+ jHj a0t$Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI H t ^RIHtHtHt^RIHt^RIHtHtHt^RIHt^RIHt]P6!]4t^tR tR t R t!R t"R t#]!]"]#3t$/t%R]&R&] !RR7!RR44t'RRlt(RRlt)RRlt*RRlt+RRlt,RRlt-R R!lt.R"R#lt/RsR$R%llt0R&R'lt1R(t2R)R*lt3R+R,lt4R-R.lt5R/R0lt6R1R2lt7R3R4lt8R5R6lt9R7] /R8R9llt:R:R;/R<R=llt;R>R?lt!RDRE]P~4t@RFRGltARHRIltBRJRKltCRLRMltDRNROltERPRQltFRRRSRTRRURtRVRRWRS/RXRYlltGRZR[ltHR\R]ltIR^R_ltJR`RaltK.tLRb]&Rc&/tMRd]&Re&RfRgltNRhRiltORjRkltPRlRmltQRnR/RoRplltRRqRrltSR#)uuHost-wide singleton rendezvous: one lock + one record per ROLE per OS user. Multiplex-only (Teknium ruling): exactly ONE ``hermes serve`` and ONE ``hermes gateway run`` per host, each multiplexing every profile. The per-``HERMES_HOME`` gateway lock/PID files (``gateway.status``) cannot express that — N profiles are N homes, so N processes each take their own flock and none of them ever sees the others. This module adds the missing layer: * a **host lock** (flock/``msvcrt``) held for the lifetime of the winning process, and * a **rendezvous record** the winner publishes so a second invocation can find it, prove it is the same live process, and ATTACH instead of binding a second port. Both live in :func:`gateway.status._get_lock_dir` — the only cross-profile lock root already in the tree (``$HERMES_GATEWAY_LOCK_DIR`` else ``$XDG_STATE_HOME/hermes/gateway-locks``), which scopes to the **OS user**. That is the correct granularity: separate OS users have separate ``$HOME``s, separate ``~/.hermes`` profile roots, separate ports-by-convention and separate credentials, so "one per host" means "one per host per OS user". **Staleness is proved, never assumed.** New records pair the PID with the repository's stable process-start fingerprint (boot-relative on Linux/WSL); ``createTime`` remains the legacy fallback. A dead PID or a mismatched process incarnation is STALE and ignored — an attaching client must never dial a recycled PID's port. **Relationship to ``spawn-ledger.json``** (``hermes_cli/process_identity.py``): the ledger stays the append-only machine roster of every long-lived Hermes process (Desktop's attach ladder reads it) and is still written unchanged. It cannot be the host record: it has no lock, no single-writer semantics, no removal on exit, and no place to publish a protocol version or an authentication handle. The record here is authoritative for "who owns this host role"; the ledger remains authoritative for "what is running". Both are written. New host records pair the ledger's live-PID proof with ``gateway.status``'s canonical process-start fingerprint; legacy records without that fingerprint keep the old ``(pid, create_time)`` proof. ) annotationsN) dataclass)datetimetimezoneUTC)Path)AnyOptionalSequence) make_user_dir)atomic_json_writez/api/host/identityg@gatewayservez desktop-servezdict[tuple[str, str], Any] _lock_handlesT)frozenc]tRt^Tt$RtR]R&R]R&R]R&R]R&R ]R &R]R &R]R &R ]R&R]R&RtR]R&RtR ]R&RtR]R&RRlt ] RRl4t Rt R#) HostRecordzTA published host-role owner. ``profiles`` is the SERVED set, not the launch profile.strroleintpidOptional[float] create_timehost Optional[int]portprotocol_versiontoken_fingerprinttuple[str, ...]profiles updated_athomeN start_time boot_epochcV^8dQhRR/#)returnzdict[str, Any])formats"'HostRecord.from_json..s!J8az!S7I63q668s22r4r" rrrr#r$rrrrrr r"r() r?dictgetr_ROLESfloatboolrr5tuple) clsr:rrcreatestartrrversions && r* from_jsonHostRecord.from_jsons'4((kk% {{6"#s##sax4v3E\* K({{6";;z*++/0)3FS%L)I)If teS))*UD2I2IeVWiE 7;;{399r:W[[(..B/(s33D8IE8ITt(27C(@(@Wa!'++.@"A"G"GRHNXYacgNhNhUUJ8JUUJ8JJnp7;;{399r:W[[(..B/!  r-r() __name__ __module__ __qualname____firstlineno____doc____annotations__r"r#r$r7 classmethodrP__static_attributes__r(r-r*rrTss^ I H  I O D#N !%J $ J   r-rcV^8dQhRR/#r&r'rr()r)s"r*r+r+sr-c^RIHpV!4#)zBPer-OS-USER rendezvous dir (shared by every profile of this user). _get_lock_dir)gateway.statusr^r]s r*host_state_dirr`s , ?r-cV^8dQhRR/#r[r()r)s"r*r+r+str-c\4p\VRRRR7\PR8wd\P !\ 4;_uu_4\P!VP4P4^?,'d\P!VR4RRR4V#V# +'giT#;i)aThe rendezvous dir, created owner-only (``0o700``) and tightened if it is not. A bare ``mkdir`` under the common ``umask 002`` leaves the dir group-writable, and the record inside it is what every lifecycle verb believes: a same-group process could unlink+replace it and choose this host's ATTACH answers (which home to dial, which profiles are "served"). Ownership of the dir is ours, so widening is repaired rather than refused. Ti)parentsexist_okmodewin32N) r`r sysplatform contextlibsuppressOSErrorstatS_IMODEst_modeoschmod) directorys r*ensure_host_state_dirrrs I)TDuE ||w   ) )||INN,445==E** 9* ) s AB00 C c V^8dQhRRRR/#)r&pathrr'rJr()r)s"r*r+r+s$r-cb\PR8XdR#VP4pVPP4p\ P !4pTPT8wgTPT8wd$\PRYPT4R#R# \dR#i;i)uTrue when ``path`` was written by THIS OS user inside a dir this user owns. ``read_record`` hands its result straight to :mod:`gateway.host_attach`, which dials the home it names and believes the served set it carries. A hand-written record therefore buys an attacker the lifecycle verdict for every profile on the host, so the file's ``st_uid`` — not its contents — is what makes it a record at all. Windows sets no ACLs from mode bits; there the dir already lives under the user's own state root. rfTFz6ignoring host record %s: owned by uid %s (expected %s)) rgrhrlparentrkrogetuidst_uidloggerwarning)rtinforvuids& r*_record_is_ownr}s ||wyy{!!# ))+C {{cV]]c1 DdKKY\ ^  s*B B.-B.c V^8dQhRRRR/#r&rrr'r()r)s"r*r+r+s##r-c:V\9d\RV: 24hV#)zunknown host role: )rH ValueErrorrs&r*_validated_rolers" 6.th788 Kr-c V^8dQhRRRR/#r&rrr'rr()r)s"r*r+r+sCCcCdCr-c>\4R\V4 R2, #)host-z.jsonr`rrs&r* record_pathr  od&;%\4R\V4 R2, #)rz.lockrrs&r* lock_pathrrr-c V^8dQhRRRR/#rr()r)s"r*r+r+sDDSDTDr-c>\4R\V4 R2, #)rz.tokenrrs&r* token_pathrs  od&;%>%,,w : ; E E G L][]]r-c V^8dQhRRRR/#)r&rrr'rr()r)s"r*r+r+s%%]%o%r-c^RIHpV!V4#)zKCreation time of ``pid`` (default: this process); ``None`` when unknowable.)