fix(update): keep pipe-drain proof off host console

[andrexibiza]

What changed and why

-SelfTestPipeDrain intentionally captures an 8 MiB flood to prove the Windows handoff drains child pipes without backpressure. Invoke-HermesStep then replayed that full capture through Write-Host; GitHub Actions throttled its 128 KiB lines, pushed the fixture over its wall-clock budget, and kept the job draining long after the fixture exited.

This change separates durable logging from host-console replay. Production callers keep the existing default. Only the fixture's flood arm suppresses raw console replay; its bytes remain in desktop-update-handoff.log and Invoke-HermesStep(...).Output, while concise progress and the final verdict remain visible.

Why this matters to users

This does not change the updater users run. It makes the real Windows watchdog proof reliable on the same hosted Windows environment that gates Hermes changes, so future pipe-drain regressions fail in CI instead of forcing maintainers to rely on suites that skip the executable fixture.

How to test

• scripts/run_tests.sh tests/test_desktop_update_windows_pipe_drain.py tests/test_desktop_update_windows_python_handoff.py tests/test_desktop_update_windows_progress.py tests/test_desktop_update_windows_timestamp.py (12 tests total; verified serially with disjoint pytest roots on native Windows)
• PowerShell 5.1 AST parse
• Ruff, compileall, Windows-footgun scan, git diff --check, attribution audit

Platforms tested

• Native Windows 11 / Windows PowerShell 5.1

TDD receipt

• RED: unchanged production code emitted 8,391,826 bytes to fixture stdout after the fixture's own PASS marker and zero exit-code assertions succeeded.
• GREEN: fixture stdout is bounded below 64 KiB, pipeflood| is absent from stdout, full flood bytes remain in the durable handoff log, and all four fixture arms pass.

Related work and credit

• Report and retained hosted-runner evidence: SelfTestPipeDrain fixture hangs on hosted windows-latest runners (passes on native Windows) #95971 by @teknium1.
• Underlying watchdog and executable fixture: fix(update): recover stalled Windows desktop handoffs #95625 by @fangliquanflq, integrated through fix(update): Windows desktop update stall watchdog + fleet-check false failure #95897 by @teknium1.
• Original bounded pipe-drain diagnosis and fixture: fix(update): bound the Windows update hand-off's step pipe drain #90564 by @jackulau, salvaged and extended through merged fix(update): Windows Desktop updates finish instead of parking on "Updating Hermes" #90937 by @OutThisLife.
• Current same-file open PRs checked at their live heads: fix(update): restore Hermes Update progress window hidden by cmd start /min #84025, fix(desktop): WinForms update card starts normal, not minimized #84771, fix(update): don't retry the Windows update hand-off into a GitHub 429 #89317, feat(update): complete Phase 4 fleet UX and canary rollouts (#91277) #93042, fix(desktop-update): repair stale editable install before hand-off #94107, fix(feishu): fix DM approval card button unresponsive in direct messages #95156, fix(update): stop Windows installers from killing in-flight updates #95719, fix(desktop-update): don't re-run a completed update on timeout (#96205) #96340, fix(tests): make the test suite pass on native Windows, run the full suite in Windows CI #96458, feat(update): support exact commit cutoffs #97056, fix(desktop): preserve transcript continuity across reconnects #99662. None implements this durable-log/host-replay split. fix(update): stop Windows installers from killing in-flight updates #95719 adds child-environment state inside Invoke-HermesStep; fix(feishu): fix DM approval card button unresponsive in direct messages #95156 carries a broad stale version of the same function. Whichever lands later must preserve the default-true replay parameter and the single pipeflood opt-out.
• Merge order: standalone; no dependency. Later same-file PRs rebase onto current main and retain their own disjoint mechanisms.

