+ jHj4 Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI t ^RIt^RIHt^RIHtHtHtHtHt^RIHt^RIHt^RIHt^RIHtHtH t H!t!H"t"]PF!R 4t$R t%Rt&^t'^t(Rt)R t*Rt+Rt,R t-Rt.R t/RRlt0RRlt1RRlt2RRlt3RRlt4RRlt5RR/RRllt6RRlt7]PpR R!l4t9R"R#lt:]6t;R$R%ltR*R+lt?R,R-lt@R.R/ltAR0R1ltBR2R3ltCR4R5ltDR6R7ltER8R9ltFR:R;ltGR<R=ltHR>R?ltIR@R/RARBlltJRCRDltK](3RERFlltLRGRHltMRIRJltNRKRLltORMRNROR/RPRQlltPRRRS/RTRUlltQRRRS/RVRWlltRRXRYltSRZR[ltTR\R]ltUR^R_ltV]PpR`Ral4tWRbRRcR/RdRelltXRfRgltY] P!Rh4t[] P!Ri4t\] P!Rj4t]RkRllt^RmRnlt_RoRplt`RqRrltaRRsRtlltbRuRv/RwRxlltcRyRzltdR{R/R|R}llteR~R/RRlltfRRltgRRlthRRltiRRltjRRltkRRltlR]iRR3R]jRR3R]kRR3R]lRR33tmRRltnR#)zstate.db repair, backup and writability preflight (split from hermes_state). Patchable helpers are looked up as module globals at call time, so tests patch ``hermes_state_repair.``. ) annotationsN)Path)AnyDictListOptionalTuple)get_hermes_home)report_startup_progress)read_only_db_uri)_acquire_db_flock_clear_lock_holder_record_describe_lock_holder_read_lock_holder_recordis_advisory_lock_contention hermes_stateg?ig{Gz?zyFree disk space, then retry (or recover manually with `hermes sessions recover --source {db_path} --inspect-only` first).cV^8dQhRR/#db_pathr)formats"8/home/ubuntu/.hermes/hermes-agent/hermes_state_repair.py __annotate__rHsYYtYc$aV3Rl\4#)z>The three SQLite sidecar paths for *db_path* (present or not).c3h<"TF'pSPSPV,4xK) R#5iN with_namename).0suffixrs& r _sidecars..Js* XCWG  gllV3 4 4CWs/2)_DB_SIDECAR_SUFFIXESrsfr _sidecarsr'Hs XCW XXrc$V^8dQhRRRRRR/#)rrrwhatstrreturn Optional[str]r)rs"rrrMs!4s}rc^RIHpHpV!WR7;_uu_4V!4uuRRR4# \d R\r4L9i;i +'giR#;i T\3dR#i;i)aRun *reader()* under ``hermes_cli.sqlite_safe_read.offline_file_access``. ``close()`` on ANY raw descriptor cancels every POSIX advisory lock this process holds on the file, including a peer connection's RESERVED lock (``sqlite_safe_read`` rule 1), so a raw read is only safe with no live connection; ``None`` when that makes it unsafe or the file is unreadable. Scaffold/embed installs without hermes_cli have no tracked connections.)LiveConnectionErroroffline_file_accessc,\P!4#r) contextlib nullcontext)_p_ks&,r_read_offline..Ws ZE[E[E]r)r)N)hermes_cli.sqlite_safe_readr.r/ ImportErrorOSError)rr)readerr.r/s&&& r _read_offliner;MsfhX  4 485 4 h4]`g0h5 4 4  )s<.AA AAA A AA A,+A,c V^8dQhRRRR/#rrrr+boolr)rs"rrr_s4Drc^RIHpHpT;_uu_4\V4V9d RRR4R#VP \V44RRR4R# +'giR#;i)zClaim the one-shot per-process repair attempt for *db_path*: True for the first caller, False afterwards (bounds the repair/reopen loop and stops concurrent callers racing surgery on one file).)_repair_attempt_lock_repair_attempted_pathsNFT)rr@rAr*add)rr@rAs& r_claim_repair_attemptrC_sLK   w<2 2   ##CL1    sAA A% c(V^8dQhRRRRRRRR/#)rrrr"r*r)tailr)rs"rrrjs(T3crcVPVPV,4pVPPRRR7WDP R43# \ d+p\ PRT RT 2YE4TR3uRp?#Rp?ii;i)zDOpen ``.`` for locking; on failure warn and return None.T)parentsexist_okza+bzCould not open state.db u lock %s (%s) — N)rr parentmkdiropenr9loggerwarning)rr"r)rE lock_pathexcs&&&& r_open_lock_filerPjs!!',,"78Itd;../// 1$7I$PR[a$s.A BB=BBc V^8dQhRRRR/#)r flag_namer*r+Noner)rs"rrrusCCCCDCrc^RIpVP^4VPVP4\ W!4^4R#)N)msvcrtseeklockingfilenogetattr)handlerRrVs&& r _msvcrt_lockr\us+ KKN NN6==?GF$>BrcV^8dQhRR/#)rr+rSr)rs"rrr{sDDTDrc^RIHpV'd\VR4R#^RIpVP VP 4VP VP,4R#)zJTake the advisory lock on *handle* without waiting (raises on contention). _IS_WINDOWSLK_NBLCKN)rr`r\fcntlflockrYLOCK_EXLOCK_NB)r[r`rbs& r_try_lock_nonblockingrf{s6(VZ( FMMOU]]U]]%BCr clear_recordFc V^8dQhRRRR/#)rrgr>r+rSr)rs"rrrs 8 8$ 84 8rc ^RIHp\P!V4;_uu_4\P!\ 4;_uu_4V'd\ VR4MA^RIpV'd \V4VPVP4VP4RRR4RRR4R# +'giL;i +'giR#;i)z>Drop the advisory lock on *handle* (best effort) and close it.r_LK_UNLCKN) rr`r1closingsuppressr9r\rbr rcrYLOCK_UN)r[rgr`rbs&$ r_release_lock_handlernsv(   F # #Z%8%8%A%A   , )&1 KK  7&B # #%A%A # # #s)#C!B1 *5B1 C1 C <C C c V^8dQhRRRR/#)rrNrtimeoutfloatr)rs"rrrs22D252rcd\P!4V,p\V4R# \\3dsp\ T4'g\ PRY4Rp?R#\P!4T8dRp?R#\P!\4Rp?KRp?ii;i)zeWindows counterpart of ``_acquire_db_flock``: True / False (timed out) / None (non-contention error).TueCould not acquire state.db repair lock %s (%s) — skipping schema surgery on a non-contention error.NF) time monotonicrfBlockingIOErrorr9rrLrMsleep_REPAIR_LOCK_POLL_SECONDS)rNr[rpdeadlinerOs&&& r_acquire_repair_lock_windowsrys~~')H  2 !& )) 2.s33 78AH~~8+ JJ0 1 1 2s ,B/'B**B* B**B/cV^8dQhRR/#rr)rs"rrrs(((rc #"^RIHpHp\VRRR4wr4VfRxR#RpV'd\ W4V4pM\ \ V4WB\R4wrTVfRpM;V'g4\PRY2\V'dRM \V444VxV'd\VR R 7R#VP4R# T'd\TR R 7iTP4i;i5i) aSerialize state.db schema surgery across processes. Yields True when this process holds the repair lock, False when the bounded acquire timed out or the lock file could not be opened; on False the caller must NOT do surgery (unlocked surgery IS the interleaving this prevents). ``flock``: the kernel drops it when the holder dies (a pidfile would wedge every future repair); a forked child inheriting the fd is the exception, so the acquire records pid + start time and breaks a provably dead holder's lock. Bounded because a live repairer can sit in ``VACUUM`` for minutes. An unopenable lock file (no space/inodes/descriptors) fails closed too: a sibling that opened ITS handle before the disk filled may be inside surgery. The acquire is still bounded because a *live* repairer can legitimately sit in ``VACUUM`` for minutes