_process_create_time)hermes_cli.process_identityr)rrs& r*process_create_timers@  $$r-c$V^8dQhRRRRRR/#)r&rrrrr'Optional[bool]r()r)s"r*r+r+s!00#0O00r-c^RIHpV!W4#)zVReuse the spawn ledger's proof: True/False when provable, ``None`` when it cannot say.)_pid_alive_matches)rr)rrrs&& r*_pid_incarnation_matchesrs> c //r-g^@cV^8dQhRR/#)r&r'rr()r)s"r*r+r+sOr-c^RIp\VP44# \d\P RRR7R#i;i)Nz5boot time unreadable; legacy record age check skippedTexc_info)psutilrI boot_time Exceptionrydebug)rs r* _boot_timersBV%%'((  LW[ \s"AAc V^8dQhRRRR/#r&rrr'rr()r)s"r*r+r+ sGGSG^Gr-cZ\V4'dR#^RIHp\P!\ \ V44\P4pT!\P!TRRR 74'*# \dR#\d\PRTRR7R#i;i) aiTrue when no process holds the host lock for ``role``; ``None`` when it cannot be probed. Read-only callers (status, dashboard) reach this, so it never creates the lock dir or file: a missing lock file means nobody holds the lock. The probe takes the lock for an instant, so a gateway claiming it in that instant gets HELD_BY_OTHER and its supervisor retries. F_probe_lock_fileTz host %s lock could not be probedrNzr+rencoding) owns_host_lockr_rroopenrrO_RDWRFileNotFoundErrorrkryrfdopen)rrfds& r*_host_lock_is_freer sd/ WWS4)299 5   "dW EF FF   7 Ms7A66 B*B* B*)B*cV^8dQhRR/#)r&r'rr()r)s"r*r+r+sSr-c^RIHpV!4;'gR# \d\P RRR7R#i;i)u^Identity of this boot. Empty when /proc is unreadable — a recorded epoch is then unprovable.current_instantiation_epochr!z4boot epoch unreadable; host liveness will not use itTr)gateway.drain_controlrrryrrs r*_current_boot_epochrs?E*,222  KVZ [s"??c V^8dQhRRRR/#)r&recordrr'rr()r)s"r*r+r+*s,, ,~,r-cVPp\4pV'dV'gR#W8wdR#VPfVPfR#VPf"\ VP VP4pMQ\ VP R4pVRJdV#^RIHpHpV!VP 4pVfRMV!VPV4pVRJdV#VP\8XdfV'g^VPeP\4pVeBVPV\, 8d&\VP4p V fR#V 'dR#R#)uWhether the record still names the same live process incarnation. New records prefer the canonical start fingerprint: on Linux/WSL it comes from /proc start ticks and is immune to wall-clock shifts that move psutil.create_time(). Those ticks are NOT unique across reboots — they reset, and an early-boot PID reused within the drift tolerance looks like the dead owner. A published boot epoch that differs from this boot's is a mismatch; one that cannot be compared (this boot's epoch is unreadable) is unprovable, ``None``. A gateway record with no epoch (published before ``bootEpoch`` existed, or on any platform without /proc, where the epoch is always empty) whose create_time predates this boot is a mismatch only while nobody holds the host lock. A record with neither create_time nor start_time proves nothing about its pid, so it never vouches for one. Legacy records without a start fingerprint keep the create-time check. Do not infer identity from argv. NFT)get_process_start_timestart_time_fingerprints_match)r$rr#rrrr_rrr ROLE_GATEWAYr_LEGACY_BOOT_SLACK_Sr) rrecorded_epochepochmatchedaliverrcurrentboot lock_frees & r*_record_incarnation_matchesr*s&&N  !E  "  V%7%7%?  *6::v7I7IJ(T:  LX(4!/$/LVM^M^`g/hd {{l">f>P>P>\|   2 2T =jju!5! gt $ ${{6fkk)W[[-?6::-M N1L K K  =v{{DR]R]^> =  =v{{DR]R]hl msk&F# F F#5$G3G ,G365G +G3 F F# F##6GG G0 +G30G338H/.H/ include_staleFc$V^8dQhRRRRRR/#)r&rrrrJr'r;r()r)s"r*r+r+s'LLcLTL>RLr-c^\V4p\V4'gR#VPRR7p\ P \P!T44pTfR#T'g\T4'gT#R# \\3dR#i;i \\3dR#i;i)z\Published record for ``role``; ``None`` when absent, foreign, corrupt or (by default) stale.N utf-8-sigr) rr} read_textrkUnicodeDecodeErrorrrPrrr TypeErrorr)rrrtrawrs&$ r* read_recordrs t D $  nnkn2%%djjo6~"/&*A*A6KtK ' (  "s"A?)B?BBB,+B,c V^8dQhRRRR/#rr()r)s"r*r+r+s  S S r-c\V4PRR7P4# \\3dR#i;i)u Owner-written session token for ``role`` (``""`` when absent/unreadable). This is the handle an attaching client uses when the backend is auth-gated and therefore withholds its token from an unauthenticated ``GET /``. Confidentiality is enforced at WRITE time by :func:`_write_private_text` (POSIX ``0o600``; an owner+SYSTEM-only protected DACL on Windows, where mode bits set no ACLs at all). Reading it is therefore evidence of, not proof of, same-OS-user authority — the authority boundary the host lock is scoped to. rrr!)rrstriprkrrs&r*rrsA$));)?EEGG ' (s(+AAc V^8dQhRRRR/#rr()r)s"r*r+r+s R Rz Rd Rr-cVP'gR#\\VP44VP8H#)uJDoes the on-disk token still hash to the record's fingerprint? A record published without a token (the gateway) has an empty fingerprint and is consistent by definition. A mismatch means the record and the token file come from different incarnations (a torn restart) — discovery must not attach with a token the owner rejects. T)rrrrs&r*record_token_is_consistentrs2  # # # Z 4 59Q9Q QQr-c$V^8dQhRRRRRR/#)r&rtrtextrr'Noner()r)s"r*r+r+s!$$d$#$$$r-c \PR8Xd ^RIHpV!WP R44R#VP VP R,4p\P!\V4\P\P,\P,R4p\P!VRRR7;_uu_4pVPV4VP4\ P"!\$4;_uu_4\P&!VP)44RRR4RRR4\P.!\T4\T44R# +'giLC;i +'giLN;i \*d`\ P"!\$4;_uu_4\P,!\T44RRR4h +'gih;ii;i) aCreate/replace ``path`` with owner-only content. POSIX: ``0o600`` via tmp + atomic replace. Windows: mode bits set NO ACLs, so the same ``os.open`` would leave a live session token readable by whatever the inherited DACL grants; the SSH runtime's protected owner+SYSTEM DACL writer is the repo's primitive for exactly this credential class and is reused here. It also replaces in place, because ``os.replace`` onto a token file another process still holds open fails on Windows. rf)write_private_filerNz.tmpwr)rgrhhermes_cli.windows_ssh_runtimer r with_namenamerorrO_WRONLYO_CREATO_TRUNCrwriteflushrirjrkfsyncfileno BaseExceptionunlinkr)rtrr tmprhandles&& r*_write_private_textrs5 ||wE4W!56 ..V+ ,C S2;;3bjj@% HB  YYr3 1 1V LL  LLN$$W--).2JJs3xT# .