+ jHjsaR\t0tRt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIt^RIt^RIHt^RIHtHt^RIHt^RIHt^RIHtHt^RIHtHtH t H!t!H"t"H#t#H$t$H%t%H&t&^RI'H(t)H*t+H,t-H.t/H0t0H1t2^R I3H4t4^R I5H6t6^R I7H8t8H9t9H:t:H;t;Ht>H?t?H@t@HAtAHBtBHCtCHDtDHEtEHFtFHGtGHHtHHItIHJtJHKtK^R ILHMtMHNtNHOtOHPtPHQtQHRtRHStS^RITHUtUHVtVHWtW^RIXHYtY^RIZH[t[H\t\^RI]H^t^^RI_H`t`^RIaHbtb^RIcHdtd^RI3te^RIftg^RIhHiti^RIjHktkHltlHmtmHntnHotoHptpHqtqHrtrHstsHtttHutuHvtvHwtw^RIxHyty^RIzH{t{^RI|H}t}^RI~Ht^RIHt^RIHtHtHtHt^RIHtHtHt^RIHt^RIHt^R IHt^R!IHt^R"IHt^R#IHt^RIt]EP2!]4tR$t]3R%R&lltR'R(ltR)R*lt!R+R,]4t!R-R.]4tR/R0lt]!R1R204t]%!R34t]!4R4, ;ttR5t^R6uttR7tR8R9ltR:tR]t]^kR;R<ltR=R:/R>R?lltR^tR@RAltRBRClt] EPj!RD4tRERFltRGRHltRItRJtRKtRLtR_RMR:/RNROlllt]!4t]^k]EP!4tRPt] EPRQ8HtRRRSltRTRUltRVRWlt!RXRY]Y][]]d]^]`]]]]]]y]{]}]]]b4t!RZR[4tR# ]dRtELDi;i)`a-SQLite state store for Hermes Agent: session metadata, message history, model config, FTS5 search. WAL mode (concurrent readers + one writer); compression splits sessions via parent_session_id chains; sessions are source-tagged ('cli', 'telegram', ...). Batch-runner / RL trajectories live elsewhere. N)deque)contextmanagersuppressPath) make_user_dir)get_hermes_homemkdir_under_hermes_home) AnyCallableDictIteratorListOptionalTupleTypeVarcast)TITLE_SOURCE_DERIVEDTITLE_SOURCE_LLMTITLE_SOURCE_USER escape_like _placeholdersstat_db_file_identity)read_only_db_uri)holder_pid_checkable)STORAGE_CORRUPTmark_storage_corruptnote_storage_errorstorage_corrupt_reason storage_state)_DELETED_WAL_GENERATION_MSG_DISK_IO_ERROR_MARKER_STATE_DB_CORRUPT_MSG_STATE_DB_GENERATION_KEY_STATE_DB_REPLACED_MSGDeletedWalGenerationError!SessionCompressionInProgressErrorStateDbCorruptErrorStateDbReplacedError_is_no_more_rowsclassify_persistence_erroris_malformed_db_erroris_malformed_schema_erroris_sqlite_lock_error)_STATE_DB_GUARD_BYPASS_ENV_in_test_context_is_production_state_db_real_platform_state_root_register_test_instance_set_last_init_errorget_last_init_error)_READ_POOL_MAX_proc_fd_targets_read_budget_for)SessionSessionsMixin)SessionFtsSetupMixinload_fts5_cjk_extension)SessionPortabilityMixin)SessionTelegramTopicsMixin)SessionProfileRepairMixin)SessionSchemaMixin)log_write_lock_holders) _connect_tracked_db_fd_is_truly_unlinked_prepare_connection_retirement_read_sqlite_application_id_stat_sqlite_sidecar_identity_watched_sqlite_sidecar_paths!has_invalid_sqlite_header_preopenis_zeroed_state_dbquarantine_cross_process_lockquarantine_invalid_state_dbRetiredGenerationCaptureErrorcapture_retired_wal_generationrefuse_deleted_wal_generation)SessionMessagesMixin)SessionPruneRewriteMixin)SessionApiContentMixin)SessionCoverageMixin)SessionRewindMixin)_WAL_INCOMPAT_MARKERS_on_disk_journal_modeapply_database_pragmasapply_wal_with_fallback)_claim_repair_attemptpreflight_db_writabilityrepair_state_db_schema)SessionTitlesMixin)SessionUsageMixin)SessionMaintenanceMixin)SessionGatewayMixin)SessionCompressionMixin)SessionSearchMixini Nc<V^8dQhR\R\R\/#)keyfallbackreturnstrint)formats"1/home/ubuntu/.hermes/hermes-agent/hermes_state.py __annotate__ri_s"  c S RU c^RIHpV!4PR4;'g/PV4pVfV#\V4pV^8dV#T# \dTu#i;i)za``sessions.`` from config.yaml (lazy import: circular at load), else *fallback*; 0 disables.)load_config_readonlysessions)hermes_cli.configrlgetrf Exception)rarbrlvaluelimits&& rh_configured_transcript_limitrs_sh:%'++J7==2BB3G =OE  u00 s!"AAAA A#"A#c$V^8dQhR\/#r`rcrf)rgs"rhriril??c?rjc\R4#)max_resume_messagesrsrjrhresolved_max_resume_messagesr|l '(= >>rjc$V^8dQhR\/#rurv)rgs"rhririprwrjc\R4#)max_export_messagesrzr{rjrhresolved_max_export_messagesrpr}rjcFaa]tRt^tto]R3V3RlV3RllltRtVtV;t#)SessionResumeTooLargeErrorzacross its lineagec,<V^8dQhRS[RS[RS[/#)r` message_countrrscope)rfre)rg __classdict__s"rhri'SessionResumeTooLargeError.__annotate__us%      ),  JM  rjc\<WuVnVnW0n\SV`RV RV R24R#)z+This session is too long to reload safely (z messages; limit z). Start a fresh chat and keep a copy with the dashboard Sessions page's Export action or `hermes sessions export --format md --session-id ` (neither is capped), or raise the limit with `hermes config set sessions.max_resume_messages 0`.N)rrrrsuper__init__)selfrrrr __class__s&&&&rhr#SessionResumeTooLargeError.__init__usC*7&DJ  9-HYZ_Y`aG G rj)rrrr __name__ __module__ __qualname____firstlineno___MAX_SAFE_MESSAGESr__static_attributes____classdictcell__ __classcell__rrs@@rhrrts/APd    rjrcDaa]tRt^to]3V3RlV3RllltRtVtV;t#)SessionExportTooLargeErrorc,<V^8dQhRS[RS[RS[/#)r` session_idrrrrd)rgrs"rhri'SessionExportTooLargeError.__annotate__s"  3 s 3 rjc`<WVuVnVnVn\SV`RV RVR R24R#)z Session 'z' has more than ,z exportable messages; the JSON/JSONL backup is built in memory and capped per session. Use the dashboard Sessions page's streaming Export action, or set sessions.max_export_messages: 0 in config.yaml to disable the guard.N)rrrrrr)rrrrrrs&&&&rhr#SessionExportTooLargeError.__init__sB:DUZ7+TZ  |#3E!9=i i rj)rrrrrrs@@rhrrsI[   rjrc0V^8dQhR\R\/#)r`holderrcrebool)rgs"rhririsSTrjc\P!RT;'gR4pV'd\VP^44M^pV^8:gV\P !48XdR#\ V4'gR#\e\P!V4'*#\PR8XdR#\P!V^4R# \dR#i;i \dR#\\3dR#i;i)amTrue only when a ``pid=`` lock holder's local PID is provably gone. Reclaim on kernel proof only: unstructured/same-process holders (another thread's live lease) and any probe doubt keep the lease until TTL expiry (PID reuse must never steal a live lease; a wrongly-kept one self-heals). Foreign/unstamped PID namespaces defer to TTL: see ``hermes_state_pidns``.z(?:^|:)pid=(\d+)(?::|$)FntT)researchrfgrouposgetpidrpsutil pid_existsrpnamekillProcessLookupErrorOSError OverflowError)rmatchpids& rh(_compression_lock_holder_process_is_deadrs II0&,,B ?E!