on a large DB, and an unbounded wait would hang the caller's open with no traceback (the failure shape of #36644). )r`_REPAIR_LOCK_TIMEOUT_SECONDSz .repair.lockrepairzOskipping schema surgery rather than running it without cross-process authority.NFzstate.db repair lockustate.db repair lock %s held by another process for more than %.0fs — skipping schema surgery in this process to avoid racing the repairer. Recorded holder: %s.T)rg)rr`r|rPryr r*rwrLrMrrrnclose)rr`r|rNr[acquireds& r_cross_process_repair_lockrs G'+|~I ~ H 3IGcdH0Y1JLb d H  H NNh$0JbciJjk m  d ; LLN  d ; LLNs'%C4C 8C )7C )C4 (C11C4c V^8dQhRRRR/#)rrrr+z Optional[Any]r)rs"rrrs    rc\VRRR4wrVe \V4V# \\3dTP 4R#i;i)zNon-blocking cross-process lock for one auto-maintenance pass (None = skip the pass: otherwise two startups both pass the interval check and the second prunes a row the first has only just closed recoverably).z.auto-maintenance.lockzauto-maintenancezskipping automatic maintenance.N)rPrfrur9r~)r _lock_pathr[s& r"_try_acquire_auto_maintenance_lockrsY)2JL^aBCJ   !& ) W % s#!AAc V^8dQhRRRR/#rconnsqlite3.Connectionr+rSr)rs"rrrs I I0 IT Irc2VPR4P4^,pVPR\V4^,R, 24R# \P\ \ 3d"p\PRT4Rp?R#Rp?ii;i)aaIncrement the schema cookie after direct ``sqlite_master`` surgery. Ordinary DDL bumps it and peers compare it before running a prepared statement (how they discard a cached schema); ``writable_schema=ON`` edits do NOT, so live connections would keep firing triggers into ``messages_fts*`` shadow tables that no longer exist. Best-effort, never raises.zPRAGMA schema_versionzPRAGMA schema_version=iz)Could not bump state.db schema cookie: %sN) executefetchoneintsqlite3 DatabaseError TypeError IndexErrorrLrM)rcurrentrOs& r_bump_schema_cookiersy I,,67@@B1E -s7|a/?:.M-NOP  ! !9j 9IBCHHIsAA B5BBc V^8dQhRRRR/#)rheadbytesr+r)rs"rrrs%rc\V4^`8dV#\V4p\Fwr#RW2, ,WV%K \V4#)zJZero the commit-counter fields so ordinary writes don't re-key the ledger.)len bytearray#_FINGERPRINT_VOLATILE_HEADER_RANGESr)rbufstartends& r_mask_volatile_headerrsA 4y2~ D/C9  CK0#: :rc V^8dQhRRRR/#)r total_bytesrr+r)rs"rrrs__s_s_rcJ\\\V\,44#)zLFree space required *beyond* the copy itself, for a volume of *total_bytes*.)max_REPAIR_BACKUP_MIN_FREE_BYTESr_REPAIR_BACKUP_FREE_FRACTION)rs&r_repair_backup_headroom_bytesrs ,c+@\2\.] ^^rc$V^8dQhRRRRRR/#)rrrrefusalr*r+z#tuple[Optional[str], int, int, int]r)rs"rrrs' N N$ N N1T Nrc`VP4P\R\V444,p\P !VP 4pRY#P\TP43# \d%pRTP RT RT R2^^^3uRp?#Rp?ii;i)a#``(error, bundle_bytes, free_bytes, headroom_bytes)`` for *db_path*'s volume (main file plus every PRESENT sidecar); *error* is set (and the sizes zero) on stat()/disk_usage() failure. Fails CLOSED: the nearly-full volume these guards exist for is exactly where they are most likely to fail.c3"TF6qP4'gKVP4PxK8 R#5ir)existsstatst_sizer!ps& rr#_disk_budget..s*+gFX\d\d\f,> B- B("B-(B-c V^8dQhRRRR/#rrrr+r,r)rs"rrr s ] ] ]- ]rc \VR4wrr4VeV#W2^V,,V,8dR#RVR, R RVP RVR, R R^V,R, R R VR, R R 2 #) zEReturn an error unless snapshot, VACUUM and promotion can fit safely.zrepair snapshotNonly eA.2f GB free on z"; the repair snapshot needs up to zGB, VACUUM may need another zGB, and z8GB must remain as headroom. Free disk space, then retry.)rrI)rerrorsnapshot_bytesrheadrooms& r_repair_scratch_space_errorr s,8BS,T)E4   ^!34x??D3Js#;w~~.>>`#C((Da.FX\_E_`cDddl#~c""Z \]rc V^8dQhRRRR/#rr)rs"rrrs > >d >} >rc \PVR7p\VR4wr#rEVeV RV 2#WC, V8dR#RVR, R RVP R VR, R R VR, R R V 2 #) zDisk guard for the forensic copy: reason to refuse, or None. A full raw copy on a nearly-full volume (which a preceding repair loop may itself have caused) can finish off the disk and every process on the machine.r&z forensic copyNz. rrrrz; copying the damaged DB needs zGB and must leave z GB headroom. )_MANUAL_RECOVER_HINTrrrI)rhintrrrrs& r_backup_free_space_errorrs & &w & 7D".w"HE 4&!! {hD3Js#;w~~.>>]^beh^hil]mn^C( dV =>rc V^8dQhRRRR/#)r source_pathrr+rqr)rs"rrr$snn$n5nrc&^RIHp^pV.\V4OFNp\P!\ 4;_uu_4W#P 4P, pRRR4KP \W\, 4# +'giKy;i)zBound one SQLite snapshot by source size incl. sidecars (a WAL can hold committed rows not yet in the main file), so a healthy large-database copy is not cut off by the repair-lock timeout.)r|N) rr|r'r1rlFileNotFoundErrorrrr0_REPAIR_SNAPSHOT_MIN_THROUGHPUT_BYTES_PER_SECOND)rr| source_bytes candidates& r _repair_snapshot_timeout_secondsr$sr:L!;Ik$:;  !2 3 3 NN,44 4L4 3< +r)rs"rrr/s n n- nD nrcVa\S\P4'gR#\\SRR4;p\4'd+V^,\P \P 39#\;QJdV3RlR4F 'gK R# R#!V3RlR44#)uWhether a pre-strategy SQLite failure proves deterministic corruption. Lock contention, timeouts, disk-full and I/O failures are environmental — a retry may succeed, so they must not burn the repair ledger. Only SQLite's corruption/image result codes prove deterministic damage.Fsqlite_errorcodeNc3Z<"TF q\S4P49xK" R#5irr*lowerr!mrOs& rr#3_repair_failure_consumes_attempt..;s!m.lCHNN$$.l(+T)zfile is not a databasez database disk image is malformed) isinstancerrrZrSQLITE_CORRUPT SQLITE_NOTADBany)rO error_codesf r _repair_failure_consumes_attemptr/s c700 1 1-? FF*LLT!w'='=w?T?T&UUU 3m.lm33m3m3m.lm mmrc V^8dQhRRRR/#)rrrr+r)rs"rrr>sEEE$ErcFVPVPR,4#)z.repair-attempts.jsonrr&s&r_repair_ledger_pathr>s   W\\,CC DDrc V^8dQhRRRR/#rr)rs"rrrBs::T:m:rc0aRV3Rllp\SRV4#)aCheap identity for a damaged DB file: size + a bounded content sample. EXCLUDES mtime: a malformed-schema DB still accepts writes, so live writers, checkpoints and the strategies move mtime between passes; keyed on mtime every pass looked like a NEW file and the attempt counter reset forever. Hashing a multi-GB file per open is the cost this ledger avoids, so sample the head/tail slices any real repair, truncation or restore must change. ``None`` = identity unavailable (:func:`_read_offline`; a live peer is expected here since this runs BEFORE ``_backup_db_file``'s live-connection guard). Callers MUST NOT substitute a differently-shaped key: the ledger compares for equality, so alternating shapes never match and the unbounded loop returns.cV^8dQhRR/#rr+r*r)rs"rr%_db_fingerprint..