Stage and require verified extraction helper in Windows release packages

tools/test_package_windows.py

@@ -9,6 +9,7 @@ import zipfile
 
 from package_windows import package, CRT_LIBRARIES
 from embeddinggemma2 import runtime_provenance as provenance
+import stage_extraction_worker as extraction
 
 
 def executable(path, machine=0x8664):
@@ -31,6 +32,24 @@ def inventory(resources):
 
 
 class PackageTests(unittest.TestCase):
+    def test_extraction_missing_tampered_stale_preserves_existing_package(self):
+        for mutation in ("missing", "tampered", "stale"):
+            with self.subTest(mutation=mutation), tempfile.TemporaryDirectory() as directory:
+                root, resources, app, output = self.fixture(directory)
+                output.write_bytes(b"previous package")
+                helper = resources / "searchi-extract-worker.exe"
+                if mutation == "missing":
+                    helper.unlink()
+                elif mutation == "tampered":
+                    helper.write_bytes(helper.read_bytes() + b"changed")
+                else:
+                    source = root / "crates/searchi-extract-worker/src/main.rs"
+                    source.write_bytes(source.read_bytes() + b"\n// changed\n")
+                with self.assertRaises(ValueError):
+                    package(root, app, output)
+                self.assertEqual(output.read_bytes(), b"previous package")
+                self.assertEqual(list(output.parent.glob("*.partial")), [])
+
     def test_optional_cli_manifest_and_architecture(self):
         with tempfile.TemporaryDirectory() as directory:
             root, _, app, output = self.fixture(directory)
@@ -67,6 +86,10 @@ class PackageTests(unittest.TestCase):
             path = root / name
             path.parent.mkdir(parents=True, exist_ok=True)
             path.write_bytes((provenance.ROOT / name).read_bytes())
+        for name in extraction.fingerprint()["inputs"]:
+            path = root / name
+            path.parent.mkdir(parents=True, exist_ok=True)
+            path.write_bytes((extraction.ROOT / name).read_bytes())
         resources = root / "apps/desktop/src-tauri/resources"
         app = root / "build/app.exe"
         executable(app)
@@ -93,6 +116,9 @@ class PackageTests(unittest.TestCase):
             "sha256": hashlib.sha256(upstream.read_bytes()).hexdigest()}}}))
         (resources / "media-runtime/manifest.json").write_bytes(manifest.read_bytes())
         inventory(resources)
+        helper = root / "build/searchi-extract-worker.exe"
+        executable(helper)
+        extraction.stage(helper, extraction.fingerprint(root), resources, root)
         return root, resources, app, root / "archive.zip"
 
     def test_valid_pe_media_mutation_and_notice_corruption_preserve_previous_archive(self):