+ jHj^d2aR5t-0tRt^RIt^RIt^RIt^RIt^RIt^RIHt^RIH t RRlt Rt Rt Rt R t]tR t!R R ]4tR RltRRltRRltRRltRRlt!RR]4t!RR4tR6RRlltRtRt!RR ]P:4tR!R"ltR#R$lt ]PB!4t"/t#]^k/t$]^kR%R&lt%!R'R(]4t&]PNR)R*l4t(]PNR+R,l4t)R-R.lt*R/R0lt+R1R2/R3R4llt,R#)7aAdditive state.db schema drift: detection, the one-shot browse reconcile, and explicit repair. Drift (a declared table/column missing) is not corruption. Browsing catches an unowned store up once, additive DDL only (:func:`reconcile_drift_for_browse`); ``hermes sessions repair`` reconciles a protected snapshot so failed DDL never leaves the store partly upgraded or escalates into FTS surgery (:func:`repair_declarative_schema`). Neither runs while a gateway owns the store. N)closingPathc$V^8dQhR\/#pathr)formats";/home/ubuntu/.hermes/hermes-agent/hermes_state_reconcile.py __annotate__r sdc^RIHp^RIHp\ V!VP 4P 4R,RVR74;_uu_4pV!4F"pVPV4P4K$ RRR4R# \Pd5p^RI H pT!T4'd\T4uRp?uuRRR4#hRp?ii;i +'giR#;i)zCReturn a missing declared table/column, not a corruption diagnosis.)schema_read_probe_statementsconnect_tracked?mode=roTuri tracking_path_schema_not_builtN)hermes_state_schemarhermes_cli.sqlite_safe_readrrresolveas_uriexecutefetchonesqlite3OperationalErrorhermes_state_repairrstr)rrrconn statementexcrs& r schema_drift_reasonr$s@; !6!6!8:!E4_cd e eim 9;  Y'002< f  ''  = %%3x f e    f e s< C-BCC 9C:C C  CC C# c8^RIHpHpHpHpHp^RIHpVPVPR,4pV!V4;p 'd \V 4hV!V4;p 'd \V 4hV!WVR7V!V4;_uu_4p \V 4V!V P44V P4RRR4\V4;p 'd\RV 24hV!V4;p 'd\RV 24hV!WVR7V!V4;p 'd-\P !\"4P%R V 4R#R# +'giL;i T!T4;p 'd,\P !\"4P%R T 4ii;i) )_copy_database_snapshot_db_opens_cleanly _repair_conn_repair_scratch_space_error_unlink_db_triple)apply_declared_schemaz.reconcile-scratch)source_connectionNz"schema reconciliation incomplete: z"reconciled snapshot is unhealthy: )destination_connectionz,Could not remove reconciliation snapshot: %s)rr'r(r)r*r+rr, with_namename RuntimeError_require_history_tablescursorcommitr$logging getLogger__name__warning) rguardr'r(r)r*r+r,scratcherrorr!reasons && r _reconcile_snapshotr="sb:nnTYY)==>G+D11u15!!!'**u*5!!gG ' " "d #D ) !$++- 0 KKM # )1 16 1!CF8LM M&w/ /6 /!CF8LM MeL%g. .5 .   h ' / /0^`e f /# "&g. .5 .   h ' / /0^`e f /s*.E2E :8E3E E E=FcVPR4Uu0uF q^,kK ppRR0V, 'd \R4hR#uupi)z1SELECT name FROM sqlite_master WHERE type='table'sessionsmessageszWcanonical history tables are missing; use sessions recover, not additive reconciliationN)rr1)r!rowtabless& r r2r2?sM $ -` a b a!ff aF bJ&((tuu)csAc^RIHpHpHpHpV!V4'd \ R4h^RIHp\V!VP4P4R,RVR74;_uu_4p\V4RRR4\V4fVPRRR 7R#V!V4;p 'd \ V 4hV'd+V!V4wrV f\ R V 24h\V 4VR &V!V4;_uu_4wrV f\ R V 24h\W 4VPRR R 7RRR4R# +'giL;i +'giR#;i)r&)_backup_db_filer(_exclusive_repair_db_guard_live_writer_holds_dbz5a live writer still holds state.db; stop it and retryrrTrNalready_healthy)repairedstrategyzpre-repair backup refused: backup_pathz7could not acquire exclusive state.db repair ownership: reconcile_declarative_schema)rrDr(rErFr1rrrrrr2r$updater r=) rbackupreportrDr(rErFrr!r<bpathr;r9s &&& r _reconcile_lockedrPEs1 T""RSS; !6!6!8:!E4_cd e eim% f4 ( t.? @"4((v(6"" &t,  =!3E; E  E g@icJaa]tRt^wtoRtRR/V3RlV3RllltRtVtV;t#)DeclarativeDriftErrorzTThe store lags SCHEMA_SQL (missing table/column) and browsing could not catch it up.ownedFc&<V^8dQhRS[RS[/#)rdetailrS)r bool)r __classdict__s"r r "DeclarativeDriftError.__annotate__zssdr c2<\SV`V4W nR#N)super__init__rS)selfrUrS __class__s&&$r r\DeclarativeDriftError.__init__zs   r rS r7 __module__ __qualname____firstlineno____doc__r\__static_attributes____classdictcell__ __classcell__r^rWs@@r rRrRws^Ur rRc0V^8dQhR\R\/#)rr#return) BaseExceptionrV)r s"r r r sPPMPdPr cb^RIHp\V\P4;'d V!V4#)zK``no such table/column`` from a schema read probe: drift, never corruption.r)rr isinstancerr)r#rs& r is_declarative_drift_errorros&5 c733 4 O O9J39OOr c0V^8dQhR\R\/#rhomerkrr )r s"r r r s88$838r cX^RIHpV!V4pVR8XdR#V'dRV R2#RV R2#)z[The `hermes sessions repair` invocation that targets *home* (no time limit, additive only)._profile_label_for_homedefaultzhermes sessions repair hermes -p z sessions repairz HERMES_HOME=z hermes sessions repair)gateway.statusrvrrrvlabels& r _repair_commandr|s=6 #D )E ' E7"233 $6 77r cRV^8dQhR\R\\\3,/#rq)rtupler )r s"r r r s"888sCx8r cz^RIHpV!V4pV'dVR8wd VRV R23#T;'g \V4R3#)r&rurwrxz gateway restarthermes gateway restart)ryrvr rzs& r _owner_remedyrsF6 #D )E )# 5')9:::   CI7 77r c0V^8dQhR\R\/#rqrs)r s"r r r s " "$ "3 "r cH^RIHp^RIHpV!V!V4R, 4;'g/pVP R4p\ V\ 4'd@V'd8V!\V44V!V48wd\\V44^,#\V4^,#)aRestart command for the gateway that holds *home*'s lock. A multiplexer launched from another home (usually the default) records that home in ``hermes_home``; `hermes -p gateway restart` is refused there ("Manage the host gateway instead"), so name the owner's own command.)canonical_home)_read_gateway_lock_recordz gateway.lock hermes_home) gateway.runtime_ownershiprryrgetrnr rr)rrrrrecord owner_homes& r _owning_gateway_restartrs98 &~d';n'L M S SQSFM*J*c""znT*EU6VZhimZn6nT*-.q11  q !!r c>V^8dQhR\R\R,/#)rrrkNrs)r s"r r r s4C$Jr cr^RIHpHpHpHpV!V4FzwrVV^8:dKV!V4pVf/^RIpVP V4P4;'gRpV'gKRV!V4'gKbRVR,9gKrV!V4u# R# \\XP3dRpLXi;i)aqA Hermes gateway process holding *path* open without this profile's gateway.lock: a pre-v0.22.1 multiplexer serves named profiles without reserving their per-profile lock, so the lock alone misses it. Only holders whose command line is a Hermes ``gateway`` run count; plain readers (Desktop, sibling browses, CLI reads) are not owners. Returns a description, else None.)