+ jHjuLRt^RIt^RIHt^RIt^RIHt^RIt^RIH t ^RI H t H t ^RI Ht^RIHt^RIHtHt^R IHt^R IHtHtHt]P4!]4t^R IHtHtH t H!t!H"t"H#t#H$t$H%t%H&t&]'!0Rt+R?R lt,Rt-Rt.Rt/R@Rlt0Rt1Rt2Rt3Rt4Rt5Rt6Rt7Rt8Rt9Rt:RR/Rlt;RtR!t?R"t@R#tAR$tBR%tCR&tDR'tER(tFR)tGR*tHR+tIR,tJR-tKR.tLR/tMR0tNR1tOR2tPR3tQR@R4ltRR5tSR6tTR7tUR8tVR9tWRAR:ltXR;tYR#)BzBot Chat ingress into the existing authority FIFO; viewers never own delivery. The mailbox is a delivery receipt, not an execution queue. A committed canonical admission is the only consumer; unknown execution is never retried as inference. N)partial)Path)parse_turn_author) Principal SessionRef)Platform) MessageEvent)RuntimeStoreErrorget_session_admission) HELD_NOT_SENT) _TERMINAL _delivery_id_read) mailbox_lock read_receipt write_receipt scan_receiptsremember_receipttrack_receipt_task withdraw_pin refuse_pin requeue_piniH?cHVPR4p\V\4'dW0P8wdR#\ V4TUu.uF:p\TPT4\4'dY,'dK8TNK< ppT'dRRP T4,#\TPR4\4'gR#TPR4p\T\4'd T\9dR T: 2#R # \ dR#i;iuupi) zCReturn why an admission-backed receipt is unsafe for bulk recovery. delivery_idz#delivery id does not match filenamezdelivery id is invalidzmissing canonical fields: z, messagezmessage is not a stringstatuszunknown canonical status N)get isinstancestrstemr ValueErrorjoin_CANONICAL_RECEIPT_STATUSES)pathrecordrequired_stringsrkeymissingrs&&& 8/home/ubuntu/.hermes/hermes-agent/gateway/session_bot.py_canonical_record_errorr))s**]+K k3 ' ';))+C4([!/K.s C#66fkks.GK+dii.@@@ fjj+S 1 1( ZZ !F fc " "f4O&O*6*55  ('(Ks D 5DD DDcVPR4RJd,RV9d%VPR4R8wdR#\WR 4#RV9gVPR4R8XgRV9d \W4#R V9d^R IHpV!W4#R #) zRValidate the known canonical, refused or legacy receipt shape for directory scans.refusedT admission_idrfailedzrefused receipt is not failed principal_id canonicalowner)_ticket_shape_errorzunknown receipt schema profile_home session_idr.)rr)tools.bot_live_deliveryr1)r#r$r1s&& r(_record_shape_errorr6>s zz)$v)E ::h 8 +2&t5cdd6::h#7;#F.\bJb&t44&?"400 #cVPR4R8H;'d)RV9;'dRV9;'d\WR4RJ#)zYThe ``ambiguous`` pin ``_admit`` writes before it admits: no admission id, never refused.r ambiguousr,r+Nr2)rr))r#r$s&&r(_is_pre_admission_pinr:Ms^ JJx K / n nN&4P n nU^flUl n n'6deimmor7cZ\P!\4PRW4R#)z.Skipping malformed Bot mailbox receipt %s (%s)N)logging getLogger__name__warning)r#problems&&r(_warn_malformedrASs h''(XZ^hr7c#"VPR4Fp\V4pVfRM \W#4pVeCVe?\W#4'd.VP W#VP 4P 34KfTe\Y$4KwTfK}Y#3xK R# \\3dpR\T4rCRp?LDRp?ii;i5i)aBulk mailbox scan: isolate unreadable/malformed records; exact-id reads still fail closed. An owner scan passes ``pins``: pre-admission pins land there with their mtime, unwarned, since only the owner can tell whether their admission committed (``_scan_owner_receipts``).z*.jsonN) globrr6r:appendstatst_mtimeOSErrorr rrA)rootpinsr#r$r@excs&& r( _scan_recordsrKWs (# -4[F$nd2Ed2SG"t'79C>CCi,c2".Rr2\W4GRjxL wrEVEFjwrgpVR,\P!4V, RV9rp VR,\V48wg\WRV ,4'd\ V\ Wg44KwRp V \ 8dPV 'dH\W4GRjxL p V RJ;'d\ Wm4RJp V 'dVPWm34MV \ 8d\W4GRjxL p V 'g=V 'd\Wg4pVfTM \W>4p\ V\ Wg44EK5\P!