+ jHjsRt^RIt^RIt^RIt^RIHt^RIt^RIt^RIt^RI t ^RI H t H t ^RIHt^RIHt^RIHt^RIHt]P,!R4t]t]!0Rm4tR R R .3R R .33t.ROtR RltRRltRRRRRR/RRlltRRlt RRlt!RRlt"RRlt#RR lt$R!R"lt%RR#R$llt&]!0Rm4t']'R%0, t(R&R'lt)R(R)lt*R*R/R+R,llt+Rt,R-R.lt-R/R0lt.R1R2lt/R3R4lt0R5RR6R/R7R8llt1R5RR6R/R9R:llt2R;Rllt3R?R@lt4RRAlt5RBRClt6RDRElt7RFRGlt8RHRIlt9RJRKlt:RLRMlt;RNROltRURVlt?RWRRXR`` keeps resolving/monkeypatching. Origin helpers are imported lazily inside each function (no import cycle; test patches stay effective). N)suppress) dataclassfieldPath) _best_effort)PROFILE_MARKER_NAME _gateway_service_matches_profilezhermes_cli.update_cmduser systemctlz--usersystemc(V^8dQhR\RR/#)okreturnNbool)formats"@/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_cmd_fleet.py __annotate__r)s 8 8 8 8c^RIHp^RIHp^RIHpT;'gV!4pV!4R, p\ \4;_uu_4T!Y@'dRMR4RRR4R# +'giR#;i)get_hermes_home)committed_success)durable_write_bytesz.update_exit_code01N)hermes_cli.update_cmdrhermes_cli.update_receiptr pm.filesystemrrOSError)rrrrpaths& r_write_gateway_update_exit_coder%)sT5;1 " " "B  2 2D '  D"$$7    s A&& A7 c$V^8dQhR\/#rrr)rs"rrr7s;;D;rc2^RIHpV!4\, #)udLEGACY per-``HERMES_HOME`` breadcrumb. Read-compat only — nothing writes it any more. One host runs one multiplexing gateway, so the pull→restart obligation is host-scoped (``hermes_cli/update_host_obligation.py``). An obligation armed by the old per-profile code is still read and cleared here so an in-flight update is discharged after the upgrade. r)r r_FLEET_RESTART_PENDING_NAMErs r"_fleet_restart_pending_marker_pathr*7s6  : ::r expected_sharuntimesownerclV^8dQhR\R\\,R,R\R\/#)rr+r-Nr.r)strlistdictr)rs"rrrBs;MMMTRVZZ^M^MnqM{MrcV.8XdR#^RIHp^RIHpV!4P \ 4P 4'd\PR4R#V!\ 4W\4VR7#)uArm the HOST pull→restart obligation. Never raises; False when no store every profile reads took it. An unwritable host state dir falls back to this profile's per-home marker, which settles the debt only on an install proven to have no other profile; otherwise the arm returns False and the commit point refuses to move (``update_host_obligation.arm_host_obligation``, review S2). T_m)arm_host_obligationzFSkipping fleet-restart-pending obligation under pytest (live checkout))r+r-profiler.) r r5!hermes_cli.update_host_obligationr6_pytest_owns_live_checkoutr*parentloggerdebug_current_profile_name)r+r-r.r5r6s$$$ r#_write_fleet_restart_pending_markerr>Bsc2~(E t&&'I'K'R'RSS ]^ ACR^'<'>e MMrc$V^8dQhR\/#r'r0)rs"rrrWssrcV^RIHpV!4;'gR# \dR#i;i)uXProfile whose CLI armed the obligation (diagnostics only — the record is host-scoped).get_active_profile_namedefaultr,)hermes_cli.profilesrC ExceptionrBs rr=r=Ws-?