__annotate__MseeSerc <SP4p\SR4;_uu_4pVP\4pVP \ ^VP \, 44VP \8dVP\4MRpRRR4VP R\P!\X4X,4P4R, 2# +'giLZ;i)rbrN::N N) rrKread_FINGERPRINT_SAMPLE_BYTESrWrrhashlibsha256r hexdigest)stfhrrErs r_sample _db_fingerprint.._sampleMs \\^ '4 B7745D GGC2::(AAB C9;F_9_27745ehD!**Qw~~.CD.ID.PQ[[]^abcdd ! s A2C** C: fingerprintr;)rrsf r_db_fingerprintrBs ee - 99rc V^8dQhRRRR/#rr)rs"rrrWs>>d>}>rc0aRV3Rllp\SRV4#)uRecovery-image identity for forensic-backup dedupe: whole file + sidecars. A DIFFERENT relation from :func:`_db_fingerprint` (never conflate them): the fingerprint answers "same repair epoch?" from head+tail only, and a live writer can commit into an *interior* page while preserving size and both 64 KiB slices — reusing a backup on that basis hands the operator a snapshot predating real user data. A forensic copy must claim byte identity, so this digests the ENTIRE main file plus every present sidecar (the WAL can hold uncheckpointed frames). ``None`` when a live connection makes the read unsafe (:func:`_read_offline`) — the caller then takes a fresh backup, never a false reuse. See #87409. cV^8dQhRR/#rr)rs"rr._backup_content_identity..__annotate__cs " "S "rc<a\P!4pRS3.R\\\ S444OpVFwr#VP RV RVP 4P R2P44\VR4;_uu_4o\V3RlR4FpVP V4K RRR4K VP4# +'giK;i)mainc3\"TF"wrVP4'gKW3xK$ R#5ir)r)r!sfxrs& rr#<_backup_content_identity.._digest..es$'{?lVSpqpxpxpz?ls, ,rrc&<SPR4#)ii)r)rsrr5;_backup_content_identity.._digest..ks"''+*>rrN) rrzipr%r'updaterrencoderKiterr)hashermemberslabelpathchunkrrs @r_digest)_backup_content_identity.._digestcs!G$|'{sCWYbcjYk?l'{|"KE MMBugQtyy{':':&;2>EEG HdD!!R!">DEMM%(E"! #!!"!!s )C C, zbackup-identityr)rrsf r_backup_content_identityrWs " " "3W ==rc V^8dQhRRRR/#)rrrr+dict[str, Any]r)rs"rrrqs.rc \P!\\4;_uu_4\P !\ V4PRR74p\V\4'dTM/uuRRR4# +'gi/#;i)utf-8encodingN) r1rlr9 ValueErrorjsonloadsr read_textrdict)rraws& r_read_repair_ledgerrqs^   Wj 1 1jj,W5???QR d++s 2 1 1 1 Is A A<< B c V^8dQhRRRR/#r=r)rs"rrrxs]]4]D]rcf\V4pVPR4p\V4pVeW#8HMC\V\4;'d-VP VP 4P R24pT;'d#\TPR^44\8# \dR#i;i)aWhether *db_path* has already burned its cross-restart repair budget. True only when the ledger records ``_MAX_PERSISTENT_REPAIR_ATTEMPTS`` failures against the CURRENT fingerprint. Never raises; a missing/corrupt ledger or unstatable DB reads as "not exhausted" (the in-process claim and cross-process lock still bound one run). Fingerprint unavailable (live connection) -> compare the SIZE the ledger recorded, otherwise a peer connection hides an exhausted budget on every pass.rrFfailed_attempts) rgetrrr* startswithrrr9r_MAX_PERSISTENT_REPAIR_ATTEMPTS)rledgerrecordedfpsames& r%_persistent_repair_attempts_exhaustedr)xs! )Fzz-(H  !B!#x~ x % [ [(*=*=AWAW@XXY>Z*[   \ \C #4a89=\\\ sB!-B!! B0/B0c V^8dQhRRRR/#)rrrr+r*r)rs"rrrs _ _ _ _rct^RIHpV!4pR\ RV RV RV RV R\V4P R2 #)zThe stable operator-facing diagnostic for an exhausted repair budget. The ``hermes`` commands carry the profile selector: a bare ``hermes`` follows ``active_profile`` (#105887).)profile_cli_selectorz$automatic repair has already failed u times on this exact file — the corruption is beyond the schema/FTS repair strategies (likely b-tree page damage). Manual recovery required: restore a backup, or salvage with `hermes zsessions recover --source z; --inspect-only`, then (if it reports recoverable) `hermes z --output recovered-state.db` (recovery snapshots the damaged file first, then runs the page-level `.recover` lane on the copy; do NOT point a raw `sqlite3` shell at the live database). Delete z$ to force another automatic attempt.)hermes_constantsr,r$rr )rr, profile_args& r"_persistent_repair_exhausted_errorr/sj6&(K23R2STCCN-OijqirsIIT Uopwoxy*'27788\  ^_rrc(V^8dQhRRRRRRRR/#) rrrrepairedr>rr,r+rSr)rs"rrrs/KKDKtK-KcgKrc T\V4pV'dVPRR7R#\V4pVPR4pVeTM \ V4pVf\ V\ 4'gR#TpWV8Xd#\VPR^44^,M^p\PP4PRR7pVP\P!RVRVRV/4R R 7R# \d"p \P!R T 4Rp ? R#Rp ? ii;i) uNUpdate the persistent attempt ledger after a repair pass. Never raises. Keys on the post-attempt fingerprint (what the NEXT exhaustion probe sees). If a live connection makes it unavailable, keep the recorded key and still increment — dropping the pass lets a peer reset the budget every time. Never write a differently shaped key.T missing_okNrr!seconds)timespec last_attemptrrz+Could not update state.db repair ledger: %s)runlinkrr"rrr*rdatetimenow isoformat write_textrdumps ExceptionrLrM) rr1r ledger_pathr%r&r'attemptsstamprOs &$$ r_record_repair_outcomerBs  &g.KK    $  / $W-::m,'3[9Q :h,,B@H3vzz"3Q781OQY[ikp*qr~E F KDcJJKs$C;AC;2BC;; D'D""D'c V^8dQhRRRR/#)rrrr+z list[Path]r)rs"rrrs===*=rcTVP R2pVPP4Uu.uFNq"PPV4'gK%VPP \ 4'dKLVNKP pp\TRRR7#uupi \ d.u#i;i)z8Timestamped forensic backups of *db_path*, newest first..malformed-backup-cVP#r)r )rs&rr5-_existing_malformed_backups..sqvvrT)keyreverse)r rIiterdirr#endswithr%r9sorted)rprefixrfounds& r_existing_malformed_backupsrOs ~/ 0F#NN224A4q8I8I&8QZ[Z`Z`ZiZij~Z4A %-t <<A  s.B"B"B;BBB B'&B'c$V^8dQhRRRRRR/#)rrrkeeprr+rSr)rs"rrrs'VVdV#VSWVrc\V4VRF+pV.