+ jHj/kaRti0tRt^RIt^RIHtHtHtHt^RIt^RI t ^RI t ^RI t ^RI t ^RI t^RIHtHtHt^RIHt^RIHt]P,!R4tRtRR/RR llt]R R l4tR R ltRRltRRltRRltRRltRRlt RRlt!Rt"RRlt#RR/RRllt$R R!lt%]&!0Rm4t'Rs(]^kR"R#lt)R$R%lt*R&R'lt+R(R)lt,^t-R*R+lt.R,R-lt/R.R/lt0R0R1lt1R2R3lt2R4R5lt3R6R7lt4R8R9lt5R:R;lt6R<R=lt7R>R?lt8R@RAlt9RBRClt:RDRElt;RFRGltRRLRMllt?RNROlt@RPRQltARRRRSRRTRRURV/RWRXlltBRURV/RYRZlltCRUR[/R\R]lltDR^R_ltE!R`Ra]F4tGRbRcltHRdRReRf/RgRhlltIRitJRRjltKRkRlltLRmRnltMRoRpltNRRqRrlltORsRtltPRuRvltQRRwRxlltRRyRzltSRR{R|lltTR[tUR}tVR[tWR~tXRRRlltYRRltZRRlt[RRlt\RVt]RRlt^RRlt_RRlt`RtaRtbRRRlltcRRltdRRlteRRltfRRltgRRlthR#)ahWindows gateway lifecycle for ``hermes update``: pause/resume/cold-start the service, sweep venv holders, reap orphaned backends. Split out of ``update_cmd.py``; names are re-imported there so ``hermes_cli.update_cmd.`` still resolves/monkeypatches. Origin helpers are imported lazily per function (no cycle; test patches on the origin stay effective). N)contextmanager nullcontextredirect_stdoutsuppress)datetimetimezoneUTCPath) _best_effortzhermes_cli.update_cmddefaultc$V^8dQhR\/#) log_messagestr)formats"B/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_cmd_windows.py __annotate__rssczV!4# \d'p\P!T.TOTN5!TuRp?#Rp?ii;i)zf``fn()``, or *default* after logging the exception at debug (``log_message`` gets ``*log_args, exc``).N) Exceptionloggerdebug)fnrr log_argsexcs&&$* r _try_callrs9t  [181S1s :5::c$V^8dQhR\/#)rprefixr)rs"rrr#s88C8rc#`"RxR# \dp\T RT 24ThRp?ii;i5i)z[Re-raise any failure of a mandatory step as ``RuntimeError(f"{prefix}: {exc}")`` (chained).N: )r RuntimeError)rrs& r_abort_on_errorr#"s48 8fXRu-.C78s. . +&+.c0V^8dQhR\R\/#)r profile_pathreturnr )rs"rrr+s==D=T=rc&\V4R, #)z.gateway-planned-stop.jsonr )r%s&r_planned_stop_marker_pathr(+s   < <.__annotate__OsCDrcL<\S!V44# \dR#i;i)F)r:r)r5rWs&r_alive5_wait_for_windows_update_gateway_exit.._aliveOs*  C() )  s  ##c$V^8dQhR\/#r*r:)rs"rrr[Wstrc`<SUu0uFpS!V4'gKVkK upoS'*#uupiN)r5r] remainings r _all_gone8_wait_for_windows_update_gateway_exit.._all_goneWs,$-=ISSSI= }>s++g?)rTrFrW _poll_untilmax)rPrQrer5r]rWrds&$ @@@r%_wait_for_windows_update_gateway_exitrjIsd u * D I  3w,d3$ 49Cs CC9 44 4s A3*A3c:V^8dQhR\\,/#r*)rTr9)rs"rrr`s3s8rcRp\\4;_uu_4^RIHpRRR4\P !40p\\4;_uu_4VP 4P4FNp\V4pVeV'dV!V4'dK*VP\VP44KP RRR4V# +'giL;i +'giT#;i)aPIDs a venv-holder scan must never nominate: this process and its non-gateway ancestry. Do NOT blanket-exclude ancestors: under ``/update`` the updater is a CHILD of the gateway, and hiding it dead-ends the update on ``venv-blocked``. Gateway ancestors stay visible (the pause path stops them gracefully; a detached child survives on Windows); interactive ancestry is never a blocker.N)looks_like_gateway_command_line) rrrFrmrHrIProcessparents_cmdline_or_emptyaddr9r5)psutil_is_gwskipanc anc_cmdlines& r#_self_and_non_gateway_ancestor_pidsrw`s F )   M  iik]D )  >>#++-C+C0K&;6+;N;NSWW&.  K     Ks#C8C$ C$(C$ C! $ C5 c$V^8dQhR\/#r*r)rs"rrrvssrczRPVP4;'g.4# \dR#i;i)z>Joined argv of a psutil process, ``""`` when it can't be read. )joincmdlinerprocs&rrprpvs6xx ,,"-- s!++ ::c0V^8dQhR\R\/#)rr.r&)r r)rs"rrr~s//D/S/rc\VP44pVP4P \ P 4\ P ,# \d\T4pLZi;i)z```str(path)`` lower-cased with one trailing separator, resolved when possible (prefix matching).)rresolverLlowerrstriprHsep)r.raws& r_lower_dir_prefixr~sW$,,.! 99;  bff % .. $isAA65A6c4^RIpV# \dR#i;i)z\The ``psutil`` module, or ``None`` when it can't be imported (callers degrade, never raise).N)rrr)rrs r_psutilrs% M s  c$V^8dQhR\/#r*r`)rs"rrrseeTercVP4pVRJ;'d:VP4;'d"VP4VP48*#)zfTrue when *proc* has a running parent that is not a recycled PID (a "parent" created after its child).N)parent is_running create_time)rrs& r_parent_is_liversI [[]F   d d&"3"3"5 d d&:L:L:NRVRbRbRd:ddr exclude_pidscV^8dQhR\\,R,R\\\\\3,,/#)rrNr&)rTr9rRtupler)rs"rrrs7113s8d?1dSXY\^acfYfSgNh1rch^RIHp\4pV!4P4'dVf.#^RIHpV!V!4P 4;'gV!4P R, p\V4p\V!4P 4p\T;'g \44\V4,p.pVP.RO4p T EF}p T Pp T PR4T PR4rT 'dT e\T 4T9dKP\\!T 4P#44P%4pTP+T4p\T PR4;'g\!T 4P,4pTP%4pT'g"TP+R 4'g TR 9gEK\/T 4pTP%4pT'g<TT9g5RT9gEK6TT9g$\1T 4P+T4'gEK`TP3\T 4TT34EK T# \d.u#i;i \dEKi;i \&\(3d\T 4P%4pELVi;i) aoLive processes running from the project venv's interpreter as ``(pid, name, cmdline)``; never raises. The hermes.exe shim guard misses the Desktop backend and anything off ``venv\Scripts\python(w).exe``; they keep ``.pyd`` files mapped so a mid-update dependency sync dies half-way. Empty off-Windows / without psutil; self + non-gateway ancestors excluded. cmdline/cwd are expensive per process on Windows (500+ procs can blow the Desktop preflight watchdog), so they are fetched lazily for plausible candidates only. The FULL cmdline is kept: callers parse it (the pausable-gateway exemption looks for ``gateway run``). _mproject_venv_dirvenvr5exenamehermes_cli.main)r5rr)pythonpypy>uv.exeuvx.exe hermes.exe)hermes_cli.update_cmdrr _is_windowshermes_constantsr PROJECT_ROOTrrTrw process_iterrinfor0r9rr rrrL ValueError startswithrrp _cwd_prefixappend)rrrrrvenv_dir venv_prefix root_prefixrtmatches proc_iterrrr5rexe_normin_venvrname_low cmdline_raw cmdline_lows$ r_detect_venv_python_processesrs+) YF 4     1 1 12PPbd6G6G&6PH#H-K#BD$5$56K |$$su %(KF(S SD*,G''(>?  99D88E?DHHUOSckSX%5  (49,,./557H%%k2488F#55tCy~~6::<8../ABBhRuFu '- !'')  k[0  ,+2LP[\`PaPlPlmxPyPy NNCHdK8 934 N9      $ (3x~~'H (s6I I0*0J I-,I-0 J?J*J10J1c$V^8dQhR\/#r*r)rs"rrrsrc \VP4;'gR4P4P\P 4\P ,# \ d\P u#i;i)zWLower-cased cwd of *proc* with one trailing separator; bare ``os.sep`` when unreadable.r{)rcwdrrrHrrr~s&rrrsY488:##$**,33BFF;bffDD vv sA%AA%%BBc$V^8dQhR\/#r*) frozenset)rs"rrrs%%Y%rcP\e\#0Rmp^RIHpV!4^,PFEpVP'gKVP ^8wgK*VP VP4KG \V4s\# \d\s\#i;i)uTop-level CLI flags that consume a value, from the REAL parser (nargs != 0); cached per process. Derived so the holder classifier can't drift from argparse (a handwritten subset misparsed ``--reasoning high serve``). Pre-argparse profile selectors are added explicitly (stripped before argparse sees argv). Falls back to a static snapshot when the parser can't import — the updater must classify holders even on a broken tree. Introspects ``build_top_level_parser()`` (every option with nargs != 0) so the holder classifier can never drift from the argparse surface (#91869 review: a handwritten subset misparsed ``--reasoning high serve`` as subcommand ``high`` and ``-m dashboard serve`` as ``dashboard`` — recreating the wrong-hint class). )build_top_level_parser>-p--config --profile) _holder_value_flags_cachehermes_cli._parserr_actionsoption_stringsnargsupdaterr_HOLDER_VALUE_FLAGS_FALLBACK)flagsractions r_holder_value_flagsrs!,((5EA=,.q1::F$$$): V223;%.e$4! %$ A$@! $$As0B B *B B%$B%c>V^8dQhR\R\R,/#rr}r&Nr)rs"rrrs))s)sTz)rca a \P!VRR7o ^RIHpHpS Uu.uF#q3P R4PRR4NK% ppV!V4'dV!V4o S fR#RV 3R llo \V 3R l\S 44R4pVfR#\4pV^,pV\S 48dtS V,pW9gVPR ^4^,V9dTR V9d^M^, pKQVPR 4'd V^, pKsVP4#R# \dTP4o EL7i;iuupi) aThe actual Hermes SUBCOMMAND a venv-holder argv runs, or None (callers must NOT guess a label). Token-based, never substring (``kanban --preserve-cache`` contains "serve"): find the ``hermes_cli.main`` / ``hermes(.exe)`` entry token, return the first following token that isn't a flag or a flag's value. Profile selectors (``--profile X``, ``-p X``) are skipped like the canonical gateway matcher does. See #90778. F)posix)command_line_runs_inline_sourceinline_bootstrap_argv"'\/Nc<V^8dQhR\R\R\/#)ritokenr&)r9rr:)rs"rr/_hermes_holder_subcommand..