\4PRV 'dRMR W4EKm WEV3#EL|LL5i) aThe owner's bulk scan, under the mailbox lock ``_admit`` holds. A pre-admission pin past the grace window whose ``bot:`` never committed (refused by an older build, a death before the commit, a transient refusal on the legacy migration path) is withdrawn as ``_admit`` withdraws one: the scan stops warning and a same-id resend admits once. A pin laid over a legacy ticket (``owner``) is that never-run message's only copy: it is requeued instead, for ``_migrate`` to admit once under the same id. A pin whose admission committed stays the explicit unknown record and keeps its warning. Also returns the FIFO barrier: the lowest ``_legacy_order`` of a legacy pin of this home that is still unresolved (inside the grace window, or its requeue lost to a concurrent change). No legacy ticket ordered after it may be admitted by this pass. It holds for one scan only: past the grace window the pin is requeued and released, and a failed requeue is re-read by the next scan (gone, admitted or a ticket again), so the barrier never outlives the pin.Nrr0r3bot:FzD%s Bot delivery %s pre-admission pin (age %ds): nothing was admittedRequeuedWithdrew)rtimer_pin_committedrAr6_PIN_GRACE_SECONDSrrDr _legacy_orderminr<r=r>info) authorityhomerIbarrierrHrecordsr#r$mtimer&agelegacyclearedticketorders&& r(_scan_owner_receiptsr`psZ''33MD#e!-0$))+2EwRXGX& > "c$i /!)Vc\BB D"5d"C D  $ $&t11FD(VV-@-NRV-VG~. & &(33G%d3#*?%G8K D"5d"C D (#(()o7=:s Y) $, ' !!/42 4sYFFBF)F7F8FF,F F FFAF>FFFc\WR,V4eR#^RIHpVPP 4;_uu_4pVP RW1R,,34P 4RJuuRRR4# +'giR#;i)zWhether the pin's admission may have committed: a live row, or a deleted target (its admissions moved to retired receipts keyed by the route principal the pin never recorded).r4NT)RETIRED_PREFIX$SELECT 1 FROM state_meta WHERE key=?) _admission_at hermes_state_mutation_retirementrbdb _read_ctxexecutefetchone)rVr$ request_idrbconns&&& r(rQrQsnY| 4jAM?    ! !T||B+\.BBDFFNhjX\] " ! ! !s 0A;; B cVPRVPR44p\V\4'd$\V\4'gW P3#\ R4R3#)z``_migrate``'s FIFO key of a legacy ticket, or of the pin laid over one (it keeps the ticket's fields). A pin without an integer order holds every legacy ticket until it resolves.sequence created_atz-inf)rrintboolnamefloat)r#r$r_s&& r(rSrSsU JJz6::l#; #K0 0H"9VD\B $45   cnn -D    * * @ @ LE {{x~~- 455 e dsAE, E) D E,c \^RIHp^RIHp\ VP R4;'gR4P R4'dR#VPpTPVPVR,4;'g VR,4pW3FpVe:\ VP R4;'gR4P R4'dR#\ VP R4;'gR4pVP4;_uu_4pTPRY';'g VR,,Y7;'g VR,,34P4'd RRR4R#RRR4\WF4'gKR# VR,# +'giL1;i) aThe id holding the canonical title when the Bot Chat is a conversation no FIFO can own (an ``api_`` row an older gateway or a plain ``POST /api/sessions`` minted, a messaging row, an unbound CLI/TUI/Desktop row no native open can adopt), else None. Such a row can never be adopted (``validate_legacy_row``), renamed (the canonical title is its identity) or renamed over the API, so it would refuse every delivery for good. A bound local chat, old local history a native open adopts and a local row a login stamped as its own are never moved. POLICY_PREFIX) LEGACY_PREFIXchat_idrozlocal-Nrz+SELECT 1 FROM state_meta WHERE key IN (?,?))hermes_state_localrhermes_state_local_migrationrrr startswithrfrrrgrhri_kept_local_history) rVrrrrfr candidaterrks && r(rrsK1: 3779  # #$//99 B ..