+ jHj5e6Rt^RIt^RIt^RIHtHtHtHtHtRt Rt Rt Rt Rt RtR RR R/R ltR tR t]!0R%m4tRtRtRtRR&/RltR'tR(tRtR)tR*tRtRtRtRt Rt!Rt"RR&/Rlt#Rt$Rt%Rt&Rt'Rt(R t)RR&/R!lt*R+t+R"t,R#t-]+3R$lt.R#),z9Durable deletion fences outside prunable transcript rows.N)RuntimeStoreErroradmission_fingerprintmutation_receipt_key_json_textzgateway.retired_session.v1.zgateway.retired_route.v1.zgateway.viewer_close.v1:c^VPR\V,34P4RJ#)$SELECT 1 FROM state_meta WHERE key=?NexecuteRETIRED_PREFIXfetchoneconn session_ids&&E/home/ubuntu/.hermes/hermes-agent/hermes_state_mutation_retirement.py retired_inrs, <<>R\A\@^ _ h h jrv vvcVP4;_uu_4p\W!4uuRRR4# +'giR#;iN _read_ctxr)dbrrs&& rretired_sessionrs# 4$+ s / A c~VPRV34P4'dR#\W4'dR#R#)z``(code, message)`` refusing a create of the explicit *session_id*, else None: a live row, or a deleted (retired) id. A row recreated beside the fence would list fine and refuse every turn.!SELECT 1 FROM sessions WHERE id=?N)session_existszSession already exists)session_deletedz,Session was deleted; its id cannot be reused)r r rr s&&rcreate_conflictrs; ||7*GPPRR99$##PP rpinnedspentc(^pVP4;_uu_4pV!V4p\WV4'd!VeV!WV4'dWF3uuRRR4#MVeV!WV4'gWF3uuRRR4#V^, pKd +'giR#;i)a``(n, derive(n))``: the first generation of a derived session id a NEW request may use. A user-deleted id stays retired for good, so a derived id (header-less chat, Bot Chat, hosted-room member, A2A context) whose session was deleted moves to its next generation, never recreated. ``pinned(conn, sid)`` keeps an exact retry on the retired generation holding its identity; ``spent(conn, sid)`` skips a live one used up another way (a renamed Bot Chat). Read from durable rows only, so a restart and every concurrent caller pick the same id.Nr)rderiverr generationrsids&&$$ rfirst_generationr$&s}J 4$C$$$%&*;*;%?  eD&6&6!  !OJ s/BB5 B B c^pV!V4;qB8wd^VPR\V,34P4'gR#VPR\V,34V^, pKkR#)aMake permanent the fences a walk (``derive`` as for :func:`first_generation`) passed on its way to *session_id*, inside the write that binds *session_id*: that successor now holds the conversation, so a sweep marker aging out would send a later walk back to the passed generation. False when a passed generation has lost its marker since the walk (a sweep's was reclaimed): a walk now stops there, so *session_id* must not be bound as its successor.rFz]UPDATE state_meta SET value=json_remove(value, '$.expires') WHERE key=? AND json_valid(value)Tr )rr!rr"r#s&&& rkeep_passed_fencesr&9sf J$ $3 3||B^VYEYD[\eegg t$s*, .a rc WV3Fp\V4K \WVR/^R7wrVVP4;_uu_4pVPRV34P 4RJuuRRR4# +'giR#;i)model) operationpayloadexpected_revisionrN)rrrr r )r principal_idr request_idvaluekey_digestrs&&&& rhas_mutation_receiptr1IsjJ7 e 8' *X_ik:;=LC 4||BSFKTTV^bb s #A// B c^RIHpHpHpVP RW!,34P 4pVfR#V!V^,4pVP R4p\V\4'd;/VP4UU u/uFwrV\9gKWbK up pCR./CVR&VP R\V!V44W!,34R#uup pi)zA retired result keeps the exact-retry outcome (final response, flags, usage/accounting) but not the transcript copies a turn result carries (cumulative ``messages``, reasoning, the settled ``_turn_user_row``).) RESULT_PREFIX encode_result load_resultz(SELECT value FROM state_meta WHERE key=?Nresultmessages)UPDATE state_meta SET value=? WHERE key=?) hermes_state_terminalr3r4r5r r get isinstancedictitems_TRANSCRIPT_FIELDSr) r admission_idr3r4r5savedr.r6kvs && r_compact_resultrCUsPO LLCmFbEd e n n pE } a !E YYx F&$nv||~]~tqJ\A\dad~]n_ikmnhLLyz^s CCc ^RIHpHpHpVEFmpVP RV34P 4pVP RV34P 4p.VOVOUu0uF qR,kK upR0, p V 'd\ RV 9dR4hR4hVFp \V 4p ^R IH p V !V\P!V R ,4V R ,4R V R &R V R&\P!4V R&\W R,4VP RW+R,,\V 434VP RV!V R,W[R ,4\P!V R,434K VFp \V 4p VP RV R,34Uu.uFp\V4NK p p\!VRRR//R7pV FpVR,V8wgKRVR&K WR&\P!4V R&VP RW;R,,\V 434VP RV R,34K VP RV34VP RV34EKp R#uupiuupi) )ADMISSION_PREFIX WORKER_PREFIX identity_keyz:SELECT * FROM session_admissions WHERE target_session_id=?z2SELECT * FROM worker_executions WHERE session_id=?statusterminalunknownunknown_execution session_busy) retire_media payload_jsonr-z{}z[] lineage_json retired_atr?z-INSERT INTO state_meta(key,value) VALUES(?,?)r,zfSELECT sequence,payload_digest,result_json FROM worker_receipts WHERE execution_id=? ORDER BY sequence execution_idr)zexecution.finishr*)canonical_targetr*payload_digestN result_jsonreceiptsz0DELETE FROM worker_receipts WHERE execution_id=?z0DELETE FROM worker_executions WHERE session_id=?z8DELETE FROM session_admissions WHERE target_session_id=?)r9rFrGrHr fetchallrr<hermes_state_mediarNjsonloadstimerCrdumpsr)r session_idsrFrGrHr# admissionsworkersrstatesrawrowrNrVclosingreceipts&& rretire_terminal_receiptsrfdsqSS\\"^ad`fgppr ,,SVYU[\eeg'>'>g'>?'>!H++'>?:,N #9;N$7c cTbc cCs)C 7 tzz#n*=>L@Q R"&C "&C  $ C  Dn"5 6 LLH*-@@%*M O LLH&s>':C\ARSUYU_U_`cdr`sUtu wCs)C)-x^$&*()*(AQ*(H),S$&8)RHJG#+,7-1GM*$' O $ C  LLH'n*==uSzJ L LLKcR`NaMc d%& G#P ORUQWXO@$)s J+JzSELECT 1 FROM session_admissions WHERE target_session_id=? AND status IN ('queued','started','unknown') UNION ALL SELECT 1 FROM worker_executions WHERE session_id=? AND status IN ('registered','running','unknown') LIMIT 1expiringc^RIHpV!W4\W4\W4\ WVR7^RIHpV!W4R#)a^The complete deletion fence for ids that are being deleted in this transaction. Terminal receipts alone are not enough: without the ``RETIRED_PREFIX`` marker an exact retry of a settled request reports ``not_found`` instead of its terminal receipt, a late accounting/constructor backfill recreates the deleted row, and the same request is then admitted a second time against it. Every delete path (canonical mutate, legacy ``delete_session*``, prunes and sweeps) must publish the whole fence, so it lives here once. The marker of an id in *expiring* (a housekeeping sweep's) ages out at the retry horizon.)retire_spilloverrg)retire_local_receiptsN)rXrirfretire_mutation_receipts retire_routeshermes_state_localrk)rr]rgrirks&&$ rretire_sessionsros44T'T/T/$h78$,rca V'gR#RPR\44pVPRV R2\P!