+ jHj8Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt]P!] 4t RRlt RRlt RtRR ltR R ltR R ltRRRR/RRlltRRltRRltRRltR#)zFresh-process recovery after the update's in-process restart phase aborts. Separate owner from ``update_cmd``: its own vocabulary (``verified`` / ``relaunch_attempted`` / ``failed``, serve units, survivors) and its own fail-closed contract.) annotationsNcV^8dQhRR/#returnbool)formats"E/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_abort_recovery.py __annotate__r sGGGcv\PR8H;'d \\P!R44#)zWCan a fresh process restart ``hermes-serve*``/``hermes-dashboard*`` units on this host?linux systemctl)sysplatformrshutilwhichrr r _serve_unit_recovery_availablers' <<7 " F FtFLL,E'FFr cV^8dQhRR/#rrz list[dict]r)r s"r r r s7979*79r c^a /p\VRR4;'gREFp\VRR4R9dK\VRR4p\V\4'dV^8:dKD\VRR4p\V\4'dTM/pRVR\ \VRR44R\ \VRR44R\ \VRR44R \ VP R 44/W&VP R 4'gK\ VR ,4W,R &VP R 4W,R &EK T'g.#^RI H pT!4Uu/uFdpTP R4R9gK\TP R4\4'gKBTR,\ TP R 44bKf upo RT 3RllpTP4UU U U u.uFBwr9T!Y94'gKT P4U U u/uFwrT R 8wgKYbK up p NKD p p p pp \T RR7# \d#p\PR T4.uRp?#Rp?ii;iuupi \d#p\PRT4Ro Rp?LRp?ii;iuup p iuup p p pi)uPre-update serve/dashboard runtimes that are STILL the same process — i.e. live on the pre-update code generation. Identity is the incarnation ``(pid, create_time)``, never the PID alone: ``ledger_entries()`` prunes dead entries, but a correctly restarted serve can come back on the same number. Fail closed on missing evidence (unreadable ledger, no incarnation on either side): the runtime counts as surviving.runtimeskindNpiddetailprofile supervisor _create_time create_time systemd_unit systemd_scopez)Could not read planned serve runtimes: %s)ledger_entriespurposez)Serve/dashboard survivor probe failed: %scV^8dQhRR/#rr)r s"r r :_surviving_pre_update_serve_runtimes..__annotate__=s J J Jr c<SfR#VS9dR#VR,SV,r2VRJ;'d4VRJ;'d(\\V4\V4, 4R8'*#)NTFrg@)absfloat)rrowplanned_created live_createdlives&& r _still_live9_surviving_pre_update_serve_runtimes.._still_live=sv < d?(+N(;T#Y 4 ' I IL,D I IE,'%*@@ASHJ Jr cVR,#)rr)r*s&r 6_surviving_pre_update_serve_runtimes..MsSZr )keyr)serve dashboard)getattr isinstanceintdictstr_numericget Exceptionloggerdebughermes_cli.process_identityr#itemssorted)planplannedruntimerrexcr#entryr.r*kv survivorsr-s& @r $_surviving_pre_update_serve_runtimesrKsf "GtZ4:::Gw-5KK'5$/Cc3''3!8Wh5F)&$77VRFsFC(D$E3ww 2>?c''<"DEM)B C EGL zz.))/26.3I/J ^,06 ?0K _-!;(  >())e)yy#'== =BLUYYW\M]_bBc =E%L(599]#;< <))e J J B'HC;s+@ >#))+=+$!n)<+='B )!7 88=  @#F )e  @#F" >BsH<C$H<:H<I1I,3"I,&I,I1!J' 8J' J!J!!J' < I)I$I)$I),I11 J<JJ!J' cB\V\\34'dV#R#N)r7r8r))values&r r;r;PsusEl335==r cV^8dQhRR/#rr)r s"r r r Ts  * r c$.p\T;'gR4Ftp\V4PR4wr4pV'd'VR9d V'dVPRVRV/4KNV'gKXVPR\V4/4Kv V#)zScope-qualify the units the aborted phase already settled: ``/`` because ``hermes-serve.service`` can exist in BOTH the user and system manager (two processes)./scopeunitr)usersystem)rBr: partitionappend) skip_unitsrowsrGrRseprSs& r _qualified_serve_skipsr[Ts|D ((b)u://4D 5..4 KK%6 7 U KKU, - * Kr c$V^8dQhRRRRRR/#)r gateway_moder recover_serverz"subprocess.CompletedProcess | Noner)r s"r r r as$''+/'@D'''r cp\PRRR.p\PP 4pRVR&R&FpVP VR4K V'dU\P R8Xd@\P!R4pV'g\PR 4R#VR R R R R.VOpR\P!RVRVRRVR\V4//4RRRRRRRRRTR\^^^Z\V4,,V'd^M^,4/p \P R8Xd,\!