-2 1    ) ) IIc#h * * ) s[1!FAF %E6 ;F F6 F F  F FF-H G2) H2 H = Hc&]tRtRtRtRtRtRtRtR#)HostLockOutcomeiaWhy a host-lock claim ended the way it did. ``COULD_NOT_OPEN`` is NOT contention: a read-only/undeletable lock dir (EROFS, EACCES, ENOSPC) collapsed into the same "another owner holds it" log and sent operators hunting a second gateway that never existed. acquiredz held-by-otherzcould-not-openr(N) rRrSrTrUrVACQUIRED HELD_BY_OTHERCOULD_NOT_OPENrYr(r-r*rrsH#M%Nr-rc V^8dQhRRRR/#)r&rrr'ztuple[str, str]r()r)s"r*r+r+sCOr-c\V4p\P!\4;_uu_4V\P P \V443uuRRR4# +'giM;iT\T43#r>)rrirjrkrortabspathr)rrts& r* _lock_keyr%sS T?D   W % %bggooc$i01 & % % % #d) s *A## A3 c V^8dQhRRRR/#)r&rrr'z)tuple[HostLockOutcome, Optional[OSError]]r()r)s"r*r+r+s,,#,"K,r-cx\V4p\V4p\PV4e\P R3#^RIHp\V^,4p\4\VRRR7pT!T4'gN\P !\4;_uu_4TP#4RRR4\P$R3#T\T&\P R3# \d5p\PRYRR7\PT3uRp?#Rp?ii;i +'giL;i) zTake the host-wide lock for ``role``. Idempotent per (role, lock path). Returns the outcome and, for ``COULD_NOT_OPEN``, the OSError that explains it. N_try_acquire_file_locka+rrz&host %s lock could not be opened at %sTr)rr%rrGrrr_r)rrrrrkryrr!rirjcloser )rkeyr)rtrexcs& r*claim_host_lockr.s 4 D D/C)(($//5 ARelease the host lock for ``role`` when this process holds it.N_release_file_lock) rpopr%rr_r3rirjrkr+)rrr3s& r*release_host_lockr5sZ   y)>? FF ~1v   W % %  & % % %s A:: B c V^8dQhRRRR/#r&rrr'rJr()r)s"r*r+r++sKKKKr-cT\P\\V444RJ#)zXTrue when THIS process holds the host lock for ``role`` (re-probing our own flock lies).N)rrGr%rrs&r*rr+s"   Yt'<= >d JJr-c V^8dQhRRRR/#rr()r)s"r*r+r+0s$$C$N$r-c\V4p\V4'dR#\V4pVP4'gR#\ VRRR7p^RIHpT!T4# \ dR#i;i)a*Whether any process currently holds the host lock for ``role``. ``True`` / ``False`` when the flock can be observed; ``None`` when the lock file cannot be opened. Never retains a lock. This process's handle is authoritative: re-probing our own flock succeeds on POSIX, so a second open would lie. TFr*rrNr)rrrexistsrrkr_r)rrtrrs& r*host_lock_is_heldr<0sj 4 Dd T?D ;;==dD730 F ## sA A.-A.c V^8dQhRRRR/#rr()r)s"r*r+r+Fs  J 4 r-c\V4'gR#\VP4RJd.\P RVPVP 4R#R#)unTrue when ``record``'s incarnation is proven AND its host lock is not observed free. The publisher holds the host lock for its whole life and the OS drops it on death, so a free flock falsifies a record whose pid merely looks alive (recycle, start-tick collision after a reboot — #138343, #133744). Every reader that trusts a record as a running owner uses this. Fz5host %s record names pid %s but the host lock is freeT)rr<rryrrrs&r*record_names_live_ownerr?FsE f % %%. Lfkk[a[e[ef r-rr!rrrr"c4V^8dQhRRRRRRRRRR R RR R /#) r&rrrrrrz Sequence[str]rz Optional[str]r"r'r;r()r)s"r*r+r+UsP++ + +  +  +  + ++r-c:\V4p^RIHp\T\P !4\ 4V!\P !44\4\T;'gR4\V\4'dV^8d \V4MR\\T;'gR4\;QJd.RV4FNK 5M !RV44\P!\ 4P#4\T;'gR4R7 p\%4V'd\'\)V4V4\+\-V4VP/4RR7\74T# \0d\2P5RTR R 7R#i;i) u"Publish this process as the host owner of ``role``. ``None`` when the write failed. ``token`` (serve) is persisted 0600 next to the record and only its fingerprint is published. ``home`` is the launch HERMES_HOME — the key an attaching client needs to reach this owner's control socket. )rr!Nc38"TFp\V4xK R#5ir>)rr@s& r*rC!publish_record..qs0x!s1vvxsrEr )rezAhost %s record could not be published; discovery will not find itTr)rr_rrrogetpidrrrr?rrrrKrnowr isoformatrrrrr rr7rkryrz_invalidate_attach_cache)rrrrrr"rrs&$$$$$ r*publish_recordrHUs% 4 D5   IIK'))"))+6&( _$T3//D1HSY$.