&#ekk!n AC ax3"))+%  ' '  ((-- -  ww$ Q     ] #s0C8C# C C # D1DDDautocustomTstate.dbN@g?@c$V^8dQhR\/#rur)rgs"rhrirismm$mrjcN\\8wd\#\4R, #)zDefault state DB path at CALL time: a re-pointed ``DEFAULT_DB_PATH`` wins, else ``get_hermes_home()`` is resolved fresh (a runtime HERMES_HOME redirect works regardless of import).r)DEFAULT_DB_PATH_IMPORT_DEFAULT_DB_PATHrr{rjrh_default_db_pathrs .1HH?loN_blNllrjFc(V^8dQhR\RR/#)r`db_pathrcNr)rgs"rhririsDTrjc b\'g:\PP\4'g\ 4'gR#\ V4P4P4p\43Uu.uF q"fKTNK pp\F:pTP\ T4P4P44K< TF-p\Y4'gK\RT RT R\ R24h R# \dR#i;iuupi \dKi;i)a<Raise before any connection/mkdir/pragma/byte probe when a pytest-context process (env OR ancestry) resolves a production DB. Env alone is not enough: a child spawned with a rebuilt environment loses ``PYTEST_*`` and ``HERMES_HOME`` together, which is precisely the state in which it writes to production (#82770). NzAlive-system guard: test attempted to open production state.db at z (under real Hermes root u). Tests must run against a temporary HERMES_HOME — pass an explicit tmp db_path or let the hermetic conftest redirect HERMES_HOME. If this test genuinely needs the live database, mark it with @pytest.mark.live_system_guard_bypass — or, for a spawned child process, export z=1 in its environment.)_STATE_DB_GUARD_BYPASSrenvironror.r/r expanduserresolverpr1 _STATE_DB_GUARD_EXTRA_DENY_ROOTSappendr0 RuntimeError)rresolvedrrootsextraroots& rh_ensure_test_isolationrs0J!K!KScSeSe=++-557346 H61QQ6E H1  LLe//199; <2  "8 2 2'j(A$H) *D(DE# #    H   s0 'D=DD6D DD D.-D. create_mainc4V^8dQhR\R\RR/#)r`rrrcNrr)rgs"rhriris!88D8$848rjc\PR8XdR#TpV'd\P\P,\P,p\ \R4'dV\P ,p\ \R4'dV\P,p\P!W#R4p\P!V4VVPVPR,4VPVPR,43Fp\P!V4p\P !TP"4'dKB\P$!TP"4'gKj\P&!TR4K R# \dL\dR#i;i \dKi;i)uCreate/tighten a writable state database and its sidecars to 0600. SQLite otherwise creates ``state.db``, ``-wal``, and ``-shm`` according to the process umask (commonly 0644 under 0022). Read-only SessionDB attachments never call this helper and remain observational. Existing files are tightened with ``chmod(2)`` on the path: opening the file and closing that descriptor would drop every POSIX ``fcntl`` lock the process holds on its inode — including the locks of an already-open SQLite connection to the same database. A lock-losing close in one process lets a sibling's connection take the shared-memory DMS exclusively at its own close, checkpoint, and unlink the sidecars while long-lived holders (gateway, desktop ``hermes serve``) keep using the deleted inodes. rN O_NOFOLLOW O_CLOEXECiz-walz-shm)rrO_WRONLYO_CREATO_EXCLhasattrrropencloseFileExistsErrorIsADirectoryError with_namelstatFileNotFoundErrorstatS_ISLNKst_modeS_ISREGchmod)rr main_pathflagsfdpathsts&$ rh_secure_state_db_filesrsP ww$I bjj(2994 2| $ $ R]] "E 2{ # # R\\ !E 51B HHRL ',,/0',,/0 $B << # # ||BJJ''  u%      $!   s07F0-G0 G =G G  G  GGcRV^8dQhR\\\3,R\/#r`msgrcdictrer r)rgs"rhriri8s&^^tCH~^$^rjc\V\4'dVPR4R9dR#VPR4p\V\4;'d$VP 4P \ 4#)zPersisted harness prompt (older builds wrote the forked curator's turns into real sessions; replaying them hijacks the session).roleFcontent>usersystem) isinstancerrorelstrip startswith_REVIEW_HARNESS_PREFIXESrrs& rh%_is_background_review_harness_messager8sZ c4 CGGFO;M$Mggi G gs # ] ](8(C(CD\(]]rjcV^8dQhR\\\\3,,R\\\\3,,/#r`messagesrclistrrer )rgs"rhririAs7tDcN/CTRUWZRZ^H\rjc V'gV#.pRpRpVFlp\V4'd V'*pRpKV'd3Rp\V\4'dVPR4R8XdRpKYRpVP V4Kn V#)zZDrop harness messages and the curator-mode assistant reply that immediately followed each.FTr assistant)rrrror)routskip_next_assistantprevious_was_harnessrs& rh _strip_background_review_harnessrAs  "C  0 5 5';": #'  "' #t$$K)G',$$ 3 Jrjz^\[[A-Za-z_][A-Za-z0-9_.-]*\]$cRV^8dQhR\\\3,R\/#rr)rgs"rhriri]s&ddDcNdtdrjc6\V\4'd.VPR4R8wgVPR4'gR#VPR4p\V\4;'d-\ \ P VP444#)zAssistant tool-call turn whose content is a bare ``[marker]`` (an older conversation_loop persisted a local template's marker as the final response).rr tool_callsFr)rrrorer_STALE_TOOL_CALL_MARKER_RE fullmatchstriprs& rh"_is_stale_tool_call_marker_messager]sp c4 CGGFO{$B#''R^J_J_ggi G gs # c c-G-Q-QRYR_R_Ra-b(ccrjcV^8dQhR\\\\3,,R\\\\3,,/#rr)rgs"rhririfs7  T$sCx.-A d4PSUXPX>FZ rjc^p\\V4FpRVR&V^, pK V'd\PRV4V#)zBlank stale ``[marker]`` assistant content (replaying it teaches the model to keep emitting it); tool_call/result pairing stays intact.rrzMCleared %d stale tool-call marker message(s) while restoring session (#78148))filterrloggerinfo)rrepairedrs& rh_strip_stale_tool_call_markersrfsLH8(CIA D []e  Orjz/Sessions will not be saved until this is fixed.zC If the database lives on a network drive, move it to a local disk.zUthe session database could not be opened; it may be on a network or unsupported drivezbMove it to a local disk (`hermes {profile_arg}doctor` shows where it is), then start Hermes again.detailsc<V^8dQhR\R\R\/#)r`prefixrrcr)rgs"rhriri|s("" "" "rjca ^RIHpV!4p\4o S 'gV R\ RV R2#^RIHpV!S 4pVP VPRrp\;QJd#V 3Rl\4F 'gK RM R M!V 3Rl\44'd4VPR 8Xd\\PR V4rvM\pV R V R\ R V V 2p V'd^RIHp V RV !S 4 2, p V #)u;User-facing one-liner: ``: . [ network