\"R^4\!\"R ^4,V R!&MRV R"&\"P$!V3/V BR#R$/B# \&\"P(3d"p \PR%T 4Rp ? R#Rp ? ii;i)'uSpawn ``hermes_cli.update_restart_recovery --stdin`` detached from this process; None when it could not run (no systemd-run in gateway mode, OSError, timeout) — the caller fails closed.z-mz"hermes_cli.update_restart_recoveryz--stdin1HERMES_UPDATE_RESTART_RECOVERYNrz systemd-runz=Cannot isolate fresh gateway recovery from the gateway cgroupz--userz--scopez--quietz --collectz--inputprofiles supervisors serve_unitsrecoverskipcapture_outputTtextencodingzutf-8errorsreplaceenvtimeoutwin32CREATE_NEW_PROCESS_GROUPDETACHED_PROCESS creationflagsstart_new_sessioncheckFz)Fresh gateway restart recovery failed: %s)_HERMES_GATEWAYHERMES_GATEWAYHERMES_GATEWAY_MODE)r executableosenvironcopypoprrrr>warningjsondumpsr[maxlenr6 subprocessrunOSErrorTimeoutExpired) rc candidatesr]r^rXcommandrmmarker systemd_runkwargsrFs &&$$$ r _run_fresh_recovery_processras ~~t%I9UG **// C,/C()N O  /ll=1  NNZ [)Y T\T[\  - I}f>TU_>`acd $j'8Y s 3sBc(m!33msQRSTVF ||w J :A >UgijAk k '+"#~~g==u== Z.. /BCHsE99F5F00F5c V^8dQhRRRR/#)rr^rrdict[str, list]r)r s"r r r s * *D *_ *r c\V\4'd\VPR4\4'd\VPR4\4'd\;QJd.R.VR,OVR,O4F 'dK RM# RM!R.VR,OVR,O44'd'R\ VR,4R\ VR,4/#V'd\ PR4R.RR./#R.R./#)zValidate the child's ``serve_units`` block; an unreadable block is not "nothing to do" when serve recovery was requested (those units may still serve the pre-update generation).verifiedfailedc3B"TFp\V\4xK R#5irMr7r:).0rSs& r %_parse_serve_units..sa2`$ 4%%2`FTz4Fresh recovery returned an invalid serve-unit resultz )r7r9r<listallrBr>r}) raw_server^s&$r _parse_serve_unitsrs 9d## y}}Z0$ 7 7Jy}}U]G^`d*:;; Hb ))r skip_profilesrXc(V^8dQhRRRRRRRR/#)rr]rrzset[str] | NonerXrrr)r s"r r r s8IPIPIP0?IPIP+:IPr c Faaa^RIHpV!WR7wpo\V4o\4pR!RV3RllloS'gV'g S!....4#RVV3Rllp\ SWQWcR7pVfV!4#VP ^8wd(\ PRVP 4V!4#\P!VP;'gR 4p V PR 4p V PR 4p V PR 4p V PR 4;'gR .R ./p \YR7pYT 3p.p\ ;QJdRT4F 'dK RM RM !RT44'd .T OT OT Op\ ;QJdRT4F 'dK RM RM !RT44'dv\";QJdRT4F 'gK RM RM !RT44'g<\%T4\%S48wg#\'T4\'\%T448wd\ PR4T!4#\T 4\T 4\T 4rp T PR4p\)T\*4'dTM/P-4Fkwpp\)T\.4'gK\)T\04'gK6T'gK@\3RT RRP5RT44 RT R24Km T R3T R3TR ,R3TR ,R 33F1wppT'gK\3TRP5T4,4K3 S!SYY4# \\\3d \ PR4T!4u#i;i)"aRetry supervised gateway restarts from a clean Python process. Only inventory-classified supervisor-owned profiles. ``skip_units`` names the units the aborted phase already settled, as ``/``. The scope is part of the identity, not decoration: ``hermes-serve.service`` can exist in both the user and the system manager as two different processes, and an unqualified token would let a settled one suppress recovery of a stale one (review on #96235). )_gateway_recovery_partition)rcV^8dQhRR/#rrrr)r s"r r :_recover_gateway_restart_after_abort..