&(55I5 s ((cV^8dQhRR/#rrN)rs"rrr`saaTarcl^RIHp^RIHpV!4V!4P \ 4RR7R#)z\Discharge the obligation for the whole host (legacy per-home marker included). Never raises.r4)clear_host_obligationzfleet-restart-pending)labelN)r r5r8rK_clear_marker_filer*)r5rKs r#_clear_fleet_restart_pending_markerrN`s((GD>@H_`rc$V^8dQhR\/#r'r)rs"rrrhsrc^RIHpV!4'dR#\\4;_uu_4\ 4P 4uuRRR4# +'giR#;i)uDTrue when this HOST owes a fleet restart — from any profile's CLI.host_obligation_presentTNF)r8rRrr#r*is_filerQs r_fleet_restart_obligation_armedrThs=I   '  13;;=     s A A! cTV^8dQhR\\\3,R,/#rHr2r0)rs"rrrrs DcNT1rc8^RIHpHpV!4pVeV#V!4'dR#\4P RR7p/pTP4F,pTPR4wrgpT'dYd9dR#YT&K. T# \ \ 3dR#i;i)zArmed obligation as ``key=value`` fields: HOST record first, then the legacy marker. ``None`` means nothing armed OR a malformed record; both must leave the obligation standing. )rRobligation_fieldsN utf-8-sigencoding=) r8rRrXr* read_textr# UnicodeError splitlines partition) rRrXfieldstextlegacylinekeysepvalues r_obligation_fieldsrhrs ]  F    13=={=S F!..-%cms " M \ "sBBBc2V^8dQhR\R,/#rHr@)rs"rrrs==sTz=rc^RIHpHp^RIHpV!RR7;'g/P R4pV'd \ V4#R# \dT!R.T!4P4u#i;i)z@Current on-disk checkout HEAD, or None if it cannot be resolved.)_capture_head_shar5)get_code_identityT)refreshshaNgit) r rkr5hermes_cli.version_inforlgetr0rF PROJECT_ROOT)rkr5rlrns r_current_checkout_sharssa;== .44"99%@s3x(D( = %"$*;*;<<=s!AA AA$A.-A.c0V^8dQhR\R\/#)rreceiptr)r2r)rs"rrrs>>t>>rc\VPR4pVPR4pVR9gVR 9dR#VPR4p\V\4'dVPR4'dR#V^8H;'gVR8Hp\VPR44;'dV'*#) akTrue when *receipt* is from an update that did not finish cleanly. The command boundary stamps a ``stop_reason`` on every receipt, including clean ones (``completed at command boundary``, ``sys.exit(0)``); it must not make a successful receipt look unfinished, or the next ``hermes update`` retriggers ``fleet_restart_pending`` from pre-pull plan SHAs (#98022). exit_codeoutcomeTgateway_restart incompletesuccess stop_reason)rN)failedpartialrunning)rq isinstancer2r)rurwrxry succeededs& r_receipt_looks_unfinishedrs K(Ikk)$G !W0P%Pkk"34O/4((_-@-@-N-NQ66'Y"6I  M* + = =I =rcJV^8dQhR\R\R,R\/#)rrur+Nr)r2r0r)rs"rrrs&&&D&d &VZ&rcaaa^RIHp\V\4'gR#S;'gV!4oS'gR#RV3Rllo^RIHoVP R4p\V\4'dEV'd=\;QJd VV3RlV4F 'gK R# R#!VV3RlV44#\V4'gR#VP R 4p\V\4'gR#\;QJd8V3R lVP R 4;'g.4F 'gK R# R#!V3R lVP R 4;'g.44#) a6True when ``update_receipts/latest.json`` records a runtime SHA skew. Prefer the post-restart ``fleet`` matrix. ``plan.runtimes[].code_sha`` is captured *before* the pull, so a finished update's plan always looks stale and must not retrigger a restart; consult it only for an unfinished receipt. See #95294. rsFc$V^8dQhR\/#r'r)rs"rr4_receipt_reports_stale_runtime..__annotate__sEE4ErcX<\V4;'d\V4\S48g#N)rr0)code_shar+s&r _sha_mismatch5_receipt_reports_stale_runtime.._sha_mismatchs#H~DD#h-3|3D"DDr)row_is_externalfleetc3<"TFep\V\4;'dIS!V4'*;'d4VPR4R8H;'gS!VPR44xKg R#5i)statestalerNrr2rq).0entryrrs& r 1_receipt_reports_stale_runtime..ss  ud # X X#E** X X7#w.VV- *@U2V XsA0A0A0 A0Tplanc3<"TF4p\V\4;'dS!VPR44xK6 R#5i)rNr)rruntimers& rrrs81G 7D!LLmGKK 4K&LL1s? ?r-) r rsrr2r!rrqr1anyr)rur+rsrrrrs&f @@r_receipt_reports_stale_runtimers-< gt $ $::#8#:L EE: KK E%5s   ss s s      %W - - ;;v D dD ! ! 