These two Python files prepare and test an unpublished one-class archive fixture. They do not supply an app manifest, an accepted Qortal patch, or a deployable JAR. The initial helper/test source was selected from core commit 9194e2d4a26ae7879188547cc768399c89f28cfd; subsequent local corrections require normal review before integration.

Run the focused tests with a controlled scratch TMPDIR:

PYTHONDONTWRITEBYTECODE=1 python3 -B tests/apps/qortal/test_cache_fixture.py -v
PYTHONDONTWRITEBYTECODE=1 python3 -B tests/apps/qortal/test_package_overlay.py -v

Only Python standard-library code and synthetic archives are used. No JVM, compiler, container, network, real keys, operator configuration or installed Qortal data is touched. Class fixtures have a synthetic magic prefix; passing these tests does not establish that a class is valid executable Java.

The helper verifies the original archive pin, then uses that exact byte snapshot for both generation and comparison. Replacing the original pathname after the hash check cannot cause unverified entries to enter the fixture. Output creation is exclusive; existing output and dangling output symlinks are not overwritten. Duplicate entries, missing target class, JAR signatures, wrong pins, symlink inputs and invalid/excessive replacement class data are refused. Replacement class reads stop at the existing 1 MiB limit plus one detection byte, before allocating an arbitrarily large input. Inputs and the output parent must remain caller-controlled: this is not an adversarial filesystem sandbox. Partial output after a later write/verification error is retained for diagnosis, not automatically deleted or marked qualified.

No official binary is modified by these tests. Source provenance/review, credential design, clean packaging, nonempty migration/rollback, actual Core bootstrap, gateway and managed/physical acceptance remain separate gates.