fix: harden Windows updater restart handoff

[eWOOD29]

Status

Independent exact-snapshot technical and canonical-record review complete — RESULT: PASS; Gate 1 merge approval ready.

PR #8 remains open, draft, and unmerged. No merge, beta.2 preparation/publication, release-asset change, or live updater operation is authorized.

Exact snapshot

• Required base: 6148ecd84cccfbad69e4ac94899311c87745a1e7
• Base tree: 78e70a24f2869a9719607f26da039745482bf745
• Prior evidence-failed head: c54be2a629deef3dbd79a2d55a0df140acd17a5b
• Prior process-identity-failed head: f38a56e2c897eb3094eb37180ae4862a8607f7a0
• Current frozen head: 9265cc0ad407f27755d6abcf248168b9291689f4
• Current frozen tree: 03d4c63b9c03ab86532aa40893557cc3ad68c8f9
• Ancestry against required base: 7 ahead / 0 behind
• Exact-head CI: 31898113799 — SUCCESS

Review history and remediation

The original implementation at 6aa3779d… had two production P0 defects: retained exited Windows process objects could be accepted as live startup owners, and failed recovery could relaunch an installation not re-established as trusted. Both were fixed at production remediation head 3e2d60adb12e14c482f1ab270e1b3c4f287565cf and independently closed.

The later evidence head c54be2a… failed because normal Windows/Hermes python can expose a launcher as Popen.pid while a descendant owns the listening socket, and because test-owned Popen objects were not reliably reaped.

Head f38a56e2… corrected launcher-tree attribution and reaping, but a fresh independent review found that full ProcessIdentity equality still treated mutable parent_pid and executable observations as identity. A reparented process with unchanged PID and creation time could therefore be falsely classified as absent. The same review required durable native-boundary controls.

The current append-only remediation at 9265cc0a…:

• centralizes stable identity as exactly (pid, creation_time);
• preserves parent PID and executable only as diagnostics;
• uses stable identity for root anchoring, survivors, and listener-tree membership;
• rejects stale/reused numeric PIDs with changed creation time;
• adds deterministic reparenting and listener PID-reuse controls;
• adds fail-closed controls for Process32FirstW, Process32NextW, OpenProcess, and GetProcessTimes failures;
• preserves genuine subprocess rollback/finalization proof and explicit process reaping.

A fresh final independent technical re-review of 9265cc0a… explicitly closed both prior P1/P2 technical findings. Its only blocking result was that this PR body and the Project Hub had not yet been reconciled to the new snapshot; this update addresses that record-only gate without changing code.

Exact changed-file scope

Exactly eight files differ from required develop:

1. appdock.py
2. scripts/update_helper.py
3. tests/test_generation9_remediation.py
4. tests/test_update_real_finalize_rollback_process.py
5. tests/test_update_real_rollback_process.py
6. tests/test_update_restart_handoff_regression.py
7. tests/test_windows_process_tree_deterministic.py
8. tests/windows_process_tree.py

The current remediation commit changes only the four test/evidence files numbered 4, 5, 7, and 8.

Production code is unchanged after 3e2d60adb12e14c482f1ab270e1b3c4f287565cf:

• appdock.py: b9aa89cbf4c3d0317ddd54905186536b0522521b
• scripts/update_helper.py: aa85150b10427f65ac74930eba265887fe8a48e9

Local Windows validation

All process runs used ResourceWarning as an error.

• Deterministic process-identity/native controls: 9 tests, OK
• Normal Hermes handoff regression: 8 tests, OK
• Normal Hermes rollback and finalization real-process tests: PASS, including three repeated iterations in final independent review
• Direct Python 3.11 focused controls: PASS
• Direct Python 3.13 focused controls: PASS
• Full normal Hermes Python 3.11 suite: 222 tests, OK
• Full direct Python 3.11 suite: 222 tests, OK
• Full direct Python 3.13 suite: 222 tests, OK
• No attributable ResourceWarning or subprocess is still running warning
• Changed-file Ruff, compile, JavaScript 4/4, privacy, and docs: PASS

The normal Hermes launcher topology was independently reproduced: the Popen.pid launcher had a different descendant PID owning the disposable listener; stable identity correctly attributed it to the owned tree and cleanup removed it.

Exact-head CI

Run 31898113799 is bound to 9265cc0ad407f27755d6abcf248168b9291689f4 and completed SUCCESS, with all 10 jobs passing:

• Windows Python 3.11 and 3.13: 222 tests, OK each
• Ubuntu Python 3.11 and 3.13: 222 tests, OK each
• Raw logs: zero ResourceWarning; zero subprocess is still running
• Compile, JavaScript, privacy/secret, and documentation: PASS
• Windows portable build/inspection/privacy/install/uninstall: PASS
• Ubuntu portable build: PASS
• Windows/Ubuntu package-byte and ZIP-metadata equality: PASS
• Windows private fixtures on both hosts: PASS
• Private preview/discovery/ZIP-byte equality: PASS

Informational only: GitHub forced older Node 20 artifact actions onto Node 24; no gate was affected.

Safety and approval gates

The live machine remains healthy on managed v0.2.1 / Stable. Startup, Tailscale, channel, private state, and retained beta.1 failure evidence remain preserved.

A final different record-aware independent verifier directly read the current PR body and authenticated Google Docs Project Hub, confirmed no branch drift or remaining technical/record blocker, and returned RESULT: PASS.

Recommended next action: Ethan may explicitly authorize Gate 1: merge PR #8. Gate 1 authorization must not be treated as authorization to prepare/publish beta.2 or run the live updater. After merge, beta.2 preparation/release readiness is a separate bounded phase and Gate 2; any live updater run is Gate 3.