archive(update): retain PyYAML/native-lock invariant without reviving July topology

[andrexibiza]

Disposition

Closed unmerged as an invariant-only historical witness. The July implementation is preserved for provenance; it is not a current updater delivery owner and must not be blindly rebased or merged.

Historical branch object: 061eac74e84226487f0d5f9f566a78e278379a3f

Surviving invariant

A Windows updater must not execute from mutable or native artifacts owned by the deployment generation it is replacing. Importing PyYAML in the mutating process can keep its native module mapped; a failed replacement may leave an importable but structurally incomplete yaml package. Importability, process coordinates, and a successful installer exit are not settlement proof.

Current delivery topology

• #91277 — architecture / phase-order owner.
• #91316 — deployment-plan admission owner; binds deployment root, source/target generation, component scope, and plan digest before mutation.
• #91895 — active generation-fenced deployment transaction owner; carries durable mutation authority through source-boundary settlement.
• #91913 — machine-readable proof-carrying-authority interlock; records archive(update): retain PyYAML/native-lock invariant without reviving July topology #60233 with disposition invariant_only and prevents narrative promotion back into current-main closure.

#60233 historical PyYAML/native-lock witness
  → #91316 deployment-plan admission
  → #91895 durable generation-fenced mutation authority

What does not survive

The old main.py dispatch split, config bypasses, gateway stop/kill heuristics, duplicate installer logic, and parallel transaction ownership are retired. Any remaining acceptance witness must be composed into the current admission/transaction lane rather than reopening this branch as a third updater.

Historical test or CI results remain evidence for their exact historical objects only; none transfer to current main or to #91316/#91895.

[teknium1]

Thanks for tracing the PyYAML native-extension failure mode. The premise is present on current main: startup imports yaml at hermes_cli/main.py:548, and cmd_update() imports hermes_cli.config at hermes_cli/main.py:9416.

Problems

• The new None if _windows_update_import_minimal() branch at hermes_cli/main.py:9492 skips _pause_windows_gateways_for_update(). Current main deliberately pauses gateways before _detect_venv_python_processes() (hermes_cli/main.py:9585, 9604-9609). A running gateway is a detected venv holder (tests/hermes_cli/test_update_venv_health.py:145-166), so this path aborts before dependency repair.
• tests/hermes_cli/test_update_import_minimal.py:50 replaces _cmd_update_impl with a no-op, so it cannot cover that changed ordering.

Suggested changes

• Preserve the gateway-pause-before-holder-check guarantee with a dependency-light implementation suitable for the PyYAML-free path, and cover an active gateway regression.

Automated hermes-sweeper review.

[teknium1]

This bypasses the existing gateway pause, but the later venv-holder guard is still active. A running Windows gateway will be detected as a venv Python holder and the update exits before dependency synchronization. Preserve the pause-before-holder-check guarantee with a PyYAML-free mechanism.

[andrexibiza]

Fixed in 65925bc. The Windows minimal-update path now preserves the existing pause-before-holder-check ordering. _pause_windows_gateways_for_update() delegates to a PyYAML/config-free implementation on that path, stops active venv-backed gateway run processes, and returns the existing resume-token shape; the normal gateway pause path is unchanged.

Added regressions that (1) execute the real _cmd_update_impl() far enough to assert pause -> holder check, and (2) prove an active gateway is stopped by the minimal helper without importing yaml.

Validation: 46 passed, 1 skipped across the update import/venv-health/concurrent-quarantine suites; Ruff and git diff --check pass.

[andrexibiza]

Rebased onto current main (a6defd4) — was CONFLICTING, now MERGEABLE. Commits 76fdb5f (PyYAML-free Windows update import path) + 638d2a8e (pause gateways before venv holder check) replayed on top of main with conflicts resolved. Verified: tests/hermes_cli/test_update_import_minimal.py + test_update_venv_health.py = 22 passed / 0 failed via scripts/run_tests.sh (incl. the win32 subprocess test that blocks yaml imports during hermes update), ruff clean.

[andrexibiza]

Current topology — invariant retained, July implementation not revived

#91913 now records this PR as an invariant_only fossil in the modern updater graph:

#60233 historical PyYAML/native-lock witness
  → #91316 deployment-plan admission
  → #91895 durable generation-fenced mutation authority

The surviving architecture rule is broader than the original import list: the actor mutating a deployment generation must not execute from mutable or native artifacts owned by that target generation. The focused early-import test remains useful acceptance evidence, but this historical branch is not a third updater delivery owner.

Contract PR: #91913
Exact contract head: 170a3a0e67034abd7d6a2c69a16c292b4781720f.