3xx +11r13333xx +11r1 r manual-servec V^8dQhR\R\\,R\\\\3,,R,/#)rrupending_manualrN)r2r1settupler0)rs"rrrs;((D($t*(USVX[S[_I]`dId(rc(VPR4;'g/pVPR4;'g.Uu.uFq3R3NK ppTPRVPR4;'g.44TPRVPR4;'g.44TPRVPR 4;'g.44\4pR pVFwr7\V\4'gR pKVPR V4pVPR 4p VR9d#VPR4\ 9d W19dKkVR8wgV 'dV R8XdR pKVP W34K V'dR#T#uupi)a Pure coverage classification after manual retention of this receipt snapshot. Empty means this receipt owes no gateways, not that an independent marker owes none. Unknown identities, unclassified serve backends and failed manual transfers make coverage unverified. rr-Nc3("TFqR3xK R#5irrIrrs& rr)_receipt_owed_gateways..Y.XU4=.Xpending_manual_servesc3("TFqR3xK R#5irrIrs& rrrrrcarried_manual_servesc3("TFqR3xK R#5igatewayNrIrs& rrrsN3M%9%3MrrFTkindr7 supervisorrunknownserve dashboard)rqextendrrr2_SUPERVISED_SERVE_BACKENDSadd) rurrrentriesowed unverified default_kindrr7s && r_receipt_owed_gatewaysrso ;;v  $ $"DKO88T^K_KeKeceKe/fKe% KeG/f NNYgkk:Q.R.X.XVX.XYY NNYgkk:Q.R.X.XVX.XYY NNN7;;w3G3M3M23MNN!$DJ&%&&J yy.))I& ) )eii .EIc.chmiD  9 Gw)/CJ  $!# '$4'4'10gs FcvV^8dQhR\R\\\\3,,R,/#)rrrN)r1rrr0)rs"rrrs,  4 Cc3h,@4,G rc*\4pVFp\V\4'dVPR4MRpV'dVR8XdR#VP RV34TP RVPR4;'g.44K V#)a``(kind, profile)`` identities the live rows vouch for; ``None`` when any row is unidentified. A multiplexer's row carries the ``served_profiles`` its runtime status records (``_fleet_row`` keeps the field only when well-formed), so one live process covers every profile it serves. r7Nrrc3*"TF pRV3xK R#5irrI)rserveds& rr*_fleet_covered_gateways.. sZ9Yv 6*9Ysserved_profiles)rrr2rqrupdate)rcoveredrowr7s& r_fleet_covered_gatewaysrs~ %(EG(23(=(=#'')$4'Y. Y()ZAR9S9Y9YWY9YZZ  Nr accept_statesc V^8dQhR\R,R\R\\\\3,,R,R\R\/#)rr+Nrurrr)r0r2rrr)rs"rrrsUS4Z$cRWX[]`X`RaNbeiNi~CW[rcaaaS'gR#^RIHpHoVfR#V'g4\VP R4;'g/P R44#V!4pV'dE\ ;QJd!VVV3RlV4F 'gK RM RM!VVV3RlV44'dR#\ V4pVRJ;'dW&8*# \d"p\PRT4Rp?R#Rp?ii;i) zHRequire a successor at the expected SHA for every owed gateway identity.Fcollect_fleet_versionsrNrr-c3<"TFEpS!V4'dKVPR4S9;'gVPR4S8gxKG R#5i)rrN)rq)rrrr+rs& rr-_live_fleet_covers_receipt..sI OC$8 YCGGG M 1 X XSWWZ5HL5X XsAAATz0Could not reconcile pending fleet identities: %s) r!rrrrqrrrFr;r<) r+rurrrrrexcrs f&&d @r_live_fleet_covers_receiptrs Q <V,2277 CD D&(      )%0d"66t6  GMsKCCCCC' C2C C-CC C4C//C4cvV^8dQhR\R\\\\3,,R,/#)r inventoryrN)objectrrr0)rs"rrr/s,VE#s(O0Dt0Krc^RIHpVfR#\V\4'dVP R4^8wd \ R4hVP R4p\V\ 4'g \ R4h\4pVFp\V\4'g \ R4hV!V4'dK4VP R4R 8Xd/VP R 4'dVP\4KxVP R 4pVP R4R 8wg4\V\4'dVP4'dVR 8Xd \ R 4hVPR V34K V#)zThe ``("gateway", profile)`` set a marker's inventory owes; None when it recorded none. Raises ValueError for a malformed or unsupported inventory, which keeps the marker. ) runtime_outside_gateway_evidenceNversionz#unsupported fleet-restart inventoryr-z+fleet-restart inventory has no runtime listz,fleet-restart inventory row is not an objectrrstopped_unmappedr7rz8fleet-restart inventory row is not an identified gateway) 'hermes_cli.update_cmd_fleet_gatewaylessrrr2rq ValueErrorr1rr_UNMAPPED_GATEWAYr0strip)rrr-rrr7s& r_marker_owed_gatewaysr/s0 Y i & &)-- *Ba*G>??