hint]``. The cause table lives in ``hermes_state_user_copy`` so CLI, gateway and TUI agree. Chat surfaces (gateway, TUI) get the one-liner; ``details=True`` (the CLI banner) appends a ``Details: `` line for the raw SQLite text. Network filesystems (NFS/SMB/FUSE/ZFS) cannot host SQLite's write-ahead log: when the raw cause carries one of those markers the message names the network-drive suspicion, because ``hermes doctor --fix`` cannot repair a mount — only moving the file can.)profile_cli_selectorz. z Run `hermes z&doctor` to check the storage location.)describe_storage_failurerc3H<"TFqSP49xK R#5iN)lower).0mcauses& rh 0format_session_db_unavailable..s ='> Krjg^@win32c$V^8dQhR\/#rur)rgs"rhriris::T:rjcl\\RR4RJ;'d\\PR4#)z`Whether this runtime can switch off SQLite's close-time checkpoint (Python 3.12+ ``setconfig``). SQLITE_DBCONFIG_NO_CKPT_ON_CLOSEN setconfig)getattrsqlite3r Connectionr{rjrh#_close_time_checkpoint_configurablerAs3 G? Fd R 9 9**K8:rjcFV^8dQhR\R\\,/#r`rrc)rerr)rgs"rhriris(4.rjc \T;'gR4P4pV'd V'gR#\4R, p\VRRR7W2 R2, pVP RRR 7;_uu_4pVFapVfK \ V\ 4'dTM R \V4/pVP\P!VR \R 7R ,4Kc RRR4V# +'giT#;i)zAppend pending messages to HERMES_HOME/sessions/.jsonl (state.db was replaced under a live process). Returns the path, or None if nothing to write.rNrmT)parentsexist_okz.jsonlautf-8)encodingrF) ensure_asciidefault ) rerrrrrrwritejsondumps)rrsid sessions_dirrhandlerrecords&& rhdivert_session_transcript_jsonlrTs jB  % % 'C h"$z1L,t< E. (D 3 ) )VC *3 5 5Is3x;P TZZUCPSWWX * K * ) Ks;C-AC-- C> chV^8dQhR\R\\\\3,,/#)r`rrc)rrtuplerfre)rgs"rhriris'<R/V3R?lR@lllt/RR>R/V3RAlRBlllt0RV3RClRDllt1RV3RElRFllt2V3RGlRHlt3V3RIlRJlt4V3RKlRLlt5V3RMlRNlt6V3ROlRPlt7V3RQlRRlt8V3RSlRTlt9V3RUlRVlt:];V3RWlRXl4tV3R]lR^lt?V3R_lR`lt@V3RalRbltARcR/V3RdlRelltBV3RflRgltCV3RhlRiltDV3RjlRkltEV3RllRmltFV3RnlRoltGV3RplRqltHRrtIV3RslRtltJRtKRtLRtM^dtN]OtP]QtR]StT]P^]R^]T^/tURutVRvtWRwtXRxtYV3RylRzltZR{R/V3R|lR}llt[V3R~lRlt\V3RlRlt]V3RlRlt^V3Rlt_Rt`VtaR#) SessionDBizVSQLite-backed session storage with FTS5 search; many reader threads, one writer (WAL).g4@rg?rg{Gz?g333333?g@g??ii'iPg>@cF<V^8dQhRS[S[,RS[S[,/#)r` system_promptrcrre)rgrs"rhriSessionDB.__annotate__s#(3-HSMrjcVfR#\P!VPR44P4pVP RW!34V#)NrHzAINSERT OR IGNORE INTO system_prompts (hash, prompt) VALUES (?, ?))hashlibsha256encode hexdigestexecute)connr` prompt_hashs&& rh_store_system_promptSessionDB._store_system_promptsJ  nn]%9%9'%BCMMO  O  ( rjc<V^8dQhRR/#r`rcNr{)rgrs"rhrirb s  T rjc(VPR4R#)zDELETE FROM system_prompts WHERE NOT EXISTS (SELECT 1 FROM sessions WHERE sessions.system_prompt_hash = system_prompts.hash) AND NOT EXISTS (SELECT 1 FROM sessions WHERE sessions.tool_names = system_prompts.hash)N)rhris&rh#_delete_unreferenced_system_prompts-SessionDB._delete_unreferenced_system_prompts s  V rjcP<V^8dQhRS[PRS[S[S[3,/#)r`rowrc)r?Rowrrer )rgrs"rhrirbs'w{{tCH~rjc\V4pRF1pRV R2V9gKVPRV R24pW!9gK-W1V&K3 VPR4'dVPR4'EgFVPR4pRp\V\4'd!V'd\ P !V4pM\V\4'dTp\V\4'dVPR4'gQVPR4p\V\4'd*VP4'dVP4VR&VPR4'gQVPR4p\V\4'd*VP4'dVP4VR&V# \\3dRpLi;i)r`_ _resolved _reset_from_branched_from model_configN)r` tool_names) rpoprorrerNloads TypeError ValueErrorr)rtdatacolumnrrawcfgrqs& rh_session_row_dictSessionDB._session_row_dictsiCy5F6()$,88axy$9:>#+L 6''DHH5E,F,F((>*CC#s##**S/CC&&#t$$xx ..GGM2E!%--%++--.3kkm]+xx 011GG$45E!%--%++--16-. ":.Cs$F99GGcH<V^8dQhRS[S[P,RR/#)r`rircNrr?r@)rgrs"rhrirb6s*RR1C1C(DRRrjc VfR#VP4R# \d\PRRR7R#i;i)zCClose a partially initialized connection without masking its error.Nz&Could not close a SessionDB connectionTexc_info)rrprdebugrps&rh_close_connection_quietly#SessionDB._close_connection_quietly5s= <  R JJL R LLADL Q Rs"AAc$<V^8dQhRS[RR/#)r`labelrcNre)rgrs"rhrirb?sSScSdSrjc VP4R# \d-p\PRY PT4Rp?R#Rp?ii;i)zUClose *conn*; a failing close leaks a tracked fd: logged at WARNING, never swallowed.z%s close failed for %s: %sN)rrprwarningr)rrirexcs&&& rh_close_conn_loggedSessionDB._close_conn_logged?s; S JJL S NN7 c R R Ss A !AA NFc4<V^8dQhRS[R,RS[/#)r`rN read_onlyr)rgrs"rhrirbFs#_._.t _.t_.rjc<T;'g \4Vn\VP4W nRVnRp\ P !^4pVPPRR4 RVPP RVP 2Vn?\P!4Vn\ P"!\$R7Vn\)VP4VnVP*P,Vn\P!4VnRVnRVnR^uVnVnRVn^Vn/VnR;Vn Vn!RVn"\P!4Vn#RVn$RVn%/Vn&RR uVn'Vn(RVn)R;Vn*;Vn+Vn,R;Vn-;Vn.Vn/RVn0\c4Vn2\Pf!\P!44Vn4RVn5R;Vn6Vn7RVn8RVn9RpV'dVPu4M/\w4'g\y4Vn$VP{4VP}4R pT'g'TP`Ruq`n0TPT4R#TP*PT4\T4R# \dELii;i ?i;i \d*p\\T4P R T 24hRp?ii;i T'g&TP`Ruq`n0TPT4iTP*PT4\T4i;i) r%Nr?.:)maxsizeFgrTr&)Errrr_creation_sitesys _getframe f_globalsrof_codeco_namef_linenorp threadingLock_lockqueue LifoQueuer5 _read_poolr7 _read_budgetpermits _read_permits_read_conns_lock_read_conns_closed_read_open_failed_at _wal_active _write_count_db_file_identity_db_file_application_id_db_sidecar_identity _db_replaced_db_wal_generation_lost_retired_generation_capture_retired_capture_lock_retire_connection_connection_pinned_wal_lock_guard _db_corrupt_db_corrupt_reason_fts_usermerge_floor_applied _fts_enabled _fts_stale_trigram_available_fts_cjk_loaded_fts_cjk_available_fts_unavailable_warned_connr _token_queue Condition_token_queue_cond_token_writer_thread_token_writer_stop_token_writer_busy_token_atexit_hook_shared_registry_owned_open_read_onlyrArB _open_writer_record_db_file_identityr3typerrregisterr2)rrrcallerinitialization_completerris&&& rhrSessionDB.__init__Fs,44"2"4 t||,"' ]]1%F##'' C896==;P;P:QQRSYSbSbRcd   ^^% @EWe?f-T\\:!..66 ) 0#(%(!.3Q+$+37,-$68!;@@D8;?(%.