Phase 10.2B: planned-stop runtime correction (stdlib-only marker protocol + H3 standalone stop)

[yshen92]

Phase 10.2B planned-stop runtime correction

This PR provides the minimal Phase 10.2B correction needed for a standalone H3 stop to cleanly stop the immutable deployed R0 gateway before the candidate checkout.

It keeps the ordinary planned-stop wire format intact and reuses R0's existing takeover marker as the standalone stop intent channel. That marker is intentionally invisible to R0's planned-stop filesystem watcher, so the actual service-manager SIGTERM is the first shutdown-handler invocation and R0 consumes the intent as planned. The candidate runtime also retains a compact monotonic planned-shutdown classification so a planned shutdown cannot be downgraded by a duplicate later signal after upgrade.

Runtime identities

• Phase base runtime identity: fe085446b864cb7d31f57499e407ce0f7275c511
• Immutable deployed R0 consumer: 01edcadbd194f81bd7eceb9ca267737830ce24c0
• Current candidate / PR head: e6982c8b7e25367c9cfb15d8b95da185feb7fc23
• Commit count on the Phase base: 4
  • 2bc81537c1 — extract the planned-stop protocol into a stdlib-only module
  • 287f132ec8 — suppress the Windows-footgun lint on the Linux-gated liveness probe
  • bd3c22d29e — preserve planned classification across duplicate shutdown notifications in the candidate runtime
  • e6982c8b7e — make the standalone stop cleanly stop immutable exact R0 without the watcher race
• Standalone helper: gateway/planned_stop_protocol.py
• Helper blob OID: 246e57e3e9a341b7343fc0b4067efba89b18ac5e
• Helper file SHA-256: 433022971acac19388eff86a07c6ca2037e772b82be121563c41f5ccbaa1c73f

Exact failure and correction

Live H3 qualification was run against the earlier candidate 287f132ec8410bff19a8cfd553ab1b0bf7f90dd1. Step E wrote a valid ordinary planned-stop marker and systemctl --user stop hermes-gateway.service returned success, but immutable R0's watcher invoked shutdown_signal_handler(None) first and consumed that marker. About 6.9 ms later, systemd's real SIGTERM invoked the handler again with no marker remaining, which latched an unexpected shutdown and produced Result=exit-code, ExecMainStatus=1. The transaction stopped at Step E; the candidate was not checked out or deployed.

The standalone helper now writes R0's already-supported .gateway-takeover.json record before issuing the same single systemctl --user stop. R0's watcher does not observe that filename. The subsequent real SIGTERM consumes the takeover record and follows R0's clean planned/takeover exit path. No sleep, retry, service-policy change, or H3 expectation workaround is involved.

Protocol and safety guarantees

• The ordinary four-field planned-stop marker remains target_pid, target_start_time, stopper_pid, written_at; PID/start-time and TTL checks are unchanged.
• The takeover record uses R0's existing schema and validation. Its shared builder was moved into the stdlib-only protocol module, with gateway/status.py delegating to it to avoid parallel implementations.
• The helper remains stdlib-only and suitable for <absolute-python> -I -S -B - over stdin.
• Linux host/user/service identity, manager-reported HERMES_HOME, /proc start-time, path-containment, and stale-marker protections remain fail-closed.
• There is no filesystem mutation before the intent write, followed by exactly one /usr/bin/systemctl --user stop hermes-gateway.service invocation.
• Windows candidate-runtime watcher behavior and ordinary planned-stop behavior remain covered and unchanged.

Qualification and review history

• The failed live H3 run above exposed the immutable-R0 watcher/SIGTERM race in the prior candidate.
• New deterministic tests execute the exact historical R0 gateway/run.py blob (24d501b5b752fe37d201843990847d1bbd306a8d) and gateway/status.py blob (ce02648a958f9a281303dd825ad45b2fdc8eb046). They first reproduce the old watcher-first failure, then drive the current standalone helper through the exact R0 shutdown handler and assert the clean manager-equivalent result: ActiveState=inactive, Result=success, ExecMainCode=1, ExecMainStatus=0.
• Candidate-runtime regression coverage still proves handler(None) -> handler(SIGTERM) remains planned, while a standalone unmarked SIGTERM remains unexpected/non-zero.
• Relevant planned-stop, standalone, exact-R0 compatibility, shutdown/signal, restart, takeover/replace, status, and Windows suites pass locally: 185 passed, 0 failed. One Linux /proc parity test is skipped on macOS; its exact-R0 compatibility siblings execute against the pinned historical blobs.
• ruff, py_compile, and git diff --check pass.
• A Luna adversarial review found no remaining lifecycle, immutable-R0, protocol, takeover, or scope defect in the corrected diff.
• CI for the current head is running; completed checks are green at the time of this update.

No hermes-config, H3 runner, Phase 10.2B binding, or deployment files are changed by this PR. A fresh adversarial review, authority rebind, readiness/authorization cycle, and live H3 rerun are still required.

Do not merge. Keep this PR open as input to the next Phase 10.2B binding.

[yshen92]

PR #2: APPROVED for Phase 10.2B planned-stop runtime-correction scope.

[yshen92]

Closing without merge following the 2026-08-21 Dev-Review v2 strategic reassessment. Restricted-worker/H3 hardening is now Deferred, Evidence-Triggered and is no longer a prerequisite for framework activation. This PR and its exact reviewed commit are retained as historical/future hardening evidence; the branch should not be deleted. If the capability is needed again, reassess it against the then-current Hermes runtime/upstream rather than automatically resuming this deployment path.