_looks_like_hermes_read_proc_argvdescribe_holder_pidforeign_state_db_holdersNgateway:NN) hermes_state_holdersrrrrpsutilProcesscmdline ImportErrorOSErrorError) rrrrrpid_targetargvrs & r _lockless_gateway_holderrs xw06  !8 s# < ~~c*224<< 4&t,,d2h1F&s+ +7   &,,7  s)BBB65B6c]tRt^tRtRtR#)BrowseBudgetExceededz\The browse reconcile could not finish inside BROWSE_RECONCILE_BUDGET_S; nothing was written.Nr7rbrcrdrerfrr r rrsfr rc~a]tRt^toRtV3RlRltV3RlRltV3RlRltV3RlR ltV3R lR lt R t Vt R #)_BudgetzSOne monotonic deadline for everything a browse does while holding ``gateway.lock``.c <V^8dQhRS[/#)rsecondsfloat)r rWs"r r _Budget.__annotate__sr cv^RIpVPVnVP4V,VnRVnR#)r&NF)time monotonic_clockdeadlineexpired)r]rrs&& r r\_Budget.__init__s)nn  /  r c <V^8dQhRS[/#rrkr)r rWs"r r rs7757r cX\VPVP4, R4#)g)maxrrr]s&r remaining_Budget.remainings4==4;;=0#66r c <V^8dQhRS[/#rr)r rWs"r r rs++e+r c6\VP4R4#)g?)rrrs&r busy_timeout_Budget.busy_timeouts4>>#T**r c<V^8dQhRR/#rrkNr)r rWs"r r rsBB4Br c@aV3RlpVPV\4R#)cX<SP4SP8d RSn^#^#)Trrrrsr progress_Budget.arm..progresss"{{} -# r N)set_progress_handler_BUDGET_PROGRESS_OPS)r]r!rsf& r arm _Budget.arms  !!(,@Ar c<V^8dQhRR/#rr)r rWs"r r rsZZtZr cxVP'gVP4^8:dRVn\R4hR#)r&T/browse schema catch-up exceeded its time budgetN)rrrrs&r check _Budget.checks1 <<<4>>+q0DL&'XY Y1r rN) r7rbrcrdrer\rrrrrfrg)rWs@r rrs>] 77++BBZZr rcBV^8dQhR\R\R,RR/#)rrbudgetNrkrr)r s"r r r s%%%%w~%%r c ^RIHp^RIHpHp^RIHpHpT;'g\\4pVP4\V!WVP4RR74;_uu_4pV!V4VPV4VPR4VP4pV!V4V!4F#p VPV 4P!4K% VP4VPR4RRR4R# \"P$d*p T!T 4'd\'\)T 44T hhRp ? ii;i \*dp \,P.!\"P04;_uu_4TPR4RRR4M +'giM;iTP2'd-\5T \"P$4'd \7R 4T hhRp ? ii;i +'giR#;i) aMissing SCHEMA_SQL tables and columns, in ONE ``BEGIN IMMEDIATE`` transaction. No data migration, no FTS work, no schema_version stamp (that stays the owner's: the version gates data migrations this path does not run). Every statement is additive and idempotent. The declared shape is verified inside the transaction before COMMIT: a column the shared reconciler could not add (it logs and continues) or an expired budget rolls the store back to exactly what it was, never a partial upgrade.r)_reapply_durability_barriersr)r,rN)rtimeoutisolation_levelzBEGIN IMMEDIATECOMMITROLLBACKr)rrrrrrr,rrBROWSE_RECONCILE_BUDGET_Srrrrrr3rrrrRr rl contextlibsuppressrrrnr) rrrrrr,rr!r3r"r#s && r _apply_additive_schemars<SW  9 9w89F LLN 6CVCVCX157 8 8;?$T* 4 &' [[]F !