^^%5"CG"'%'4921$1,1)HMMMDOd.EY^]]t69U #(7!*!4!4Y^^5E!F@D!>MMANc<V^8dQhRR/#rnr{)rgrs"rhrirbs2A2Ad2Arjc \VPP4VPP4'd\ VP4'd\ VPRRR7\ VP4;_uu_4pV'g!\PRVP4\ VPRR7VPVR7VP4RRR4M:\ VPRR7VPRR7VP4VP)4VP*'d(\,P.!VP4VnR#R# +'giL[;i \Pdp\T4'd\TP4'gh\PR T4TP!TP"4\%TP4P'R 4'ghTP4Rp?ELRp?ii;i) zWritable open: preflight, zero-byte quarantine, connect + schema (one in-place repair of a malformed sqlite_master), generation stamp.rT)db_labeldirectory_onlyzAstartup quarantine lock for %s not acquired within 5s; proceedingralready_lockedNFu`state.db schema is malformed (%s) — attempting automatic repair (a backup copy is made first).r)r rparentexistsrFrWrHrr_handle_quarantine_if_invalid$_connect_and_init_with_lock_patiencer? DatabaseErrorr,rVerrorrrrXro_ensure_db_file_generationr _lockguardholdr)r lock_acquiredrs& rhrSessionDB._open_writers  3 34% 8<<&&((,Mdll,[,[) [_`24<<@@M(_ LL-T\\JO66m6T==?A@) K22%2H99; '')    $.??4<<#@D CA@$$$ 8-S119Nt||9\9\ LL89<   * *4:: 6)$,,7;;JGG  5 5 7 7 8s>A0FA"F3F<9F F FFI )BII c<V^8dQhRR/#rnr{)rgrs"rhrirbs = = =rjc v\\^,4FpVP\R7;Vnp\ VRR7VP 4pVPVR4RJVnVP'dVPVR4RJVn R# R# \dRTnTPT4hi;i \Pd[p\\T4P!49pT\8g T'gh\"P$!\&4Rp?EKRp?ii;i)a~Read-only attach for cross-profile aggregation: no schema init, NO write lock (sidebar polling never contends with that profile's backend); the DB must exist. FTS flags are probed with SELECTs only, and the connection is closed on ANY probe failure (malformed schema raises DatabaseError) so a leaked tracked connection cannot block the forensic backup the writable heal takes next.timeoutrr messages_ftsTmessages_fts_trigramN)range_READ_ONLY_IOERR_RETRY_ATTEMPTS_connect_read_only_READ_BUSY_TIMEOUT_SrrTcursor_fts_table_proberr BaseExceptionrr?OperationalErrorr!rertimesleep _READ_ONLY_IOERR_RETRY_BACKOFF_S)rattemptririoerr transients& rhrSessionDB._open_read_onlys ` (terminal `hermes` chat only).) rrrFrst_sizerrIrrr3r?r)rrzsizeqpathwherers&& rhr'SessionDB._handle_quarantine_if_invalids ##%%*KDLL*Y*Y  LL%%'//E,DLLX-2/%)8e-eW4I%Q1161F1F$,,0GHj j  SS! =T\\00227XY]YeYe7f7f'', ,8g2= E s$D$$ D43D4c4<V^8dQhRS[P/#ru)r?r@)rgrs"rhrirbs7#5#5rjc \\VP4RRRR7p\PVn\ VRR7pVR8H;'d\V4R8HVn\VP4\VRR7VPR4\V4Vn V# \dTPT4hi;i) zConnect + WAL/pragma/tokenizer setup for a writer connection (no schema init). Short timeout: jittered application-level retry handles contention, not SQLite's busy handler; isolation_level=None: explicit BEGIN IMMEDIATE.Fr]N)rrrrrwalzPRAGMA foreign_keys=ON)r@rerr?rurrUrSrrrTrhr:rrr)rrimodes& rh_open_writer_connSessionDB._open_writer_conns#  UY  &{{D *4*ED $u}UU1Ft1LPU1UD  #4<< 0 "4* = LL1 2#:4#@D     * *4 0  s BB++C c<V^8dQhRR/#rnr{)rgrs"rhrirb7s4rjc\VP4\VPRR7VP4VnVP 4R#)T)rN)rLrrrr _init_schemars&rh_connect_and_initSessionDB._connect_and_init7s< &dll3 t||>++-  rjc<V^8dQhRR/#rnr{)rgrs"rhrirbAsDDdDrjc  D\P!4VP,pVP4R# \P dp\ T4'ghTPTP4\P!4pY18d"\TPTP4h\P!TPTP4p\P!\!T\#Y, R444Rp?KRp?ii;i)aOpen + init, waiting out a sibling's write lock with jittered patience: _init_schema's DDL runs on a 1s-timeout connection, so a sibling's VACUUM or checkpoint used to fail the ENTIRE open and callers disabled persistence for the whole run. Non-lock errors propagate immediately.NMbP?)r monotonic_WRITE_PATIENCE_Srr?rr-rrr?rrandomuniform_WRITE_RETRY_SLOW_MIN_S_WRITE_RETRY_SLOW_MAX_Srminmax)rdeadlinernowjitters& rhr.SessionDB._connect_and_init_with_lock_patienceAs>>#d&<&<< D&&(++ D+C00..tzz:nn&?*4<<9O9OP(D(DdFbFbc 3vs8>5'ABCC Ds;DCDDcD<V^8dQhRS[S[P,/#rur)rgrs"rhrirb^s'');); <'rjc 4VP'dVP'dR#VP;_uu_4VPpT;'d$\P !4V, \ 8pVP'g V'd RRR4R#RRR4VPPV4'g(\PR\VP4R#RpVP\R7p\!VRR7VP"'d \%V4V# +'giL;i \&dpTeTP)TR4TPP+4\-T\.P04'ghTP;_uu_4\P !4TnRRR4M +'giM;i\PRTPRR 7Rp?R#Rp?ii;i) asOpen a fresh read-only connection, or None when unavailable (callers return it to self._read_pool). WAL only: WAL readers never block on the writer, so reads skip self._lock; under DELETE journal mode (NFS fallback) readers hit SQLITE_BUSY storms, so the legacy locked path stays. Autocommit reads see everything committed so far (read-your-writes for flush-then-search).NzVread pool at capacity (%d) for %s; serving this read from the locked writer connectionrrrzpartially-opened read connz'read-only connection open failed for %sTr)rrrrrr_READ_OPEN_RETRY_SECONDSrracquirerrr5rrrrTrr:rrreleaserr?Error)r failed_at backing_offrirs& rh_get_read_connSessionDB._get_read_conn^s 4>>>  " " "11I#__(89(DG_(_K&&&+ # "+6#   ((.. LL+,:DLL  **3G*HD "4* =###'- ?# "$ ''.JK    % % 'c7==11&&&,0NN,<)'&&& LLBDLL[_L ` sJA D0D0D0.AE0 E  HA%H3G H G' "*HHc <V^8dQhRS[/#rur:)rgrs"rhrirbs4rjc VPP4pTP T4R# \PdR#i;i)z^Close one idle pooled connection (a peer on the same file wants its permit); never a live one.FT)r get_nowaitrEmpty_close_read_connrris& rh_evict_one_idle_read_conn#SessionDB._evict_one_idle_read_connsD ??--/D d#{{  s/AAc<V^8dQhRR/#rnr{)rgrs"rhrirbs(((rjc VPVR4VPP4R# TPP4i;i)zClose a pooled read connection and release its permit even when the close fails (withholding it would narrow the read path forever). Over-releasing the BoundedSemaphore raises ValueError.z read-connN)rrr.r9s&&rhr8SessionDB._close_read_conns< (  # #D+ 6    % % 'D   % % 's 0A cD<V^8dQhRS[S[P,/#rur)rgrs"rhrirbs))Xg.@.@%A)rjc VP'dVP'dR#VPP4# \P dTP 4u#i;i)zBorrow a read connection, opening on a miss; None when the read path is unavailable. A pool hit costs no permit (the connection already holds one).N)rrrr6rr7r2rs&rh_checkout_read_connSessionDB._checkout_read_connsU4>>> )??