+ jHj, a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI H t H t H t ^RI H t ^RIHtHt^RIHt^RIHt^RIHt]P.!]4tR tR R ltR R lt]P:!R4tRRlt] !0R/m4t!RRlt"Rt#Rt$Rs%R]&R&]PN!^R7RRl4t(R0RRllt)RRRRR R/R!R"llt*R R/R#R$llt+R%R&lt,R'R(lt-R R/R)R*llt.R R/R+R,llt/R R/R-R.llt0R#)1uExternal drain-control marker contract (dashboard → gateway). No control channel exists into a running gateway, so begin/cancel-drain writes (or removes) ``{HERMES_HOME}/.drain_request.json`` and a gateway watcher reacts; an ACTIVE marker means ``gateway_state -> "draining"``. Two lenient staleness signals (either suffices): epoch mismatch (HERMES_HOME is a durable volume on Hermes Cloud, so a marker survives the restart a drain-gated action ends in and would park the fresh gateway in ``draining`` forever) and expiry (same-epoch orphan past :data:`DRAIN_REQUEST_MAX_AGE_SECONDS`; re-writing refreshes it). Reading never raises: a malformed file reads as ``{}`` — still drain-active (fail-safe toward quiescing). Staleness rejects only on a *definite* verdict. ) annotationsN)datetimetimezoneUTC)Path)AnyOptional) _parse_iso)get_hermes_home)atomic_json_write restart_waitcV^8dQhRR/#)returnNone)formats":/home/ubuntu/.hermes/hermes-agent/gateway/drain_control.py __annotate__r$s999cp\VRR4pVe%VPR4'g \VR&R#R#R#)z^Publish the restart's after-turn wait (``drain_reason``) unless a drain already named its own.session_runtime_descriptorN drain_reason)getattrgetRESTART_WAIT_REASONrunner descriptors& ropen_restart_waitr$s8!=tDJjnn^&D&D%8 >"'ErcV^8dQhRR/#rrboolr)rs"rrr+sGGGrc\VRR4;'g/p\\VRR44;'d7\\VRR44;'dVPR4\8H#)zSTrue while *runner* is in a restart's after-turn wait (draining, not yet stopping).rN _drainingF_runningr)rr"rrrs& rrestart_wait_openr&+sk!=tDJJJ e4 5 F F$wvz[`?a:b F F~.2EEGrzh/api/(?:health|status|profiles/sessions(?:/sidebar)?|sessions/[^/]+(?:/messages(?:/around)?|/timeline)?)cV^8dQhRR/#r!r)rs"rrr;s++t+rcVR8H;'d<\\PT;'gR44;'d \V4#)zVTrue for an allowlisted read request while *runner* is in a restart's after-turn wait.GET)r"_RESTART_WAIT_READS fullmatchr&)rmethodpaths&&&rrestart_wait_readr/;sC eO * *%8%B%B4::2%N O * *!&)+rcV^8dQhRR/#r!r)rs"rrrLs___rcP\\VRR44;'d V\9#)zUTrue when an interactive WebSocket verb must be refused because *runner* is draining.r$F)r"rRESTART_WAIT_WS_METHODS)rr-s&&r ws_method_refused_while_drainingr3Ls$  U3 4 ^ ^G^9^^rz.drain_request.jsong @z Optional[str]_expiry_logged_for)maxsizecV^8dQhRR/#)rrstrr)rs"rrr\sHHSHrcR;r\P!\4;_uu_4\R4P RR7P 4pRRR4\P!