//D :GGc$i HCZ  IMM)$<$B$B C N Nx X XimmI.44"5 \\^^t||I*.H.H4I*.H.H4IKLLTHJW ^W r - -  t9^s-F<(F%F F+ c^RIHpHpHpVP R4V9dR#VP R4'dV!V4'gR#V!W4R# \ dR#i;i)a]Whether an unbound row is local history the Bot Chat door must leave in place: a CLI, TUI or Desktop row a native open adopts, or one a login stamped as its owner. A local-source row no open can ever adopt (a route column left by a crash or reconnect, another profile's stamp) is not: it held the title and refused every delivery for good (#141243).)LEGACY_LOCAL_SOURCESlegacy_account_labelvalidate_legacy_rowrFuser_idT)rrrrrr )rfrrrrs&& r(rrsc ml wwx 44 wwy"6s";";B$  s A A$#A$cVfR#VPpW!R,VPVR,439dR#\VPVR,4;'g/P R4;'gR4P R4#)aEWhether *pinned*, the Bot Chat the producer discovered, is the title holder this delivery's ``_target`` just moved aside. The producer pins the id it read before asking, so the first delivery after a move would otherwise be refused ``admission_conflict`` for the chat the door itself replaced, and land only on the next beat.Frtitlero Bot Chat ()rfrrrrr)rVholderpinnedrfs&&& r(_moved_aside_by_this_doorrsu ~ B TlB$:$:6$<$HII vd|,2277@FFB G R RS_ ``r7c\aaa\SPS4;'g/PR4;'gR4pVR 9dRMTpRV RS R2o\S4SP8dSRSP^, R,oVVV3R lp\ SP V44#) a Free the canonical title from *sid*: it keeps its id and history under a visible name the user can find, rename or delete: ``Bot Chat (API )`` for an API conversation, else named by its platform (``Bot Chat (telegram )``). False when the title moved meanwhile.rroAPIr )Nu…)cV<VPRSSPS34P#)zUUPDATE sessions SET title=?, title_source=?, hidden=0 WHERE id=? AND title='Bot Chat')rhTITLE_SOURCE_USERrowcount)rkrfrrsids&r(write!_displace_bot_chat..writes-||s!2#7#7=??Gx Hr7)ro api_server bot_peer_dm)rrrlenMAX_TITLE_LENGTHrq_execute_write)rfrrlabelrrrsff @r(_displace_bot_chatrs"..%++00:@@b AF@@EfE wauA &D 4y2&&&,R((1,-6H !!%( ))r7rc v"RVP9d \R4h^RIHpHp^RIHp^RIHp^RI H p^RI H p\VRR 4p V f\P!4;qnT ;_uu_4GR jxL VP"P%R 4p V eVeV R ,V8wg\'W 4V8wdR R R 4GR jxL R #\(P+R V4V!V\-\.VP"V44GR jxL 'gR R R 4GR jxL R #\1W4p R V RRR\3\4P6!44RR/p V!WV 4'gV P9R4V!WV 4p \;V \<4'dAV!V\-WP"VP>V R74GR jxL V!W R,4p V!V\-W`V R 44GR jxL T uuR R R 4GR jxL #ELELCELLLNL%L +GR jxL 'giR #;i5i)a@No Bot Chat yet (or *displace*, an API conversation holding its title, is moved aside first): mint it the way ``hermes chat --in ~ -c "Bot Chat" --create-if-missing`` did on the CLI lane this door replaced, so a fresh profile's first delivery has somewhere to land instead of being recorded as failed. Same owner step as ``session.create`` with a title: lookup, creation and title run under the authority's titled-create lock, with the commits off the owner loop (N90). Creation is the actor's own capability; a submit-only principal (owner recovery) still gets ``not_found``.zsession:creater)stage_local_sessionstaged_creation_follows)restore_local_session)title_new_session) tracked_write)commit_local_session_titled_create_lockNrrzJBot Chat title held by %s, a conversation no FIFO can own: moving it asiderjrclicwdfollow_profile_configT)epochreceiptr4) rr gateway.session_localrrgateway.session_local_recoveryrgateway.session_local_titlergateway.session_runtime_workersrrrgetattrasyncioLockrrfrrloggerr?rr_bot_chat_creation_idrrrWpoprdictr)rVrrrrrrrrlockheldrjparamsrs&&$ r(rrsu111 ,,RD==7 93T :D |/6||~=,tt||00<  4:#9=RS\=cgo=o tt NNgiq r&y':Lill\d2effftt+9<  HeUC DT)41'yDD JJ. /!)F; c4  73G]f]l]lvy+z{ { {' |3DECIw/@SR\']^^^+ttt g $ |^)tttsA7H99H :H9=AH H9 H H9;H H HH H9$H%H9+BHH*H2H3H8 H9HH9H9HH9HHH9H6 "H%# H6 .H6 0 H9caaaaa^RIHo^RIHpRSP,oV3RloRpV!SP VVVV3RlVR7wrES!V4#)u(The first creation identity whose session is not spent. Generation 0 keeps the historical ``bot-chat:`` id; a generation is spent once