\V4OFpVPRR7K K- R# \d"p\P RY44Rp?KGRp?ii;i)zADelete all but the *keep* newest forensic backups (and sidecars).NTr3z&Could not prune stale DB backup %s: %s)rOr'r8r9rLrM)rrQstalevictimrOs&& r_prune_malformed_backupsrUsi,W5de<0y/0F V  .1= VGUU VsA A, A''A,c(V^8dQhRRRRRRRR/#)rrrstaging backup_pathr+rSr)rs"rrrs(D4dtrc WV3p\\\V44UUu.uFawrEVP4'gKWQP VP V,4VP VP V,43NKc ppp.pV.VOFwrp \ P!W4K .VOVNF-wrp \P!W4VPV 4K/ R#uuppi \dl.R.TOTN4OTOFTp \P!\4;_uu_4T PRR7RRR4KB +'giKS;i hi;i)ukCopy DB + sidecars to *staging* names, then rename each into place. ORDER MATTERS: the main DB name is the bundle's commit marker (what ``_existing_malformed_backups`` counts), so sidecars publish FIRST and the main DB LAST — a failure partway never leaves a countable backup over a missing sidecar. On failure, staging files AND anything promoted are removed.c3*"TF wrq2xK R#5irr)r!_sstaged_ds& rr#)_publish_backup_bundle..sH6GNB6GsTr3N)rr%r'rrr rcopy2osreplaceappendr>r1rlr9r8)rrWrXrr"sidecarsidecars publishedsrcr\_dst_srcdstrTs&&& r_publish_backup_bundlerjsO k *D'*+?7AS'Tj'TOFX_XfXfXhv++GLL6,ABKDYDYZeZjZjmsZsDtu'T jI "&!2!2 C LL %"3!28!2T!2 D# JJv #   S !"3 j UH6G6G$6GHU9UF$$W--  ..---V  s2C,AC,AC22AE(3E  E( E!  E(c V^8dQhRRRR/#)rrrr+z$tuple[Optional[Path], Optional[str]]r)rs"rrrs8282T82&J82rc  \P!\4;_uu_4^RIHpV!V4'd+RV R2p\ P RW4RV3uuRRR4#RRR4\PP4PR4pVPVP RV 24p\P!^4F>pVP4'gM'VPVP RV RV 24pK@ VP R 2VP R 23FbpVPP!V4F@p\P!\"4;_uu_4VP%R R 7RRR4KB Kd \P!\"4;_uu_4\'V4R ,;p'dY\)V4p V eJ\)V^,4V 8Xd3\ P+RV^,4V^,R3uuRRR4#RRR4\-V4;pe\ P RW4RV3#\/WPVP RV 24V4\1V4VR3# +'giEL:;i +'giEKm;i +'giL;i \2d(p \ P5RY 4RRT 23uRp ? #Rp ? ii;i)uRaw-copy a (possibly malformed) DB plus sidecars to a timestamped backup. Raw bytes on purpose: the DB won't open cleanly, so preserve them exactly for forensics. Returns ``(backup_path, None)`` or ``(None, reason)``; repair treats a refused backup as a HARD STOP because the bundle is the recovery path when every strategy fails. Refuses while a connection to this DB is live in the process: the raw read would ``close()`` a descriptor and cancel that connection's POSIX advisory locks (``hermes_cli.sqlite_safe_read``) — real case: one SessionDB enters repair while the gateway holds others. Dedupe: reuse the newest backup when byte-identical to the current recovery image (``_backup_content_identity`` — NOT mtime, NOT ``_db_fingerprint``); a repair loop once re-copied the same bytes on every restart. Staging names live OUTSIDE the ``.malformed-backup-`` prefix: inside it they count as a backup, sort NEWEST (prune kept partials, deleted intact copies) and dedupe could return one with no real forensic copy on disk. Refusal reasons (``_backup_free_space_error`` / ``_MANUAL_RECOVER_HINT``) point operators at the safe lane, `hermes sessions recover --source --inspect-only`, never at a raw sqlite3 shell on the live file. See #69603. )has_live_connectionza connection to z is still open in this process; raw-copying it would cancel that connection's POSIX advisory locks. Close all SessionDB handles first.z&Refusing to raw-copy %s for backup: %sNz %Y%m%d_%H%M%SrE_z.backup-staging-*z.malformed-backup-*.incomplete*Tr3:NNzBReusing existing forensic backup %s (identical to the damaged DB).z"Refusing forensic backup of %s: %sz.backup-staging-z%Could not back up malformed DB %s: %szbackup copy failed: )r1rlr8r7rmrLrr9r:strftimerr itertoolscountrrIglobr9r8rOrinforrjrUr>rM) rrmreasonrArXseqpatternoldnewestsrc_idrOs & r_backup_db_filer{s&   [ ) )C w ' '( 2^^F LLA7 S< * ) ' *    ! ! # , ,_ =E##w||n4Fug$NOKq!!!## ''7<<.8J5'QRSVRW(XY "2#<<.(9:w||nLkM+C51112sg4JA!K2J( 2K7A(J= K*0K8K J% ( J: 3 K= K K LK=7L=Lc V^8dQhRRRR/#)rrrr+r>r)rs"rrrs F Ft F Frc\P\P,p\P!W4;'g4VP 4'*;'g\P!W4#)aTrue when *p* is read-write for this user OR no longer exists. The preflight lists the files first and checks them after, and a live sibling connection's last ``close()`` unlinks ``-wal``/``-shm`` in between (a concurrent quarantine can rename ``state.db`` aside the same way). ``os.access`` on the vanished path returns False, which is "gone", not "read-only". The final re-check covers a sidecar that vanished and was recreated by the next opener before ``exists()`` ran. )r`R_OKW_OKaccessr)rmodes& r_rw_or_vanishedrsF 77RWW D 99Q  E EQXXZ E E299Q3EErdb_labelzstate.dbdirectory_onlyc(V^8dQhRRRRRRRR/#) rrrrr*rr>r+rSr)rs"rrr%s*%5%5d%5%5[_%5lp%5rc(\V4R8Xg!\V4PR4'dR#Rp\P!\4;_uu_4\ \ 44P4pRRR4VPVPR,4VPVPR,43pV'dRM1\;QJd.RV.VO4FNK 5M!RV.VO44pVPR3.VOEFwrgV'dVP4'd\V4'dK7V'dRMR pR p \P!