fix(backup): retain staging cleanup capability

tools/tht/internal/backup/preflight_windows_test.go

@@ -4,6 +4,7 @@ package backup
 
 import (
 	"context"
+	"errors"
 	"os"
 	"path/filepath"
 	"testing"
@@ -34,10 +35,77 @@ func TestStageArchiveProtectsWindowsStagingArtifactsWithOwnerOnlyACLs(t *testing
 	if err := safeio.ValidatePrivateDirectory(result.stagingRoot); err != nil {
 		t.Fatalf("staging root ACL = %v, want owner-only", err)
 	}
-	if err := safeio.ValidatePrivateDirectory(staged.directory); err != nil {
-		t.Fatalf("staged archive directory ACL = %v, want owner-only", err)
-	}
 	if err := safeio.ValidatePrivateRegular(staged.path); err != nil {
 		t.Fatalf("staged archive ACL = %v, want owner-only", err)
 	}
 }
+
+func TestStageArchiveCloseUsesPinnedRootAfterAncestorSwap(t *testing.T) {
+	installation := preflightTestInstallation(t)
+	if err := os.MkdirAll(installation.ControlDirectory(), 0o700); err != nil {
+		t.Fatal(err)
+	}
+	archive := filepath.Join(t.TempDir(), "valid.zip")
+	writePreflightArchive(t, archive, preflightArchiveSpec{
+		entries: []preflightArchiveEntry{{path: "configuration/operator.env", body: []byte("safe")}},
+	})
+	result, err := Preflight(context.Background(), installation, PreflightRequest{Archive: archive, Confirm: true}, permissivePreflightDependencies())
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer result.CloseArchive()
+
+	outsideParent, err := filepath.EvalSymlinks(t.TempDir())
+	if err != nil {
+		t.Fatal(err)
+	}
+	outside := filepath.Join(outsideParent, "outside")
+	if err := os.Mkdir(outside, 0o700); err != nil {
+		t.Fatal(err)
+	}
+	if err := safeio.ProtectPrivateDirectory(outside); err != nil {
+		t.Fatal(err)
+	}
+	sentinelPath := filepath.Join(outside, "sentinel")
+	sentinel := []byte("outside sentinel")
+	if err := os.WriteFile(sentinelPath, sentinel, 0o600); err != nil {
+		t.Fatal(err)
+	}
+
+	attemptedSwap := false
+	restoreHook := safeio.SetPrivateDirectoryTestHookForTest(func(stage string) {
+		if stage != "before-stage-archive-remove" || attemptedSwap {
+			return
+		}
+		attemptedSwap = true
+		if err := os.Rename(result.stagingRoot, result.stagingRoot+"-moved"); err == nil {
+			t.Fatal("staging-root rename succeeded while Close retained its directory handle")
+		}
+	})
+	defer restoreHook()
+
+	staged, err := result.StageArchive(context.Background())
+	if err != nil {
+		t.Fatal(err)
+	}
+	stagedName := staged.name
+	if filepath.Dir(staged.path) != result.stagingRoot {
+		t.Fatalf("staged archive directory = %q, want %q", filepath.Dir(staged.path), result.stagingRoot)
+	}
+	if err := staged.Close(); err != nil {
+		t.Fatal(err)
+	}
+	if !attemptedSwap {
+		t.Fatal("stage archive cleanup hook did not run")
+	}
+	if _, err := os.Stat(filepath.Join(result.stagingRoot, stagedName)); !errors.Is(err, os.ErrNotExist) {
+		t.Fatalf("staging archive = %v, want os.ErrNotExist", err)
+	}
+	gotSentinel, err := os.ReadFile(sentinelPath)
+	if err != nil {
+		t.Fatal(err)
+	}
+	if string(gotSentinel) != string(sentinel) {
+		t.Fatalf("outside sentinel = %q, want %q", gotSentinel, sentinel)
+	}
+}