--/ /{{ )&&( ( )sA%A*)A*reopenTcJ<V^8dQhRS[RS[S[P,/#)r`rCrc)rr r?r@)rgrs"rhrirbs*)L)L4)L8GQ[3\]]///?**DJJ7D4>>> Z,,'<=FFHKK LL/4H44O0P/QR S L gmm,,LL#7K8H7I!JK-Z %zz! ! +**!***222! OO66t<'+H$zz! ! +*** ))$/ (-,Xgmm,,LL#7K8H7I!JK-,,,ZZsL6HL6G>G"#L63'L6L"1A=L"/L"4 L6>AL" K!L"2J0 L" L6"G;7G>:G;;G>> H L6J-)I? =II? I3 0I? 2I3 3I? 6 J-? J J-J--L60 K ;L""L%L  L LLL"" L3 - L6c$<V^8dQhRS[RR/#)r`rIrcNr)rgrs"rhrirbs A A# AD Arjc VP'd(\P!RVP RV R24hVP'dKVP 'g9VP 4'g#VPRVP RV R24hVP4\PRVPV4VP4Vn TP'd(\ P"!TP4TnR #R # \d#p\P!RT R T 24ThR p?ii;i) a+Reopen the writer after ``close()`` raced a live caller (a teardown owner set ``_conn = None`` while a worker still had a transcript flush to land). Loud (WARNING) and bounded (only after an explicit close()). Caller holds ``self._lock``. No _init_schema: no DDL races with siblings during teardown.rFz/ was closed (read-only handle); cannot serve a z after close()zstate.db connection for zF is quarantined after structural corruption; refusing to reopen for a z after close(). uqstate.db connection for %s was closed while a %s was still in flight — reopening (teardown/worker race, #94736)z'state.db connection was closed while a u was still in flight (a session-teardown path called close() before this worker finished — #94736) and the automatic reopen failed: N)rr?rLrrr_db_file_was_replaced_corrupt_error_halt_if_db_generation_changedrrrrrprrrrr)rrIrs&& rhrM$SessionDB._reopen_after_close_lockedsB >>>** /"").:     T%6%6%6$:T:T:V:V%%*4<<.9CCJ)L""  ++- BCG<T4\,P8!RTR R 24Th\@T 9d1T'g)T'g!TP+Y24'd RpRp?EKh\7T\,PB4'dR T 9g)\ET4'gTPGT4'dBTP;_uu_4TP 4RRR4M +'giM;iTPIYTR 7'dRp?EKTPKT4'dTPMT4hRp?ii;i) udRun *fn(conn)* inside BEGIN IMMEDIATE with jittered lock retry; commit is handled here (callers must not commit). Returns *fn*'s result. BEGIN IMMEDIATE takes the WAL write lock up front so contention surfaces immediately; on locked/busy the Python lock is released, a jitter slept, and the WHOLE callback retried — *fn* must stay idempotent under retry.NFT)storagerMrHzBEGIN IMMEDIATEzQdatabase is locked (another Hermes process held the state.db write lock for over z.0fus — likely a long maintenance operation such as VACUUM, a large WAL checkpoint, or an older pre-update process; the database itself is healthy)znot a database)r&r[)'rrr_raise_if_db_corruptr_raise_if_db_replacedrrMrhcommitrrollbackrpr_CHECKPOINT_EVERY_N_WRITES_try_wal_checkpoint_FTS_MERGE_EVERY_N_WRITES_try_incremental_merge_ftsr&r$_COMPRESSION_BUSY_WAIT_S_sleep_before_write_retryr?r/r)rerrrr-r?rr!rr+_is_fts_write_corruption_error_enter_fts_fail_open_is_structural_corruption_error_halt_db_corrupt) rrZr[r&compression_deadlineioerr_begin_retried fn_startedresultrerr_msgs &&& rh_execute_writeSessionDB._execute_writesD  //J>>#j004$  % %d % 3JU ZZZ..0zz)777HJJ&&'89 %) !#DJJ ))+ !!Q&!$$t'F'FF!K,,.$$t'E'EEJ335 )! JJ//1 )! ! Z,5 (/+.t~~/?$B_B_/_ai+j(11(*G*G==. $C((T-K-KH-a-ac(..*c7#;#;<<+C0099(OO$/t||ZH%66<>sCC!ZZZ 668(ZZZ00T^0__ ;;C@@--c2]. sF-A F(.EBF- F*FF F FF FF F* %F--A P P &P '(PA!P>APP P+AP;PN) P) N9 4!PP3PP manyr[c F<V^8dQhRS[RS[RS[RS[S[,RR/#)r`sqlparamsrsr[rcN)rer rrr)rgrs"rhrirbgs:888 #8378MUV[_8 8rjc @aaaVVV3RlpVPWTR7R#)z8Run one INSERT/UPDATE/DELETE through ``_execute_write``.cV<S'd VPM VP!SS4R#r) executemanyrh)rirsrvrus&rh_do!SessionDB._write_sql.._doks!%T  4<< 7f Erjr[Nrq)rrurvrsr[rzs&ffd$ rh _write_sqlSessionDB._write_sqlgs F C7rjcB<V^8dQhRS[RS[RS[S[,RS[/#)r`rurvr[rc)rer rrrf)rgrs"rhrirbos/??3??RW?dg?rjc 8aaVV3RlpVPWCR7#)zRun one UPDATE/DELETE through ``_execute_write``; return rows changed (``SELECT changes()`` when the driver reports None / negative).c<VPSS4PpVeV^8d'VPR4P4^,pV#)NzSELECT changes())rhrowcountrN)rirrvrus& rhrz&SessionDB._write_rowcount.._dorsG||C099H8a<<<(:;DDFqIOrjr|r})rrurvr[rzs&ff$ rh_write_rowcountSessionDB._write_rowcountos  ""3">>rjcP<V^8dQhRS[RS[RS[S[P,/#r`rurvrc)rer rr?ru)rgrs"rhrirbys0\\S\#\x 7L\rjc 2aaVPVV3Rl4#)z<``fetchone()`` of one read-only statement via ``_read_ctx``.cD<VPSS4P4#r)rhrNrirvrus&rh%SessionDB._read_one..{dll36O6X6X6Zrj_read_retrying_ioerrrrurvs&ffrh _read_oneSessionDB._read_oney(()Z[[rjcP<V^8dQhRS[RS[RS[S[P,/#r)rer rr?ru)rgrs"rhrirb}s0\\S\#\tGKK7H\rjc 2aaVPVV3Rl4#)z<``fetchall()`` of one read-only statement via ``_read_ctx``.cD<VPSS4P4#r)rhfetchallrs&rhr%SessionDB._read_all..rrjrrs&ffrh _read_allSessionDB._read_all}rrjcR<V^8dQhRS[S[P.S[3,RS[/#)r`rZrc)r r?r@r)rgrs"rhrirbs.x1C1C0Da0G'HQrjc \\^,4F/pVP4;_uu_4pV!V4uuRRR4u# R# +'giKF;i \PdjpT\8g#\ \ T4P49d\TPT4h\P!\4Rp?KRp?i\Pdp\TPT4hRp?ii;i)aRun an idempotent SELECT through ``_read_ctx``, retrying a transient SQLITE_IOERR. A warm ``mode=ro`` pooled reader can hit the same millisecond-wide WAL transition window as a read-only OPEN (#100436) when its statement executes or steps: a sibling process's checkpoint / WAL reset / frame flush surfaces ``disk I/O error`` because a read-only connection cannot rewrite the -shm index (#100871, WSL2 ext4-on-vhdx, multi-process). The window closes on its own, so the statement is replayed on the SAME connection within the read-only IOERR budget -- never closed and reopened (close() cancels this process's POSIX locks for every sibling connection), never quarantined (busy is not broken). A persistent IOERR exhausts the budget and propagates.N)rrrQr?rr!rerrrrrrr)rrZrrirs&& rhrSessionDB._read_retrying_ioerrs>>TZZ/     G jj((@C[B](*AJJ&&U159**,,D13hj3q66AKE!ZZ//0GHQQS 5?