}}Z(H h % %FGG!$D'4((KL L +G 4 4  ;;v ) + .s-Tesoc.B.BesrcurrentrzGFleet-restart-pending marker discharged: %d gateway(s) already serve %sr)rrrhrqrrjsonloadsr#r^rrNr;r<rsr!rrrFallrrr0rrlen) rrar+rr target_sharrrrrrs @r_marker_only_restart_obsoleterbs,6G#% >zz."5;;= $TZZ ;0O%PQ  ,- ^_  (*L L8ARS_A`A`J U&( ##-Te-T###-Te-T*T*T  <,\HH%e,G 3    777 y (C 0C,D ,R   (9': :g E !T)3J! >ES)=SSE >4@4I4ICF5D3Q3Q') LLQ E JsO g \: .,  SUXY( ?s;IAII6#J%8J%I32I36 J"JJ"c>V^8dQhR\R\R,/#)rrurNrV)rs"rrrs//d/sTz/rcBVPR4p\V\4'd V'gR#VPR4'gVPR4'dR#VPR4;'g/PR4pV'd \V4#R#)zTReturn the pulled SHA when the restart phase completed, even if a later step failed.ryNrz phase_error post_updatern)rqrr2r0)rurypost_shas& r _receipt_restart_phase_completedrsykk"34O ot , ,O<((O,?,? ,N,N M*00b55e&((0222 !' :D )' 2 2)*?*A7Q QQrcnV^8dQhR\R,R\\,R,R\/#rr)rs"rrrs6RR4$;RtTXz\`O`RlpRrc`^RIHp^RIHp^RIHpVfV!4;'g/pVf V!V4p\ 4'd\4'*#\W4p\V4'gR#\V4pV'd\W`VRR7'dR#\V!4W4'*#)zJHold a completed restart to the code it pulled, not a later checkout HEAD.rrrF)r)rr) r rsr!rrrrTrrrrr)rurrsrrr restarted_tos$$ r_update_owes_fleet_restartrs;=P%'--25g>&((0222 !' :D )' 2 23G"SZZ F `gmn SZ`a BPrcV^8dQhRR/#rHrI)rs"rrrs P P Prc^RIHp^RIHpHpV!4;'g/pRp\ \ 4;_uu_4V!V4pRRR4\ \ 4;_uu_4\W4R7'd \RR7RRR4\ \ 4;_uu_4V!RVR7RRR4R# +'giLz;i +'giLO;i +'giR#;i)z5Cheap CLI-startup hint. Never restarts; never raises.r)rwarn_pending_manual_servesN)rurT)r)rr) r!rrrrrrFrr)rrrrurs r&_warn_pending_fleet_restart_on_startuprs=l!#))rGN )  5g>  )   %g U U ' 5  )  "4O         s# B4!C C4 C  C  C+ c#"\F$wr\V\,^ R7pYT3xK& R# \dK8\P dpTe T!Y4Rp?K^Rp?ii;i5i)zYield ``(scope, scope_cmd, list-units CompletedProcess)`` per systemd scope that answered. A missing systemctl skips the scope silently; a listing timeout skips it after ``on_list_timeout(scope, exc)`` (when given) so the other scope is still processed. timeoutN)_SYSTEMD_SCOPES _systemctl_LIST_GATEWAY_UNITSFileNotFoundError subprocessTimeoutExpired)on_list_timeoutscope scope_cmdresultrs& r_systemd_gateway_unit_listingsr! sk ,  ,? ?LF&&,!  (( *+  s< A/3 A/ A,A/A,A, A'!A/'A,,A/c0V^8dQhR\R\/#)rrrr)rs"rrrsstrc|VR8H;'d1\\R4;'d\P!4^8g#)r geteuid)hasattrosr$)rs&r _needs_sudor's;    B "   JJLA rc<V^8dQhR\R\R\/#rrsvc_namerr1r0int)rs"rrr$!dccrcH\\V4RVRR.,^ R7p\ TR^4^8wd^#\ \ TRR4;'gRP4;'g^4# \\P3d^#i;i \d^#i;izLive ``MainPID`` of a unit; ``0`` when inactive, unprivileged or unreadable. Property reads need no manage-units privileges, and an unreadable PID is never collapsed: identity that cannot be proved keeps its own restart. show--property=MainPID--valuer returncoder r, rr1r#rrgetattrr,rrrr*r s&& r_unit_main_pidr7$ DOvxAUW`.aakmnv|Q'1,GFHb177R>>@EEAFF Z.. / .!A0BB)B0BB B! B!c(V^8dQhR\RR/#)rr}rNr1)rs"rrr6s4u4ut4u$4urczaa a^RIHp\4o /oVFbwr4pS PV4VP^8wdSP RV R24K?