& )9; NN9-668< LLN LL "# 8 8//(--3CH=3F  $$W]]33 Z(4333~~~*S'2J2J"K"K*+\]cff   % 8 8 8sl*+G5"E 9D%E E $E E E  G2,G-F  G- F+&G--G--G22G55 H browse_schema_reconcileg?cBaa]tRtRtoRtV3RlV3RlltRtVtV;t#)CorruptStoreErrorizThe lagging store is also damaged: browsing must not write DDL into it. Worded like sqlite's own malformed-image error so every caller maps it to the corrupt-store status (``hermes doctor``).c <V^8dQhRS[/#)rrU)r )r rWs"r r CorruptStoreError.__annotate__ sZZsZr c.<\SV`RV R24R#)z3database disk image is malformed (integrity_check: )N)r[r\)r]rUr^s&&r r\CorruptStoreError.__init__ s NvhVWXYr rraris@@r rrsjZZZr rc0V^8dQhR\R\/#)rrrr)r s"r r r s++T+7+r c 4^RIHpVP4\V!VP 4P 4R,RVVP 4R74;_uu_4pVPV4VPR4P4pRRR4TP4XUu.uFEqw'gK \!T^,4P#4R 8wgK3\!T^,4NKG ppR P%TR ,4;'gR# +'giL;i \PdIpTP'd \R4Th^RIHpT!T4'd\!T4uRp?#hRp?ii;iuupi) ag``PRAGMA integrity_check`` on a read-only connection under *budget*: None when ``ok``, else the first problems. Full integrity_check, not quick_check: quick_check skips index-vs-table content, so an index with the right entry count but the wrong keys passes it. Raises :class:`BrowseBudgetExceeded` when the scan cannot finish in time (fail closed: no write).rrT)rrrzPRAGMA integrity_check(3)Nz/integrity check exceeded the browse time budget)is_malformed_db_errorokz; :NN)rrrrrrrrrfetchallr DatabaseErrorrrhermes_state_errorsrr lowerjoin) rrrr!rowsr#rrproblemss && r _integrity_problemrs9 < LLN  _T\\^%:%:%>>&'XY_b b=  % %s8O LsZAD5&1D"D53 F"F(F" D2 -D52D55F 1F < F F F  Fc$V^8dQhR\/#rr)r s"r r r 's  4 r c&.pWPVPR,43F;pVP4pVPVPVP 34K= \V4# \ dTPR4Kii;i)zW(size, mtime_ns) of the main file and its WAL: any committed write changes one of them.z-walN)r/r0statappendst_size st_mtime_nsFileNotFoundErrorr~)routpsts& r _store_signaturer'sx CNN499v#56 7 B JJ BNN3 48 :!  JJt  s7A00BBcDV^8dQhR\R\P/#rrrk)r threadingLock)r s"r r r :s==$=9>>=r c\VP44p\;_uu_4\P V\ P !44uuRRR4# +'giR#;irZ)r r _scan_guard _scan_locks setdefaultrr)rkeys& r _path_scan_lockr:s: dlln C %%c9>>+;< s )A A- c]tRtRtRtRtR#)_SiblingStillBusyi@z[Another browse/maintenance holder kept gateway.lock past its own budget; carries the drift.rNrrr r rr@ser rc$V^8dQhR\/#)rrrr)r s"r r r Es  T r c #"^RIHp\P!4;_uu_4pVP V!V.\ R74RxRRR4R# \ dp\RT R24ThRp?ii;i +'giR#;i5i)z``exclusive_maintenance`` for a browse. A lock this user cannot open at all (a root-run gateway's, #42685) is not drift and not a crash: refuse by name with its recovery text.)exclusive_maintenance)purposezRSession store is behind this Hermes version, but its gateway.lock cannot be used (z); nothing was changed.N)rrr ExitStack enter_contextBROWSE_RECONCILE_PURPOSErrR)rrrstackr#s& r _reservingrDs@     5 ;    5tfF^ _ `   ;'5/127: ; ;  s?