#jm00q1Qa<"59b1J>DD1GJJ&&)?y'IJ/6,JJ&&'GH56}}7:}} G LL@# F F Gs{H AG7AG77G7AG7 G70G7'G77GH G41G73G44G77 H H H I H<<Ic<V^8dQhRR/#rnr{)rgrs"rhrirbs B B$ Brjc \VP4Vn\VP4Vn\ VP4pV'd WnR#VPe[VP 'gGVPR4pV'd+V^,'d\V^,4VnR#R#R#R#R# \PdRpLQi;i)z?Snapshot inode plus the on-disk generation header when present.Nr) _stat_db_file_identityrrrDrrCrrrr?r/rf)rdisk_idrs& rhr"SessionDB._record_db_file_identitys!7 !E$A$,,$O!-dll; +2 ( ZZ #D,H,H,H "!^^,CD jmm/2:a=/A,,z -I #== "!  "s;CCCc <V^8dQhRS[/#rur:)rgrs"rhrirbs ; ;t ;rjc VPpVe\VP4V8wdR#\VP;'g^4pV'gR#\ VP4p\ T;'dW28g4#)zATrue when the path no longer names the file this instance opened.TF)rrrrfrrCr)rrecorded recorded_appdisk_apps& rhrUSessionDB._db_file_was_replacedsi))  $:4<<$HH$T477<<1= .t||<H99!9::rjc <V^8dQhRS[/#rur:)rgrs"rhrirbs$rjc aVP;'g/p\P!VP4oV'dW\;QJd-V3RlVP 44F 'gK R# R#!V3RlVP 444#VP 'gR#\PPR4'd\VP4p\\P!44FGwr4\P!V4pRV9gK$WR9gK,\WBV,4'gKFR# \#VP4pV'dW`nR# \ dR#i;i)aTrue when the WAL/SHM generation this handle opened is gone. Recorded generation: pure stat (no /proc walk on healthy writes). Empty identity (WAL appeared after open, or cleared by a clean close()): probe /proc/self/fd for deleted sidecars and adopt the current ones once clean.c3d<"TF%wr\\SV,44V8gxK' R#5ir)rr)r suffixidentbases& rhr#5SessionDB._wal_generation_was_lost..s+Zj&tD6M':;uDZjs-0TFlinuxz (deleted))rrfspathrr.itemsrrplatformrrEr6rrXcanonical_sqlite_pathrArrD)rrwatchedtargetfd_path canonicalcurrent_identityrs& @rh_wal_generation_was_lost"SessionDB._wal_generation_was_losts, ,,22yy& 3ZbZhZhZj33 3 3ZbZhZhZj  << " "7 + +3DLLAG '7 'DOF . D DV LI$.93G 5gy?Q R R# (E9F (8 %   s*%=E3'E3/E3 E3 E33 FFc<V^8dQhRR/#rnr{)rgrs"rhrirbsIIIrjc 8VP'gVP4'd@RVnVP4\P \ 4\ \ 4hVP'gVP4'dRRVnVP4VPR4\P \4\\4hR# \d,p\P RTPT4Rp?L[Rp?ii;i)zStop writes (logging once) when the file was replaced or its WAL/SHM generation is gone: never run in-file repair on a new generation, never keep committing on a split WAL. Both flags are sticky.Thaltz}Could not capture the retired WAL generation of %s at halt: %s. close() retries the capture and refuses to settle without it.N)rrU_disable_close_time_checkpointrrr$r(rr_capture_retired_generationrJrr r%)rrs& rhrW(SessionDB._halt_if_db_generation_changeds     : : < < $D   / / 1 LL/ 0&'=> >  ' ' '4+H+H+J+J+/D (  / / 1 008 LL4 5+,GH H,K 1  DEI\\SV s(C## D.!DDc&<V^8dQhRS[RS[/#)r`triggerrc)rer)rgrs"rhrirbs34rjc  hVP;_uu_4VPeVPuuRRR4#\VP\ VP ;'g/4VR7pW nRRR4\ PRVPVX4V# +'giL4;i)aDurably capture the lost WAL generation this handle still holds open, once per handle. The quarantine keeps the retired frames from being checkpointed under wrong page numbers, but they live only in an unlinked inode that dies with this process's last descriptor, and the canonical DeletedWalGenerationError remediation is to stop the writers. Capturing at the first halt (or at close(), whichever sees the loss first) makes "preserve" outlive the process. Raises RetiredGenerationCaptureError; nothing is mutated on failure.N)sidecar_identityrzCaptured the retired WAL generation of %s at %s to %s; read its manifest.json before deciding whether those frames belong on top of the file now at the path.)rrrKrrrrr)rrartifacts&& rhr%SessionDB._capture_retired_generations ' ' '//;77( '6 tD4M4M4S4SQS/T^eH08 , (  NOS||]dfn ( 'sB!'B!"B!! B1 c<V^8dQhRR/#rnr{)rgrs"rhrirb*s..t.rjc VP'd\\4hVP'd\ \ 4hVP 4R#)zHSticky-flag fast path (no log spam on every write), then the live probe.N)rr(r$rr%r rWrs&rhr_SessionDB._raise_if_db_replaced*s>    &'=> >  ' ' '+,GH H ++-rjc&<V^8dQhRS[RS[/#)r`rrc)rr)rgrs"rhrirb3s  - D rjc \V\P4;'dJ\V\4'*;'d-VP V4'*;'d\ V4R8H#)zBare SQLITE_CORRUPT/NOTADB with no FTS provenance: canonical B-tree/schema/freelist damage, never repairable from the live write path.corrupt)rr?rr'rhr*)clsrs&&rhrj)SessionDB._is_structural_corruption_error2se sG11 2 = =s$788 = =66s;; = =+3/9<  rjc&<V^8dQhRS[RS[/#r`rrc)rer')rgrs"rhrirb=s jjSj2Ejrjc D\V \ RVP R24#)zDBuild the quarantine error for this handle (message assembled once).z (cause: ))r'r"r)rrs&&rhrVSessionDB._corrupt_error=s("fX.C-DIdNeNeMffg#hiirjc$<V^8dQhRS[RR/#)r`rrcN)r)rgrs"rhrirbAsMdrjc  TRVn\V4Vn\VPV4VP 4\ PRVPVVP4VP4pRF(p\WR4fK\W#\W44K* W!h)z@Quarantine this handle and raise; never run in-file repair here.Tzstate.db %s reported structural corruption outside the FTS indexes (%s); quarantining this handle: no further writes, no automatic reopen, no explicit WAL checkpoint at close. Stop the gateway and run `hermes sessions recover --source %s --inspect-only`.N)sqlite_errorcodesqlite_errorname) rrerrrrrrrVr>setattr)rrerrattrs&& rhrkSessionDB._halt_db_corruptAs"%c( T\\3/ ++-  TVZUaUacf LL  !!#r?rrprrr)rflagrir=s& rhr(SessionDB._disable_close_time_checkpointVsw BDIzzD+t4 <9,   dD !  LLV t    s A-A21A2c<V^8dQhRR/#rnr{)rgrs"rhrirbts++t+rjc ^VP'gVPV4RVnR#R#)aRetain the exact quarantined connection past GC and interpreter teardown (once per handle). Takes the connection as a parameter: callers are lock-held close paths, and the writer-conn thread-safety audit flags self._conn in functions outside `with self._lock`.TN)rrr9s&&rh_pin_connectionSessionDB._pin_connectionts+ &&&  # #D )&*D #'rjc <V^8dQhRS[/#rur:)rgrs"rhrirb}s $ $ $rjc RVnVP4'*;'dVPRJpVPR4p\PRTPT4T'd!