its session was deleted (retired: a retry must never resurrect it) or renamed (titled, but not "Bot Chat" — or the lookup had found it), and a replacement takes the next one. Derived from durable rows only, so a restart and two concurrent deliveries (serialized by the titled-create lock) pick the same identity. An existing UNtitled session is the same creation interrupted before its title: it is reused.)local_identity)first_generationz bot-chat:c$<V^8XdS#S RV 2#)ru:) generationbases&r('_bot_chat_creation_id..JsJ!OD$WD6:,AW$Wr7cVPRV34P4pVRJ;'d\V^,4#)z%SELECT title FROM sessions WHERE id=?N)rhrirq)rkrrs&& r(titled%_bot_chat_creation_id..titledLs8llBSFKTTV$//4A</r7cL<S!SPSPS!V44#N)rsubject)nrrVrrjs&r(rrPsy/C/CU]]T^_`Ta br7)spent)rrrerrrf) rVrrrr_sidrrrjs ff @@@r(rr@sM>A -- -DWJ0( bjprJ j !!r7c  \VPVR7pVf \W4#RRRRRRRRRR R R R /PVR ,R4/VR ,,p^R IHpV!VPV4pT;'g/PRR4pVeLVR,PRR4pVR ,R8XdRMR p^RIHpVR8XdV!V4'dRpWG3#Ve VPR 4R9d VR ,pWG3#)z_``(status, reply)`` of one admission, read from its committed result, never transcript recency.r,queuedstartedclaimedunknownr9terminal cancelledrejectedr-outcomeradmission_resultreplyroresultfinal_response completedsettled)is_intentional_silence_response>r-r)r rf_expired_outcomergateway.session_resultsrgateway.response_filtersr) rVr,fallbackrrrsavedrrs &&& r(_admission_outcomerTs)  < HC { 44)Y ;; Z8U]^bbcfgpcqs~ABEFNBOPF8 Y\\< 8E ^^ " -E h##$4b9!)n ; M Y #B5#I#IE =  (,,x"8r?r )rVr$rr4s&& r(r r os A \\rF zz(y(hGR!888L)JoillJ??FJJw333ill..z:B (#++ _ JJ} %z 3FJJw333 1 22r7cH\WR,\VR,44#)zThe delivery's one retry admission id, read from the FIFO by its derived identity, so every reader (an in-memory record, the receipt file, an owner restart) follows the same retry.r4r)rd_retry_identity)rVr$s&&r(_retry_admissionrs! <$8/&Q^J_:` aar7cVPP4;_uu_4pVPRW34P4pRRR4X'd V^,#R# +'giL#;i)zVSELECT admission_id FROM session_admissions WHERE target_session_id=? AND request_id=?N)rfrgrhri)rVr4rjrkrs&&& r(rdrdsY    ! !Tlls&355=XZ  "3q6"d" " !s "A  A0 c V\W4pT;'g VR,pV'd\W4wrEM\WR,V4wrER;rgVR8Xd\W4wrg\WAR ,VR ,VR ,VR,VR ,VW&VR 7 P4U U u/uF wrV fK WbK up p # \dXpTPR8wdh^RIHp TPR4;'gRTPR4;'gT rvRp?LRp?ii;iuup p i)aThe delivery's receipt. Once the one transient-failure retry was admitted, the sender's outcome is the retry's: ``status``/``reply`` follow it (``retry_admission_id``). A ``failed`` receipt carries ``error`` + a typed ``reason`` (``tools.bot_failure_reasons``): the relay's Desktop forwards ``res.reason`` to the sender, which cannot re-derive it from a reply that lacks the provider text.r,Nr-r)UNKNOWNerrorBot Chat delivery failedreasonrr3r4r) rrr3r4r,rrretry_admission_idrr) rr_failurer rtools.bot_failure_reasonsrrritems) rVr$retry_idcurrentrrrrrJrkvs && r(_resultr#s8 2H00&0G*9? *9^6LfU E  o$Y8ME"M=RN+|8LN+VI5Fe#ABGI [ITQMN ADI [[ ! ozz[( 9"JJw/MM3MvzzZbOcOnOngn6  o  [s0 C)D%6D% D" /D;DDD"c b^RIHp^RIHpHpV!VP V4;'g/P R4;'g/pVP R4;'gVP R4;'gRpYc!V!VP R4VP R44;'gT43#)z``(error, reason)`` of a failed admission from its committed result: the raw provider error and the turn loop's typed verdict, classified like every other Bot lane. A refusal that never ran (no result) has no provider text: ``unknown``.r)classify_agent_errorturn_failure_textrrrrfailure_reason)r rrr%r&rfr)rVr,rr%r&r rs&& r(rrs9Q illL 9 ? ?R D DX N T TRTE IIg  [ [%)),<"= [ [A[E &'879KUYYWgMh'i'r'rmrs ssr7cd\W4pVR,R8Xd\W4'dRVR&V#)rr-r)r#_retry_eligible)rVr$rs&& r(_delivery_resultr*s2 Y 'F h8# (J(J$x Mr7c~^RIHp\W4pV'd\W4^,R 9dVR3#R #\WR,V4^,pVR 9d VR,R3#VR8XdTV!VR,VR,4;'gTp\ V/VCRVP R4/C4'd VR,R3#R #) a``(admission_id, interim)`` a live waiter must follow; ``(None, False)`` once the delivery settled for good. The retry, once admitted, is the only admission whose future fires again. An original that failed while its one retry is still eligible is ``interim``: pending, never the answer, while the owner's receipt task admits the retry (or records why it would not; the receipt file is re-read for that, the caller's in-memory record is stale).)read_delivery_resultFr,r-r3rretryT>rr)NF)r5r,rrr)r)rVr$r,rrr s&& r(peer_wait_admissionr.s = 2H$6y$KA$NRg$g% zmzz  .+A6 J1 MF &&n%u,, $VN%;VM=RS]]W] 9&M&M%))G:L&M N N.)4/ / r7c"RV,R,#)rMz:retryrr&s&r(rrs C<( ""r7cVPR4;'g/PR4'g\W4'dR#\VPVR,R7pVeVR,R8wgVR,R 8wdR#^R IHpV!VPVR,4pVfR#^R IHpHpV!VR ,4V8g#) uRExactly the main-lane gate (``tools.bot_failure_reasons.result_retry_action``): the original admission SETTLED ``failed`` with a committed result whose error classifies transient (429/5xx/ context overflow). queued/started/unknown admissions never qualify — unknown execution is never replayed — and the retry itself is never retried.r-r+Fr,rrrrr-r) RETRY_NONEresult_retry_actionr) rrr rfr rrr2r3)rVr$rrr r2r3s&& r(r)r)s  7!!r&&y115Ei5X5X  6.;Q RC {c(mz1S^x5O8 Y\\6.+A BE }I uX /: ==r7c &"\W4'gR#\VR,4pVPR4RJdR0M \4p\ VR,VP \ RR0V,4R 4pVP4\W4GRjxL wrxp VPVR ,8wd \R 4hVPPV P4R 8Xd \R 4h\!TR,TP"RTRTP$RT P/R7p ^RIHp T P*PT !T44TPR4e \-TR,4T P*R&RT/TR&TPRRR7\Y4GRjxL TP/TP0P3TP"4Y4GRjxL p TP\5Y44TR,R9d\7YTR,T P84\Y4GRjxL \;YT4R#EL \d]p T PR8XdTPRRR7Rp ? R#RTRT P/TR&\Y4GRjxL Rp ? R#Rp ? ii;iELL \d1p T PR8wdhTPRRR7Rp ? R#Rp ? ii;iL5i) aAdmit the delivery's one retry under a DERIVED identity recorded on the same receipt, so a repeated deliver(), an owner restart or a second settle re-reads that admission instead of minting another. The identity is written before the admission: a death in that two-store window re-admits the SAME identity, which the FIFO answers with the existing row (never a second turn). No user-row adoption: a transient owner-side failure persists the DM row and then CLOSES it with the durable failed-turn boundary (``agent.conversation_loop._close_durable_failed_turn`` / ``_hmwa_close_failed_turn``, #107070), so ``agent.session_persistence.adopt_unanswered_turn`` would decline by contract (a plain assistant row follows the DM) and the retry is a fresh turn after that boundary. A failure that left the DM as an OPEN tail (the context-pressure classes skip the closer) is not retried: the owner execution has no adoption seam, and the retry's DM would merge into it.NroperatorTsession:operatorr.rz session:readzbot-delivery-retryr4ruseropen_user_tailruntime_drainingrro)rridentityr+r-rgateway_session_keygateway_session_idtextrinternal message_idmetadata automation_notification_metadataauthor turn_authorr queue_fullr>rr)r)rrsetrr frozenset_require_admission_openrr4r rflatest_conversation_rolerupdaterrrrgateway.session_automationrDrBradmit_automationr_adapter_for_sourcer# _watch_replyr,r)rVrWr#r$r;r5rrrrrJeventrDrs&&&& r( _maybe_retryrRs 9 - -vm45H(.zz*'='E"#35H f^,i.B.B!1> BX MNPd fE))+!