__annotate__ s&ffSfffrcN<VP4PR4PRR4pVPR4;'d)V^8;'dSV^, ,R8H;'g6VP R^4R,R9;'gVPR4#)rrrr-mzhermes_cli/main.py)hermesr)rstripreplaceendswithrsplit)rrlowtokenss&& r _is_entry,_hermes_holder_subcommand.._is_entry skkm!!%(00s; ./SSAESSfQUmt>Sff JJsA r "&> >ffCF<,_hermes_holder_subcommand..sQ(9HAYq=Paa(9s$ $=-)shlexsplitrgateway.status_inline_sourcerrrrnext enumeraterlenrr) r}rrt normalized entry_idx value_flagsrrrrs & @@r_hermes_holder_subcommandrs/!WE2 d=CDV''%.((s3VJD&z22&z2 >ff Q &(9QSWXI%'KA A c&k/q   5;;sA#6q#9[#H cUl )A   c " " FA;;= = !! EsD5)E5EEc\V^8dQhR\\,R\\,/#)rrPr&rRr9)rs"rrr s"49crc^RIHp\4pV!4P4'd V'dVf.#^RIHpV!V!4P 4;'gV!4P R, p\V4p\V4\V4,p.pVFp\\4;_uu_4VP\V44P4p V f RRR4KR\V P4p W9dUW9dOV P!4;'gRP#4P%V4'dVP'V 4RRR4K V# +'giK;i)aVenv-interpreter parents of *pids* that hold the install open; never raises. A shim-started gateway is a chain: ``venv\Scripts\python.exe`` launcher (keeps ``.pyd`` mapped) -> uv CPython worker (writes the PID file). The pause set sees the worker, the venv scan sees the launcher, so a paused gateway still tripped the guard. One hop up only, venv-prefixed only (bounds blast radius).rNrrr{)rrrrrrrrrwrTrrrnr9rr5rrrr) rPrrrrrrrtfoundr5rppids & r_venv_launcher_ancestorsr s ) YF 4    TV^ 1 1 12PPbd6G6G&6PH#H-K .v 6T BDE i ^^CH-446F~! vzz?DD$56::<;M;M2:T:T:V:a:abm:n:n T" !  L! s;.E037E0+%E0E00 F c0V^8dQhR\R\/#rr}r&r)rs"rrr:sssrc|^RIHpV!V4'dR#\V4pV\9dR#V'dRV 2#R#)avMachine-readable class of one venv holder for ``--list-venv-holders``. ``gateway`` (the pausable gateway matcher), ``backend`` (``serve``/``dashboard`` -- the Desktop app's backend shape), ``hermes:`` for any other Hermes entry, else ``python``. Derived from the same classifiers the refusal path uses so automation stops exactly what the guard would refuse on._is_pausable_gatewaygatewaybackendzhermes:r)hermes_cli._scan_venv_blockersrr_BACKEND_PURPOSES)r}r subcommands& r_venv_holder_kindr:s?DG$$*73J&& %% rc:V^8dQhR\\,/#r*)rRr,)rs"rrrOs4:rc ^RIHp\4p.pV!4P4Fwr4pYErvVe~\ \ 4;_uu_4VP \V44pVP4;'gTpRPVP44;'gTpRRR4VPR\V4RVRVR\V4/4K V# +'giLA;i)a``[{pid, exe, argv, kind}]`` for every process the venv-holder guard would refuse on, read-only. Off Windows (or without psutil) the guard never fires, so the list is empty. ``exe``/``argv`` are the live psutil values when readable (the scan may carry only a cmdline prefix).rNrzr5rargvkind) rrrrrrrnr9rr|r}rr) rrrholdersr5rr}rrrs rlist_venv_holdersr Os ) YFG d@@B7T  )$$~~c#h/hhj((Dxx /::7% s3xVT6K\]aKbcdC N %$s AC"&C"" C2 cV^8dQhR\\\\\3,,R\\,R,/#rrr&NrRrr9r)rs"rrrbs5T%S# 2F-GDQTIX\L\rc ^RIHp\4p.pVFwrEpTpVeb\\4;_uu_4RP VP \V44P44;'gTpRRR4V!V4'gR#VP\V44K V# +'giLA;i)aPIDs from *matches* when EVERY remaining venv holder is a pausable gateway, else ``None`` (keep refusing). A gateway respawned inside the pause->guard window (or via an unmapped spawn path) still holds ``.pyd`` files. Uses the Desktop preflight's ``_is_pausable_gateway`` so exemption and tolerance cannot drift; live argv is re-read via psutil when possible since the scan may hold only a cmdline prefix.rNrz) rrrrrr|rnr9r}r)rrrrrPr5_namer}rs& r_leftover_pausable_gateway_pidsrbs D YFD&G  )$$xxs3x 8 @ @ BCNNw%#D)) CH ' K %$s AB33 C cRV^8dQhR\\,R\R\/#)rrP gateway_moder&)rRr9r:)rs"rrrvs&T#YRVrcaV'g S'gR#V3Rlp\VR4pV'gR#\RRPRV44 R24R#) aRefuse a plain Windows update that would tree-kill its own ancestry (a chat agent's ``hermes update`` is a gateway child; ``taskkill /T /F`` kills the updater first). ``--gateway`` is exempt (detached delivery). Refuse only when a nominated gateway is positively an ancestor; unknown ancestry keeps existing recovery. The leftover holder recovery below uses ``taskkill /T /F`` on Windows, so force-stopping that gateway also kills the updater before it can mutate the checkout (#98814). Fc<^RIHpSUu.uF&q!\V44'gK\V4NK( up#uupi))#_is_pid_ancestor_of_current_process)hermes_cli.gatewayrr9)rr5rPs r _ancestors6_refuse_gateway_ancestor_tree_kill.._ancestorss3J$(ZDS,OPSTWPX,YCDZZZs;;z7Could not inspect gateway ancestry before tree-kill: %sui✗ Refusing to stop the gateway process tree because this updater is running inside it (gateway PID(s): , c38"TFp\V4xK R#5irbr)rr5s& rr5_refuse_gateway_ancestor_tree_kill..s:Yy3s88ysz). On Windows, taskkill /T would terminate the updater before the update can run. From a chat platform, use `/update` instead. Otherwise, run `hermes update` from a separate terminal.T)rprintr|)rPrr ancestorssf$ r"_refuse_gateway_ancestor_tree_killrvs\4[*&_`I   115:Yy:Y1Y0Z[u u rcV^8dQhR\\\\\3,,R\\,/#rrr&)rRrr9rr,)rs"rrrs.$uS#s]/C*Ddrc^RIHpHpTUUUu0uFwr4p\ T4kK ppppT!4Uu.uFfpTP R4\ 9gK\TP R4\4'gKFTR,T9gKVT!T4RJgKdTNKh up# \d.u#i;iuupppiuupi)uFull ledger entries for venv holders that are MANUAL serve/dashboard backends. Positive identity only: self-registered purpose serve/dashboard, live (pid, create_time), recorded spawner NOT alive (a Desktop-owned backend keeps its live Electron spawner and must keep the refusal — the app would respawn what we kill). Full entries let the relauncher rebuild from host/port/profile, not argv.ledger_entriesspawner_is_deadpurposer5F)hermes_cli.process_identityr$r%rr9r0r isinstance)rr$r%r5r_cmd holder_pidsentrys& r_ledger_manual_serve_holdersr,s O5<.s4q9QAVadeVeUnUnUp/3{Q//9Qs AAportprofiler{hostr rr&z--hostz--port)rr) rrrr_venv_scripts_dirrr0r(r9rr) r.rrcommandsr+r5r6r7r3s & @r_serve_relaunch_commandsr:s*) F )  d,,.  "q9QqsyzF !#Hyy $$$ EIIi066B7UYYv=N=T=TRT9U H'g>Rg.XZ [599Y'() *AEh-=2 ORZ\_`d\eQf g  O   s 0E E c(V^8dQhR\RR/#rrr&Nr+)rs"rrrsDTrc ^RIHpHpVPR4'gR#RVR&VPR4;'g.pV'gR#\ V4p\ V4\ V4, p.pV'd"\ R4V!4PV4pV'g V'd \ R4T!RV'*;'dV'*R \ V4\ V4, R \ V4 R V 24R#) zIdempotent atexit relaunch of manual serves stopped by the venv guard. `pending` flips False on first invocation so explicit call + atexit registration cannot double-spawn.)r_record_update_steppendingNFr.u4 ⟲ Relaunching stopped serve/dashboard backend(s)u ⚠ Some stopped backends could not be relaunched automatically; restart them manually (hermes serve --host --port ).serve_relaunchz relaunched=z failed=z skipped=)rrr>r0r:rr_respawn_dashboard_processes)rrr>r.r9skippedfaileds& r_relaunch_stopped_servesrDs> 99Y  E)ii "((bG '0H'lS]*GF DE228<& S Tf*44W c(mc&k12(3v;-yQXPYZrc0V^8dQhR\R\/#)rargv_lowr&rr:)rs"rrrs77s7t7rc\V4#)uWhether an argv is a DESKTOP backend — feeds ``taskkill /T`` via ``_orphaned_desktop_backend_pids``. Same predicate as ``_looks_like_desktop_control_plane``: ``-m hermes_cli.main`` entry shape (the Desktop's only spawn shape, ``apps/desktop/electron/main.ts``) AND the canonical holder classifier says ``serve``/``dashboard``. A user-launched ``hermes.exe serve`` / ``hermes dashboard`` is NOT the Desktop's: the guard refuses on it, never reaps it. )!