\PRTP4T# \dKpT'dTP TP 4\PRTPT4hRp?ii;i)acCapture the retired generation; return whether the handle must be retired unclosed. Where SQLite's close-time checkpoint cannot be switched off (no setconfig, Python < 3.12), sqlite3_close would write the retired frames over the newer generation, so the exact connection is retired unclosed instead. A failed capture leaves the handle open for a retry -- but the pin is taken FIRST on such a runtime: every production caller reaches close() through hermes_state_registry.release_or_close, which swallows the error, so an interpreter exit before the retry must not be able to checkpoint the stale frames either.TNrzCould not capture the retired WAL generation of %s at close: %s. The handle stays open and close() retries the capture; those frames are NOT yet preserved.zSkipping the close-time WAL checkpoint for %s: this handle's WAL/SHM generation was deleted or replaced; the retired generation is captured at %s. Stop the other writers before reopening and inspect the capture before deciding its disposition.ztRetaining the quarantined connection for %s unclosed: this runtime cannot switch off SQLite's close-time checkpoint.) rrrrrJrrrrrr)rretire_without_closerrs& rh_settle_lost_generation_locked(SessionDB._settle_lost_generation_locked}s(,$#'#F#F#HHppTMdMdlpMp 77@H  ` LL(  NN=>Bll $#'- #$$TZZ0 LLWX\XdXdfi   sB C%AC  C%r]c$<V^8dQhRS[RR/#)r`r]rcNr:)rgrs"rhrirbs = =t = =rjcVP'dVP4hV'd_\VP4\8Xd?VP \ P!R\VP4 R244R#R#R#)zDdatabase disk image is malformed (reported earlier in this process: rN) rrVrrrrkr?rr)rr]s&$rhr^SessionDB._raise_if_db_corruptsn    %%' ' }T\\2oE  ! !'"7"7V)$,,78;#< = F7rjc,<V^8dQhRS[RS[RS[/#)r`r&r[rc)rr)rgrs"rhrirbs"  % U t rjc  l\P!4pW18dR#W1V, , VP8p\P!V'dVP VP 3MVPVP3!p\P!\V\W, R444R#)zSleep one jitter interval if the budget allows; True = retry, False = deadline passed. Small jitter for the first _WRITE_RETRY_SLOW_AFTER_S, then slow; never overshoots the deadline.FrT) rr_WRITE_RETRY_SLOW_AFTER_Sr r!r"r#_WRITE_RETRY_MIN_S_WRITE_RETRY_MAX_Srr$r%)rr&r[r'slowr(s&&& rhrg#SessionDB._sleep_before_write_retrysnn ?+,0N0NNLPT ) )4+G+G H))4+B+BC  3vs8>59:;rjcF<V^8dQhRS[S[S[S[3,,/#ru)rrVrfre)rgrs"rhrirbs!774c3h+@7rjc ,\VP4#)zQForeign processes holding this DB or its WAL sidecars (see hermes_state_holders).)rZrrs&rhrZ#SessionDB._foreign_state_db_holderss(66rjc0<V^8dQhRS[S[,/#rura)rgrs"rhrirbs  HSM rjc VP'dRVP R2#VP'dR#VP'dR#R#)uWhy this handle must not checkpoint or run in-file repair, or None. A corrupted image has torn B-trees; a replaced file or a deleted/replaced WAL generation would checkpoint under wrong page numbers into the main DB -- the shutdown-time cause of #105670. Precedence note: close() evaluates generation loss BEFORE calling this (and skips it entirely when lost — a lost generation settles through the capture path, not the quarantine advisory), while the halt path checks replaced first.zstructural corruption (rza replaced state.db filez&a deleted WAL generation (split-brain)N)rrrrrs&rh_quarantine_reasonSessionDB._quarantine_reasonsG    ,T-D-D,EQG G    -  ' ' ';rjc<V^8dQhRR/#rnr{)rgrs"rhrirbsGGTGrjc dVP4eR#VP;_uu_4VPf RRR4R#VP'd,\P !VP VP4VPPR4P4pV'd4V^,^8d&\PRV^,V^,4RRR4R# +'giR#;i \d"p\PRT4Rp?R#Rp?ii;i)a`Best-effort PASSIVE WAL checkpoint; never raises. PASSIVE never blocks writers; TRUNCATE corrupted B-trees on 65K+ page databases under exclusive-lock I/O pressure. Previous TRUNCATE strategy caused B-tree corruption on large databases (65K+ pages) due to the exclusive-lock I/O pressure from checkpointing thousands of frames at once (issue #45383). Nrz(WAL checkpoint: %d/%d pages checkpointedz#WAL checkpoint (PASSIVE) failed: %s) rrrrrrrrhrNrrrpr)rrors& rhrcSessionDB._try_wal_checkpoints  " " $ 0  G::%'''OODLL$2F2FG++,LMVVXfQi!mLL!KVTUYX^_`Xab G NN@# F F GsLDC/DC/AC/23C/%D/ D :DD D/D**D/c<V^8dQhRR/#)r`rcr\r{)rgrs"rhrirbs  ; rjc V#)u``with SessionDB(path) as db:`` closes on exit; owners must release deterministically. Ownership of a SessionDB should be released explicitly. Historically an instance with a started token writer pinned ITSELF (bound-method writer target plus a strong ``atexit`` drain hook), so ``__del__`` never ran for exactly the instances that leaked descriptors (#88033). The writer now retires after an idle window and the atexit hook holds only a weak reference, so abandoned handles are eventually collectible — but "eventually, after the idle window and a GC cycle" is not a release policy. Call sites owning a handle are still expected to close it deterministically (see the ownership comments in ``run_agent.py`` and ``tui_gateway/methods_session.py``). r{rs&rh __enter__SessionDB.__enter__s  rjc <V^8dQhRS[/#rur:)rgrs"rhrirbsTrjc&VP4R#F)r)rexc_typertbs&&&&rh__exit__SessionDB.__exit__s rjc PVP'd^RIHpV!V4R#VP4VPRuq nVe\ P !V4VP;_uu_4RVnRRR4VP4'dKVP;_uu_4VP'EdkVP'*;'dBVP;'g.