߲j0UdZddlZddlZddlZddlZddlZddlZddlmZddl m Z m Z m Z e rddl mZejdZdZdZd Zd Zd Zej,eZdaej2Zd ad ed<deddfdZde efdZde efdZ de!fdZ"de!fdZ#GddZ$ejJZ&ded<ej2Z'de(fdZ)de$fdZ*y)a"Read-connection budgeting for SessionDB's WAL read path: per-file and process-wide permit ceilings plus a descriptor-headroom gate, so N handles on one state.db cannot walk the process into EMFILE. Idle pooled connections keep their permit and are reclaimable across peers on the same path.N)Path) TYPE_CHECKINGIteratorOptional) SessionDB hermes_state@g?)gNztuple[float, Optional[int]]_fd_usage_cachepidreturnzIterator[tuple[str, str]]c#Kd|d}tj|D]#}|d|} tj||f%y#t$rY2wxYww)zYield ``(readlink target, fd path)`` for every entry in /proc//fd (unreadable links skipped). Raises OSError when the fd directory itself cannot be listed.z/proc/z/fd/N)oslistdirreadlinkOSError)rfd_dirfdfd_paths :/home/ubuntu/.hermes/hermes-agent/hermes_state_readpool.py_proc_fd_targetsrHsjcU# Fjj HAbT" ++g&/ /   s(&AAA AAAAcdD]"} ttj|cSy#t$r<}|jtj tj fvrYd}~yYd}~fd}~wwxYw)zOpen descriptors in THIS process; None when unmeasurable (Windows: no fd dir, correctly inert); -1 when the probe itself hit EMFILE/ENFILE (no headroom).)z /proc/self/fdz/dev/fdN)lenrrrerrnoEMFILEENFILE)rexcs r_open_fd_countr"Tsd/ rzz&)* *  yyU\\5<<889 s) A.,A))A.c ddl} |j|j\}}||jdfvryt|S#t$rYywxYw#tt t f$rYywxYw)zFThe process's soft RLIMIT_NOFILE, or None when there is no usable one.rNr) resource ImportError getrlimit RLIMIT_NOFILEAttributeErrorr ValueError RLIM_INFINITYint)r$soft_hards r_fd_soft_limitr.`sy(()?)?@ e &&++ t9  GZ 0s"AA A  A A'&A'c2t}|ytj}t5t\}}|duxr ||z t k}dddst }t5||fadddy|dk\xr ||z tkDS#1swY>xYw#1swY+xYw)zCan the process spare a descriptor for a new read connection? Fails OPEN when unmeasurable (refusing every read would be a self-inflicted convoy); fails CLOSED only on evidence (measured shortfall or a starved probe).NTr)r.time monotonic_fd_usage_lockr _FD_USAGE_CACHE_SECONDSr"_FD_HEADROOM_RESERVE)r,nowstampcachedfreshs r_fd_headroom_okr9os  D | .. C O' vd"Ne 7N'NO !  ,"FmO , ~ Q; AD6M-AAAOO  , ,sBB B  Bct5ttj}dddt dDS#1swYxYw)zClose one idle read connection on ANY path: the process ceiling is shared across files, so a quiet profile must not hold descriptors a busy one needs.Nc3<K|]}|jywN) reclaim_idle).0budgets r z3_reclaim_idle_read_conn_anywhere..s;v""$;)_read_budgets_locklist _read_budgetsvaluesany)budgetss r _reclaim_idle_read_conn_anywhererHs@ /}++-./ ;7; ;;//s ?AcneZdZdZddZddZddZdddefd Zdd Z defd Z dddefd Z dd ddefdZ y)_PathReadBudgetu Read-connection permits for ONE database file, shared process-wide (per-instance semaphores let N SessionDBs peak at N x (1 + MAX)). An idle pooled connection keeps its permit, so a permit miss first reclaims an IDLE connection from a peer on the same path. ``_READ_POOL_MAX`` used to be enforced by a ``BoundedSemaphore`` owned by each SessionDB, which bounded the wrong noun: the descriptors are spent on a *file*, so N SessionDB objects on one state.db each got their own allowance and peak scaled as ``N x (1 + _READ_POOL_MAX)``. A long-lived gateway holds at least two (``SessionStore`` and ``GatewayRunner`` open independent handles per profile path) and the count grows with the profile count, which is how a healthy process walked into EMFILE — #98573. rNctjt|_tj|_t j|_d|_ y)NF) threadingBoundedSemaphore_READ_POOL_MAXpermitsLock_lockweakrefWeakSet_members_duplicate_handles_warnedselfs r__init__z_PathReadBudget.