Fix installer state and launcher freshness checks

tests/setup/update-command-contract

@@ -39,6 +39,12 @@ trap 'rm -rf "$tmp"' EXIT
 STAGE_NAMES=(install-packages link-dotfiles link-skills link-user change-settings
              link-vicinae-scripts setup-server link-server setup-identity
              install-hardware)
+PACKAGE_BEHAVIOR_INPUTS=(
+    setup/lib/artifact-provenance
+    setup/lib/chatgpt-package
+    setup/lib/extras-catalog
+    setup/lib/machine-role
+)
 
 copy_hash_inputs() {
     local root="$1" source relative
@@ -50,8 +56,10 @@ copy_hash_inputs() {
         find "$repo_dir/setup/packages" -maxdepth 1 -type f -print0
         find "$repo_dir/setup/provenance" -type f -print0
     )
-    mkdir -p "$root/setup/lib"
-    cp -- "$repo_dir/setup/lib/artifact-provenance" "$root/setup/lib/artifact-provenance"
+    for relative in "${PACKAGE_BEHAVIOR_INPUTS[@]}"; do
+        mkdir -p "$(dirname "$root/$relative")"
+        cp -- "$repo_dir/$relative" "$root/$relative"
+    done
 }
 
 # A PANAMA_PATH that looks enough like the real one for install to run, and
@@ -255,7 +263,7 @@ grep -qx 'install-packages' <<<"$ran_forced" \
 # Dynamically discovering them makes this fail when a new reviewed input is
 # added but omitted from hash_packages.
 for relative in "${package_inputs[@]}" "${provenance_inputs[@]}" \
-    'setup/scripts/install-packages' 'setup/lib/artifact-provenance'; do
+    'setup/scripts/install-packages' "${PACKAGE_BEHAVIOR_INPUTS[@]}"; do
     printf 'changed %s\n' "$relative" >>"$tmp/a/$relative"
     install_status=0
     ran_input_changed="$(run_install "$tmp/a" --upgrade)" || install_status=$?
@@ -282,7 +290,7 @@ done
 # Fixed hash inputs must not silently disappear or degrade into a directory or
 # link. An unreadable package input also proves a failed content read cannot be
 # hidden by the final digest command.
-for fixed_input in setup/scripts/install-packages setup/lib/artifact-provenance; do
+for fixed_input in setup/scripts/install-packages "${PACKAGE_BEHAVIOR_INPUTS[@]}"; do
     for case_name in missing directory symlink unreadable; do
         case_root="$tmp/hash-${fixed_input//\//-}-$case_name"
         build_fixture "$case_root"
@@ -320,6 +328,26 @@ grep -qx 'install-packages' <<<"$ran_hash_failure" \
 cmp -s -- "$tmp/hash-failure/stamp-before" "$tmp/hash-failure/state/panama/packages-hash" \
     || note 'a failed package-state hash wrote a new packages-hash stamp'
 
+# Inputs changed while install-packages was running were not the inputs it
+# consumed at the start. Do not stamp the later bytes as successfully applied.
+build_fixture "$tmp/hash-mid-stage-drift"
+cat >"$tmp/hash-mid-stage-drift/setup/scripts/install-packages" <<'EOF'
+#!/usr/bin/env bash
+if [[ "${1:-}" == --trust-preflight ]]; then
+    printf 'trust-preflight\n' >>"$PANAMA_RAN"
+    exit 0
+fi
+printf 'install-packages\n' >>"$PANAMA_RAN"
+printf '\nchanged during package installation\n' >>"$PANAMA_PATH/setup/lib/machine-role"
+EOF
+chmod +x "$tmp/hash-mid-stage-drift/setup/scripts/install-packages"
+install_status=0
+run_install "$tmp/hash-mid-stage-drift" --upgrade >/dev/null || install_status=$?
+[[ "$install_status" -ne 0 ]] \
+    || note 'mid-stage package input drift returned success'
+[[ ! -e "$tmp/hash-mid-stage-drift/state/panama/packages-hash" ]] \
+    || note 'mid-stage package input drift stamped bytes the stage did not start with'
+
 # A failing stage must not record the hash, or the failure is hidden forever.
 build_fixture "$tmp/c" 1
 install_status=0