__annotate__sccVecr c6<RTRTRTRTRSRVfR.R.//#T/#) requestedrrelaunch_attemptedrskippedrer)rrrrrers&&&&&r _result5_recover_gateway_restart_after_abort.._resultsM J:NPb fi [=PJHb9c cWbc cr cV^8dQhRR/#rr)r s"r r rs333r c<S!S..S4#rMr)rrcsr _all_failed9_recover_gateway_restart_after_abort.._all_failedsxR22r )r]r^rXz(Fresh gateway restart recovery exited %srrrrrez4Fresh gateway restart recovery returned invalid JSON)r^c3B"TFp\V\4xK R#5irMr7rrbuckets& r r7_recover_gateway_restart_after_abort..s :':fd # #'rFTc3B"TFp\V\4xK R#5irMrrs& r rrs?wV 64((wrc3L"TFp\V\4'*xK R#5irMr)rrs& r rrsD8:gs+++8s"$z;Fresh gateway restart recovery returned incomplete profilescoveredu • One host gateway serves z and , c38"TFp\V4xK R#5irM)r:)ros& r rrsF^W]RSs1vvW]su — restarted once through z ; that restart is their outcome.uT ✓ Restarted supervised gateway(s) in a fresh process (systemd-verified active): ui ⚠ Relaunch attempted in a fresh process but not supervisor-verified (check these gateways manually): uJ ✓ Restarted serve unit(s) in a fresh process (new main PID observed): u8 ⚠ Could not verify a replacement for serve unit(s): rM)hermes_cli.update_cmdrrBrr returncoder>r}r~loadsstdoutr<AttributeError TypeError ValueErrorrranysetrr7r9rAr:rprintjoin)rCr]rrXrrr^rresultrecovery_resultrrrrrebucketsreported covered_mapownerothersnamesrirrcrs&$$$ @@@r $_recover_gateway_restart_after_abortrs1B5dXJj!H24Mcc Mr2r2&&33)*}mF ~} AA6CTCTU}**V]]%8%8b9"&&z2,001EF $$X.#'' 6XX:r8UW:X %YLKV4GH s :' :sss :' :::P-PTU}+1(+;VDV=WY_`fYg&H!%%i0K)3K)F)F+BUUW v eS ! !j&>&>66 0uTYYF^W]F^=^<_`**/0PR X ij V W Z "no X  Z[ ] t 5 $5)) *] 8X6 OOA Iz 2MN}s-"M+AM+"M++2N N cV^8dQhRR/#)rrNoner)r s"r r r s^^^r c @V'gR#\R4VFkp\RVPR4 RVPR4 RVPR4;'gR R VPR 4;'gR R 2 4Km VUu.uFqPR 4R8XgKVNK pp\V4\V48d \R4^RIHpHpVFZpT!VPR4;'gRVPR44p\RVPR4 RV!V4 24K\ \ PR8XdJ\;QJdRV4F 'gK RM RM !RV44'd\R4R#R#R#uupi)zName the serve/dashboard processes still on pre-update code: ``hermes serve`` hosts ``tui_gateway.server``, and an un-restarted unit keeps the pre-pull ``sys.modules`` graph so every chat turn fails with an ``ImportError`` no gateway row explains.Nuk ⚠ These serve/dashboard processes still run pre-update code (they started before the checkout changed):z pid ru — rz (profile rdefaultrrunknown)systemdzm Ask their owner to relaunch `hermes serve` / `hermes dashboard`, or reconnect Desktop for an SSH backend.)_format_restart_commands_systemd_restart_commandsr!zr"z pid z is managed by systemd: darwinc3H"TFqPR4R8HxK R#5i)rlaunchdN)r<)rr*s& r r-_warn_stale_serve_runtimes..s'[VZs (=(JVZs "TFzL For launchd-managed backends: `launchctl kickstart -k gui/$UID/