_looks_like_desktop_control_plane)rFs&r_is_backend_argvrJs -X 66rc>V^8dQhR\R\R,/#rr)rs"rrrs   t rcTpRPVP\V44P44;'gTpVP 4# TPdR#\ dTP 4#i;i)z_Current lower-cased argv of *pid* (falls back to the scanned *cmdline*); ``None`` if it exited.rzN)r|rnr9r} NoSuchProcessrr)rrr5r}rs&&& r_live_argv_lowrNsw D xxs3x088:;FFw ::<      ::< s#=AAB)B2BBcV^8dQhR\\\\\3,,R\\\\3,,R,/#r r )rs"rrrsFBBDsC}1E,FB4PUVY[^V^P_K`cgKgBrcl\4pVfR#.p.pVEF#wrEp\WV4pVfK\V4'gVP\ V44KFVP \ V44p\ VP4^d,4p TP4p T 'dTP T 4MRp T eWT P4'dAT P4TP48:dTP\ T44EKTP\ T4T 34EK& VUU u0uFwrLVkK p pp VF]pV 'dOYP V4P4Uu0uFp\ VP4kK up,'gR#K_ V# TPdEK\dR#i;i TPdL\dR#i;iuup piuupi TPdK\dR#i;i)u``(pid, start_time)`` roots from *matches* when every remaining holder is an ORPHANED backend, else ``None``. Killing a Desktop-owned ``serve`` is futile (the app respawns it), but a straggler whose Desktop is gone would dead-end the update with "Hermes is still running" and zero open windows. Qualifies only if cmdline is a Hermes backend AND the parent is demonstrably gone (PID missing or reused). Tree-aware: holders inside an accepted root's tree fold into it; only roots are returned (``taskkill /T`` reaps descendants). Any live-parent backend, unjustified non-backend, unprovable case, or no psutil -> ``None``. Never raises. The venv-holder guard refuses on the Desktop app's ``serve`` backend by design: while the Desktop is open, killing its backend is futile (the app supervises and respawns it within seconds), so the user must close the app. But in the GUI-updater handoff path the Desktop has *already exited* — by contract it tree-kills its backends and waits for the venv shim before spawning hermes-setup, and the update-in-progress marker parks any relaunched Desktop from spawning a fresh backend (#50238). A ``serve`` backend still holding the venv at that point is a straggler whose supervisor is gone: SIGTERM raced its spawn, or it belongs to a crashed window. Nothing will respawn it, and refusing on it dead-ends the update with "Hermes is still running" while the user stares at zero open windows (ryanc's 2026-08-09 01:59/02:17 failures). N)rrNrJrr9rnroundrrMrrrror5)rrrrootsrdr5rr}rrprocess_start_timerr _start_timeroot_setas& r_orphaned_desktop_backend_pidsrWs&YF ~#%EI&GV'2 ; $$   SX &  >>#c(+D"'t'7'7'9C'?!@  99;D-1V^^D)tF!f&7&7&9&9f>P>P>RVZVfVfVh>h  S*  c#h 234; '@-22E(EH2 8>>RUCVC^C^C`.aC`as155zC`.a#a#a$b L;##    ##     3/b##    s~:F9G 1,G =G  H)HH !H9GGGG H3H<HH HH3$H3-H32H3cV^8dQhR\\\\\3,,R\\,/#r!r )rs"rrr-s.4c3m0D+E$s)rc ^RIHpHpHpV!4pTUu/uF<p\ TP R4\4'gK*TP R4TbK> ppTUUU u.uF[wrxp TP \T44;p 'gK*T P R4T9gKBT!T 4RJgKP\T4NK] up pp# \d.u#i;iuupiuup ppi)aPIDs the spawn ledger positively identifies as orphaned backends; never raises. Strongest rung (no PPID/cmdline inference): qualifies when ``(pid, create_time)`` matches a live ledger entry (PID reuse can't forge it), purpose is a REAPABLE kind (never interactive), and the recorded SPAWNER is provably dead. Safe in ANY context. Unlisted holders fall to later rungs and never disqualify identified ones.)REAPABLE_PURPOSESr$r%r5r&T)r'rZr$r%rr(r0r9) rrZr$r%r.eby_pidr5r_cmdliner+s & r_ledger_reapable_backend_pidsr^-s bb "(/ Pw!*QUU5\32OoaeeElAowF P-4 -4)SZZC) )E ) /4yy/CGX/X ]lmr]sw{]{ CW    P s4C'CC!'C C% C3C CCcV^8dQhR\\\\\3,,R\\,R,/#r r )rs"rrr?s5DsC}1E,F4PS9W[K[rc\4pVfR#.pVFFwr4p\WV4pVfK\V4'gR#VP\ V44KH T;'gR#)aBackend PIDs safe to tree-reap during a GUI-updater hand-off, INCLUDING ones with a live parent; never raises. The orphan-only rung bails on ANY live parent (mid-teardown Electron, launcher->worker chain) and hung a hand-off. Inside the hand-off gate (marker + ``--gateway`` + no live ``hermes.exe`` shim) nothing legitimate supervises a ``serve`` from this venv, so survivors are leaks. Any non-backend holder or no psutil -> ``None``. The CALLER must have confirmed the gate; outside it the stricter orphan-only path stands. Any ``serve`` backend still holding the venv here is therefore a leak, live parent or not, and reaping its tree is correct rather than a race. See #50238. N)rrNrJrr9)rrrrRr5rr}rs& r_handoff_reapable_backend_pidsra?sgYF ~E&GV'2 ; $$ SX ' ==DrcV^8dQhR\\,\\\\3,,,RR/#)rrPr&N)rRr9r)rs"rrrXs4IId3i$uS#X*??IDIrc :^RIHp^RIHpHpVFp\ V\ 4'dTM\V4V!\V443wrVVf\PRV4KVV!WVR7'g\PRV4K}\P!RR\V4R R .R \P\P\PV!4R 7K R# \d#p\PR YW4Rp?EKRp?ii;i)zForce-stop each PID with its full child tree (Windows); best effort, never raises. ``taskkill /T /F``: stopping only the parent can leave a ``.hermes-runtime`` child holding the install open. See #70026. get_process_start_time) pid_is_hermeswindows_hide_flagsNz9Skipping taskkill of PID %s: process identity unavailable)expected_start_timez1Skipping taskkill of non-Hermes or changed PID %staskkillz/PIDz/Tz/FF)checkstdoutstderrstdin creationflagsz"Could not stop process tree %s: %s)rFrehermes_cli._subprocess_compatrfrgr(rr9rr subprocessrunrDEVNULLr)rPrerfrgr+r5rhrs& r_stop_process_treesrsXs6O,6ue,D,D53u:WmnqrwnxWyJz  I"* XZ]^ NN PRUV NNVSXtT:%!))*2D2DJL^L^02  I LL=s H H Is% C-'%C-AC-- D8DDc0V^8dQhR\R\/#rrG)rs"rrrss t ts tt trcpRT;'gRP49;'d\V4\9#)uTrue for this-install ``hermes serve`` / ``hermes dashboard`` argv (Desktop control plane). Not the messaging gateway — don't feed into ``looks_like_gateway_command_line``. Token-based via the parser-derived classifier, never substring (``kanban --preserve-cache``, ``-m dashboard chat``). Undeterminable subcommand is NOT a control plane. See #92091. A cmdline whose subcommand cannot be determined is NOT a control plane — callers must not guess ownership. See #90778, #91869. rr{)rrr)r}s&rrIrIss3 B 5 5 7 7 s s.s6o^nYZuuY#44TT9Ku9TT^ns"99TFNz(Desktop-lifecycle holder scan failed: %s)rrr r'r$r%anyrrrrIrrrrnr9)rr$rrr5rr}r%s @r_desktop_owns_gateway_lifecycler{s) A B BO 3o^l^no333o^l^no o o C B o CYF()FHrsyywyyG099  > i v~~c#h788! 8! z  C B! s#-D" "D".D"+D5" D2 5 E c$V^8dQhR\/#)rrr)rs"rrrs00s0rc.^RIpWPV43#)zd``(psutil, service)`` for the named SCM service (psutil imported here so tests can stub the module).N)rrwin_service_getrrrs& r _win_servicers ))$/ //rc@V^8dQhR\R\R\RR/#)rverbrsettled_statusr&Nr)rs"rrrs.WW#WSW3W4Wrc :\P!RW.RRRR^ RR7pVP^8wdkVP4V8wdTVP;'g VP P 4p\T;'gRV RVP 24hR #R #) zl``sc.exe ``; a non-zero exit is only an error when SCM doesn't already report *settled_status*.zsc.exeTzutf-8rF)capture_outputtextencodingerrorsrQrjzsc.exe z failed with N)rprq returncodestatusrlrkrr")rrservicerresultdetails&&&& r_sc_exers ^^ 4t$Yb%FA'.."2n"D--006==7796UUwtfM&BSBSAT%UVV#Erc<V^8dQhR\R\R\/#)rr5rr&)r9rSr:)rs"rrrs! / /C /e / /rc\VPV4P44p\ Y2, 4R8*# TPTP3dR#\ dR#i;i)zIs the process with this exact ``(pid, create_time)`` identity still alive? AccessDenied/unknown reads True (fail closed: the venv may still be locked).FTMbP?)rSrnrrM ZombieProcessrabs)rrr5rcurrents&&& r_original_process_is_alivershs+779: w$ % ..  &"6"6 7 s(>A,A,'A,+A,c<V^8dQhR\R\R\/#)rrQintervalr&)rSr:)rs"rrrs!EUTrc\P!4V,p\P!4V8d(V!4'dR#\P!V4KAR#)zYPoll *condition* every *interval* seconds until true (True) or *timeout* elapses (False).TF)_time monotonicsleep) conditionrQrdeadlines&&& rrhrhs; 7*H // h & ;; H rc<V^8dQhR\R\R\/#)rr5labelr&)r9rrS)rs"rrrs&ddcd#d%drc\VP\V44P44# \dp\ RT R24ThRp?ii;i)zM``create_time`` of *pid*; unreadable identity aborts the stop (RuntimeError).Windows z, process identity is unavailable before stopN)rSrnr9rrr")rrr5rrs&&& r_process_create_timersSdV^^CH-99;<< dXeW,XYZ`ccds03 AAAc(V^8dQhR\RR/#)rrr&Nr)rs"rrrsXXSXtxXrcRVe{\VP44\VP4;'g^4reTR8wd\ RT RT 24hT\T^,48wd\ RT R24hRV3RV33FRwrV fK \ \W ^,V4\V ^,4, 4R 8gKE\ R V R 24h VeVezVP\V^,44P4U u0uFp \V P4kK p p \T^,4T 9d\ R T 24hR#R#R# \dp\ RT R24ThRp?ii;iuup i \dp\ R 4ThRp?ii;i)zhRefuse to stop *name* unless SCM state, service/gateway process identities and ancestry all still match.NWindows service z( SCM identity is unavailable before stoprunningz$ is not stably running before stop: z) SCM process identity changed before stoprrrrz% process identity changed before stopz;Windows gateway ancestry is unavailable before service stopz.Windows gateway is no longer owned by service ) rrr9r5rr"rrrSrnro) rrrrexpected_service_identityexpected_gateway_identitycurrent_statuscurrent_service_pidrridentityr ancestor_pidss &&&&& r_verify_service_identitiesrs , k25gnn6F2GW[[]M_M_^_I`/ Y &!1$7[\j[klm m #&?&B"C C!1$7`ab b&(ABYPiDjk  C(>#NghiNjJk;l;t;t;vw;vS_;vMw (+ ,M A!OPTvVW W B 2W, k!1$7_`agj j kx g\]cf f gsF3E"E"&1F F5F " F-E==FF F& F!!F&expected_processesrrrQg>@c V^8dQhR\R\\\\3,R3,R\\\3,R,R\\\3,R,R\RR/#) rrr.rNrrQr&)rrr9rS)rs"rrrsyvv v&+E#u*,=s,B&Cvejknpukuevy}e}v$S%Z047vINv vrc8aaaa\V4woo\SVSW#4\RVSR4RVV3Rllo\VV3RlV4'dR#SP 4R8wd\ RV RVR R 24hS!4;p'd\ RV R V 24hR#) uStop one verified Windows service and wait until SCM reports it down. Lingering matching-identity processes after SCM says stopped make venv mutation unsafe — fail closed.stopstoppedc:V^8dQhR\\,/#r*r)rs"rr3_stop_windows_gateway_service..__annotate__sxxDIxrc d<SUUu.uFwr\SW4'gKVNK upp#uuppirb)r)r5rrrrs rr]-_stop_windows_gateway_service.._alives.,>w,>(B\]cehBv,>wwws,,cR<SP4R8H;'d S!4'*#)rr)r]rsr/_stop_windows_gateway_service..s 7>>+y8II\IrNrz did not stop within .0fzs; venv mutation unsafe.z. stopped but its process tree is still alive: )rrrrhrr") rrrrrQalive_after_stopr]rrrs &d$$$ @@@r_stop_windows_gateway_servicers#4(OFGvtW6Ok FD'9-xxI7SS~~9$-dV3HQT Umnoo!8##-dV3abrastuu$rc4V^8dQhR\R\RR/#rrrQr&NrrS)rs"rrrs&ZZZ%Z4Zrca\V4^,o\RVSR4\V3RlV4'g\RV RVR R24hR#) zEStart one previously paused Windows service and verify it is running.startrc*<SP4R8H#)rr)rsrr0_start_windows_gateway_service..sw~~/9.__annotate__s00d0rcL<SP4pVR8Xd S!S4VR9#)r)rrr)rrrrs r_settled2_restore_windows_gateway_service.._settleds+! Y  *4 0///rrz) did not reach a restorable state within rrN)rrrrhr")rrQrrrsf$ @@r _restore_windows_gateway_servicersSD4 #G00 x ) )-dV3\]deh\iijkll *rc2V^8dQhR\R,/#rr&Nr+)rs"rrrs$+rc ^RIHp^RIHp\ R4;_uu_4VP 4'g RRR4R#RRR/R.R .R R/p\ R 4;_uu_4V!4'dCVP .R 7pVf)\PR 4RRR4RRR4R#W2R&RRR4VuuRRR4# +'giL;i +'giR#;i)uPause token for the no-running-gateway case: cold-start after update when an autostart entry exists. An installed autostart entry is an explicit "I want a gateway" signal; a gateway that died between updates would otherwise stay down until next login (resume only relaunches what was running). Desktop-owned lifecycle -> ``None`` (spawning ``gateway run`` beside Desktop races ports/state); the skip is ownership, not liveness — except when the start attestation reports a vouched-for gateway that died without a clean exit. The Desktop hand-off exits the app before the updater starts and can kill the running gateway in those same seconds, so discovery finds no live PID to pause (#109538) — the dead attestation is the only surviving "a gateway was up" evidence, and the Desktop only restarts gateways it stopped itself (its hand-off script, after the update verifies; #119809). Keep the plan, and record the attestation *generation* that authorized it on the token: the marker is a mutable one-shot that any concurrent ``hermes gateway status``/``start`` consumes, so execution authorizes the spawn from the token and consumes only that generation (#110020 review).r{gateway_windowszACould not check Windows gateway autostart state before update: %sN resume_neededTprofiles unmapped_pidsunmappedcold_start_if_installedzECould not check Desktop gateway-lifecycle ownership before update: %s current_pidszHSkipping Windows gateway cold-start plan: Desktop owns gateway lifecycleattested_generation) rr{ hermes_clirr is_installedattested_death_generationrr)r{rr generations r_windows_cold_start_planrsF* Y Z Z++-- [ Z!$ BZY[]vx|} a b b.00,FFTVFW %LL!kl c [ Z0:+, c [ Zc b [ Z s5CC!:C C-C 1 C C C C) cBaa]tRtRtoRtV3RlV3RlltRtVtV;t#)ServicePauseFailedi.zA gateway service could not be stopped; ``rollback_failures`` lists what the in-line rollback could not restart. Empty = everything stopped was restarted, so the pause is void; otherwise its record must stay, since gateways are still down.c6<V^8dQhRS[RS[S[,/#)rrrollback_failures)rrR)r __classdict__s"rrServicePauseFailed.__annotate__3s33s3tCy3rc2<\SV`V4W nR#rb)super__init__r)selfrr __class__s&&&rrServicePauseFailed.__init__3s  !2r)r) __name__ __module__ __qualname____firstlineno____doc__r__static_attributes____classdictcell__ __classcell__)rrs@@rrr.sF333rrcHV^8dQhR\R\R\R\/#)rrrrr&r,rR)rs"rrr8s0%E%ET%ET%E]a%Efj%Erc aa^RIHoHp.pRpVFp\VP4pV!V\ \ VRR44\VP4\VP43\VP4\VP43R7VPV4RpK V'dSPV\V4.R7VUu/uFHp\VP4V9gK\VP4\VP 4bKJ upSR&\#RRP%V4,4S#uupi \&Edp T'dT.M.\\)T44,p \*P-T 4U u.uF qT 3T3R ll3NK Muup ip p T'g T'dT PR T3R l34.p T F<wrT!4K \&d"pT PT R T 24Rp?K6Rp?ii;i R T;'gR R T 2pT 'd TRRP%T 4,, p\/TT 4T hRp ? ii;i)zStop each SCM gateway service, recording them on *token*; roll everything back on failure. Runs after every fallible ordinary-gateway step so a failure here restores the attempted services AND the already-paused ordinary gateways before re-raising.)rrNdescendant_identities)rrr)servicesexpected_servicesrestarted_servicesservice_profilesu) ✓ Paused Windows gateway service(s): rc<S!V4#rbrc)r2rs&rr1_pause_windows_gateway_services..Qs >^_`>arzordinary gatewaysc<\S4#rb)%_resume_windows_gateways_after_updatersrrrSs :_`e:frr!z'Could not stop Windows gateway service unknownz; rollback failures: ; rc)rrrrrrr/r9 service_pidrSservice_create_time gateway_pidgateway_create_timerrrRr6rr|rreversedr,fromkeysr)service_gatewaysrrrrpaused_servicescurrent_service_namerrr restore_namesr2rollbackrrrestore restore_excrrs&f&& @r_pause_windows_gateway_servicesr8sc fOE'G#&w||#4 )$wwPgik?l9m+.w/B/B+CU7KfKfEg*h+.w/B/B+CU7KfKfEg*h   " "#7 8#' (  LL/T/EZoqL rN^)BN^befgflflbmrAcA)DQVVc!))n)DN^)BE$ % = /@ZZ [ )B E3G./RSWX`apXqSrr lplyly{HmI.JmIgh12a.bmI.J.J x OO02fg h&NE D  D!