(!::5 >>VL1 1#$89 9 << 0 01A1A Bf L#$45 5 M fY/ d'}%!8,F7O MMM,  %%%!2293C3C3W3WX\XcXc3dfkvv MM'),- h00Yf]&;W=Q=QR  %%%Yf-I;  ::+ + MM"M 5 %xCJJGwD)))"&v  :: %   Yb 1 &sA9L<I"IAI":B;L5K 6L;8K3K4K8AL L LI"" K -$KL!K8J;9K>LK  LK L %LLL  Lcp"Rp\P!V4GRjxL \V4;_uu_4GRjxL \ W4GRjxL wrVVfRRR4GRjxL R#WR R2, pVP \ W44V'g\WWv4GRjxL VP \W44\W4GRjxL \WV4RRR4GRjxL R#L \dRpLi;iLLLLjL?L% +GRjxL 'giR#;i5i)FNT.json) rshieldr rrrLr#rRr*rr)rVrWr&futurepausedrHr$r#s&&&& r( _record_replyrX)s FnnV$$$ I&&&)$44  > '&&Um# gi01y= = = &y9:D)))&1'&& % '4' >)'&&&sD6C:C8C:D6D D6DD D D6%D&D6,rr) rrrLr#rPrrRrr)rVrWr&rHr$s&&& r(refresh_receiptrZ>sI&&&)$44  > '&&  gi01 ( 4 4 #zz:N/O/i/iSYZhSi j9DU%=,@&IIID)))&1'&&4' J)'&&&sDC.DC:C0 C: DC2D A-C:8C49C: C6 C: D'C8(D0C:2D4C:6C:8D:D D D D  Dc VPVPrC^RIHpHpV!V4\ VP P4PP4pV!V4p\W4V4RVP9d \R4hRR0R\4R0Rm/p \V4W,, 'd \R 4h^R IHp Hp Hp VR8XdR V !WrP%R44/#VR8Xd RV !V4/#V !WrP%R4VP%RR4VP%R R4VP%R R4R7RR/# \&dp \R4T hRp ? ii;i)ru)require_servingrvzsession:controlr{rosteragentsoutboxrrrrinvalid_params)write_remote_rosterclaim_pending_envelopes write_replycount envelopesro)rrrrNokT>rrrr)rVrr|r\rvrrfr}r~rrrr rHtools.bot_relayrarbrcrr ) connection operationrrVrr\rvrWrrfieldsrarbrcrJs&&& r(relay_operationrkKsT!++Z-=-=uPI  $$ % , , 4 4 6D t $D )D! 2 22 344 HceW>` aF 6{V&&& 011YYH,T::h3GHIIH4T:;;?D**T*&**Wb2I **Wb1&**Xr:R T $< ? 453>?sA E E2! E--E2c "\W4GRjxL wr4pVUUu.uFZwrgV'gKRV9gKVPR4'dK1VR,R9gKAVe\Wg4V8gKWWg3NK\ pppV'gR#\W4GRjxL wrp \ VRR7EF*wrgVR,p V R,\ V48wdK(VP PV R,4V P8wdK[^R I H p V !V R,VR 7;_uu_4pV'd \R 4hRRR4VR,R8Xd+VPR R R7\W'RR7GRjxL K\WW#\VR,4VR,WV \!VPR44VVPRR4R7 GRjxL EK- R#ELuuppiELP +'giL;iLL,5i)Nr0r,rrc\V!#r)rS)items&r(r_migrate..os t8Lr7r0r3r4)active_session_liveness_guard) registry_homeruntime_coordination_requiredr9unknown_execution)rrexpectrrrEnotification_categoryr)rEr\rv>rr)r`rrSrsortedrrfrr4hermes_cli.active_sessionsrpr rLr_admitr r)rVrrWrHrYrXr#r$r\rrrr0rpactives&&&& r(_migrater{ds$8 #HHD718N#v-6d S SW]'(GHHT ( y ( MM5HM IY? ? ? Yt<}@U3VI&5ARSYS]S]^fSgAhqw+1::6Mx+XZ Z ZNIN 7T S @ ZsHG  H G#G#G# G#!G#7G#>HG)BH)G,>9H7G?8AHH H#H, G< 7 HHc "\VPP4PP 4p\ V4;_uu_4GRjxL \ W4GRjxL wr#pVFwrVV'd7VPR4\V48wgVPR4'gKEVP\W44VR,R9d5\YVR,VPR4;'g VR,4VR,R9d\WWV4GRjxL \'Y4GRjxL \)YT4K VPP+R 4pVfRRR4GRjxL R#VPP-VPP/VR ,44p V fRRR4GRjxL R#^R IHp VPP54;_uu_4p T P7R YPR4;'g V R ,,34P94p RRR4X 'gRRR4GRjxL R#\;V R,VP<\?RR04R4p \AW W4GRjxL RRR4GRjxL R#ELkEL[EL \dTp\P!\ 4P#RTPR4TP$TRR 7Rp?EKRp?ii;iELELELZ +'giL;iLLL +GRjxL 'giR#;i5i)zIRebuild derivative replies and queued legacy admissions at owner startup.Nr3r,rrrz&Bot delivery %s not recovered: %s (%s)T)exc_inforrrrcrrrzr7zbot-owner-recovery>rr)!rrfr}r~rrr`rrrLr#rPrRr r<r=r>rrrrrrrrrrgrhrirrrIr{)rVrWrHrY_r#r$rJrrrrkboundrs& r(recover_bot_deliveriesrs  $$ % , , 4 4 6DI&&&!5i!FFq#LDVZZ73t9DFJJWeLfLf  gi89(#'<< &2G!',@!A![![VNE[](#+@@&yEEE - - - Yf 5%$&ll// ; ; /'&&0))),,*J*J3t9*UV > 5'&&6 5 \\ # # % %LL!G**Y"7"G"G6$<HJLLTHJ & A'&&B&+Y-A-A#%5~$FGI]_y444G'&&FF$ !!(+112Z28**]2KSZZY]hl2n   .''8& %9'F 5G'&&&sCAM%J<M%M$J?%A M1M4A K+K-K .K2ML& 4M5 M%L)M%AM M%L,M%(MAL/ MM M%%M&M%,9M%M&M* M%5M6M%?MK L# AL ML# #M)M%,M%/ L? :MM%MM%M" M M" M"  M%caaaa\VRR4oSf /;oVnSPS4pVe.V^,S8Xd V^,P4'gR#VPP S\ P!4P44o\ P!