\ V4434P 4pVFwrE\P!V4pVPR4o \S \4'gKD\;QJd#V 3Rl\4F 'gK RM R M!V 3Rl\44'gKS P4UUu/uFwrxYw\9dRMTbK uppVR&VPR \V4V34K R#uuppi) zKeep each exact-retry mutation receipt (digest, ids, revision) but drop the user content a rewind/compress/rename result carries, so a retry after the delete cannot read it back.Nz OR c3."TF pRV R2xK R#5i)zjson_extract(value,'z'') IN (SELECT value FROM json_each(?1))N).0paths& r +retire_mutation_receipts..s!<$:D/tf4[\$:sznSELECT key,value FROM state_meta WHERE key GLOB 'gateway.mutation.v1.*' AND CASE WHEN json_valid(value) THEN (z) ENDr6c3,<"TF qS9xK R#5irrr)rsfr6s& rrurvs+]A\AKA\sTFr8)join_RECEIPT_SESSION_PATHSr rYr\listrWrZr:r;r<any_MUTATION_TRANSCRIPT_FIELDSr=r) rr]namedrowsr/rbrerArBr6s && @rrlrls  KK<$:< every id of its local conversation (the creation id (policy, FIFO, generation), each receipt lineage segment and the current target), and the ids of every derived (Bot Chat, A2A) conversation. One prefix scan, not a lookup per swept id. Malformed receipts name nothing.) POLICY_PREFIXz-SELECT value FROM state_meta WHERE key GLOB ?*entrylineagec3V"TFp\V\4'gKVxK! R#5ir)r;str)rsxs& rru'_local_conversations..s,u ^!aklmorasA ^s) )rNr-)rnrsetr rYrZ TypeError ValueErrorr;r<r:tupler{updatefromkeysr startswith_DERIVED_LOCAL_PREFIXES) rrmembersderivedrbrerridss & r_local_conversationsrs 135W,,NQ^adQdPfg jjoG'4((  W-w{{9/Eweu L 9 ^ SZ\`HaHaWgi ^;EeT;R;R , 7X\ ^ueeu L 9 ^ SZ\`HaHaWgi ^;EeT;R;R , 7X\ ^uut}}S./ w{{<(..B / : :;R S S NN3 h  :&   sGG'&G'cVPR\ R2\P!\ V4434Uu0uF q"^,kK up#uupi)zKThe ids among *session_ids* of derived API sessions (``_DERIVED_API_SQL``).zSELECT id FROM sessions WHERE z+ AND id IN (SELECT value FROM json_each(?)))r _DERIVED_API_SQLrYr\r{)rr]rcs&& r_derived_api_sessionsrsX"ll ()9(::ef D% &(* +*sFF* ++ +sAc aaa\V4\S4uowopVVV3RlpVUu.uFqC!V4'gKVNK ppV\SV4,p\SYUUu.uF qDV9gK VNK upR7V#uupiuupi)aKSweep variant of :func:`retire_sessions`: fence the idle sessions and return only those ids. A session with live or unknown work is skipped, so one busy row cannot abort a whole prune/empty-session sweep (explicit deletes still refuse with ``session_busy``). A local reset/compression conversation is swept only whole: while any of its ids is kept or has live work (the owner's queued admission continues on the current segment), every one is skipped. A sweep's markers age out at the retry horizon: housekeeping retires thousands of ids a pass (cron), and a permanent marker each would grow ``state_meta`` without bound. A derived id's stays (Bot Chat, A2A context, header-less chat, a chain's next generation, hosted-room member): its conversation resumes on the next generation, and the generation walk stops at the first unfenced id, so an aged-out marker would send the next turn back