((E7"[M)BCC D' ;;O;\;\S\:]]_`c_de  - :K0LL LF ):;DEs~B(E9!EE;-E((EE I0"=I+F32I+ I++G42I+4 H ?HI+H  I+/I+?,I++I0keepquietTcFV^8dQhR\R\\,/#)rrr&)r:rRr9)rs"rrr`s"KKKcKrc4^RIHpV!\V4WR7#)aR*pids* whose live home this update owns, plus *keep* (PIDs mapped to this install's profile PID files / services). The same home scope the POSIX fleet restart uses (#93349): a gateway of another Hermes install, or one whose home cannot be read, is named (unless *quiet*) and left running, never paused, force-killed or replayed (#124659).)_scoped_manual_gateway_pidsrr)hermes_cli.update_cmd_fleetrrR)rPrrrs&$$ r_owned_gateway_pidsr`s H &tDz JJrc ^RIHpHpHp\ R4;_uu_4V!RR7pVUu/uFqDP VbK ppRRR4\ R4;_uu_4V!XR7pRRR4XUu0uFp\ VP4kK pp\ R4;_uu_4\\P.V!RR 7O\X4O\V4O4\V4V,R R 7p RRR4XWhX 3#uupi +'giL;i +'giL;iuupi +'giLE;i) z|``(profile_processes, service_gateways, service_gateway_pids, running_pids)`` for the pause; any indeterminate probe aborts.)find_gateway_pidsfind_profile_gateway_processesfind_windows_gateway_servicesz.Could not map Windows gateway PIDs to profilesT)strictNz5Could not determine Windows gateway service ownership)r2z5Could not discover Windows gateway PIDs before update all_profilesFr) rrrrr#r5r9rrr,r sortedrT) rrrprofile_process_listrr2r rr3r1s r_discover_windows_gatewaysr%isss I J J=TJ8LM8LXXt^8LM K P Q Q8K_` RDTUDTC 3 34DTU P Q Q*4== nT2 nV the marker poll / force-kill ladder in the caller. ``on_request(pid)`` runs once the request is issued (marker on disk, else a positive socket ACK) and before the socket call: from then on a crash leaves that gateway owed while it drains, never before.N)pause_gateway_for_updatepausingalready_stoppingz+Socket pause unavailable for gateway %s: %s) r0r9rr6rrNr r.gateway.control_socketr'rrr) r1r2r3 on_requestr mapped_pids socket_acksr5r requestedr'ackrs &&&& r_request_socket_pausesr0zs4 "HK K2t8I8M8Mc8R < &)#hT\\"#3s8$5d499os3xP / s3x  R H*4 ?;C **cgg6H.I.I""3' Z%;s3x(&= 1s), raised to a socket-paused gateway's declared ACTIVE-TURN budget + teardown grace so it isn't force-killed mid-turn.)_get_restart_drain_timeoutg?g$@c3j"TF)p\VPR4;'gR4xK+ R#5i) drain_timeoutrgN)rSr0)rrVs& rr)_gateway_drain_timeout..s)UA5!7!>!>3??s!33Nu → z. gateway(s) ACKed socket pause; waiting up to zs for graceful exit) rr3rirSrrrrr9)r-r3r5declareds& r_gateway_drain_timeoutr8s>E"<">?E  i UUUH $?M! s;'((VWZ[hWiVjj}~   ! sB%B' B$#B$' B7 c2V^8dQhR\R,/#rr+)rs"rrrsD?D?D4KD?rc aaa^RIHpV!4P4'gR#\R4;_uu_4^RIp^RIHoRRR4^RIHo\R4;_uu_4SP4wr#RRR4\4wrErgV'g \XX4#VUu.uFqV9gK W9gKVNK p p^RIH p ^RI Hp VUu/uFp\V4V !\V44bK p pV Uu/uFp\V4V !\V44bK p pRV P!49d>\#R R P%R V P'444,R ,4hV Uu.uFZpR \V4R\)\V43V3RllR\V44RV \V4,RV \V4,/NK\ ppRRRT RTRVUu/uF8pW9gK W9gK\+WH,P,4\V4bK: upRVUu/uF%p\+V4SP/V4R,bK' up/oV'dzVUu.uFp\+VP04NK ppSP3T\5V4.VUu/uF,p\+VP04\+VP,4bK. upR7\R4;_uu_4SP7SXX4SP9SV\;WtV4R7RRR4\=WtWiVVV3RlV R7pRRRVRV RV/p\?V4VP!4Uu0uFp\+VP,4kK up,VUu0uFp\+VP,4kK up,p\AVV4\CVVVV4pSPKTSX4# +'giEL;i +'giEL;iuupiuupiuupiuupiuupiuupiuupiuupi +'giEL;iuupiuupi \Dd+pTPF'gSPISX4hRp?ii;i)a}Stop running Windows gateways before mutating the checkout or venv. Scheduled/startup gateways run via pythonw.exe, invisible to the hermes.exe instance guard, yet keep files locked during ``git``/``uv``. Stop only PIDs the gateway discovery code identifies. The paused set is on disk (``update_pause_record``) before the first stop, with any set a killed earlier update orphaned.rNz2Could not prepare Windows gateway pause for update)_capture_gateway_argvupdate_pause_recordz4Could not read the gateways an earlier update pausedrdgateway_pid_homez;Could not prove the Hermes home of unmapped gateway PID(s) rc3H"TFwrVeK \V4xK R#5irbr)rphs& rr5_pause_windows_gateways_for_update..s&U-$!1vs1vv-s""z; nothing was stoppedr5rc<S!V4#rbrc)rAr;s&rr4_pause_windows_gateways_for_update..s ?TUV?Wrz2Could not capture argv for unmapped gateway %s: %sr6ctrTrrr identities)rrrrz0Could not record the gateways this update pauses)r4c(<SPSV4#rb)mark_stop_sent)r5intended pause_records&rrrEs\=X=XYacf=gr)r+born)&rrrr#rFrr;rr= adopt_orphansr%_cold_start_pause_tokenrehermes_cli.update_fleet_scoper?r9valuesr"r|itemsrrr6rrrrR record_pausemark_stop_requestedr7_stop_windows_gatewaysrT$_record_attested_cold_start_profilesrrr abandon_pause finish_pause)rradoptedclaimsr2r r3r1r5rrer?rLhomesrrnamesrrrArunning_profilesrr;rJrKs @@@r"_pause_windows_gateways_for_updater]sJ ) 4     M N N< O? O P P&446 QNhNjK)= &w77$0uLS?P4PSUXUtSSLMu5>BN O,3CH,SX6 6,D O>K K]cSX'C1 1]E K u||~X!YY&U%++-&UUVXopq q ! !C C&)SX,W,`befibj#l s3x$SX 8!    z8lVls0C585TCS*/778#c(BlV\Z\cs3x!6!6s!;D!AA\Z H &67&6QVV&67$u+Z\O_)`O_!#aff+s199~*EO_)`  b K L L!!(GV< (( l,A,cw,x ) z M&lG[lt1gnrtH dJ/=Zdfn oE8}@Q@X@X@Z'[@Z1AII@Z'[[xH_IxHrs_bcdclcl_mxH_II(0@A/0@%S[\  $ $UHg >>w O N N Q P P v P LVZ8)` L L L(\_I $$$  & &x 9 s O"&O6&P 3P ;P $P=$P9A P&P3P;)P++P#&P(!2P-.2P2#Q Q Q" O3 6 P 2 Q  R%RRcXV^8dQhR\R,R\R\R,/#)rrXNrYr&r)rs"rrrs. A ATD[ A$ A4$; Arc~^RIHp\4pVeTM RRR/R.R./p\V\ 44VP R4'dTMTpVfVeVP V4#R#VeTM RRR/R.R./p\R 4;_uu_4VPW0V4uuRRR4# +'giR#;i) zYNo gateway runs: the cold-start plan, plus any orphaned set adopted from a killed update.r<NrTrrrcold_start_profilesz/Could not record the adopted paused-gateway set) rr=rrUrTr0 stamp_treer#rR)rXrYrKrprobes&& rrNrNs> $ &E&E_dJPRTcegisuw,xE(6YY455E5E161B|&&u-LL&E_dJPRTcegisuw,xE J K K((@ L K K Ks B++ B< c$V^8dQhR\/#r*r+)rs"rrrs&&:>&rc 6^RIHpHp^RIHp VU u.uF2p \ V 4V9gK\ V 4V9gK'\ V 4NK4 p p /T;'g/P 4U U u/uFwr\ V 4V bK up p CV U u/uF\p \\W,R^4;'g^4^8gK0V \\W,P4^d,4bK^ up CpV !4PV 4pTPVU u/uF0p \ V 4V9gK\ V 4V!\ V 44bK2 up 4\WW%R7wppp\R4\V4pV !4P!VVR7p.p\#\%V4P'V4P'V44Fsp\)\*\,\.4;_uu_4V!\ V4RVP1\ V44R7VP3\ V44R R R 4Ku V'd'\R R P5\#V44 24V'd\R \7V4 R 24V'd^\R\7V4 R24\8;QJdRV4F 'gK RM RM !RV44'd \R4V#uup iuup p iuup iuup i +'giEKS;i)aSocket-pause the mapped gateways, drain, then tree-kill survivors; the paused ``profiles``. A force-killed process needs no stop record: dead, it is owed; alive, it was never stopped. The kill is authorized by each process's birth as discovered (*born*, a mapped gateway's strict PID-file identity first), never re-read after the drain: a PID that exited and was reused meanwhile reads its replacement's own birth. No discovered birth refuses the kill.)re terminate_pidrr)r+uB→ Stopping Windows gateway process(es) before updating Hermes...)rQT)forcerhNu! ✓ Paused gateway profile(s): ru → Force-stopped z gateway process(es)u → Stopped z, gateway process(es) without profile mappingc3L"TFqPR4'*xK R#5irNr0rus& rr)_stop_windows_gateways..)s3(Q55=  (s"$Fz5 Restart manually after update: hermes gateway run)rFrererrr9rQrSr/rQrrrr0rr8rjr#rTunionrProcessLookupErrorrMrLr0rr|rrz)r1r2r3rrr+rLrererrAmappedkv launcher_pidsrr,r-r5 survivors force_killedr5s&&&&&&& rrTrTsE(* qlc!f>?#EFFPVS TD D11&9MKKeARUVWRX`dRd7Q/A77ef)?)