add test coverage for the handling of mismatching files on the same sha (faked here by mangling a file after it's written, since we know of no SHA256 collisions)