The shared-file guard stopped deletion, but re-uploading a cover on the album
whose id matches the shared filename derived the same deterministic path, and
SetImage's os.Create truncated the file the other album still references —
silently changing its cover too.
When the current file is shared, upload under a de-duplicated name so the
derived filename is unique; the shared file stays intact for the other row
and the purge GC reaps it when the last reference goes.
