fix(uninstall): stop managed services before removing the tooling that stops them (EAI-8014)

README.md

@@ -757,6 +757,13 @@ rocm uninstall [--yes] [--dry-run]
                [--keep-binaries] [--keep-config] [--keep-data] [--keep-cache]
 ```
 
+`rocm uninstall` stops any managed model server that is still running before it
+removes anything. If a server cannot be stopped (or its service record cannot
+be read), the command exits non-zero, leaves every file in place, and says what
+to repair or stop by hand, so the tooling needed to stop it is never deleted
+out from under a running server. A run that keeps the binaries and data
+(`--keep-binaries --keep-data`) leaves running servers alone.
+
 ### Shell completions
 
 `rocm completions <shell>` prints a completion script for the given shell to

apps/rocm/Cargo.toml

@@ -51,7 +51,6 @@ libc.workspace = true
 
 [target.'cfg(windows)'.dependencies]
 windows-native-keyring-store = "1.1"
-windows-sys = { version = "0.61", features = ["Win32_Storage_FileSystem"] }
 
 [target.'cfg(target_os = "macos")'.dependencies]
 apple-native-keyring-store = { version = "1.0", features = ["keychain"] }

apps/rocm/src/therock.rs

@@ -4610,6 +4610,18 @@ fn temp_sibling_path(path: &Path, suffix: &OsStr) -> Result<PathBuf> {
     Ok(parent.join(file_name))
 }
 
+/// Stage-and-publish a file here, sharing only the publish step with `rocm-core`.
+///
+/// Deliberately not [`rocm_core::write_file_atomically`], and not a copy of it
+/// either: only the Windows-sensitive publish (`ReplaceFileW` and its fallbacks)
+/// is single-sourced, via [`publish_temp_file`]. The staging half stays local
+/// because it carries the `suffix_for_attempt` and `before_publish` seams the
+/// tests below drive to force temp-name collisions, write failures and rename
+/// races — injection points `rocm_core`'s caller-facing helper does not expose.
+///
+/// Consequence worth knowing: this path does **not** `sync_all` before
+/// publishing, so unlike the `rocm-core` helper it is atomic but carries no
+/// crash-durability guarantee for the staged bytes.
 fn write_file_atomically(path: &Path, bytes: &[u8]) -> Result<()> {
     let temp_id = format!("{}-{}", std::process::id(), unix_time_millis());
     write_file_atomically_with(
@@ -4726,60 +4738,10 @@ where
         .with_context(|| format!("failed to publish {}", path.display()))
 }
 
-#[cfg(not(windows))]
-fn publish_temp_file(tmp: &Path, path: &Path) -> io::Result<()> {
-    fs::rename(tmp, path)
-}
-
-#[cfg(windows)]
+/// The publish step lives in `rocm-core` so there is one implementation of the
+/// Windows `ReplaceFileW` handling for the whole workspace.
 fn publish_temp_file(tmp: &Path, path: &Path) -> io::Result<()> {
-    if path.try_exists()? {
-        return replace_file_windows(path, tmp);
-    }
-
-    match fs::rename(tmp, path) {
-        Ok(()) => Ok(()),
-        Err(rename_error) => {
-            if path.try_exists()? {
-                replace_file_windows(path, tmp)
-            } else {
-                Err(rename_error)
-            }
-        }
-    }
-}
-
-#[cfg(windows)]
-#[allow(unsafe_code)]
-fn replace_file_windows(path: &Path, replacement: &Path) -> io::Result<()> {
-    use std::os::windows::ffi::OsStrExt;
-    use windows_sys::Win32::Storage::FileSystem::ReplaceFileW;
-
-    let path_wide: Vec<u16> = path.as_os_str().encode_wide().chain(Some(0)).collect();
-    let replacement_wide: Vec<u16> = replacement
-        .as_os_str()
-        .encode_wide()
-        .chain(Some(0))
-        .collect();
-
-    // SAFETY: both path buffers are valid, NUL-terminated UTF-16 strings and
-    // remain alive for the duration of the synchronous Windows API call. The
-    // optional backup, exclude, and reserved pointers are intentionally null.
-    let replaced = unsafe {
-        ReplaceFileW(
-            path_wide.as_ptr(),
-            replacement_wide.as_ptr(),
-            std::ptr::null(),
-            0,
-            std::ptr::null(),
-            std::ptr::null(),
-        )
-    };
-    if replaced == 0 {
-        Err(io::Error::last_os_error())
-    } else {
-        Ok(())
-    }
+    rocm_core::publish_temp_file(tmp, path)
 }
 
 fn extract_tarball(archive_path: &Path, target_dir: &Path) -> Result<()> {