__init__s8 11.A ^^% 6=oo6G ).&rc|j5|jj|td|jD}|tkDxr |j }|r2d|_dj td|jD}dddr(tjd|jtyy#1swY4xYw)Nc3PK|]}|js|jd yw)N) read_only_connr>members rr@z+_PathReadBudget.register..s*''FLL,Ds$&Tz, c3NK|]}|jr|jywr<)r]_creation_siter_s rr@z+_PathReadBudget.register..s#2.4VM]M]F))2s%%z%d live SessionDB handles on %s in this process; each holds its own writer connection (read connections are capped at %d for the file). A long-lived process should share one handle per path. Created at: %s) rQrTaddsum_HANDLES_PER_PATH_WARNrUjoinsortedloggerwarningdb_pathrN)rWdbhandleswarncreation_sitess rregisterz_PathReadBudget.registers ZZ  MM  b ! $ G44[T=[=[9[D15."&628< 2," "  NN !^^  #  s BCC c||j5|jj|dddy#1swYyxYw)zERemove a closed writer from duplicate-handle diagnostics immediately.N)rQrTdiscard)rWrks r unregisterz_PathReadBudget.unregisters0 ZZ & MM ! !" % & & &s2; requesterctst5tdz adddy|jsy|j |ryt j y#1swYyxYw)zTake a permit for a new read connection, or refuse (caller degrades to the locked writer connection). Gates, broadest first: fd headroom, process ceiling, this file's ceiling.r\NFT)r9rB_read_open_denied_fd_headroom_acquire_process_permit_acquire_path_permit_process_read_permitsreleaserWrss racquirez_PathReadBudget.acquires] # 3-2- 3++-  $ $Y /%%' 3s AA%c`|jjtjy)zCReturn one connection's permits. Pairs with a successful acquire().N)rOryrxrVs rryz_PathReadBudget.releases %%'rYcvtjdxs"txrtjdS)NFblocking)rxr{rHrVs rrvz'_PathReadBudget._acquire_process_permits8$,,e,< , . `3H3P3PZ_3P3` rYc|jjdxs0|j|xr|jjdS)NFr~)exclude)rOr{r=rzs rrwz$_PathReadBudget._acquire_path_permitsJ||##U#3   i  0 YT\\5I5ISX5I5Y rYrzOptional[SessionDB]c|j5|jDcgc] }||us| }}dddtdDScc}w#1swY xYw)zClose one idle pooled connection held by a member; True if one went. Its release() returns both permits, so both ceilings reclaim through here.Nc3<K|]}|jywr<)_evict_one_idle_read_connr_s rr@z/_PathReadBudget.reclaim_idle..sL&6335LrA)rQrTrF)rWrrkmemberss rr=z_PathReadBudget.reclaim_idlesYZZ H$(MMGbRw5FrGGG HLGLLLH H Hs A  AAA A  A)rN)rkrrNr<) __name__ __module__ __qualname____doc__rXrorrboolr{ryrvrwr=rYrrJrJse /B&  (    k d M$9MTMrYrJz1weakref.WeakValueDictionary[str, _PathReadBudget]rDc| tt|jS#t$rt|cYSwxYw)z9Canonicalise a db path so two spellings share one budget.)strrresolver)rjs r_read_budget_keyrs84=((*++ 7|s !$;;ct|}t5tj|}|t }|t|<|cdddS#1swYyxYwr<)rrBrDgetrJ)rjkeyr?s r_read_budget_forrsN 7 #C ""3' >$&F!'M#  s ,AA)+rrloggingrrLr0rRpathlibrtypingrrrrr getLoggerrhrN_READ_POOL_PROCESS_MAXrer4r3rMrxrurPr2r __annotations__r+rr"r.rr9rHrJWeakValueDictionaryrDrBrrrrrYrrs<C    44&   > * 2 223IJ!"!1<.< # "=     BB*<$<_M_MHGbgFaFaFc Bd#Y^^%rY