\ VPW43V3RllV3RlR7Kd \S4p/p\V4^8dV!VV3Rl4wrgVP4Fwr\RV R V R 24K VFp SV ,wr4p \WK4'gK"\V4R .,p \V4'd R R .V ,p \WVR7pVP^8wg\WK4'gSP V 4KK SP%V 3Rl\&44R# \ P"dSP T 4Ki;i)uRestart every hermes-gateway/serve unit ONCE PER LIVE HOST PROCESS. One host runs one multiplexing gateway, so leftover per-profile units (``hermes-gateway-.service``) all point at the SAME live ``MainPID``; restarting each in turn restarts the host gateway N times — a self-inflicted N-fold outage triggered by one update. Units that share a live main PID are collapsed to one representative and the others are named as LEGACY units to migrate, never silently dropped.  collapse_units_to_host_processessystemd-z (listing failed)c6<SPV RV 2WV34#/ setdefaultr*_scope_cmdtargetss&&&r<_restart_systemd_gateway_units_best_effort..J'HZHZ(!H:&x(@IBrc&<SPV4#r)append)r*rr}s&&rrIrJLs&--2Ir process_uniton_unit_timeoutcT<\SV,^,SV,^,4#r7rerHs&rrIrJTnWS\!_gcl1oNr • D is a legacy per-profile unit sharing one host gateway process with l; restarting it again would restart that process twice. Fold the units together with: hermes gateway migrate--no-ask-passwordsudo-nrc3F<"TFwrVS9gKRV R2xK R#5i)r?z (listing unavailable)NrI)rr_answereds& rr=_restart_systemd_gateway_units_best_effort..js)t?xu^cks^s:HUG#9:?s !!N)r8r>rrr3rM_for_each_systemd_gateway_unitr r1ritemsr _systemd_unit_owned_by_updater'_systemctl_reset_and_restart_wait_for_service_activerrrr)r}listingsr>rrr keysrunit_key owner_keyrer* manage_cmdr`rHsf& @@r*_restart_systemd_gateway_units_best_effortrl6sSuH02G$, & U    ! MMHUG+<= > & MM16BI  %- =D G 4y1}8 NP &}} XJbk4 4  /%,S\"(,YAA )_(;'<< u   $*4J $1*R[\F  A%-Ei-Z-Z h'.[ MMt?tt(( $ MM( # $s)AF&F:9F:cHV^8dQhR\\,R,/#rH)r1r2)rs"rrrms$t*t"3rc\a\4oS'gR#^RIHpV!4pT'd\ T4fR#\;QJdT3RlT4F 'dK RM RM!T3RlT44'dT#R# \d"p\P RT4Rp?R#Rp?ii;i)zThe fleet matrix when the probe finds at least one gateway and every row is ``current`` at the checkout SHA (identity known); ``None`` on any unknown/stale/down row or a failed probe (restart).N)rz-Pending fleet restart: fleet probe failed: %sc3<"TF=qPR4R8H;'d\VPR44S8HxK? R#5i)rrrN)rqr0)rrrs& rr+_live_fleet_current_rows..|s> gafZ]777 y ( U US1D-E-U Uafs A&AFT)rsr!rrFr;r<rr)rrrrs @r_live_fleet_current_rowsrqms)*L D&( +E2: s gaf gsss gaf ggg   DcJs A?? B+ B&&B+c$V^8dQhR\/#r'r@)rs"rrrssrc\4pV'd \V4#\4;'g/PR4;'gRP 4pV'dV#\ \ 4;_uu_4^RIHpV!4;'g/PR4p\V\4'd/\VPR4;'gR4uuRRR4#RRR4R# +'giR#;i)uThe SHA a completed host restart is stamped with; ``""`` when nothing names the code. ``_current_checkout_sha()`` is ``None`` on every non-git install (zip, pip, Docker), and an empty stamp can never match, so the