Sealed installs (desktop bundled, docker, nix) do not run hermes update.
Their user state did not get the post-update steps. This change adds a
boot-time check that closes the gap.
At boot, the code compares two facts. The current identity is the commit
of the install (install-stamp.json for sealed trees, .git/HEAD for
checkouts). The last-known identity is stored in a record file under
install-bootstrap/. When the two match, the boot pays two file reads.
When they differ, the boot runs the idempotent steps from
hermes_cli/post_update.py under a single-flight lock, then writes the
record.
Records have two scopes. The home record follows HERMES_HOME, so each
profile bootstraps its own config, skills, and state.db. The machine
record is anchored to the default home, so machine-global steps (the
cua-driver refresh) run one time per machine per code change.
hermes update writes both records after a good update. The next boot
then skips the steps that update already ran.
Boot hooks: gateway startup, serve/dashboard startup, interactive CLI
start. The hooks never raise and are not in the version fast path.
ethernet