\\4;_uu_4VRJ;'d VP4P!V4p V 'dx\"P$!YfP'4P(\&P*,\&P,,V'd\&P.M^,4RRR4V 'd[\"P0!V\"P2\"P4,4'd\6P9R WV4EKVPP;R4'dR MR p \<P>!T R V'dRMR RV RV RV RV 2 4h R# +'giEL};i +'giL;i)uRefuse-or-repair read-only DB files BEFORE the first connection opens. A stray read-only ``state.db`` / ``-wal`` / ``-shm`` (sudo run, restored backup, copied dotfiles) otherwise surfaces as an opaque "attempt to write a readonly database" inside ``_init_schema``, and the obvious wrong "fix" (deleting the ``-wal``) loses committed transactions. ``chmod u+rw`` repair only inside the Hermes home tree (Hermes owns those files; ``chmod`` fails on files the user doesn't own, bounding the repair exactly); otherwise fail fast naming the file and command. Never deletes/truncates a WAL sidecar — once writable, the normal open checkpoints it. ``:memory:``/``file:`` skipped. Shared with ``kanban_db``. Port of Kilo-Org/kilocode#12508's startup preflight. This preflight: z:memory:zfile:N-wal-shmc3X"TF qP4'gKVR3xK" R#5i)FN)is_filers& rr#+preflight_db_writability..8s!+d@T1XaXaXcJQJ@Ts* *TxFz2%s preflight: repaired read-only %s (chmod u+rw%s)uv Do NOT delete the -wal file — it contains committed data that will be merged into the database once it is writable.z is not writable: directoryfile zf is read-only for this user. Hermes needs read-write access to open the database. Fix with: chmod u+rwz 'z4' (files owned by another user may need sudo/chown).r) r*r#r1rlr>rr resolverr tuplerIis_dirrr9ris_relative_tor`chmodrst_modeS_IRUSRS_IWUSRS_IXUSRrr~rrLrtrKrOperationalError) rrrhomerdfilesrrrin_scopewal_notes &$$ rpreflight_db_writabilityr%s9 7|z!S\%<%3L2A7L- K>  L rpg@c$V^8dQhRRRRRR/#)rrrrprqr+rr)rs"rrrMs"TuGYrc>^RIHpV!WVRR7p\V4V#)u``sqlite3.connect`` for the repair/probe paths, with macOS write barriers. These paths bypass ``SessionDB``/:func:`apply_wal_with_fallback`, so they inherited ``synchronous=NORMAL`` and no ``checkpoint_fullfsync`` — on Darwin an interrupted ``REINDEX``/``VACUUM``/``writable_schema`` rewrite leaves half-written b-tree pages. Autocommit (``isolation_level=None``): DDL and ``VACUUM`` are illegal inside an implicit transaction. Barriers are best-effort: on a malformed schema even ``PRAGMA synchronous=FULL`` raises, so whole-file rewrites call :func:`_reapply_durability_barriers` once the schema parses again. Tracked (:func:`hermes_cli.sqlite_safe_read.connect_tracked`) because repair connections hold the strongest locks in the process (``locking_mode=EXCLUSIVE``, ``BEGIN IMMEDIATE``); an untracked fd let the byte-level probes ``open()``/``close()`` the live file, which cancels every POSIX advisory lock this process holds on it (sqlite.org/howtocorrupt §2.2) and lets an external writer commit mid-repair (#63386). )connect_trackedN) tracking_pathrpisolation_level)r7r_reapply_durability_barriers)rrprrs&$ r_connect_repair_durablerMs#< 77\` aD & Krc V^8dQhRRRR/#)rrrrprqr)rs"rrrbsQQ$QEQrcB\P!\WR74#)zRA :func:`_connect_repair_durable` connection as a context manager, closed on exit.rp)r1rkr)rrps&$r _repair_connrbs   5gO PPrc V^8dQhRRRR/#rrrr+r>r)rs"rrrgs  '9 d rc\^RIHpHpV!V4V!V4R# \dR#i;i)zBest-effort (re)application of the macOS write barriers; True if accepted. Call before ``VACUUM``/``REINDEX`` once the schema parses: a connection opened on a malformed schema could not take them at open time. Never raises.)_apply_macos_checkpoint_barrier_enforce_macos_synchronous_fullTF)hermes_state_walrrr>)rrrs& rrrgs2b'-'- s  ++c V^8dQhRRRR/#rr)rs"rrrts  $6 4 rc ^RIHp\V4p\P!\ 4;_uu_4^RIHpHpV!V!4RRRR7;pe V!WRR7RRR4V# +'giT#;i) aDurability barriers for guest users of ``state.db`` that must inherit its owner's journal mode. Also applies the configured ``database.synchronous`` level, a per-connection pragma that otherwise only rides on the journal-mode setup path guests must not run.)_apply_synchronous_pragma)cfg_getload_config_readonlydatabase synchronousN)defaultzstate.db (guest)r) rrrr1rlr>hermes_cli.configrr)rrokrrraw_synchronouss& rapply_durability_barriersrtsg; %d +B   Y ' 'C&';'=z=bfg gO t %dFX Y ( I ( ' Is (A&& A7 c V^8dQhRRRR/#rr)rs"rrrs,rc\P!\4;_uu_4VPR4RRR4VP 4R# +'giL";i)zJLeave EXCLUSIVE locking mode (so the file is never left pinned) and close.zPRAGMA locking_mode=NORMALN)r1rlr>rr~rs&r_close_unpinnedrs7   Y ' ' 12 (JJL ( 's A A c$V^8dQhRRRRRR/#)rrrbeginr*r+rr)rs"rrrs"  T # 2D rc\VRR7pRVR3FpVPV4K V# \d\T4hi;i)zZero-timeout connection holding ``locking_mode=EXCLUSIVE`` after a rolled-back *begin*; closed (unpinned) and re-raised when exclusion cannot be taken.grzPRAGMA locking_mode=EXCLUSIVEROLLBACK)rrrr)rrr statements&& r_open_exclusiversV #7C 8D95*MI LL #N K  s .AcV^8dQhRR/#rr)rs"rrrsrc#"\VR4pTR3x\ T4R# \P\3dpRT3xRp?R#Rp?ii;i \ T4i;i5i)uYield ``(conn, None)`` — one live connection that excludes writers for repair surgery — or ``(None, exc)`` when exclusion could not be taken. ``locking_mode=EXCLUSIVE`` retains file-level exclusion after the short ``BEGIN EXCLUSIVE`` is rolled back; the rollback is essential because ``Connection.backup`` uses this connection as *source* and later as the promotion *destination*, both transaction-free. It stays open across the snapshot -> strategies -> promotion window so no writer can commit a change promotion would overwrite. Existing readers make acquisition fail rather than being disturbed (fail closed). Timeout 0: the cross-process lock already serializes repairers, and a partial repair is less safe than "stop the gateway and retry".zBEGIN EXCLUSIVEN)rrErrorr9r)rguardrOs& r_exclusive_repair_db_guardrsa):;Tk  MM7 #Ci s;A# $A A#AA A# AA# A  A#source_connectiondestination_connectionc ,V^8dQhRRRRRRRRRR/#) rrrdestination_pathrzOptional[sqlite3.Connection]rr+rSr)rs"rrrs9iiii/Ki4Pi\`irc aa \V4o \P!4S ,oRVV 3Rllp\P!4;_uu_4pT;'gVP \ V44pVe)VP'd\P!R4hT;'gVP \ V44pVPVRV\R7RRR4R# +'giR#;i)a&Copy one complete SQLite snapshot without replacing either file inode: the online backup API folds committed WAL frames into the source snapshot and writes the destination in one transaction (rolled back if interrupted), so ``state.db`` is never swapped out from under handles that refer to it.c(V^8dQhRRRRRRRR/#)r_statusr _remaining_totalr+rSr)rs"rr-_copy_database_snapshot..