\\ 4;_uu_4\R4P RR7PR^4^,P4^,pRRR4V'g V'dV RV 2#R# +'giL;i +'giL<;i) u|Identity of THIS container / VM instantiation (":"). Stable for the life of PID 1 (a gateway-only respawn keeps honouring an in-flight drain) but changes when the machine is recreated: boot_id on a VM reboot, PID 1's start time on ``docker restart``. ``""`` when neither is readable (non-Linux, no ``/proc``) disables the epoch check — never fail-closed. r*z/proc/sys/kernel/random/boot_idzutf-8encodingNz /proc/1/stat):) contextlibsuppressOSErrorr read_textstrip IndexErrorrsplitsplit)boot_id pid1_starts rcurrent_instantiation_epochrG[sG   W % %89CCWCU[[] &   Wj 1 1.)33W3ELLSRSTUVW]]_`bc  2*1JgYa | $GRG & % 1 1s*C(?AC;( C8 ; D c V^8dQhRRRR/#)rhomeOptional[Path]rrr)rs"rrrns[[^[t[rch\VeV4\, #\44\, #)zBAbsolute path to the drain-request marker, respecting HERMES_HOME.)rr _DRAIN_REQUEST_FILENAMErIs&rdrain_request_pathrNns) ( @CZ ZZo.? @CZ ZZr principalz drain-controlsuppress_notificationFrIc(V^8dQhRRRRRRRR/#) rrOr7rPr"rIrJrdict[str, Any]r)rs"rrrss,@DTbrc RRR\P!\4P4RVR\ 4R\ V4/p\ \V4V4V#)aWrite the begin-drain marker atomically; returns the payload. Re-writing refreshes ``requested_at`` (keep-alive past the max-age). ``suppress_notification`` skips ONLY the home-channel "gateway shutting down" broadcast (the per-session interrupt ping is never suppressed); which drains are quiet is the caller's policy. Stamped with the instantiation epoch so a copy surviving a machine restart on the durable volume reads as stale. actiondrain requested_atrOepochrP)rnowr isoformatrGr"r rN)rOrPrIpayloads$$$ rwrite_drain_requestr[ssV '>8<<+<+F+F+H+W`,.0GNcIdG(.8 Nrc V^8dQhRRRR/#rrIrJrr"r)rs"rrrs   4 rc\V4pVP4R# \d8p\T\4'g\ P RY4Rp?R#Rp?ii;i)zPRemove the drain marker (cancel-drain, idempotent). Returns True if one existed.Tz&drain-control: failed to remove %s: %sNF)rNunlinkr? isinstanceFileNotFoundError_logwarning)rIr.es$ rclear_drain_requestresM d #D  !.// LLA4 Ks A!,AA!c V^8dQhRRRR/#)rbodyrRrr"r)rs"rrrs^rc 2VPR4p\V4pVfR#\P!\4V, P 4pV\ 8:dR#\V8wd.Vs\PRW\ VPR44R#)uTrue iff ``requested_at`` parses AND is older than the max-age. Missing/unparseable and future-dated (clock skew) timestamps are honoured. Logged once per marker, not per poll — the operator's breadcrumb for a leak. See #85433. rVFudrain-control: ignoring expired drain marker (requested_at=%s, age=%.0fs > max %.0fs, principal=%s) — the drain that wrote it was never cancelled; treating as stale so the gateway keeps accepting turns.rOT) rr rrXr total_secondsDRAIN_REQUEST_MAX_AGE_SECONDSr4rbrc)rgrawrVages& r_marker_is_expiredrms ((> "Cc?L << | + : : ping clarify.lock session.info session.list prompt.submitprompt.receiptsession.detachsession.resumeclarify.respondapproval.pendingapproval.respondruntime.describeapproval.receivedsession.interruptsession.events.since)N)1__conditional_annotations____doc__ __future__rr= functoolsr}loggingrerrrpathlibrtypingrrgateway.memory_statusr hermes_constantsr utilsr getLogger__name__rbrrr&compiler+r/ frozensetr2r3rLrjr4__annotations__ lru_cacherGrNr[rermrtrwrzrq)rs@rrs* #  ,, ,,#" %9Gjj<= +$%_0 !'%)M( QH H$[ 'GLei& $ 4 0d 0