to the swept generation. A Bot Chat's mailbox receipts also outlive the horizon. A caller-named API id is not derived: its marker ages out, so the caller can use that id again, as for any other swept session.c<SPW34pSPV4;'d@\;QJdV3RlV4F 'gK RM RM!V3RlV44'*#)c3n<"TF*pSP\W34P4xK, R#5ir)r _LIVE_LEDGER_SQLr )rsrrs& rru5retire_prunable..removable..s02tnsij4<<@PSTRX3Y3b3b3d3dnss25TF)r: issupersetr|)r#wholer conversationsswepts& r removable"retire_prunable..removablesN!!#v.&ttss2tns2tsss2tns2t/t+ttrrj)rrrro)rr]rrr#quietrrsf& @@rretire_prunablers'*+&68LT8R#E #M7u( :KS9S>SSKE : $T511GD%%*V%3gCU33%*VW L ;*VsBB#B 0B cX^RIHpHpV!W4pV!WV4\W4VF;pVP WR4VP RV34VP RV34K= TP RVUu.uFqw3NK up4VPV4\4RV/3#uupi)rE) require_idledelete_targets session_resetziUPDATE sessions SET parent_session_id=NULL, runtime_revision=runtime_revision+1 WHERE parent_session_id=?z'DELETE FROM messages WHERE session_id=?zDELETE FROM sessions WHERE id=? deleted_ids) hermes_state_mutation_guardsrrro_bump_conversation_generationr executemany#_delete_unreferenced_system_promptsr)rrrr*rrtargetsr#s&&&& rdelete_in_transactionrsIT.G7#D" ((OD ADGCI J >G 678S7C78ST**40 5='* **9Ts6 B' c\P!V4p\ T\ 4'dTP R4#R# \\3dR#i;i)aThe ``session_id`` a stored routing/receipt JSON object names, else None. Unrelated rows are not validated here: a malformed one (an array, invalid JSON) names no target, so it can neither be retired nor abort the delete of a different session; the routing loader skips it too.Nr)rYrZrrr;r<r:)rbr.s& rentry_session_idrsO 3'1&=&=599\ "G4G z "sAAAc R\P!4/VCpV'd1VPRV\P!/VCRR/C434R#VPRV\P!V434R#)rQzINSERT INTO state_meta(key,value) VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=excluded.value WHERE json_valid(state_meta.value) AND json_extract(state_meta.value, '$.expires')expiresTaQINSERT INTO state_meta(key,value) VALUES(?,?) ON CONFLICT(key) DO UPDATE SET value=CASE WHEN NOT json_valid(state_meta.value) THEN json_remove(excluded.value, '$.own') WHEN json_extract(state_meta.value, '$.own') IS NOT NULL OR json_extract(state_meta.value, '$.expires') THEN excluded.value ELSE json_remove(excluded.value, '$.own') ENDN)r[r rYr\)rr/rfieldsr.s&&$, r _mark_retiredrsz499; 1& 1E G4::&@&@ 4&@AB D EHKDJJW\L]F^  `rc\V4pVFWp\V\V,W29RR7VPRRV,34VPR\V,34KY \V4pVPR4P 4F>p\ VR,4V9gKVPRVR,VR,34K@ R #) T)rownz"DELETE FROM state_meta WHERE key=?zgateway.api.settings.v1.8SELECT scope,session_key,entry_json FROM gateway_routing entry_json;DELETE FROM gateway_routing WHERE scope=? AND session_key=?scope session_keyN)rrr r VIEWER_CLOSE_PREFIXrWr)rr]rgr#rrcs&&$ rrmrm3s8}HdNS0#/tT 9`` slot of an ``agent::...