\VP4;'dVP!4pT;'dVP#4pV'dRMVP%4pVe-\&P)RVP*WPP*4M6VP'g%V'gVPP-R4\2P!VP44V'd$VP7VP4RVn M+VPRuqpn VP9V4/VnRRR4VP:P V4R# +'giEL;i \.d!p\&P1RT4Rp?LRp?ii;i +'giLo;i)u3Drain queued token deltas, then a PASSIVE checkpoint on writable handles (NOT TRUNCATE: a full WAL reset races the gateway's live writer, tearing B-tree pages). A registry-shared instance RELEASES one refcount instead. Drains queued token deltas first (the background writer needs the connection). Read-only connections never request a checkpoint. See #45383. When this instance is shared (opened via ``hermes_state_registry.acquire``), ``close()`` RELEASES one refcount instead of tearing down the connection: the registry owns the lifecycle and only closes on the final release (#90837). This prevents one caller's close from tearing down the writer connection that other callers in the same process are still using — while still letting legacy ``close()`` call sites return their reference instead of leaking it. )r.NTzSkipping the close-time WAL checkpoint for %s: this handle observed %s. Take a snapshot of state.db, -wal and -shm before restarting, then run `hermes sessions recover --source %s --inspect-only`.rz,WAL checkpoint (PASSIVE) at close failed: %s)rhermes_state_registryr._stop_token_writerratexit unregisterrrr:rrrrrrrrrrrrrhrprrrrrr)rr.hookgeneration_lostrquarantine_reasonrris& rhrSessionDB.closes  & & & 5 DM  !(,(?(?%%     d #  " " "&*D ##,,..  ZZZzzz&*nn"4##00]]T667[[D._dosbv&C\\-C5uE]3 F++!H MM$FM 3Orj)rerstripr(rq)rr0rzr7rsf& @@rhretag_kanban_worker_sessions&SessionDB.retag_kanban_worker_sessionssX_%,,U3/x8 == # % ""3''rjc&<V^8dQhRS[RS[/#rCr)rgrs"rhrirbs#$rjc VPV4pV'gR#VPR\V4 R2\V44p\ V4#)ubTrue when this session — or any segment of the compression lineage a resume would materialize — belongs to the Kanban dispatcher (``source``/``created_source`` = ``'kanban'``): the transcript of a worker run, not a human conversation (#68779). Both columns are checked: ``source`` is live routing state the dispatcher tags (``HERMES_SESSION_SOURCE=kanban``) and the legacy retag rewrites, while immutable ``created_source`` survives later surface flips. The lineage is the VERIFIED compression chain (``_resume_lineage_ids``) — exactly the rows a resume loads — so a worker transcript stays kanban-owned across rotations, while a delegate/branch child of a worker (a DIFFERENT conversation) is not swept in. Plain classification, not a gate: the resume-time guard (``hermes_cli/kanban_resume_guard.py``) owns the decision and the dispatcher-owned exemption.Fz$SELECT 1 FROM sessions WHERE id IN (z>) AND (source = 'kanban' OR created_source = 'kanban') LIMIT 1)_resume_lineage_idsrrrVr)rrlineagerowss&& rhis_kanban_owned_session!SessionDB.is_kanban_owned_sessionsU**:6~~2=3I2JKK K 'NDzrjcL<V^8dQhRS[RS[S[S[S[3,,/#r)rerrV)rgrs"rhrirbs(22s2tE#s(O/D2rjc V'g.#VPR\V4R,34pVUu.uFq3^,V^,3NK up#uupi)u``[(key, value), ...]`` for state_meta keys starting with the literal ``prefix`` (LIKE wildcards escaped) — e.g. ``loop:`` rows.z=SELECT key, value FROM state_meta WHERE key LIKE ? ESCAPE '\'%)rr4)rrr@rts&& rhlist_meta_prefixSessionDB.list_meta_prefixsSI~~ L|\bOcfiOiNk -11DSQQ D111sAc:<V^8dQh/S[S[R3,;R&#)r`._AUTO_PRUNE_STALE_OPEN_SOURCES)rVre)rgrs"rhrirbs%*#s(Orj)'rrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrrr)clicronkanbanacp api_serversubagenttool recoverediPi)NFr)rMr)r{)r) input_tokens output_tokenscache_read_tokenscache_write_tokensreasoning_tokensapi_call_count)estimated_cost_usdactual_cost_usd) model cost_status cost_sourcepricing_versionbilling_providerbilling_base_url billing_modesourcetask)brrrr__doc__rIr_TRANSCRIPT_WRITE_PATIENCE_S_ACTIVITY_WRITE_PATIENCE_Srfrrrr"r#rbrd_FTS_MERGE_MAX_PAGES_PER_INDEX_FTS_MERGE_COMMANDS_PER_PASS_IMPORT_MAX_SESSIONS _IMPORT_MAX_MESSAGES_PER_SESSION_IMPORT_MAX_TOTAL_MESSAGES_IMPORT_MAX_SESSION_BYTES_IMPORT_MAX_TOTAL_BYTES_TOKEN_WRITER_IDLE_SECONDS staticmethodrkrqrrrrrrrrrrrr2r:r8rArrQrMrqr~rrrrrrrUrrWrr_ classmethodrjrVrkrrrr^rgrZrrcrrrr#_TOKEN_DELTA_SUM_FIELDS_TOKEN_DELTA_COST_FIELDS_TOKEN_DELTA_ROUTE_FIELDSMAX_TITLE_LENGTH_TITLE_SOURCE_DERIVEDr_TITLE_SOURCE_LLMr_TITLE_SOURCE_USERr_TITLE_SOURCE_RANKCANONICAL_BOT_CHAT_TITLE_CONTENT_JSON_PREFIXREACTIONS_METADATA_KEY_CONVERSATION_ROW_COLUMNSr(r-r:rArF__annotate_func__rrrs@rhr\r\s a 7"SWX\^aO35O #-2E** #7._offloadeds' **4A$A&AA AAs (&()r>rcallable)rrrrs&& @rh __getattr__AsyncSessionDB.__getattr__s-txx&~~K BrjrN) rrrrrcrrrrr}s@rhrrsGrjrcV^8dQh/^\9d\\R3,;R&^\9d\\,;R&#)r`.r_repair_attempted_paths)__conditional_annotations__rVrsetre)rgs"rhririsA`87%c "27aB *)S)C rjr{)z:Review the conversation above and update the skill libraryz;Review the conversation above and consider saving to memory)z/Hermes can't open its session history right now)rrcrrrdrNloggingrrr rr?rrrrr collectionsr contextlibrrpathlibrhermes_dir_aclrr)rr typingr r r r rrrrrhermes_state_commonrrtrrurrvrr4rrrhermes_state_holdersrhermes_state_pidnsrhermes_state_healthrrrrrhermes_state_errorsr r!r"r#r$r%r&r'r(r)r*r+r,r-hermes_state_guardr.r/r0r1r2r3r4hermes_state_readpoolr5r6r7hermes_state_sessionsr8hermes_state_ftsr9r:hermes_state_portabilityr;hermes_state_telegramr<hermes_state_profile_repairr=hermes_state_schemar>rXhermes_state_lockguardrhermes_state_lockownersr?hermes_state_dbfiler@rArBrCrDrErFrGrHrIrJrKrLhermes_state_messagesrMhermes_state_prune_rewriterNhermes_state_api_contentrOhermes_state_coveragerPhermes_state_rewindrQhermes_state_walrRrSrTrUhermes_state_repairrVrWrXhermes_state_titlesrYhermes_state_usagerZhermes_state_maintenancer[hermes_state_gatewayr\hermes_state_compressionr]hermes_state_searchr^r ImportError getLoggerrrrrsr|rrrrr frozenset_BARE_BILLING_PROVIDERSrrrr,rrrrrrrrrrrcompiler rrr*r2r/r0r7rrr_repair_attempt_lock_REPAIR_LOCK_TIMEOUT_SECONDSr _IS_WINDOWSrArTrZr\rri)rs@rhrs      /(EVVV 23 UT6J<<A2-+:7?;62hg20<4<2   8 $