=*V&Hk; NO*;7M::;P]:^ILc)n**=9?? NO (/7 C C #c($DHHSQTXDV W   C )D CP 1$))F8C  C c(V^8dQhR\RR/#r<r+)rs"rrrIs+++$+rc r^RIHp^RIHp\ VP R4;'g/4pV'gR#\ VP44FwrE\V!V44p\RV R24;_uu_4VPVR7'g&VPVR7pV'g \R4hVPVR7pV'g\R V R 24hVPWVR7VPVR V R 2VR7\!R V RV^, R 24VR,P#VR4RRR4K VR,'d2\RRP%\ VR,44,4hVP#RR4R# +'giEKb;i)zSpawn each ``cold_start_profiles`` entry under its own HERMES_HOME and consume exactly the generation that authorized it; one profile's failure never aborts the others (#110959).rget_profile_dirr`Nz-Could not cold-start Windows gateway profile z after update: %sr|z&cold-start did not return a process IDzgateway profile  did not become readyz!cold-start after update (profile )u ✓ Gateway profile z+ started via cold-start after update (PID: zV^8dQhR\R,R\/#rrNr&)r,r:)rs"rrrhs88D4K848rc ^RIHpHpV!4P4'gR#\ R4;_uu_4^RIHp^RIHpRRR4\ R4;_uu_4\X!RR74'd RRR4R#RRR4T;'g/pVPR 4pVf6R V9d/\ R 4;_uu_4XP.R 7pRRR4\ R 4;_uu_4V!4'd)V'g!\PR 4RRR4R#RRR4\ R4;_uu_4XP4pRRR4X'g \R4hXP!4pV'g\RV R24hV'dVP#V4\%RRP'\)\*V44 R24\-\.4;_uu_4VP1VR4RRR4R# +'giEL;i +'giEL;i +'giELi;i +'giEL,;i +'giEL;i +'giR#;i)unDirect-spawn a detached gateway after update for the ``cold_start_if_installed`` case (installed but down). Idempotent: re-checks nothing is running so a concurrent autostart can't duplicate. A successful Popen doesn't prove survival (a job object denying breakaway kills it), so success is gated on the liveness poll. Vouched PIDs are attested so a death AFTER updater exit is reported by the next CLI invocation. A successful ``Popen`` only proves the process was created, not that it survived (e.g. a Windows job object denying breakaway kills it before it logs anything — #84185). So the success line is gated on the same post-spawn liveness poll every other ``_spawn_detached`` caller uses (``gateway_windows._report_gateway_start``), instead of being printed unconditionally from the returned PID. Desktop-owned lifecycle suppresses the spawn only while nothing attests a gateway is expected: an attested gateway that died without a clean exit is restored even then (#109538) — the Desktop does not restart the messaging gateway itself. That authority is the ``attested_generation`` the plan recorded on ``token``, not the marker on disk: the marker is a mutable one-shot a concurrent ``hermes gateway status``/``start`` consumes, which would otherwise skip this spawn and clear the token (#110020 review). Only that generation is consumed afterwards — never a newer marker. )r{rTz1Could not load Windows gateway cold-start helpersrrNz5Could not re-check gateway liveness before cold-startr!rz9Could not re-read the start attestation before cold-startrzHCould not re-check Desktop gateway-lifecycle ownership before cold-startzCSkipping Windows gateway cold-start: Desktop owns gateway lifecyclez1Could not cold-start Windows gateway after updatez6Windows gateway cold-start did not return a process IDzWindows gateway cold-start PID ru7 ✓ Gateway started via cold-start after update (PID: rrzcold-start after update)rr{rrr#rrrrrr0rrrrr"rrrr|maprrrr)rr{rrrrr5rs& r(_cold_start_windows_gateway_after_updaterhs(J 4     L M M.8 N P Q Q 0dC D D R Q D R KKRE01J35@ X Y Y(BBPRBSJZ c d d * , ,Z LL^ _ e d d L M M--/ N STT 88:J  DTYYsSVXbOcEdDeef gh )  00=VW  C N M M R Q QZ Y Y d d d N M M   sM H!H( H<7I II$7I8 H% ( H9 < I  I! $ I5 8 J cV^8dQhRR/#rrc)rs"rrrsZZDZrc^RIHpV!4P4'gR#\R4;_uu_4^RIHpVP 4'dVP4\R4VP4wr#VFp\RV 24K VFp\RV 24K VP4'd VPVP44RRR4R# +'giR#;i)uRegenerate installed Windows gateway launcher scripts after update; best-effort, never fails the update. Launchers are written once at install, so old installs kept launching via ``pythonw.exe`` (``sys.stderr is None`` death). The task's /TR points at a stable path, so rewriting in place retargets it without UAC. The Scheduled Task / Startup-folder launchers (``gateway.cmd`` + ``gateway.vbs``) are persistence artifacts written once at install time — ``hermes update`` never touched them, so installs created before the hidden-console rework (aa2ae36c3f) kept launching the gateway through ``pythonw.exe`` forever: every descendant spawn flashed a conhost (#54220/#56747) and, since #70344, the console-less gateway died at startup with ``RuntimeError: sys.stderr is None`` (#71671). rNz.{ps1,sh}`` for *branch* from the fresh checkout. Old ``hermes-setup.exe`` builds NEVER re-download a cached branch-ref script, so a stale one runs months-old code forever. Guards mirror ``install_script.rs``: only the sanitized *branch* key is rewritten; commit-SHA pins (7-40 hex) are immutable and skipped. Best-effort: never fails the update. Installer binaries built before the #67193 cache-refresh fix (June 2026 and earlier) NEVER re-download a cached branch-ref script — ``install-main.ps1`` cached at install time is reused forever, executing months-stale code with long-fixed bugs (the 2026-08-09 incident: a June 4 cached script's venv stage lacked the 81327 process-tree sweep and died on ``Access denied``). The binary has no self-update path, so the poisoned cache outlives every ``hermes update``. Overwriting the cached script for *branch* with the freshly pulled ``scripts/install.ps1`` / ``scripts/install.sh`` on every update turns the stale binary's unconditional reuse into a feature: it "reuses" a file this function keeps permanently current. Post-#67193 installers re-download on each run anyway, so for them this is a harmless pre-seed of the same bytes. The .ps1 copy gets a UTF-8 BOM to match the installer's cache format (#67193 encoding fix). rz:Could not refresh bootstrap-cache scripts after update: %szbootstrap-cacheNz[^A-Za-z0-9._-]_mainz[0-9a-fA-F]{7,40}ps1scriptszinstall-.sz.tmpu5 ✓ Refreshed installer bootstrap-cache script(s): r))rz install.ps1)shz install.sh)rrr r get_hermes_homeis_dirresubr fullmatchrr1 read_bytesr with_suffixsuffix write_bytesrHrrrrr|r#) rr cache_dirsafe_ref refreshedrsrc_namesrccacheddatatmps & r _refresh_bootstrap_cache_scriptsrs$) R S S--/03DD !!  T S66,c3v7G7G3HI <<,h 7 7  T S LND$##i/(:C8H:Qtf!==F;;==(8(8>>#Du}T___%E%E&-  "d*$$V]]V%;.under_services gkkm00q1KC&,,00;v~~VYZ]V^G_GgGgGi2jGi!3quu:Gi2j#jLLS*10   gz9= I 3k100s4CC4C>C9 !!C>#C65C69C>> D N)rr6r" pid_filter)rrr}rrr r_SERVICE_READY_TIMEOUT_S) rr6rrrrr6rrrs &&& @@r_service_gateway_readyrsb+3"4(OFG .54( )$D  2 2.7.?*YUYT\m 3 ==rc0V^8dQhR\R\/#)rrr&rG)rs"rrrs34rc^RIp\T4^,P4R8H# \dR#i;i TP\ \ 3dR#i;i)rNFr)rr ImportErrorrrrrLAttributeErrorrs& r_service_runningrs_D!!