per-host restart-once guard would be inert exactly on the installs it exists for: each profile's ``hermes update`` would re-kill the one shared multiplexer. The obligation's own ``expected_sha`` — else the receipt's post-update identity — names the same pulled code. r+r,rrrnN) rsr0rhrqrrrFr!rrr2)rnrrs r_restart_identity_sharts !C 3x  & &B + +N ; A Ar H H JC  )  A*,2277 F k4 ( ({u-334   )     s:AC0C00 D c2V^8dQhR\R,/#rHr@)rs"rrrsd rcHa^RIHp\4oV!S4'dR#S'dyVeuVP'dc\;QJd)V3RlVP4F 'dK RM RM!V3RlVP44'd\ 4eR#R#)uWhy the completion tail may leave the fleet alone, or ``None`` when a restart is owed. Every route (pulled, already-current, ZIP) now finishes through the same completion tail, so the guards the old catch-up path carried live here: one host runs ONE multiplexing gateway, so a second profile's ``hermes update`` attaches to the restart the first one already stamped (#95294), and a fleet already serving the checkout code (a no-op update, a manual ``hermes gateway restart`` seconds ago) is not re-killed (#117051). The second guard needs BOTH the pre-update plan and the live probe: the live matrix only lists gateways, so a planned ``serve`` still on pre-update code (or any runtime without a stamped identity) keeps the restart — the reconciliation there is what surfaces it. )host_restart_already_completedz9this host's gateway was already restarted for this updateNc3T<"TFp\VP4S8HxK R#5ir)r0r)rrrs& rr-_fleet_restart_skip_reason..s!WgC(()\9s%(FTz6every running gateway already serves the checkout code)r8rwrtr-rrq)rrwrs& @r_fleet_restart_skip_reasonrzsgQ(*L%l33J)dmmmWWWWWW(*6G rc$V^8dQhR\/#r'r)rs"rrrs''D'rc$^RIHpV!RR7R#)zEHistorical retry hook; new retries use the ordinary completion owner.stop_for_relaunchT)rzN)hermes_cli._old_updaterr~r}s r_run_pending_fleet_restartrs 9&rc0V^8dQhR\R\/#)rcmdr)r1float)rs"rrrsAADAeArc <\P!VRRRRVRR7#)zTRun a systemctl (or sudo systemctl) invocation, capturing utf-8 text with a timeout.Tutf-8replaceFcapture_outputrbr[errorsrcheck)rrun)rrs&$rrrs& >>#dXakrz AArrcJV^8dQhR\R\R\R,/#)rrkr*rN)r1r0)rs"rrrs-KKTKSKPTW[P[Krc^RIHpT!VeTMTV4p\VRV.,^ R7\VRV.,VR7#)z``reset-failed`` then ``restart``: a unit parked in failed state by systemd's own auto-restart can wedge a plain ``restart`` against RestartSec backoff and stay dead.)systemd_restart_timeout reset-failedrrestart)'hermes_cli.update_cmd_fleet_unit_budgetrr)rkr*rrrs&&$ rreresG P%93HijZbcGz^X66C jIx#88' JJrc<V^8dQhR\R\R\/#r))r1r0r)rs"rrrs!  