scoped to
+      // collisions: files the template does not write (a `.git/`, a notes
+      // file) may stay, but a template file that would replace one the user
+      // already has refuses the whole run — checked before the first write, so
+      // the refusal leaves the directory exactly as it was. Without it a run
+      // with no name in an existing project replaced its README.md and
+      // package.json and exited 0.
+      const collisions = targetWasEmpty
+        ? []
+        : findTemplateCollisions(bundledTemplateDir(template.source.dir), targetDir);
+      if (collisions.length > 0) {
+        printError(
+          `Directory is not empty and the template would overwrite ${collisions.length} existing ` +
+            `${collisions.length === 1 ? 'file' : 'files'}: ${targetDir}`,
+        );
+        for (const rel of collisions) console.log(chalk.dim(`    ${rel}`));
+        console.log(
+          chalk.dim(
+            '  Nothing was written. Move those files aside, or scaffold into a new directory: ' +
+              'create-objectstack <name>',
+          ),
+        );
+        process.exit(1);
+      }
+
       fs.mkdirSync(targetDir, { recursive: true });
 
       const createdFiles = loadBundled(template.source.dir, targetDir);
 
@@ -0,0 +1,154 @@
+// Copyright (c) 2026 ObjectStack contributors. Apache-2.0 license.
+//
+// A scaffold into the current directory (no name, or an empty one) used to
+// copy the template straight over whatever was there: an existing project's
+// README.md and package.json were replaced and the run exited 0, while a named
+// non-empty directory was refused. The current directory now gets the same
+// protection, scoped to collisions — a template file that would replace an
+// existing one refuses the run before anything is written; files the template
+// does not write may stay.
+//
+// Runs the real CLI through `tsx` (index.ts calls `program.parse()` on import,
+// so it cannot be imported), the no-build pattern scaffold-description.test.ts
+// uses.
+
+import { describe, it, expect, beforeEach, afterEach } from 'vitest';
+import { spawnSync } from 'node:child_process';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { findTemplateCollisions } from './template-copy.js';
+
+const HERE = path.dirname(fileURLToPath(import.meta.url));
+const PKG_ROOT = path.resolve(HERE, '..');
+const REPO_ROOT = path.resolve(PKG_ROOT, '..', '..');
+const TSX = path.join(REPO_ROOT, 'node_modules', '.bin', 'tsx');
+const INDEX_TS = path.join(PKG_ROOT, 'src', 'index.ts');
+const BLANK_TEMPLATE = path.join(PKG_ROOT, 'src', 'templates', 'blank');
+
+const USER_README = '# My notes\n\nWritten by hand, not by the scaffolder.\n';
+const USER_PACKAGE_JSON = '{ "name": "my-existing-thing", "version": "3.1.4" }\n';
+const USER_NOTES = 'keep me\n';
+
+let tmp: string;
+let projectDir: string;
+
+beforeEach(() => {
+  tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'create-objectstack-collide-'));
+  projectDir = path.join(tmp, 'my-app');
+  fs.mkdirSync(projectDir);
+});
+
+afterEach(() => fs.rmSync(tmp, { recursive: true, force: true }));
+
+function run(cwd: string, nameArgs: string[]) {
+  const result = spawnSync(
+    TSX,
+    [INDEX_TS, ...nameArgs, '--template', 'blank', '--skip-install', '--skip-skills'],
+    { cwd, encoding: 'utf8', env: { ...process.env, NO_COLOR: '1', FORCE_COLOR: '0' } },
+  );
+  return { status: result.status, out: `${result.stdout}${result.stderr}` };
+}
+
+// Every path under `dir` with its bytes, so "nothing was written" is checked
+// against the whole tree, not only the files a test happens to name.
+function snapshot(dir: string): Record<string, string> {
+  const out: Record<string, string> = {};
+  const walk = (abs: string, rel: string) => {
+    for (const entry of fs.readdirSync(abs, { withFileTypes: true })) {
+      const childAbs = path.join(abs, entry.name);
+      const childRel = rel ? `${rel}/${entry.name}` : entry.name;
+      if (entry.isDirectory()) {
+        out[`${childRel}/`] = '';
+        walk(childAbs, childRel);
+      } else {
+        out[childRel] = fs.readFileSync(childAbs, 'utf8');
+      }
+    }
+  };
+  walk(dir, '');
+  return out;
+}
+
+describe('scaffold into the current directory', () => {
+  for (const [label, nameArgs] of [
+    ['no name', []],
+    ['an empty name', ['']],
+  ] as const) {
+    it(`refuses with ${label} when template files would overwrite existing ones, writing nothing`, () => {
+      fs.writeFileSync(path.join(projectDir, 'README.md'), USER_README);
+      fs.writeFileSync(path.join(projectDir, 'package.json'), USER_PACKAGE_JSON);
+      fs.writeFileSync(path.join(projectDir, 'notes.txt'), USER_NOTES);
+      const before = snapshot(projectDir);
+
+      const { status, out } = run(projectDir, [...nameArgs]);
+
+      expect(status).toBe(1);
+      expect(snapshot(projectDir)).toEqual(before);
+      expect(out).toContain('the template would overwrite 2 existing files');
+      expect(out).toMatch(/^\s+README\.md$/m);
+      expect(out).toMatch(/^\s+package\.json$/m);
+      expect(out).not.toMatch(/^\s+notes\.txt$/m);
+      expect(out).not.toContain('Environment created!');
+    }, 30_000);
+  }
+
+  it('scaffolds when the directory only holds files the template does not write, leaving them untouched', () => {
+    fs.mkdirSync(path.join(projectDir, '.git'));
+    fs.writeFileSync(path.join(projectDir, '.git', 'HEAD'), 'ref: refs/heads/main\n');
+    fs.writeFileSync(path.join(projectDir, 'notes.txt'), USER_NOTES);
+
+    const { status, out } = run(projectDir, []);
+
+    expect(status).toBe(0);
+    expect(out).toContain('Environment created!');
+    expect(out).toContain('the directory already had contents');
+    expect(JSON.parse(fs.readFileSync(path.join(projectDir, 'package.json'), 'utf8')).name).toBe(
+      'my-app',
+    );
+    expect(fs.readFileSync(path.join(projectDir, 'notes.txt'), 'utf8')).toBe(USER_NOTES);
+    expect(fs.readFileSync(path.join(projectDir, '.git', 'HEAD'), 'utf8')).toBe(
+      'ref: refs/heads/main\n',
+    );
+  }, 30_000);
+
+  it('scaffolds an empty current directory as before', () => {
+    const { status, out } = run(projectDir, []);
+
+    expect(status).toBe(0);
+    expect(out).toContain('Created files:');
+    expect(fs.existsSync(path.join(projectDir, 'objectstack.config.ts'))).toBe(true);
+  }, 30_000);
+});
+
+describe('scaffold into a named directory', () => {
+  it('still refuses a named non-empty directory with the old message', () => {
+    fs.writeFileSync(path.join(projectDir, 'notes.txt'), USER_NOTES);
+    const before = snapshot(projectDir);
+
+    const { status, out } = run(tmp, ['my-app']);
+
+    expect(status).toBe(1);
+    expect(out).toContain(`Directory already exists and is not empty: ${projectDir}`);
+    expect(snapshot(projectDir)).toEqual(before);
+  }, 30_000);
+});
+
+describe('findTemplateCollisions', () => {
+  it('names aliased dotfiles by the name they land under', () => {
+    fs.writeFileSync(path.join(projectDir, '.gitignore'), 'node_modules\n');
+    expect(findTemplateCollisions(BLANK_TEMPLATE, projectDir)).toEqual(['.gitignore']);
+  });
+
+  it('reports a file standing where the template needs a directory', () => {
+    fs.writeFileSync(path.join(projectDir, 'src'), 'not a directory\n');
+    expect(findTemplateCollisions(BLANK_TEMPLATE, projectDir)).toEqual(['src']);
+  });
+
+  it('looks inside a directory the template shares with the user', () => {
+    fs.mkdirSync(path.join(projectDir, 'src'));
+    fs.writeFileSync(path.join(projectDir, 'src', 'mine.ts'), 'export {};\n');
+    expect(findTemplateCollisions(BLANK_TEMPLATE, projectDir)).toEqual([]);
+  });
+});
@@ -28,6 +28,50 @@ export const TEMPLATE_FILE_ALIASES = new Map<string, string>([
   ['_gitignore', '.gitignore'],
 ]);
 