$++-::  LL'> 2s*"< 99AAc(V^8dQhR\RR/#r<r+)rs"rrrs/`/`D/`T/`rc 4^RIHp\VPR4;'g.4pVP R\V44\VPR4;'g.4pVPR4;'g/P 4UUu/uFwrEWB9gK WEbK ppp\ VPR44p.p.p \\V4EFp VPV 4;'g/p V'd\P!4\V PR4;'g^48dj\V 4'dYV PV 4\RV R \\V R,4\P!4, 4 R 24KV!V 4\!YPR 4;'g/PV 4V'd\"MR 4'g\V PR 4;'g^4^,p R V R\P!4\%\&^\%V ^, ^4,,\(4,/Wj&\+RV R24hVP-V R 4VPV 4W9dVPV 4EKEK W0R&WR&V'dW`R&MVP-RR 4V 'd"\+RRP5V 4,4hV'd$\RRP5V4,4R #R #uuppi \.dBp \0P3RY4\RT 24T PT 4R p ? EKR p ? ii;i)aRestart the SCM services recorded on *token*; one leaves the token only once the gateway it supervises is ready. Failed ones stay on the token so a retry sees them. A recovering launch (``token["recovery"]``) probes readiness briefly, and a running service whose gateway was not ready is not re-probed before its backoff (``service_retry``) elapses: the debt stays owed without stalling every command.rrrr service_retryrecoverynext_atu ⚠ Windows gateway service z.: its gateway was not ready; next check after rrNattemptsrz0 is running but its gateway did not become readyz=Could not restart Windows gateway service %s after update: %su1 ⚠ Could not restart Windows gateway service: z.Could not restart Windows gateway service(s): ru- ✓ Restarted Windows gateway service(s): )rrrRr0 setdefaultrQr:rrrtimerSrrrr9r_SERVICE_READY_PROBE_Smin_SERVICE_RETRY_BASE_S_SERVICE_RETRY_MAX_Sr"rrrwarningr|)rrrverified_restartsrstateretry recoveringrfailed_services service_namebackoffrrs& r_resume_windows_servicesrsEEIIj)//R0H ($x.9UYY';<BBC-2YY-G-M-M2,T,T,V k,V[TZ^Zj[T[,VE keii +,JOC* ))L)//R 1ejjlU7;;y3I3N3NQ-OOTdeqTrTr&&|46|nE**-eGI4F.G%**,.V*W)XXY[\ *< 8),CU9V9\9\Z\8a8abn8oDN*@TXZZw{{:6;;!K]A^^_G l. 1 NNZ\h n El^T U  " "< 0 0 1sP M%M<M 0M 5A2M )$M M 'M 9M B*M  N5NNc^V^8dQhR\R\R\\\3,/#rrrr&)r,rRr)rs"rrrQs*''''tTzAR'rc"aa \R4;_uu_4^RIHoHo RRR4/p\ VP 44F8wr4\ W43V 3RllRV4'gK!\V4V\V4&K: .pVFupVPR4VPR4rGV'gK.V'gK8\ WGVPR43V3R llR V4'gKdVPV4Kw W%3# +'giL;i) aSpawn the restart watcher for each paused profile gateway and unmapped argv; ``(launched profiles, launched unmapped entries)``. Nothing leaves the token here: a watcher only proves a relaunch was scheduled, so every entry stays owed until ITS gateway is verified ready.z-Could not load Windows gateway restart helper)*launch_detached_gateway_restart_by_cmdline'launch_detached_profile_gateway_restartNc:<S!\V4\V44#rb)rr9)rAors&&rr+_relaunch_paused_gateways..[s2YZ]^_Z`befgbh2irz=Could not restart Windows gateway profile %s after update: %srr5r6c><S!\V4\V4VR7#)r|)r9rR)rrVrBrs&&&rrrbsZDAQaZ)rzDCould not restart unmapped Windows gateway (pid %s) after update: %s) r#rrrr#rQrr9rr0r) rrlaunchedr6old_pidlaunched_unmappedr+rrrs && @@r_relaunch_paused_gatewaysrQs H I Iz JH"8>>#34 giTV] _ _%(\HS\ "5 &)599U+;g 4GG 7eiiPVFW+)*pry!{!{  $ $U +   &&# J Is C>> D cRV^8dQhR\R\R\\,/#r)r,rRr9)rs"rrrls* N NT NT N$s) NrcVP4Uu.uFp\V4NK ppYAUu.uFFqUPR4'gKVPR4'gK4\VR,4NKH up, p\VUu0uFq3^8gK V!V4'gKVkK up4#uupiuupiuupi)agOld PIDs a restart watcher is still waiting on, sorted; empty when every relaunch can have run. ``_spawn_gateway_restart_watcher`` respawns the gateway only once the PID it was handed is gone, so while any of them is alive the relaunch has provably not started yet. Pure function of data (``pid_exists`` is injected) so the decision is testable off Windows. rr5)rPr9r0r#)rr pid_existsr5 candidatesr+s&&& r_pending_relaunch_pidsrls'/oo&78&7s#c(&7J8(e(ii>O$TYT]T]^cTd$3uU|$(eeJ *L*3a3JsO33*L MM9eLs(B5B: B:#B: B? B?(B?c<V^8dQhR\R\R\/#r)r,rRrS)rs"rrrxs& Q Q Q Qe Qrcj^RIHp\WV4'g\#\ V4\,#)uLiveness budget for the post-relaunch poll. The base window assumes the watchers respawn immediately. When an old PID is still alive the watcher is still in its wait loop, so the poll must reach at least the watcher's own deadline — otherwise ``hermes update`` declares "no stable gateway process appeared" for a gateway that was never scheduled to appear inside the window (#107002). )!GATEWAY_RESTART_WATCHER_TIMEOUT_S)rrr_RELAUNCH_VERIFY_TIMEOUT_SrS)rrrrs&&& r_relaunch_verify_timeout_srxs-E !(j A A)) 2 36P PPrc0V^8dQhR\R\/#)rr+takenrv)rs"rrrsXX$XsXrcnaaaaaaaaaa a a a ^RIo ^RIHoHoHo^RIHo\SPR4;'g.4R,\SPR4;'g^4uo oSPR4SPR4uoo R VVVVVV 3R llo R VVV V V V3R lloV3R l#)a{``pid_filter`` matching the gateway an unmapped entry's replay started: a gateway running the same arguments after the (normalized) interpreter on the entry's home, born after the process it replaces, not one another entry already vouched for. Two homes can run identical selectorless argv, so argv alone would let home B's gateway retire home A's debt (a service gateway on another home included; on A's home only one gateway can run). Only an entry recorded before ``home`` was captured (no key: a pre-durable-pause updater's token) keeps the argv-only match; a recorded ``home`` that is empty proves no runtime and is never matched.N)_looks_like_gateway_process_same_hermes_homerer>rNNr5r6rFc0V^8dQhR\R\/#rYrZ)rs"rr,_unmapped_ready_filter..__annotate__s~~#~$~rc<RS9dR#S'gR#S!V4S!V4r!VRJ;'d/S!VS4;'dSRJ;'gVRJ;'gVS8#)r6TFNrc) r5 live_homerFrr+r?rer6old_cts & r same_runtime,_unmapped_ready_filter..same_runtimesn  (-/Ec/J2$}}):9d)K}}QW[_Q_Q|Q|ceimcmQ|Q|qsv|q|}rc0V^8dQhR\R\/#rYrZ)rs"rrrsSTrc$<VS8XgVS9dR#\SPV4P4;'g.4R,S8H;'dS!V4;'d S!V4# SP\\ 3dR#i;i)Fr)rRrnr}rrLr)r5roldrrrtailrs&rr'_unmapped_ready_filter..matchess #: ,446<<"=bATI**NijmNn**$S) + gz2  s"*A/A/A/&A//BBcv<\V4Uu.uFpS!\V44'gKVNK up#uupirb)rr9)rPr5rs& rr(_unmapped_ready_filter..s-(;D(AW(AWSQTXEV(AWWs66) rrrFrrrerOr?rRr0r9) r+rrrr?rer6rrrrrrrs ff@@@@@@@@@@@r_unmapped_ready_filterr see>UYYv&,,"-b13uyy7G7L7L13MID#99V$eiioLD&~~ XWrg?g@c bV^8dQhR\R\R\R\R,R\/#)rtargetsrrrespawn_windowNr&)rRrSrTr,)rs"rrrs>G+G+tG+uG+SG+RWZ^R^G+jnG+rcfaa^RIHo/p/p\4p\4p\4pT^T;'gR,,\,\,p \ P !4p W8dV#VU u.uF:q^,V9gKV ^,V9gK"W8gV ^,V9gK8V NK< p p V 'gbVU UUu.uF(wrpW9gKW9gKW9gKW9gK&V NK* ppp pVe$V'dVPV4W,pKV#.oRVV3RllpVP4VPRVP444V Fwp pp\V!V44pT'gTPT R4K5T'dTMTR,pTPT4Te*Y9d$TPT 4\!YT,4pYP#Y4, \8gKTYM&K \%V4\%V4,\%V48gEK\ P&!\4EK uup iuuppp i \d5p\PRT T4TPT 4Rp?EK?Rp?ii;i) u``{key: pids}`` for each ``(key, probe, claim_all)`` target whose gateway stayed visible for a whole confirmation window. All targets share one loop, so N targets cost one window, not N: one fleet process scan per tick (``probe(scan)`` calls ``scan()`` only if it needs the fleet), and each target is credited only on its own hits. *taken* holds, while a target is probed, the PIDs earlier targets vouched for (all of a profile's, the first of an unmapped entry's) so one gateway never retires two debts. A hit provisional at the deadline still finishes its window; a probe that raises leaves its target unready. *respawn_window*: a target's own liveness budget, in two parts. The restart watcher only spawns once the paused PID is gone, and that wait is charged to the *old* process — 25–35 s of a shared 30 s deadline on a busy update — while a cold gateway then needs >11 s before its control socket answers. So (a) a target first seen late gets ``respawn_window`` counted from its sighting, and (b) a target the deadline expires on without ever being seen gets ONE extra window, because the spawn it is waiting for may not have happened yet. Charging that wait to the new process is what made an update report "relaunch was not verified alive" for a gateway that was up seconds later; the verdict is committed and never revisited, so the stale debt surfaced as a manual follow-up on the next launch. Both parts are bounded, so a relaunch that truly never happens still fails closed. ``None`` keeps the single shared budget. Each target earns its sighting extension once, and the whole poll stops at the entry deadline plus both windows and one confirmation tick: a replacement that flaps in and out must not renew its budget forever. rrgNc$V^8dQhR\/#r*rR)rs"rr'_poll_until_ready..