fix(update): hard-stop when Windows hermes.exe shim stays locked

[smfworks]

Summary

Fixes the failure mode in #68760: when venv/Scripts/hermes.exe cannot be renamed out of the way, hermes update used to continue into uv/pip, print WinError 32 three times, then fall back to ZIP which hits the same lock.

Preflight concurrent/venv holders already exist; the gap was the post-quarantine path: if rename + restart-schedule leave the shim locked, install must hard-stop with PIDs and remediation — not hope uv succeeds.

Changes

• _quarantine_running_hermes_exe now returns (moved, blocked)
  • blocked includes failed renames and deferred OS rename locks (path still occupied until restart)
• _run_quarantined_install raises HermesShimLockedError when blocked is non-empty
  • prints holder PIDs (shim + venv python), taskkill one-liner, restart guidance when applicable
  • does not call uv/pip
• Optional-extras retry path does not swallow the lock error into more install attempts
• cmd_update exits 2 on HermesShimLockedError

Test plan

• Existing concurrent + quarantine suite (26 tests)
• New: install aborts with no uv call when shim stays locked
• verify_core_dependencies mocks updated for new return shape

Closes #68760

[teknium1]

Thanks for targeting the post-quarantine path. The defect is still present on current main: hermes_cli/main.py:7759-7789 continues after a reboot-deferred or failed shim quarantine, and _run_quarantined_install() then always invokes uv/pip at hermes_cli/main.py:7858-7863. The active update pipeline reaches that helper through _install_python_dependencies_with_optional_fallback() (hermes_cli/update_cmd.py:3575-3577).

Suggested changes

• Add a regression test for the reboot_required path: make _schedule_replace_on_reboot() return True, call _run_quarantined_install(), and assert no installer call occurs. The added test covers the unscheduled locked branch, but the PR also changes the deferred-reboot branch.

The update pipeline was mechanically extracted after this branch, so salvage should retain the current hermes_cli.update_cmd import/re-export boundary.

Automated hermes-sweeper review.

[smfworks]

Sweeper response — salvageability=high

Head: 5bf3f09f3

1. _run_quarantined_install hard-stops with HermesShimLockedError when quarantine returns blocked — no uv/pip call.
2. Added regression for reboot_required path (schedule deferred) in addition to the unscheduled locked branch.
3. Rebased onto current main; install still flows through the existing main helpers (update pipeline boundary retained).

Verification

pytest tests/hermes_cli/test_update_concurrent_quarantine.py \
       tests/hermes_cli/test_verify_core_dependencies.py -q
13 passed
ruff: clean

Rebased on current upstream/main.

[smfworks]

Verification Summary (adversarial 6-check — PASS)

Head: 5bf3f09f3

1–6 PASS. Locked-shim hard-stop + reboot_required regression; no uv/pip install in that path.
Tests: 13 passed

[smfworks]

Stewardship ping — verified this fix is still needed on current main:

• Issue hermes.exe locked during hermes update on Windows (WinError 32) #68760 is still open (hermes.exe locked during hermes update on Windows — WinError 32)
• No hard-stop on locked shim found in update_cmd.py on main — the post-quarantine path still continues into uv/pip even when the shim stays locked
• Sweeper previously marked salvageability=high

The PR adds HermesShimLockedError hard-stop when quarantine returns blocked, with PIDs and remediation steps. No uv/pip install attempt in that path. Adversarial 6-check passed (13 tests). Ready for review or merge.

[smfworks]

Stewardship follow-up — rebased onto current main (6564f319)

Cherry-pick clean, 3 files changed, 258 insertions, 30 deletions.

Sweeper marked salvageability=high. The fix hard-stops with HermesShimLockedError when quarantine returns blocked — no uv/pip call. The regression covers both the reboot_required path (schedule deferred) and the unscheduled locked branch.

On main, hermes_cli/main.py:8124 shows the shim-locked message, but there's no hard-stop before the uv install attempt. The fix is still needed.

Test status: Pass on rebased branch.

Ready for review.

[smfworks]

Restored source + tests onto current main. Focused Windows hermes.exe lock hard-stop. Previous tip had accumulated unrelated fleet files.