+// The name a template entry lands under in the scaffolded project.
+function outputName(entry: fs.Dirent): string {
+  return entry.isFile()
+    ? (TEMPLATE_FILE_ALIASES.get(entry.name) ?? entry.name)
+    : entry.name;
+}
+
+/**
+ * The project-relative paths in `dest` that copying `src` onto it would
+ * overwrite, or that stand where the template needs a directory. Empty means
+ * `copyDir` can run without replacing anything the user already has.
+ *
+ * Read-only, and meant to run BEFORE the first write: a scaffold into a
+ * directory that already has contents (the current directory is the one path
+ * that allows that) must refuse with the directory byte-identical, not stop
+ * halfway through the copy. Files the template does not write — a `.git/`, a
+ * notes file — are not collisions and are left alone by `copyDir`.
+ */
+export function findTemplateCollisions(src: string, dest: string, rel = ''): string[] {
+  const collisions: string[] = [];
+  for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
+    const outName = outputName(entry);
+    const destPath = path.join(dest, outName);
+    const relPath = rel ? `${rel}/${outName}` : outName;
+    let existing: fs.Stats | undefined;
+    try {
+      existing = fs.lstatSync(destPath);
+    } catch {
+      existing = undefined;
+    }
+    if (entry.isDirectory()) {
+      if (!existing) continue;
+      if (existing.isDirectory()) {
+        collisions.push(...findTemplateCollisions(path.join(src, entry.name), destPath, relPath));
+      } else {
+        collisions.push(relPath);
+      }
+    } else if (entry.isFile() && existing) {
+      collisions.push(relPath);
+    }
+  }
+  return collisions;
+}
+
 /**
  * Recursively copy `src` onto `dest`, restoring aliased filenames, pushing the
  * project-relative path of every written file onto `collected`.
@@ -36,9 +80,7 @@ export function copyDir(src: string, dest: string, collected: string[], rel = ''
   fs.mkdirSync(dest, { recursive: true });
   for (const entry of fs.readdirSync(src, { withFileTypes: true })) {
     const srcPath = path.join(src, entry.name);
-    const outName = entry.isFile()
-      ? (TEMPLATE_FILE_ALIASES.get(entry.name) ?? entry.name)
-      : entry.name;
+    const outName = outputName(entry);
     const destPath = path.join(dest, outName);
     const relPath = rel ? `${rel}/${outName}` : outName;
     if (entry.isDirectory()) {