T S T rcv^RIHpHpHpV!W4pVeV!V4'dR#\ V!RW44R#)aGate a unit restart on the unit's home being one this update owns (#93349). ``hermes-gateway*`` is an account-wide namespace: a second install's ``hermes update`` used to drain and restart the account's real ``hermes-gateway.service`` because the unit was listed, not because it ran the updated code. Foreign or unreadable ownership prints a notice and leaves the unit alone; it is not a failed restart. )describe_skipped_runtimesystemd_unit_hermes_homehome_in_update_scopeTz systemd unitF)hermes_cli.update_fleet_scoperrrr )rr*rrrhomes&& rrdrds<wv #I 8D 066 ">8 BC rkeepquietcFV^8dQhR\R\\,/#)rrr)rr1r,)rs"rrrs" @ @ @$s) @rc^RIHpHp\V4pT!VUu.uF qUV9gK VNK up4wrgV'g"VFwrX\ V!RRV 2V44K VUu.uFqUV9g WV9gKVNK up#uupiuupi)z*pids* whose live home this update owns (plus *keep*, PIDs already mapped to this install's profile PID files); every other gateway process is named and left running.)rpartition_gateway_pids_by_scopezgateway processzPID )rrrrr ) pidsrrrrpidownedforeignrs &$$ r_scoped_manual_gateway_pidsrsh t9D4T5]TcX\_ccT5]^NE  IC *+<SElDQ R! ?4C$;#,CC4 ?? 6^ @sA?A?#B6Bc0V^8dQhR\R\/#runitrr)rs"rrrs  c d rcVR8H;'g8VPR4;'gVR8H;'gVPR4#)z]``hermes-serve*``/``hermes-dashboard*`` (``.service``) by the same exact-or-hyphenated shape.zhermes-serve.servicez hermes-serve-zhermes-dashboard.servicezhermes-dashboard- startswithrs&r_is_serve_or_dashboard_unitrsV && 0 0 ??? + 0 0 - -  0 0 ??. /rc0V^8dQhR\R\/#rr)rs"rrrs  # $ rcdVR8H;'g%VPR4;'g \V4#)zyExact base unit or hyphenated profile family only: ``startswith("hermes-serve")`` would accept ``hermes-server.service``.zhermes-gateway.servicehermes-gateway-)rrrs&r_is_hermes_gateway_unitrs; (( - - ??, - - - &t , rc(V^8dQhR\RR/#)rlist_units_stdoutrNr@)rs"rrrs++c+`d+rcT;'gRP4P4FjpVP4pV'gKV^,pVPR4'd\ V4'gKPVP R4pV!V4Kl R# \ PdpT!Yg4Rp?KRp?ii;i)zProcess each hermes-gateway*/hermes-serve* unit from ``systemctl list-units``. ``TimeoutExpired`` from ``process_unit`` is isolated per unit via ``on_unit_timeout`` so one wedged systemctl call cannot abort the rest of the fleet. See #68523. r,.serviceN)rr_splitendswithr removesuffixrr)rrOrPrdpartsrr*rs&$$ rrbrbs#((b//1<<>  Qx}}Z((0G0M0M $$Z0 +  "?(( + H * * +s BC.B<<Cc0V^8dQhR\R\/#)rr*rr)rs"rrrs R Rc Rd Rrc>VR8H;'gVPR4#)aWhether *svc_name* wires SIGUSR1 to a graceful drain-then-restart. Only ``hermes-gateway*`` runs ``gateway/run.py`` (the handler); SIGUSR1 would just kill ``hermes-serve*`` and burn the drain budget, so those go straight to the blunt restart. Same exact/hyphenated shape as ``_for_each_systemd_gateway_unit`` so a near-prefix unit like ``hermes-gatewayd`` is never signalled. See #83438. zhermes-gatewayrr)r*s&r/_service_unit_supports_graceful_sigusr1_restartrs$ ' ' Q Q8+>+>?P+QQrc(V^8dQhR\RR/#)r failed_unitsrNr;)rs"rrrsVVV$Vrc^RIHpV'gR#\\P V44p\ 4\ R4VFp\ RV 24K V!4'd:\ R4\ R4\ R4\ R4\ R 4R#\ R 4\ R 4\ R4\ ;QJdR V4F 'gK R M RM !R V44'd\ R4\ R4\ ;QJdRV4F 'gK R M RM !RV44'd\ R4R#R#)zBPrint an explicit incomplete-update warning for unrestarted units.)is_macosNu8⚠ Update incomplete — some units were not restarted:z - z< Listed services may be deregistered from launchd, or stillz< running pre-update code (mixed sys.modules). Recover with: hermes gateway statusz! launchctl list | grep