__annotate__s  d rch<S'g"SP\S!RR744S^,#)Tr!)rrR)rfleetsrscan_poll_until_ready..scans& T"3"FGH8Orc34"TFqFq"xK K R#5irbrc)rrPr5s& rr$_poll_until_ready..sD^TtStS^sz4Could not verify Windows gateway %s after update: %s:NrN)rrrT_READY_CONFIRM_S_READY_INTERVAL_SrrrclearrPrRrrrrqrrirrr)rrrrreadysincerCgraced first_seen hard_stoprJrr?key_probe_allstarvedrrb claim_allrPrvouchedrrs&&&& @@r_poll_until_readyr(sL,5EE%F%FeJ1 5 5#669IIL]]I oo  L%xg1U):1qt6?Q1WZWeijklimqviv11gx4;rG0sD*/2/@EHEZ_b_psGGr)g g&/L     DU\\^DD%, !C  E$K(  #t$'dT"XG LL !)c.Cs#x~)=>%%c//3CC$ '&-( u:F #c'l 2 KK) *Myr$ UWZ\_` 3 sN=I% I%!I%7I% I*I*%I*-I*5I*4I11 J0<(J++J0c@V^8dQhR\R\R\RR/#)rrrrr&Nr)rs"rrrs/)r)rT)rT)rT)rVZ)rrc a\R4;_uu_4^RIHp^RIHo^RIHpRRR4\P!4\WX4,p\4p\VP44UUu.uF,wrxRV3\X!V44\V43V3RllR3NK. p ppT \V4U U u.uFwrR V 3\!W43R lR 3NK up p , p \#WV\$R 7p \V4Uu.uFpRV3V 9gKVNK p p\V4U U u.uFwrR V 3V 9gKV NK pp p V P'4UUu.uF qFpVNK K pppWR &VP)R4;'g/P4UUu/uFwppVV 9gKVVbK uppVR&VP)R 4;'g.Uu.uFpVV9gK VNK upVR &V'dE\+\,4;_uu_4SP/\\V44R4RRR4V 'd\1RRP3V 4 24V'd\1R\5V4 R24\\V4\V 4, 4VUu.uF pVV9gK RVP)R4 2NK" up,pV'dJ\1RRP3V4,R,4\7RRP3V4,4hR# +'giEL;iuuppiuup p iuupiuup p iuuppiuuppiuupi +'giEL;;iuupi)aRetire each relaunched runtime on ITS OWN readiness: a profile on a stable gateway in its profile home, an unmapped entry on a stable gateway running its argv. A watcher only proves a relaunch was scheduled, and another target's readiness proves nothing about this one. A parent Job Object denying CREATE_BREAKAWAY_FROM_JOB can kill the gateway on updater teardown. Vouched PIDs are persisted so a death AFTER updater exit is reported by the next CLI invocation.z/Could not load Windows gateway liveness helpersrVrrNr6c4<aSPVV3RlR7#)cV<VUu.uFp\V4S8wgKVNK up#uupirb)r9)psrArs& rrE_verify_relaunched_gateways_alive....s#"&D"QA! qq"&D&Ds&&)r6r)r)_scanrBrrs&&frr3_verify_relaunched_gateways_alive..s(`oaCaC DaCaFrTrcV!V!44#rbrc)rfs&&rrr0sWXY]Y_W`rF)rrelaunched_profilesrzpost-update relaunchu. ✓ Restarting Windows gateway profile(s): ru ✓ Restarting z% unmapped Windows gateway process(es)pid r5u: ⚠ Windows gateway restart could not be verified for: z (The respawned gateway may have been killed by a parent Job Object during updater teardown, #48820.) Recover with: hermes gateway restartz>Windows gateway relaunch after update was not verified alive: )r#rFrWrrr}rrrrrTr#rQr r9rr r(rrPr0rrrrr|rr")rrrrWrrrrrrrr+rready_profilesready_unmappedrPr5rr2rkunreadyrs&&& @r!_verify_relaunched_gateways_aliver8s: J K K..7 L #=hR]#^^HEciiqiwiwiybz|bzQ^QUD!48M3NRUV]R^$FGKMbz | )( 35 3HAa1G1U"`bgh 355G gGa bE'-h'7V'7tIt;LPU;Udd'7NV,5h,?\,?JPQ?V[C[ee,?N\"',,.A.$DS#D#.JA$2  /4yy/D/J/J.Q.Q.So.SFAsWX`nWnC.SoE*%*YYz%:%@%@b%@]%@qQnE\%@]E* i  4 4VC O5LNd e! ? .@Y?Z[\ !#n"5!66[\]S]S%889\d=A\dWXhiqh=RtAEE%L>=R\d=AAG IDIIV]L^ ^b7 7 [^b^g^gho^ppqq 9 L K K|5W\Ap] =AseL2<2MM  MM. MMM" M#3M# M),M)%M.0 N>N2 M . M? c6V^8dQhR\R,RR/#rr+)rs"rrr!s####rc^RIHpV'dVPR4'gR#^RIpVP \ 4V!4P 4'gVPR4R8wdRVR&R#VPR4'd\\P4M \4;_uu_4\V4RRR4R# +'giR#;i)z>Restart Windows profile gateways previously paused for update.rrNplatformrFr) rrr0atexit unregisterrrrsysrlr_resume_unless_torn)rrr<s& rrr!s(  /22 ;< 4    %))J"77"B!&o). *(=(= $;= P PE" Q P P Ps ; C C" c(V^8dQhR\RR/#r<r+)rs"rrr7s!!t!!rc2^RIHpVPR4'dGVPV4wr#V'g,\ RV R24RVR&W0R&VP V4R#\ V4VP V4R# TP T4i;i) zGResume the paused set, or leave it owed when the checkout is not whole.r<pause_idu& ⚠ Paused gateway(s) left stopped: zC. The next `hermes` command (or `hermes update`) restarts them.Frresume_deferredN)rr=r0 tree_is_wholersync_resume_paused_set)rrKwholewhys& rr?r?7s> yy!//6  :3%@VV W%*E/ "'*# $   e $ !5!% % s % BBc(V^8dQhR\RR/#r<r+)rs"rrrLs+#+#d+#t+#rcaaa a a ^RIHoSPR4R8Xd^RIHpV!S4#S!4P 4.o RV 3RllpV!V3Rl4\ SPR4;'g/4p\SPR 4;'g.4pV'g;\;QJdR V4F 'gK R M R M !R V44'd\W44wo o S 'g S 'dV!V V V3R l4M.SR&\\V4\S 4, 4VUu.uFqUS 9gK RVPR4 2NK! up,pV'd(S PRRPV4,4M)SPR4'dRVV3RllpV!V4V!V3Rl4S 'd\RPS 44hR SR&R#uupi)zBring every paused runtime back; each one is retired from *token* only on its own verified start, and one failure (an SCM service, a profile) never keeps the others stopped.rr;r)resume_paused_setcV^8dQhRR/#rrc)rs"rr(_resume_paused_set..__annotate__Xs&&&rc~<V!4R# \d&pSP\T44Rp?R#Rp?ii;irb)rrr)steprfailuress& rattempt#_resume_paused_set..attemptXs0 & F & OOCH % % &s <7<c<\S4#rb)rrsrr$_resume_paused_set..^s ,U3rrrc3B"TFqPR4xK R#5irhrirjs& rr%_resume_paused_set..as7huuV}}hsTFc<\SSS4#rb)r8)rrrsrrrTds=eXO`arr3r4r5z0Could not restart every paused Windows gateway: rrcV^8dQhRR/#rrc)rs"rrrMms 5 5D 5rc`<S!4PS4'g \R4hRSR&R#)z+Windows gateway cold-start was not verifiedFrN)rr")rrsr cold_start&_resume_paused_set..cold_startms-4@@GG"#PQQ/4E+ ,rc<\S4#rb)rrsrrrTts 1%8rrrN)rrr0!hermes_cli.update_cmd_posix_pauserKrr,rRrzrr#rTrr|r") rrKrQrrrk not_launchedrZrrPrrs f @@@@rrFrFLs) yy'G ''D++-H&&  34EIIj)//R0HEIIj)//R0H337h73337h777&?&S## ( a b+-E' (c(mc(m;<+3@S+3a@Q7Q !d155<. !8@SS  OONQUQZQZ[gQhh i , - - 5 5   89499X.//"E/!@Ss ?G; G;c$V^8dQhR\/#)rrr`)rs"rrrzs" " _c" rc a ^RIHpV!4PV4\V\4'gR#RRlpTp\R4;_uu_4T!VPVPR4;'g.4RRR4\VPR 4;'g.4pVPR 4;'g/o V!VPV4V!VPR V 3R lV444T!VP V 3R lVPR4;'g.44\#\4;_uu_4^RIHpT!VPVPVP(\+VP,4VP VP;'g\/VP 4RP1VP 4;'gRR7RRR4R# \dEpRTnTP P \T44\RT 24Rp?ELRp?ii;i +'giEL;i +'giR#;i)zResume gateways paused for a Windows update and fold the token into ``outcome``'s systemd/launchd-style bookkeeping so reconciliation never reports a healthy gateway as unaccounted. Must never abort the update.rTu2 ⚠ Windows gateway service restart incomplete: Nc(V^8dQhR\RR/#)rtargetr&Nr)rs"rr@_resume_windows_gateways_and_merge_outcome..__annotate__sSStStSrcdaSPV3Rl\PV444R#)c38<"TFqS9gK VxK R#5irbrc)ritemrbs& rrU_resume_windows_gateways_and_merge_outcome.._extend_unique..sR';t6?Qdd';s N)extendr,r )rbrQsf&r_extend_uniqueB_resume_windows_gateways_and_merge_outcome.._extend_uniques Rt}}U';RRrzRCould not merge Windows relaunch outcome into fleet reconciliation bookkeeping: %sr3rrc38"TFq'gK VxK R#5irbrc)rrAs& rr=_resume_windows_gateways_and_merge_outcome..s0vS4T4Z4ZXZ[ lUYY';<BBCyy!34::7--/@A7..0v:9H99H> I  I& cNV^8dQh/^\9d\R,;R&#)rNr)__conditional_annotations__r)rs"rrrs%j329t+2kr)serve dashboard>-crr-r-s-t-z--in--modelr--resume--skills --oneshotr --continue --provider --toolsets --reasoning --usage-file)g?rcrb)NN)r)jrrlogging contextlibrrrrrHrrrpr>rrrrrpathlibr hermes_cli.update_cmd_commonr getLoggerrrrr#r(r7rNrjrwrprrrrrrrrrrrrVENV_HOLDERS_EXITr rrr,r:rDrJrNrWr^rarsrIr{rrrrhrrrrrrr"rrrr%r0r8r]rNrTrUrrrrrrrrrrrrrrrr rrr(r8rr?rFr}r)rs@rrs MM  ,,5   2 3*t88=  5.,/e 1T1h )* /32%6)X4$&(4$,27 BJ$2I6 t40 W /dX.vFHvAEv:>vQUv,Z$Z mD m@33%EPKbKKS"!.H  D?N A &R06+>8vZ>+j\ =6/`d'0" N QXBG+T)rX#,!*+#\" r