[harshitethic]

Reproduction

The public python examples/create_demo_zip.py --output PATH command previously used zipfile.ZipFile(PATH, 'w'). On Linux, a disposable existing file containing ORIGINAL_SENTINEL_DATA was silently replaced by a 1,291-byte archive, and the command returned success. This is inappropriate for a first-run example that accepts an arbitrary caller-selected output path.

Fix

• Open the destination with Python's exclusive-create mode xb before writing the ZIP; refuse both preexisting regular files and preexisting symlinks instead of following or truncating them.
• Report an actionable argparse error that the output already exists and a different path is needed.
• Add regression tests proving existing file bytes and a symlink target remain unchanged, while the regular deterministic archive and real API import/search/delete still work.
• Document the safe rerun behavior in the first-run guide.

Verification

• Before: newly added existing-file regression failed, because the generator succeeded in replacing the file.
• After: all four published-example tests passed, including exclusive output and symlink checks.
• Full local backend suite: 104 passed (Linux, Python 3.12).
• python -m compileall -q backend and git diff --check passed.
• Symlink test deliberately skipped on Windows, where creating a test symlink may require elevated privileges; exclusive-create mode supports Windows but that specific case was not executed there.

Limits

The example writes only caller-selected local paths and makes no network or model calls. This does not substitute for independent external first-run testing. Require fresh Python 3.11/3.12/3.13, frontend, browser and CodeQL CI before merge.

Python 3.12 CI feedback and correction

The first CI attempt exposed an additional reproducibility bug: ZIP string-member creation recorded wall-clock timestamps. Two generator runs crossed a two-second DOS timestamp boundary, causing the archive-equality test to fail on Python 3.12 even though the other backend matrices passed. The updated generator now sets each ZIP member's timestamp to 1980-01-01 00:00:00 and pins a portable Unix regular-file mode/creator; the regression asserts those exact fields. All 104 backend tests passed again locally on Python 3.12. Fresh CI on the updated head is required before merge.