Verify restored audio before installation

internal/app/restore_commit_test.go

@@ -173,6 +173,58 @@ func TestCommittedRestoreRejectsChangedDeclaredObjectGeneration(t *testing.T) {
 	}
 }
 
+func TestCommittedRestoreRejectsChangedAudioBeforeInstall(t *testing.T) {
+	tests := []struct {
+		name       string
+		data       []byte
+		generation string
+		wantError  string
+	}{
+		{name: "content", data: []byte("tampered-audio"), wantError: "checksum mismatch"},
+		{name: "generation", data: []byte("original-audio"), generation: "replacement-generation", wantError: "generation mismatch"},
+	}
+	for _, test := range tests {
+		t.Run(test.name, func(t *testing.T) {
+			cfg := restorePlanConfig(t)
+			cfg.Pipeline.Spool.Root = filepath.Join(t.TempDir(), "spool")
+			cacheDisabled := false
+			cfg.Pipeline.Cache.S3Audio = &cacheDisabled
+			fake := &storage.FakeBackend{}
+			current := seedCommittedRestoreSnapshot(t, cfg, fake, "20260519T010203Z-a1b2c3d4", map[string][]byte{
+				"audio/alice.flac": []byte("original-audio"),
+			})
+			plan, err := buildRestorePlan(context.Background(), cfg, current, fake, RestorePlanOptions{IncludeAudio: true})
+			if err != nil {
+				t.Fatalf("buildRestorePlan() error = %v", err)
+			}
+			key := artifacts.S3RunRelativeDestinationKey(artifacts.S3RunPrefix(current.SessionPrefix, current.RunID), "audio/alice.flac")
+			generation := test.generation
+			if generation == "" {
+				generation = fake.Objects[key].ETag
+			}
+			fake.SeedObject(storage.FakeObject{Key: key, Data: test.data, ETag: generation})
+
+			root := artifacts.SessionWorkDirForCampaign(cfg.Pipeline.Workspace.Root, cfg.Session.Campaign, cfg.Session.SessionID)
+			destination := filepath.Join(root, "audio", "alice.flac")
+			if err := os.MkdirAll(filepath.Dir(destination), 0o755); err != nil {
+				t.Fatalf("MkdirAll(audio directory) error = %v", err)
+			}
+			if err := os.WriteFile(destination, []byte("local-audio-remains"), 0o644); err != nil {
+				t.Fatalf("WriteFile(existing audio) error = %v", err)
+			}
+
+			_, err = executeRestorePlan(context.Background(), cfg, current, plan, nil, fake)
+			if err == nil || !strings.Contains(err.Error(), test.wantError) {
+				t.Fatalf("executeRestorePlan() error = %v, want %q", err, test.wantError)
+			}
+			mustReadEquals(t, destination, "local-audio-remains")
+			if _, err := os.Stat(filepath.Join(root, "manifest.json")); !os.IsNotExist(err) {
+				t.Fatalf("manifest should not be installed after failed audio restore; stat err=%v", err)
+			}
+		})
+	}
+}
+
 func TestCommittedRestoreRejectsMissingDeclaredObjectBeforeManifestInstall(t *testing.T) {
 	cfg := restorePlanConfig(t)
 	fake := &storage.FakeBackend{}