__annotate__s.jjj#jsjtjrc\<\P!4S8d\RSR R24hR#)z/timed out copying SQLite repair snapshot after z.0fsN)rsrt TimeoutError)rrrrxdeadline_secondss&&&r_check_deadline0_copy_database_snapshot.._check_deadlines2 >> x '!PQabePffghi i (rNz:SQLite repair backup destination has an active transaction)pagesprogressrv) rrsrtr1 ExitStack enter_contextrin_transactionrProgrammingErrorbackuprw) rrrrrownedsource destinationrxrs &&$$ @@r_copy_database_snapshotrs8 D~~"22Hjj     5"TTe&9&9,{:S&T ! -2H2W2W2W**+gh h,cc0C0CLQaDb0c  kNg h   s:C) C)+4C)) C: c V^8dQhRRRR/#rr)rs"rrrsSS=STSrcxa\;QJdV3RlR4F 'gK R# R#!V3RlR44#)zW``no such table/column``: FTS5 / core tables not created yet (brand new file mid-init).c3Z<"TF q\S4P49xK" R#5irrrs& rr#$_schema_not_built..s!R.QCHNN$$.QrTF)z no such tablezno such column)rrOsfr_schema_not_builtrs. 3R.QR33R3R3R.QR RRrzUmessages_fts(_trigram|_cjk)?(_data|_idx|_content|_docsize|_config|_segdir|_segments)?z\bTree (\d+)\bzmissing from index (\S+)cV^8dQhRR/#rr+r>r)rs"rrrsDrc8VUUUu/uFwr#qB'gK\V4VbK ppppVFp\V4pVPR4'dR#\P V4pV'dQVP \VP ^44R4pV'd\PV4'gR#\P V4p V 'gK\PV P ^44'dKR# R#uupppi)aTrue when any damaged object named by ``PRAGMA integrity_check`` output lies outside the FTS shadow set: a ``Tree N`` id mapped through ``sqlite_master.rootpage``, an index in ``row N missing from index X``, or the file's own freelist. Unparseable lines are not counted (the FTS wording stays, which is incomplete rather than wrong). #88587: an FTS rebuild cannot repair a canonical b-tree, and the ``.malformed-backup`` it leaves behind is a snapshot of the same damage.FreelistTrF) rr*r#_INTEGRITY_TREE_REsearchr"group_FTS_OBJECT_RE fullmatch_INTEGRITY_MISSING_INDEX_RE) integrity_lines master_rowsrp_typer name_by_rootpagelinetexttreemissings && rintegrity_damage_is_structuralrs>IO[/"TB B [O4y ??: & &!((. #''DJJqM(:B?DN44T::-44T: 7>33GMM!4DEE  Ps DDc V^8dQhRRRR/#r=r)rs"rrrsYYDYTYrc\P!\V4RRR7pTP R4P 4Uu.uFp\ T4NK ppTP R4P 4Uu.uFp\T^,4NK ppTP4\\PPRT44T4# \PdR#i;iuupiuupi \PdTP4R#\PdTP4R#i;i TP4i;i)aRead-only ``integrity_check`` + ``sqlite_master`` rootpage map on a fresh connection; ``integrity_damage_is_structural`` over the result. A check that RAISES instead of reporting (a torn page under the walk) is structural too: no FTS-only fixture does that while ``messages``/``sessions`` read cleanly, and the FTS rebuild ladder cannot help. Cannot-open / locked stays False so the caller keeps the FTS path.Tg?)urirpFzASELECT rootpage, type, name FROM sqlite_master WHERE rootpage > 0PRAGMA integrity_checkc3@"TFqP4xK R#5ir) splitlines)r!rs& rr#1state_db_has_structural_damage..s%JEDoo&7&7Es)rconnectr rrfetchallrr*rr~rrrqchain from_iterable)rrrrliness& rstate_db_has_structural_damagers8 /8dCP )- O*QQYQYQ[*\]*\AuQx*\ ]$(LL1I$J$S$S$UV$UqQqT$UV )%%%JE%JJK YY ==]V  # #     sd"C!DC7#D=C<DC43C47 DEE)E<E=EEEE&c V^8dQhRRRR/#rr)rs"rrrsLLtL Lrc  ^RIHpHp\V4p\P !V4;_uu_4V!V4VP R4P4VP R4P4pVUu.uFEqU'gK \V^,4P4R8wgK3\V^,4NKG ppV'd#RPVR,4uuRRR4#VP R4P4\F*pVP R V R V R 24P4K, R\&P(!4 2p VP R4VP RV R\&P&!434VP RV RR\&P&!434\FpVP RV RV R24K \P*!\P,4;_uu_4TP R4RRR4RRR4R#uupi \PdrpTPT4;'g \!T4p \#T\P$4'd T 'gR T R T 2uRp?uuuRRR4#Rp?EKRp?ii;i \P$d=pTPT4'g\!T4'ghRp?EKERp?EKLRp?ii;i \PEd p\!T4'gR\T4P49diRp?\P*!\P,4;_uu_4TP R4RRR4M +'giM;iRRR4R#RT 2uRp?\P*!\P,4;_uu_4TP R4RRR4M +'giM;iuuRRR4#Rp?ii;i +'giEL!;i \P*!\P,4;_uu_4TP R4RRR4i +'gii;i;i +'giR#;i \Pdp\T4uRp?#Rp?ii;i)uProbe a DB on a fresh connection. Returns None if healthy, else a reason. Runs the first statement that trips the malformed-schema parse (``PRAGMA journal_mode``), ``integrity_check``, a ``sessions`` read, FTS5 MATCH probes and a rolled-back ``messages`` write — so FTS5 index corruption (reads and ``integrity_check`` pass, every ``INSERT INTO messages`` fails through the FTS triggers) is reported as unhealthy. See #50502. ) SessionDBload_fts5_cjk_extensionzPRAGMA journal_moderr; :NNNzSELECT COUNT(*) FROM sessionszSELECT 1 FROM z WHERE z MATCH '""' LIMIT 1zfts5 read probe failed on : _hermes_fts_health_probe_zBEGIN IMMEDIATEz>INSERT INTO sessions (id, source, started_at) VALUES (?, ?, ?) _health_probezOINSERT INTO messages (session_id, role, content, timestamp) VALUES (?, ?, ?, ?)user_fts_health_probe INSERT INTO (z) VALUES('flush')z no such tokenizer: cjk_unicode61rzfts5 write probe failed: )rrrrr1rkrrr r*rjoin _FTS_TABLESrr_is_fts5_unavailable_errorrrrrstime_nsrlr) rrrrrowsrproblems fts_tablerObenignprobe_session_ids & r_db_opens_cleanlyr's@ #7 +D<    % % $D ) LL. / 8 8 :<< 89BBDD+/S4a1 QqT9Jd9R AaD 4HSyy".