\WSS44pSVS3SS&VVVV3RlpVPV4\W4R#)_bot_reply_watchersNcb<SPS4SVS38XdSPSR4R#R#r)rr)finishedr,rVr&watcherss&r(done_watch_reply..dones/ << x @ @ LLd # Ar7) rrrrwaiters setdefaultrget_running_loop create_future create_taskrXadd_done_callbackr) rVrWr&r,previoustaskrrVrs &&ff @@r(rPrPsy"7>H35590||C H | ;HQKDTDTDVDV    ) ),8P8P8R8`8`8b cF   }Yc6J KD!40HSM$$ 4 y'r7c "^RIHpVPP4\P !V!VP\ W444GRjxL #L5i)rutrack_mutationN)rrrVrJrrU_deliver)rhrrs&& r(deliverrsA>002z/C/CXjEa bc cc csAAAAcVR,V8wgFVR,VP8wg.VPR4V8wgVPRR4V8wd \R4hR#)zA delivery id names one delivery: the same message, principal, author and category (the mailbox writer's identity), whether its receipt is admission-backed or refused.rr.rErvrrN)rrr )r$rrrEcategorys&&&&&r(_require_same_deliveryrsX yW$~(>%--(Ozz(#v-zz18<H 455Ir7c\WVPR44p\V40R m, 'd \R4h^RIHpV!V4pVPRR4p\ VPR44pTPR4p TPR4e\M\p \T \4'd'T P4'd\T 4T 8d \R4h\TPR44p TPR4e-\TR,\4'dT f \R4hY7YT3# \dp\R4ThR p?ii;i) z``(home, key, message, author, category)`` of one ``deliver``/``settle`` request: the delivery's full identity, validated the same way for both verbs.rrrrErvr`rCrN>rrErrr4rv)rrrHr rMrDr r _BOT_DM_MAX_CHARS_PRODUCER_MAX_CHARSrrstriprrr) rVrrrWrD notificationrr&rJrlimitrEs &&& r(_delivery_paramsrs6 6::i#8 9D 6{bbb 011K3F;L 7BH;6::d+,jj#G"(H!5!A GZE gs # #7==??c'lU>R 011 vzz(3 4F zz('F8*>|@TUWgh9J??? &9 99 @ 9s)CBC%B>&C9C:CCcH"VPVPr2\W#V4wrErgpWgV3p VP4\ V4;_uu_4GRjxL \ WE4GRjxL wrW R2, p \ W#WKWR7GRjxL p V eT uuRRR4GRjxL #\W#WJ4GRjxL \ WE4GRjxL wr\ W#WKWR7GRjxL p V eT uuRRR4GRjxL #V e \R4hVPPR4p\W#4GRjxL wpppVPRVP4pVVP8wd\W/V4'g \R4h\W#WJWVVVVVVR7 GRjxL uuRRR4GRjxL #ELcELSEL3ELEL LLLLL-L \d%p\!YET4GRjxL ;'gThRp?ii;i +GRjxL 'giR#;i5i)NrT)rrsrr4r)rErv)rVrrrJrrrr{r rfrrrr4rry_held_by_another_writer)rhrrVrrWr&rrErr;rHr$r#answerr~rrrrrrJs&& r(rrs!++Z-=-=u+;If+U(Dw*H %%'I&&&)$44 Um#&yxaa   '&&  G9T8 8 8*455IA*9T8eeF!'&&!'(;<<\\66zBF%,Y%>> CuZZ e.>.>?F)))2KI_e2f2f'(<== $cCQUW\ek6>@@''&&4a' 95e' ?@''*! G/3???FF3 F G+'&&&s3AH"F8H"H(F;)"H F> H H""G#H")G8G9G G G#G $ G- H":G ;H"8G8G 9A(G!G"G% H"2G3H";H>HH"GG G H" GGH" HG=-G0 . G=:G==HHH H H H  H"c "^RIHp^RIHpV!VP4VPP 4\ P!V!VP\W444GRjxL #L5i)ru)r\rN) r|r\rrrVrJrrU_settle)rhrr\rs&& r(settlersT;>J(()002z/C/CWZE` ab bb bsA,A5.A3/A5c B"VPVPr2\W#V4wrErgp\V4;_uu_4GRjxL \ WE4GRjxL wrV fS\ W#WEWgV4p \ WJ4GRjxL \P!\4PRWZR,4\WWgV4\W#WJWgV34GRjxL p V f \R4hT uuRRR4GRjxL #LLLL-L +GRjxL 'giR#;i5i)aFinalize a delivery the sender was told may not have been admitted: under the mailbox lock every ``_admit`` holds, either settle the id as never sent or answer with what it already is. A ``deliver`` refusal marked ``admitted=False`` proves absence only while that request held the lock; a same-id attempt may admit right after. The sender calls this before it says "NOT sent": with no receipt and no admission row for ``bot:``, a terminal ``refused`` receipt bound to the full identity is written, and every later ``deliver`` of the id answers with it instead of admitting. An admitted id gets its receipt; an in-flight pin stays unknown. Only the Bot DM tool calls this, so cron's same-id retries of a refusal are unchanged. The writer is not re-checked: it may release between the refusal and this call, and "nothing was admitted" is all that is serialized here. So the receipt claims only that, and any ``session:submit`` principal of the profile can settle an id it never delivered: the trust ``deliver`` already grants