+EKKR80x00x00<<$..0 _ F   4 0% 8+d+V^^-=EJ M Z\`kopsA E33#FFcV^8dQhRR/#r&r'rr()r)s"r*r+r+s(($(r-c\P!\4;_uu_4^RIHpV!4RRR4R# +'giR#;i)zNDrop :mod:`gateway.host_attach`'s memo: the record it summarises just changed.invalidate_host_gateway_cacheN)rirjrgateway.host_attachrMrLs r*rGrGs+   Y ' 'E%' ( ' ' 's ; A c V^8dQhRRRR/#r7r()r)s"r*r+r+s""c"d"r-c d\V4p\VRR7pVfR#RpVP\P!48wd2\ V4RJd#\ V4'g\V4;pfR#Veb\VRR7fSVeL^RIH pV!V4\P!\4;_uu_4VP4RRR4R#R#\V4\V43F@p\P!\4;_uu_4VP!RR7RRR4KB VeK^RIH pV!V4\P!\4;_uu_4VP4RRR4M\#4R# +'giR#;i +'giK;i +'giLD;i Te^^RIH pT!T4\P!\4;_uu_4TP4RRR4i +'gii;ii;i)aHRetract the record for ``role`` when its owner is provably gone; True when one was removed. A confirmed stop must retract the record too. Leaving it made ``gateway restart --all`` a silent no-op: the re-entered ``gateway run`` read the corpse's record, decided ATTACH and exited 0, so the host ended up with no gateway at all. TrNFr2 missing_ok)rrrrorDrr_hold_lock_brieflyr_r3rirjrkr+rrrrG)rrguardr3rts& r*discard_dead_recordrVs 4 D T 2F ~ E zzRYY[ %@%HPU%U $  -?-E$EE#N   T!F!N   9 u %$$W-- .-  !& 4(89D$$W-- t ,.-:   9 u %$$W-- .-   .--.--.-   9 u %$$W-- .--- sZ7G ?F;G F%* G *F9 F" % F6 0 G 9 G 5H/H  H/ H+ & H/cV^8dQhRR/#)r&rrr()r)s"r*r+r+s  S r-c(^RIHp\V4p\VRRR7pT!T4'dT#\ P !\4;_uu_4TP4RRR4R# \dR#i;i +'giR#;i)zROpen and flock ``role``'s host lock without registering it; ``None`` when not won.r(r*rrN)r_r)rrrkrirjr+)rr)rtrs& r*rTrTsu5 T?DdD73f%%   W % %  &   & % sA.B. A=<A= B c V^8dQhRRRR/#r0r()r)s"r*r+r+s  s t r-cz\V4p\VRR7pVe'VP\P!48wdR#\ V4\ V43F@p\P!\4;_uu_4VPRR7RRR4KB \4R# +'giKa;i)zERemove this process's record + token on exit (never another owner's).TrQNrR) rrrrorDrrrirjrkrrG)rexistingrts& r* clear_recordr\s 4 D4t4H  ;T"Jt$45   ) ) KK4K (* )6* ) )s >B)) B: z list[str]_cleanup_roleszdict[int, Any]_prev_signal_handlersc V^8dQhRRRR/#r0r()r)s"r*r+r+s    r-c,\P!\4;_uu_4\V4RRR4\P!\4;_uu_4\ V4RRR4R# +'giLH;i +'giR#;ir>)rirjrr\r5rs&r* _cleanup_rolerasT   Y ' 'T (   Y ' '$ ( ' ( ' ' ' 's A/ B/ A?  B cV^8dQhRR/#rJr()r)s"r*r+r+s(((r-c ^RIp\\4Fp\V4K \P V4p\ V4'd V!W4R#WBPJdR#\P!\4;_uu_4VPWP4\P!\P!4V4RRR4\^\!V4,4h +'giL+;i)zFDrop the record + token, then hand off to the handler we prepended to.N)signalrKr]rar^rGcallableSIG_IGNrirjrSIG_DFLrokillrD SystemExitr)signumframe_signalrprevs&& r*_handle_terminating_signalrnsn%d& $ $V ,D~~ V    Y ' 'v/  V$ ( S3v;& '' ( 's AC22 D c V^8dQhRRRR/#r0r()r)s"r*r+r+s11#1$1r-c&^RIp^RIp^RIp\V4pV\9d,\P V4VP \V4VP4VP4JdR#RFp\W$R4pVe V\9dK \P!