& % LL8 9 B B D)  OLL>)GI;Nc!dennp)&";4<<>:JK  - ./ ].MO n.8KTYY[Y[!,I" |I;a {J[%\]"-  ((77LL,8s& % T,, O'AA#F``J[\_J`F&sG,D,DEE&" H; "H;3H; !R2* S5(R2&IR2!A+L K %L*,R2Q ( R21S;R2K A K !K (K )R2/ S:R2K R2 L )L LL LP=3/P8"Q&,R2N- $ R2- N= 8R2S P8P=Q,R2?P  R2 P*%R2- S8P==Q Q R2-R/R  R/ R,'R//R22 S =SSS0 S+%S0+S0c V^8dQhRRRR/#r=r)rs"rrrPshh4hDhrc8^RIpVPV\R7#)uTrue when another process (or a connection outside this call) still holds ``db_path``. The foreign-holder scan (``hermes_state_holders``) is the authority: any other process with the DB or a WAL sidecar open, a deleted WAL generation, or an unknown/uninspectable holder fails CLOSED. The SQLite probe (``locking_mode=EXCLUSIVE`` + ``BEGIN IMMEDIATE``) is only an additional positive signal — it cannot see a ``journal_mode=DELETE`` reader and cannot run on a malformed file, which is why the scan comes first.N)connect_repair_durable)hermes_state_holderslive_writer_holds_dbr)r_state_holderss& r_live_writer_holds_dbr.Ps2  . .wOf . ggrc ,V^8dQhRRRRRRRRRR/#) rreportrverbr*rrOzOptional[BaseException]r+r)rs"rrr[s1s3E\hvrcvVe\V4'dRVR&W R&\PRV R2V4V#)zRecord *error* on *report* and log it as ``state.db repair ``. An *exc* proving deterministic corruption consumes the persistent repair budget (private ``_repair_attempted`` marker, popped by the caller).T_repair_attemptedrzstate.db repair z: %s)rrLr)r0r1rrOs&&&&r _repair_skipr4[sC ;C@@&*"#7O LL#D6.6 MrrTc$V^8dQhRRRRRR/#)rrrrr>r+rr)rs"rrrfs&CCDCTC^Crc >RRRRRRRR/p\RRR 7\V4pVP4'g V R 2VR&V#\V4'd\ VR \ V44#\ V4;_uu_4pV'g+\V4f R R uVR&VR&MRVR&VuuRRR4#Tp\V4'd\ VR \ V44MS\V4'd\ VR R4M4\V4p\WVVR7pVPR4'dWTR&VPRR4'gVPR4'd&\V\VPR44R7RRR4V# +'giX#;i)aRepair a state.db whose ``sqlite_master`` is malformed or whose FTS indexes reject writes. Two corruption classes: malformed schema / "duplicate object definition" (even ``PRAGMA`` fails), and FTS write-corruption (reads and ``integrity_check`` pass, writes fail through ``messages_fts*`` triggers). ``_REPAIR_STRATEGIES`` run least-destructive first on a complete snapshot; a success is copied back transactionally, so canonical rows are never modified by a failed attempt. A raw backup is taken first unless ``backup=False``. Serialised across processes (gateway, Desktop backend and CLI open the same file; concurrent ``writable_schema`` surgery is itself a corruption source). Returns ``{repaired, strategy, backup_path, error}``. See #50502. r1FstrategyNrXrg @state_db_repair)phasez does not existskippedTrepaired_by_other_processzcould not obtain the state.db repair lock (held by another process, or the lock file was unopenable); skipped schema surgery to avoid racing a concurrent repairerza live writer still holds state.db; skipped schema surgery to avoid tearing b-tree pages under a concurrent writer. Stop the gateway (hermes gateway stop) and retry.)rr0journal_mode_beforer<r3)r1)r rrr)r4r/rr'r._probe_journal_mode_for_repair_repair_state_db_schema_lockedr"poprBr>)rrr0 holding_lockresult before_modes&$ rrepair_state_db_schemarCfs)%T=RVX_aefFE):;7mG >>  $I_5w -W55FI/QRY/Z[[ #G , , !)19=?Z6z"F:$6$xw - , 1 9 9 ,Nw,W X#7 + + -u v9AK3GSYHSUFzz*%%0;,- ::)5 1 1VZZ 5K5K "7T&**Z:P5Q RG -H MI - ,H Ms=(F 0BF F %F  F c V^8dQhRRRR/#rr)rs"rrrs  D ] rc^RIHp\V4;_uu_4pV!V4uuRRR4# +'giR#;i \P\ 3dR#i;i)uBest-effort journal-mode probe: ``wal``/``delete``, or ``None`` when the file cannot be opened or probed (malformed header, concurrent opener's locks — both expected on the repair path); callers then fall back to ``database.journal_mode``.)_on_disk_journal_modeN)rrFrrrr9)rrFrs& rr=r=sJ7 ' " "d(.# " " " MM7 #s(A. A ? AAA! A!rc$V^8dQhRRRRRR/#)rrrrBr,r+rSr)rs"rrrs' F F F= Fcg Frc^RIHpVf1\V4;_uu_4pV!W@PR7pRRR4MV!W PR7pV'd#XV8wd\P RWV4R#R#R# +'giL<;i \ P\3d"p\P RY4Rp?R#Rp?ii;i)uRe-apply the journal mode after schema surgery. ``conn`` must be the exclusive repair guard connection when called from the repair path: opening a fresh connection AFTER the guard released let a writer still holding the unlinked old ``-wal`` inode coexist with a brand-new ``state.db-wal`` — two generations of one store. The reopen is the hazard, not the mode. A rebuilt file comes back in the default (delete) mode; without this a corruption event silently moves a WAL store out of WAL (the open-time WAL-reset gate never sees a flip made inside repair). Routed through :func:`apply_wal_with_fallback`, not a direct pragma, so it inherits the WAL-reset gate (a vulnerable runtime deliberately keeps DELETE; the journal_mode-changed WARNING is expected there), the macOS-NFS silent-refusal handling and the WAL companions. ``before_mode`` is only for the log comparison; the target is ``database.journal_mode``. Best-effort: the repair already succeeded, so failures log at WARNING. See #89674. See #89393. The transactional promotion already leaves the destination in its pre-repair mode, so on that path this is mostly the WAL-companion re-assertion; the reopen is the hazard, not the mode. See #101064. )apply_wal_with_fallbackNrzstate.db repair changed journal_mode %r -> %r (pre-surgery probe %r; restore resolved through apply_wal_with_fallback per database.journal_mode and the WAL-reset gate)zvstate.db repair at %s: post-surgery journal-mode restore failed (%s); verify with PRAGMA journal_mode on the next open) rrIrr rLrMrrr9)rrBrrIrafterrOs&&$ r"_restore_journal_mode_after_repairrKs&9 F <g&&%/ M'&,D<<HE 5K/ NNo&{ <0; '& MM7 #F78? F FFs3BA;#BB; B BC )CC r<c ,V^8dQhRRRRRRRRR R/#) rrrrr>r0rr<r,r+r)rs"rrrsBKlKl Kl"Kl,:KlQ^KlKlrc VPVP R24p\V4;pe\VRRV 24#\ V4fRRuVR&VR&V#V'd:\ V4wrgV'd \ V4MRVR &Vf\VRR V 24#\V4;_uu_4wrVf\VR R V 2V R 7uuRRR4#\V4;p e\VRV 4uuRRR4#\WVR7RTR&\YB4TPR4'dB\Y@TR7\ P#RTPR4T4\%YTR7TPR4'g\ P+RYR ,4T\T4;pe\ P#RT4uuRRR4# \\P\3d5p \T4\TRRT RT 2T R 7uRp ? uuRRR4#Rp ? ii;i \\P\3dGp TP'RR\)T 4R7RT 