it over that id.Nz-Bot Chat delivery %s settled as not sent (%s)rrs)rVrrrr_not_sent_recordrr<r=r>rUrrr ) rhrrVrrWr&rrErr~r$rs && r(rr!s"++Z-=-=u+;If+U(DwI&&&&t11  >%i7T\]F- - -   h ' , ,-\^ajrcs tvgxH&yYaGbcc >#$78 8'&&1 .d'&&&s?DC8DDC:&D;C<D% D2D3D:D<D>DDD D  D D  Dc (VPP4;_uu_4pVPRRV,34P4pRRR4VPP R4p XfV f \ R4h^RIHp \V\V4VPPV R,4VPVRR R R \R 7 p V PV !R V/44Ve\V4V R&V # +'giL;i)zThe never-admitted id's terminal receipt, in ``refuse_pin``'s shape. Refuses (unknown) when the FIFO holds a ``bot:`` row anyway or there is no Bot Chat to name.z3SELECT 1 FROM session_admissions WHERE request_id=?rMNrrsrCrr-Troz2Settled as not sent after a session-writer refusal) rr3r4r.rrr+rrrrvrE)rfrgrhrirr rMrDrrrrr rL) rVrrWr&rrErrkadmittedrrDr$s &&&&&&& r(rr?s    ! !T<< UX^adXdWfgppr " ,, + +J 7Cs{ 344K cD illFfFfgjkogpFq$}}ghX\dfLUbdF MM24KX3VWX <x M " !s )D D c"VP\8wg\W4GRjxL ^,eR#\VPRRR7pRVnV#L05i)aThe settleable form of a ``runtime_coordination_required`` refusal, or None. Another session writer holds the chat (a pre-authority Desktop backend's lease on a legacy Bot Chat, a live CLI). Nothing was admitted under this id when it still has no receipt: ``_admit`` pins one before it admits and withdraws it only when nothing committed. That holds only while this request has the lock, so ``admitted=False`` is a hint, not the verdict: the sender asks ``settle`` before it reports a no-send. Any other refusal keeps its unknown outcome.Nsession_writerzCanother session writer holds the Bot Chat; nothing was admitted yet)fielddetailF)rr rr r)rWr&rJrs&&& r(rrQsQ zz]"\$-D'Da&H&T SZZ/?$i kDDM K (Es$AA1Ac "^RIHp V !RV /4p W4 R2, p\WWPRRV,RVPRVP /R7pVP PV 4V e\V 4VP R &\T ;'g/V\V4VP VPVR R 7pVPV 4R VP9dRVR&V e\V 4VR&\TTT ;'g/PR4R7GR jxL 'gV eR #\R4hVPVP P#VP4VRV,4GR jxL pTPRTP6R7TP\9TT44TR,R9d\;YTTP64TR,R9d\=YTT4GR jxL \?YT4GR jxL #LL \dp\%YP RT,4ehTP&\(9dT f\+Y$4GR jxL h\,P.!\04P3RTTP&4\5Y$4GR jxL hR p?ii;iLL5i)rurCrvrTTrMr<r=r>NrFr9)rr3r4r.rrr6r5rErrtrz!Bot Chat delivery %s refused (%s)r/)rr,>rr) rMrDrrrr4rBrLrrrrrrr rNrrOrdr_OWNER_STATE_REFUSALSrr<r=r>rUrr,r#rPrRr)rVrrWrHr&rrrrrEr\rvrDrr#rQr$rrJs&&&&&&&&&&&& r(ryryasyK35LNc4deL E- D gkkDC<+@$**)=u?O?O+Q RE NN,' (,V }%&,,BCc$iTWTbTb]]GKIF MM,U///!z <xtVV\\r4F4Fx4PQ Q Q   455 !2293C3C3W3WX\XcXc3dfkmsvymyzz MM73G3GMH MM')V,- h00Yc7+?+?@ h449D&999 &9 991 R {   NNFSL A M  ::. .~"4---    h ' , ,-PRUWZWaWa bT' ' '  " : 9sBKA3KK)H* K4KAH#H!H# A;KKKKK!H## K .AK5I86A K?KKK  KKc"\W4pVPV4\W4GRjxL \WV4V#L5i)a>Publish the delivery's projection and answer with exactly that projection. The write is off-loop, so the admission may settle while it runs; re-deriving the answer afterwards would hand the sender a reply the receipt file does not hold yet (the reply watcher publishes it once this delivery releases the mailbox lock).N)r*rLrr)rVrWr$rs&&& r(rrs? i 0F MM&  %%%Yf- M&s+AAA>r-rrrr9rr/> rrG stale_epoch session_busyruntime_retiredr:stale_generationrrri))r,r3r4r.r)NNr)Z__doc__r functoolsrr<pathlibrrPagent.turn_authorrgateway.session_contractrrgateway.configrgateway.platforms.eventrhermes_state_runtimer r rr r5r r rr=r>rgateway.session_bot_mailboxrrrrrrrrrrIr"rrrr)r6r:rArKrRr`rQrSrrrrrrrrrr rrdr#rr*r.rr)rRrXrZrkr{rrPrrrrrrrrrrryrrr7r(rs  /:#0I3BB   8 $```() "#"* $o i,&"R]q.8" a * &&R"(63,b #[:t(#>$;.|2* 22Z<&5R("d 604K :G<c<$  -:` r7