$B A7AA7 B  A4A//A44A77 B  B c0V^8dQhR\R\/#)rrrrr)r s"r r r Ts0040t0r c#"^RIp^RIHpHpVP 4\ ,R,p\ P!4;_uu_4pVP\V44\T4RJxRRR4R# Tdjp\T4p T fRp?K5T!T4e T!T 4ThTP 4T8d \T 4ThTP\4Rp?KRp?ii;i +'giR#;i5i)aHold gateway.lock for the DDL. A sibling holder (another browse's flock probe or DDL, never a gateway) is retried, bounded by its own budget, rather than waited on passively: a probe holds the lock for no work and a sibling's DDL finishes inside BROWSE_RECONCILE_BUDGET_S. Yields True when the store is already current (nothing to do). Raises ``owned(drift)`` when a gateway turns out to own it, and :class:`_SiblingStillBusy` past the bound.NOwnershipConflictlive_runtime_ownerg?)rrrrrrrr r rr$rsleep_BROWSE_SIBLING_POLL_S) rrrrSrrrrr r#pendings &&& r _reserve_for_ddlrSsO~~";;cAH     5 3##Jt$45"$'4//!  % 3-d3?%d+7.c1>>#x/+G4#= 122 3  sUA D C8B+C8; D C5 C0C8!A C0*C80C55C88 D  D c$V^8dQhR\/#rr)r s"r r r psDr c^RIHpHpHpHpV!V4V8Xd\ V!V4;'gR4h\ VP44p\V4p\PV4V8XdV!4h\V\\44pT'dT!Y4\ T4hT# \dp T\T&T!4T hRp ? ii;i)aThe pre-lock phase of the browse catch-up: a full read-only integrity scan OUTSIDE gateway.lock (it may be slow on a large store and must never block a gateway boot). Returns the file signature the scan vouches for. Raises :class:`CorruptStoreError` for a damaged store (latched, so polls do not rescan it) and ``too_slow()`` when the scan cannot finish in its budget (remembered for the same signature, so a polling sidebar does not rescan a multi-GB file every few seconds).)STORAGE_CORRUPTmark_storage_corruptstorage_corrupt_reason storage_statezlatched corruptN)hermes_state_healthrrrrrr rr_scan_too_slowrrrBROWSE_INTEGRITY_BUDGET_Sr) rtoo_slowrrrrr signatureproblemr#s && r _verify_clean_before_lockr$ps qpTo- 6t < Q Q@QRR dlln C &I#)+j"$T73L+MN T+((  "'sjc!"s;B11 C<C  Cc0V^8dQhR\R\/#rrrV)r s"r r r sggTgdgr c Faaaaa^RIHpHo\V4oSfR#^RIHp\ V!VP4P4R,RVR74;_uu_4p\V4RRR4TPo\S4wopRTT3R lloTTTTT3R lp\S4;_uu_4RRR4\T4;p'd S!ST4h\!T4;_uu_4\T4f RRR4R#\#Y4p\%STS4;_uu_4p T 'dRRR4RRR4R#\'\(4p \T4;p'd S!ST4h\+T4T8wd\R S R S R24hTT3Rlp YP3F?p \,P.!T \,P04'dK0T !\3T 44h \5Y 4RRR4RRR4\T4;p 'd\R S RT R24h\@PB!\D4PGRTS4R# \dp\RS R 24ThRp?ii;i +'giEL;i +'giEL;i TdpS!S4e S!S4ThRp?ELRp?ii;i \6P8d7pR\3T4P;49dT !\3T44ThhRp?i\dp\R S RT R24ThRp?ii;i +'giELM;i \<dpT!4ThRp?i\>dp\R S RT R24ThRp?ii;i +'giEL;i)aCatch a lagging store up for a read-only browse; True when DDL ran, False when already current. Raises :class:`DeclarativeDriftError` (``owned=True`` when a running gateway owns the store) with a user-facing detail naming the drift and the remedy, and :class:`CorruptStoreError` when the lagging store is also damaged. Never touches a store missing its history tables: recreating them empty would hide lost sessions.rNFrrTrz-Session store is missing its history tables (z<); this is not upgrade drift. Run `hermes sessions recover`.c <V'dRM \S4pV'dRV R2MRp\RS RV RV RV R2 R R 7#) rz (rSession store for profile '!' is behind this Hermes version (z ), and a running gateway owns itz;, so browsing will not write to it. Restart that gateway (`z!