2TR&\ P+RT 4Rp ? ELRp ? ii;i \T4;pe\ P#RT4ii;i +'giR#;i)u)Repair strategies for :func:`repair_state_db_schema`; caller holds the cross-process repair lock. Strategies run on a SCRATCH COPY, copied back through SQLite's transactional backup API only once proven to open cleanly, so a failed repair cannot modify or lose committed data (a WAL checkpoint of committed frames on guard release is not a repair mutation). WHY not in place: the final strategy ends in ``VACUUM``, which rebuilds the file from the schema SQLite can still parse — when the damage IS in the schema b-tree (the ``malformed database schema ()`` class) every table hanging off the unreadable part is silently dropped, the probe still reports malformed, and repair returned ``repaired=False`` having destroyed what it was asked to save. The pre-repair backup (#69603) does not close this: it is a forensic artefact that nothing reads back, so recovery still depends on a human noticing a ``.malformed-backup-*`` file and knowing what to do with it. Not mutating the original in the first place is the property that holds without a human in the loop. z.repair-scratchNabortedzBcould not remove a stale repair snapshot before probing state.db: Talready_healthyr1r7rXzepre-repair backup refused; aborting schema repair to avoid mutating the only copy of the damaged DB: r:zcould not acquire exclusive state.db repair ownership; skipped schema surgery to avoid overwriting a concurrent writer. Stop the gateway and retry: r)rz5could not stage a complete SQLite repair snapshot of rr3)rz;state.db repaired via '%s' and promoted transactionally: %srF)r1r7r3z9repaired snapshot could not be promoted transactionally: rz$state.db repair promotion failed: %szstate.db schema repair could not recover %s automatically (no committed canonical data was modified or lost; backup: %s); manual restore from backup may be required.z:Could not remove state.db repair snapshot after repair: %s)rr _unlink_db_tripler4r'r{r*rrrr9rrr_run_repair_strategiesr"rLrMrKrrr) rrr0r<scratch cleanup_errorbpath backup_error live_guard guard_error space_errorrOs &$$$ rr>r>s 7<<. @AG*733 @FI1suBtC0DE E!)157H.zF:.  -g6.3E } = 4MMYN4\] ] $G , ,0I   4x#.-416AC - , 7w? ?K L ;? - , F $G S l+/F& ' "7 3zz*%% f+GU_`NN#`#)::j#97D6wZde::j)) n$]&;="37!;; H[]jkW - , 5 F g & 5jkrjssuvyuz3{BEF F - , F  =NMM544TUX4Y"[(abeaf&gF7OLL!GMM N$"37!;; H[]jkIU - , ,s,J<J<6 G'J, H(9A JJ!%J< H%1H H%J< H%%J<( J;J J JJ(J99J<< K c V^8dQhRRRR/#)rr rr+r,r)rs"rrr)s''D']'rc^RIHp.pV.\V4OF)p\^ 4FpVP RR7K' K+ RPV4;'gR# \ dbp\ T\4'd,T'd$T^ 8d\P!R4Rp?KTPT RT 24Rp?LRp?ii;i)zCRemove *path* and every SQLite sidecar; return any cleanup failure.r_Tr3g?Nrr) rr`r'ranger8r9rPermissionErrorrsrvrbr)r r`failuresrTattemptrOs& rrPrP)s(H*)D/*RyG 4  . !+ 99X  & &$& 4c?33 RS JJt$6("SE 233  4s#A C *CC+CC c V^8dQhRRRR/#rr)rs"rrr=s04rcVPR4V!4'd \V4VPR4VP4R#)zRun *edit* under ``writable_schema=ON``; bump the schema cookie when it reports a change so live peers discard their cached schema.zPRAGMA writable_schema=ONzPRAGMA writable_schema=OFFN)rrcommit)redits&&r_edit_sqlite_masterrc=s6 LL,- vvD!LL-.KKMrc V^8dQhRRRR/#rr)rs"rrrGsVV 2VtVrc ^RIHpV!V4\FPp\P!\ P 4;_uu_4VPRV RV R24RRR4KR R# +'giKg;i)zFTS5 'rebuild' rewrites each index from the content table: the least- destructive fix for an index that rejects writes while reads work.)rrrz) VALUES('rebuild')N)rrrr1rlrrr)rr table_names& r_strategy_rebuild_ftsrgGs^5D!!  !9!9 : : LL< |1ZL@ST U; :" : : :s A++ A< c V^8dQhRRRR/#rr)rs"rrrRs.4rc^\V4VPR4VP4R#)zintegrity_check reports "wrong # of entries in index" when a B-tree index drifts from its base table; REINDEX rewrites it from canonical rows.REINDEXN)rrrars&r_strategy_reindexrkRs!!&LLKKMrc V^8dQhRRRR/#rr)rs"rrr[s & &!3 & &rc2aRV3Rllp\SV4R#)zJDe-duplicate sqlite_master (lowest rowid per type/name wins), keeping FTS.cV^8dQhRR/#rr)rs"rr,_strategy_dedup_schema..__annotate__]sDrc<SPR4P4pVFwrr4SPRWV34K \V4#)zhSELECT type, name, COUNT(*) AS c, MIN(rowid) AS keep FROM sqlite_master GROUP BY type, name HAVING c > 1zFDELETE FROM sqlite_master WHERE type IS ? AND name IS ? AND rowid <> ?)rr r>)dupestype_r _countrQrs r_dedup&_strategy_dedup_schema.._dedup]sR v (* */ %E LLat, .*/E{rN)rc)rrtsf r_strategy_dedup_schemarv[sf%rc V^8dQhRRRR/#rr)rs"rrris$64rc`a\SV3Rl4\S4SPR4R#)zDrop all FTS schema and VACUUM; indexes rebuild on the next open. The destructive one, and why strategies run on a scratch copy: on a damaged schema b-tree VACUUM silently drops every table hanging off the unreadable part.c:<SPR4;'gR#)z9DELETE FROM sqlite_master WHERE name LIKE 'messages_fts%'T)rrsrr5+_strategy_drop_fts_vacuum..msdll3n&o&w&wsw&wrVACUUMN)rcrrrsfr_strategy_drop_fts_vacuumr|is$wx &LLr rebuild_ftsz594 2F: z 2 NN; 0M  $7O1C M'&$$ 1XF&{0 1s-B A5B5 B BC $CC i)rrz-journal)))\`i) messages_ftsmessages_fts_trigrammessages_fts_cjkr)o__doc__ __future__rr1r9rrqrloggingr`rerrrrspathlibrtypingrrrrrr-r hermes_startup_watchdogr r+r hermes_state_commonr r rrr getLoggerrLrwrr$_MAX_MALFORMED_BACKUPSr%rrrrrrr'r;rCrPr\rfrnrycontextmanagerrr_release_auto_maintenance_lockrrrrrrrrrrrrr)r/rBrOrUrjr{rrrrrrrrrrrcompilerrrrrr'r.r4rCr=rKr>rPrcrgrkrvr|rrQrrrrs #   33,;1   > *3C0#$4! ';#!2#J ^Y $C D 8 82" ((V "6 I_ N ] >n nE:*>4]$ _KZ^K6=9OV.82v F%5z%5bg%5Ps*QCQ    .iNRiSWi.S\ZZ 12 jj)DE.Y0L^hCDCL  FZ^ FFKlaeKl\'(V &)+i46')Z')+Y,.2kmqs r