\\\ 4;_uu_4VP#V4pVPV\$4V\V&RRR4K R# +'giK;i)uClear ``role``'s record + token and release its lock on exit — SIGTERM included. ``atexit`` alone is false advertising for the NORMAL stop: systemd stop, ``docker stop`` and the update relaunch all send SIGTERM, and every terminating SIGTERM path here ends in the default disposition (uvicorn's ``capture_signals`` re-raises it after its graceful shutdown), which kills the process without running ``atexit``. The record then outlived its process and the 0600 token kept a LIVE session token on disk indefinitely. The handler only PREPENDS cleanup: whatever handler was installed before (uvicorn's graceful shutdown, the exit-flush chain, a supervisor's) still runs, so the shutdown sequence is unchanged. N)SIGTERMSIGBREAK)atexitrd threadingrr]appendregisterracurrent_thread main_threadgetattrr^rirjrrk RuntimeError getsignalrn)rrsrlrtrrjrms& r*cleanup_on_exitr|s 4 D >!d# t,!)>)>)@@'- >V'<<   Wl C C$$V,D NN6#= >,0 !& )D C (D C Cs 1C?? D cV^8dQhRR/#)r&r'rJr()r)s"r*r+r+ s  T r-cR#)uWill THIS process multiplex? An explicit ``true`` and an unset key both say yes, and an explicit ``false`` is RETIRED (``hermes_cli.gateway_multiplex_mode``) — it is warned about and ignored at boot, so it must not make the claim-time record advertise a narrower roster than the process actually serves. Reading it here was the last place the retired flag still decided topology, and it made CLI/dashboard report "standalone, serving default" while the runtime multiplexed. The RUNTIME verdict (a boot-time guard refusal) narrows the record afterwards, in ``gateway.run._refresh_host_gateway_record``, which republishes the SETTLED set. Tr(r(r-r*_multiplex_profiles_enabledr s r- multiplexc V^8dQhRRRR/#)r&rrr'rr()r)s"r*r+r+s.Or-c ^RIHpVf \4M \V4p\;QJd.RV!VR74FNK 5#!RV!VR744# \ d\ PRRR7Ru#i;i)aUProfiles this process multiplexes; ``()`` when the roster cannot be read. ``multiplex`` defaults to what this process's own config says. Hard-coding ``True`` here published a record claiming EVERY profile from a gateway that would only ever serve its own, and a second profile's supervised unit then stood down against a set nobody serves. )profiles_to_servec3*"TF wrVxK R#5ir>r()rAr_s& r*rC"served_profiles.."sN)MgdT)Ms)rz!served profile roster unavailableTrr()hermes_cli.profilesrrrJrKrryr)rrenableds$ r*served_profilesrsq93<3D-/$y/uN):W)MNuNuN):W)MNNN  84 H s)AAA$BBc V^8dQhRRRR/#rr()r)s"r*r+r+(s??Z?C?r-cVP'd&VP;'gR RVP 2MRpVP'dRPVP4MRpRVP RV RV R 2#) zEOne-line human description used by attach messages and conflict logs.rrz no bound portz, unknownzPID z (z ; profiles: ))rrrjoinr)rwherers& r*describer(sh=C[[[v{{))k*!FKK= 9oE-3___tyy))H &**Rwl8*A >>r-r>r()T__conditional_annotations__rV __future__rrienumrrloggingrorlrg dataclassesrrrrpathlibrtypingrr r hermes_dir_aclr utilsr getLoggerrRryrrPROBE_TIMEOUT_Sr ROLE_SERVEROLE_DESKTOP_SERVErHrrWrr`rrr}rrrrrrrrrrrrrrrrrrrrEnumrr%r.r5rr<r?rHrGrVrTr\r]r^rarnr|rrr)rs@r*rs@#   !,,**(#   8 $ *  %  $6 7-/ ). $K K K \"0 CCD^ %0G*,^8" 7G ((VLEL$  R$: &dii &,4 K $, ++ + ! +  ++\("J   (*~* ($1B 4"?r-