`) to bring the store up to date.Tr`)rrR)driftholderrestartwhorrr{s&& r rS)reconcile_drift_for_browse..ownedsd.4*:QRV:W &6(!nB$)%0QRWQXY&&)U+ : .too_slowsa d # /= %)%0QRXQYZ11J30OP%&&c ef fr r*z&' changed while browsing verified it (zD); nothing was changed. Retry in a moment; the list was not cleared.c .<\RS RS RV R24#)r*r+z), but z is not writable by this user, so browsing cannot add the missing tables/columns; nothing was changed. Fix the permissions, then reload.)rR)whyr{r<s&r not_writable0reconcile_drift_for_browse..not_writables905eW<]^d]ef"e$abccr readonlyz<' is behind this Hermes version and could not be caught up (zF); nothing was changed. Run `hermes sessions repair` for that profile.z9' is being brought up to date by another Hermes process (z/). Retry in a moment; the list was not cleared.z1). Run `hermes sessions repair` for that profile.zTstate.db at %s lagged SCHEMA_SQL (%s); added the missing tables/columns for browsingrZ)$rrrr$rrrrrr2r1rRparentrrrrr$rrrrosaccessW_OKr rrrrrrr5r6r7r8)rrrr!r#_r!r-r"currentrr5targetafterrrr{rrSr<s& @@@@@r reconcile_drift_for_browser@sP  &F ~; !6!6!8:!E4_cd e eim ; #D ) f ;;DT"HE1II f f)     *$//v/FF##    t $ ,  .d= ' [!$e44 5  !!:;5d;;6;//#D)Y605eW="8#gijjc $[[1F99VRWW55*3v;772 -*48/5 X$D))u)#)%1 Q ST T h''^`dfln o ;'?xH1127: ; ; f e eB   ) d # /-S ( 0)D//!SX^^%55*3t953>,-/5eW=)),.##$*---9544B$ &*# %  ['-eW55 OQRWZ [ [Q   s $J& I(J(;J=J(4N NM. L? 8M B L? L? / K;M I=(I88I==J J  J% J(%J((K /KK L< %1L  L< #L< $L7 7L< <L? ? M MNM N M&& N 3N 4NN  N N rMTc0V^8dQhR\R\/#)rrrMr&)r s"r r r sDTr c ^RIHpHp^RIHpRRRRRRRR/pV!VP .4;_uu_4V!V4;_uu_4pV'g \ R 4h\WV4RRR4RRR4V# +'giL;i +'giT#;i T\\P\ \3dp\T4TR&Rp?T#Rp?ii;i) zHReuse repair's snapshot/SQLite exclusion beneath the runtime owner lock.)rr)_cross_process_repair_lockrHFrINrJr;z)could not obtain the state.db repair lock) rrrrrCr8r1rPrrr TimeoutErrorr )rrMrrrCrNholdingr#s&$ r repair_declarative_schemarFsR>%T=$QU VF# "DKK= 1 1+D11W&'RSS!$722 M 212 1 M w |\ R#c(w M#sLBB  A8 &B .B8 B B  B BB&CCCcV^8dQh/^\9d%\\\P3,;R&^\9d\\\ 3,;R&#)rrr)__conditional_annotations__dictr rrr~)r s"r r r sKf ,+T#y~~% &+g l &%S%Z %m r rZ).rHrerr5r9rrrpathlibrr$r=r2rPrr rr1rRror|rrrrrrr rrrrrrrrrrrcontextmanagerrrr$r@rFr )rHs@r rLsD "g:v NZ 5LP 88 "*g<gZZ:%P5Z--Z+0 nn )+ +$&%= f f    0084gTDr