`` routing key (``main`` for the launch profile, else the profile's ``_session_key_namespace`` slot); ``main`` for a key outside that shape.r:agentmain)rsplitlen)rpartss& rroute_namespacer@sN  !!r " ( ( -E5zA~%(g*=%((58VPVVrc\ V RV 2#)r)ROUTE_FENCE_PREFIX) namespacers&&rroute_fence_keyrGs !)Aj\ ::rat( EXISTS (SELECT 1 FROM state_meta m WHERE m.key = :retired_prefix || json_extract(:entry, '$.session_id') AND (:ns = 'main' OR NOT CASE WHEN json_valid(m.value) THEN json_extract(m.value, '$.own') IS NOT NULL ELSE 0 END)) OR EXISTS (SELECT 1 FROM state_meta f WHERE f.key = :fence_prefix || :ns || ':' || json_extract(:entry, '$.session_id') AND NOT CASE WHEN json_valid(f.value) THEN coalesce(json_extract(f.value, '$.expires') AND json_extract(f.value, '$.retired_at') < :now - :horizon, 0) ELSE 0 END AND (:ns != 'main' OR NOT EXISTS ( SELECT 1 FROM sessions s WHERE s.id = json_extract(:entry, '$.session_id')))))c HRVR\V4RVR\R\R\/#)zSThe named parameters of ``ROUTE_RETIRED_SQL`` for one routing entry saved at *now*.rnsnowhorizonretired_prefix fence_prefix)rRETRY_HORIZON_Sr r)rrrs&&&rroute_retired_paramsrfs0 Z{'CUCQZ\k nn>P RRrc  VP4;_uu_4p\VPR\,\ W\ P !444P 4^,4uuRRR4# +'giR#;i)zIA routing save (or the legacy sessions.json import) must skip this entry.zSELECT N)rboolr ROUTE_RETIRED_SQLrr[r )rrrrs&&& r route_retiredrlsZ 4DLL->!>!5ktyy{![]]e]e]ghikl s AA<< B c &VP4;_uu_4pVPR\\P!\ V4434Uu0uFwq3\ \4RkK upuuRRR4#uupi +'giR#;i)z\The ids among *session_ids* whose own marker in *db* is a sweep's (ages out at the horizon).zSELECT key FROM state_meta WHERE key IN (SELECT ? || value FROM json_each(?)) AND json_valid(value) AND json_extract(value, '$.expires')N)rr r rYr\r{r)rr]rr/s&& rexpiring_retirementsrsss 48<  I TZZ[(9: ;9=>9=fsC'()9=> > s8A?A:-A?:A?? B c R\V\\P!4\, 4\ V4/rCVFdpV0pVP RV34P 4'gVPR4VFp\V\Wu4WS9R7K WdV&Kf VP R4P4F^p\VR,4VP\VR,4R 49gK<VP RVR,VR,34K` R #) a0In the shared routing index (*conn*), fence the routes of *session_ids*, retired in the profile whose routing keys use *namespace*, and drop them. The fence is keyed by (profile, id) and copies the owner's marker: permanent for a delete, aging out with an *expiring* sweep's. Unless this store holds a session of that id, the launch (``main``) namespace is fenced too: a launch-keyed route to it names the retired session. The sweep fences that aged out here are reclaimed in the same write, so the owner's prunes bound them without the launch profile's sweep.rr)rrrrrrNrr)_reclaim_expiredrr[rrr r addrrrWrr:r) rrr]rgownedr#namesnamercs &&&$ rfence_shared_routesr|sT-tyy{_/LM(mRe ||?#HQQSS IIf D $ :CO Tc ||VW``b 3}- .%))toolsr7_turn_user_rowlast_reasoningrr)target_messagesummarytitle)z$.result.session_idz"$.result.target_message.session_idz$.result.target_session_idz#$.result.previous_target_session_id)z bot-chat:za2a:z(source='bot_room' OR (source='api_server' AND id GLOB 'api-[0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f][0-9a-f]'))i: )/__doc__rYr[hermes_state_runtimerrrrrr rrrrrr$r&r1 frozensetr>rCrfrror}rzrlrrrrrrrrrmrrrrrrrrrrrrrrrrs(? mm / 10w, 4t&  cXY {)YX}-2-(E_](0m.+2 +H`* = =W; lR l>="=, J) />/r