Fixes #95971

Prior Work / Attribution

Prior credit - the humans whose work this builds on, before anyone else:

• @kgice918 - reported the original Windows pipe-EOF deadlock and supplied the decisive handoff-log evidence (Windows: Desktop update hand-off hangs forever when gateway stays resident (windows.ps1 waits on ReadToEndAsync that never sees EOF) #90455).
• @jackulau - proved pipe EOF outlives process exit, built the bounded chunked drain, and added the first executable -SelfTestPipeDrain fixture (fix(update): bound the Windows update hand-off's step pipe drain #90564).
• @OutThisLife - preserved that work and added the unmetered flood arm in the merged implementation (fix(update): Windows Desktop updates finish instead of parking on "Updating Hermes" #90937).
• @fangliquanflq - added the live-child stall watchdog and job-object cancellation proof (fix(update): recover stalled Windows desktop handoffs #95625).
• @teknium1 - integrated the watchdog work with preserved credit (fix(update): Windows desktop update stall watchdog + fleet-check false failure #95897), retained the hosted-runner evidence, and filed this fixture transport defect (SelfTestPipeDrain fixture hangs on hosted windows-latest runners (passes on native Windows) #95971).

Related work searched (multiple methods, all states, before finalizing this PR):

• GraphQL dedup - PR/issue graph (SelfTestPipeDrain, pipeflood, Invoke-HermesStep, windows.ps1, host-console replay): no open PR implements this replay split; the current same-file collision set is listed above.
• Source-tree search of scripts/desktop-update/windows.ps1 and the Windows handoff tests confirmed Write-HandoffLog, Invoke-HermesStep, and the pipeflood arm are the complete relevant path.
• External search for SelfTestPipeDrain / pipe-drain evidence found the original Windows: Desktop update hand-off hangs forever when gateway stays resident (windows.ps1 waits on ReadToEndAsync that never sees EOF) #90455/fix(update): bound the Windows update hand-off's step pipe drain #90564/fix(update): Windows Desktop updates finish instead of parking on "Updating Hermes" #90937 lineage and the retained Actions evidence attached to fix(update): Windows desktop update stall watchdog + fleet-check false failure #95897/SelfTestPipeDrain fixture hangs on hosted windows-latest runners (passes on native Windows) #95971.
• File-collision dedup: both changed paths were checked against every open PR updated since the prior complete census, with nested file connections fully paginated; no new exact output-replay or flood-call implementation exists.

Unlinked related work (stars not bound to this PR by keywords):

• @jackulau - fix(update): bound the Windows update hand-off's step pipe drain #90564 [CLOSED] - original bounded-drain implementation and fixture, superseded with preserved credit.
• @OutThisLife - fix(update): Windows Desktop updates finish instead of parking on "Updating Hermes" #90937 [MERGED] - shipped the bounded drain and flood proof now refined here.
• @fangliquanflq - fix(update): recover stalled Windows desktop handoffs #95625 [CLOSED] - watchdog source later integrated through fix(update): Windows desktop update stall watchdog + fleet-check false failure #95897.

Builds on: @jackulau (#90564), @OutThisLife (#90937), @fangliquanflq (#95625), and @teknium1 (#95897/#95971).
Merge-order / dependency: standalone; later same-file work must preserve this default-true parameter and fixture-only opt-out.
Duplicates: none; the live FILE-LIST and behavior searches found no existing PR that separates durable capture from host-console replay.

[Enough1122]

AI code review — automated review for reference; please use your judgment.

• Sensible change: Invoke-HermesStep gains -EchoCapturedOutput so the self-test flood arm no longer replays its output to the host console, avoiding GitHub Actions throttling, while the hand-off log still retains full output (scripts/desktop-update/windows.ps1:1132).
• Default stays $true, so production callers are unaffected; only the self-test opts out.
• New test assertions are consistent: flood output must NOT appear in stdout, pipeflood| lines MUST be in the hand-off log, and emitted stdout stays under 64KB.
• Minor: Write-HandoffLog positional-arg calls with the -f formatted string rely on -f binding $Tag, $ln as a single array operand due to the parens — correct, but explicit -Message/-EchoToHost would be less fragile.