+ jHjIV>Rt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI Ht^RIHtHtHtHt^RIHt]P,!R4tRtRt^tR R ltR R ltR RltRRltRRltRRlt RRlt!RRRRRRRR/RRllt"RRRRRRRR/RRllt#R R!lt$R"R#lt%R$R%lt&]PNR&R'l4t(R(t)R)R*lt*R+R,lt+R-R.lt,R/R0lt-R1R2lt.R3R4lt/R5R6lt0R7R8lt1R9R:lt2R;R<lt3R=R>lt4R?R@lt5R#)AuHost-scoped update→restart obligation for ``hermes update``. Multiplex-only (Teknium ruling): exactly ONE ``hermes gateway run`` per host serves every profile, so "this pull still owes the fleet a restart" is a property of the HOST, not of one profile's ``HERMES_HOME``. The legacy ``$HERMES_HOME/fleet_restart_pending`` marker was per-home: ``hermes -p coder update`` armed and cleared coder's copy while restarting the SHARED process, and every other profile's CLI could neither see nor discharge that obligation — it simply armed its own and re-killed the same host process. The record therefore lives beside the host rendezvous record, in :func:`gateway.host_rendezvous.host_state_dir` (``$HERMES_GATEWAY_LOCK_DIR`` else ``$XDG_STATE_HOME/hermes/gateway-locks``) — the one cross-profile, per-OS-user state root the tree already has. It is written once per host and installation (keyed by the checkout), read by every profile's CLI, and cleared once. The same "one host process, not one per profile" identity is what :func:`collapse_units_to_host_processes` applies to enumerated systemd units: leftover per-profile ``hermes-gateway-

.service`` units on a multiplexed host all point at the same live ``MainPID``, so restarting each one restarts the host process N times. ) annotationsN)Path)AnyCallableIterableOptional) make_user_dirzhermes_cli.update_cmdzhost-update-restart.jsonfleet_restart_pendingcV^8dQhRR/#returnr)formats"F/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_host_obligation.py __annotate__r3sUUdUc^RIHp\PP \ \ \4P4P^,44p\P!VPR44P4R,p\ V!44\ \4P RV R2, #)aAThis installation's host obligation record. Keyed by the checkout this module runs from: every profile of one install arms, reads and clears the same record, while a second install of the same OS user (another checkout, a ZIP install) owes its own, so its completed restart never erases this install's debt (review S3). )_host_state_dirutf-8:NN-z.json)"hermes_cli.update_restart_recoveryrospathnormcasestrr__file__resolveparentshashlibsha256encode hexdigestHOST_OBLIGATION_NAMEstem)rinstallkeys rhost_obligation_pathr(3sCggs4>#9#9#;#C#CA#FGHG ..0 1 ; ; =c BC ! "-A(B(G(G'H#e%T TTrcV^8dQhRR/#r r)rs"rrrDsSSDSrc\4pVP\4p\PP V4'g(\PP V4'dV#T#)zQThe record a reader honours: this install's, else an older release's unkeyed one.)r( with_namer$rrexists)rlegacys r _owed_pathr.DsH  !D ^^0 1F--"''..2H2H6RdRrc$V^8dQhRRRRRR/#)r rrrecorddictr Noner)rs"rrrKs&ZZZdZtZrc j\V\P!V^RR7PR44R#)zQ``utils.atomic_json_write(path, record, mode=0o600)`` in stdlib only (see above).Findent ensure_asciirN) replace_bytesjsondumpsr")rr0s&&r _write_recordr:Ks%$ 6!%HOOPWXYrcV^8dQhRR/#)r r Optional[dict]r)rs"rrrPs&&n&rc(\\44#)zSThe published obligation record, or ``None`` when absent/corrupt/foreign-versioned.) _read_recordr.rrrread_host_obligationr?Ps  %%rc V^8dQhRRRR/#)r rrr r<r)rs"rrrUstrc\P!VPRR74p\ T\4'dTPR4\8wdR#T# \\\ 3dR#i;i)z utf-8-sig)encodingNversion) r8loads read_textOSErrorUnicodeDecodeError ValueError isinstancer1get_RECORD_VERSION)rpayloads& rr>r>Usc**T^^[^AB gt $ $ I(>/(Q N ' 4s&AA65A6cV^8dQhRR/#r r boolr)rs"rrr_s   rcX\4P4# \dR#i;i)uTrue when the record FILE exists, parseable or not. Fail-closed: a corrupt record is an obligation whose terms are unknown, never a discharged one — the restart is still owed and the reader falls back to "no recorded inventory". F)r.is_filerFrrrhost_obligation_presentrR_s* |##%% s  ))c V^8dQhRRRR/#)r fieldsrr r2r)rs"rrrksBBCBDBrc (a\V3RlR4R#)zOMerge ``fields`` into the armed record (test/diagnostic surface). Never raises.c&<VPS4#N)update)r0rTs&r'amend_host_obligation..ms&--"7ramendN_update_record)rTslramend_host_obligationr^ks7Ar expected_sharuntimesprofileownerc ,V^8dQhRRRRRRRRRR/#) r r_rraOptional[list]rbrcr rOr)rs"rrrps4)7ILZ] rc \4p\V4;_uu_4\W@WVR7uuRRR4# +'giR#;i \d"p\P RT4Rp?R#Rp?ii;i)aArm the host obligation. True when it was written. Never raises. Re-arming from a second profile for the SAME pulled SHA keeps the existing record (and its ``restarted`` proof) instead of resetting it: the host owes one restart, not one per profile. ``owner`` (an update run's commit-point token) joins the record's ``owners``: a run that fails before its move hands back only its own stake (``release_host_obligation``), never another run's debt for the same SHA. The first owner also stores what it found there (``found``), which the last owner to leave puts back; an owner retargeting to another SHA keeps that baseline (``_baseline_for``). r_rarbrcNz5Could not lock the host update-restart obligation: %sF)r( _record_mutex _write_lockedrFloggerdebug)r_rarbrcrexcs$$$$ rwrite_host_obligationrmpsY !D 4  8lqr!  LcRs1A 8 A A A A A8A33A8c 0V^8dQhRRRRRRRRRRR R /#) r markerrr_rrarerbrcr rOr)rs"rrrs<'' '#&'7E'WZ'hk' 'rc \WW4R7'dR#R\P!4 2R\P!4 2.V'dRV 2.M.,pVe1VP R\ P !R^R V/4,4R p\VR PV4R ,PR 44V'g\4'dRV R2pV'g"\PR\4V4R#\PR\4V4\!R\"P$R7R# \dpR T RT R2pRp?LRp?ii;i \dpRT RT R2pRp?LRp?ii;i)aArm the host record, else ``marker`` (the arming profile's per-home breadcrumb). Never raises. The one fallback for every arm (``hermes update``'s commit point, a historical updater's takeover). An unwritable host state dir (``HERMES_GATEWAY_LOCK_DIR`` on a read-only mount, a container UID that does not own ``$HOME``) must never disarm the obligation (#117275), but the marker is visible to the arming profile only: it settles the debt only on an install PROVEN to have no other profile, and an unreadable profile roster proves nothing (review S2 residual). Otherwise the marker is still left for this profile, the gap is said out loud, and the result is False: the commit point refuses to move; a takeover, whose tree already moved, keeps the warning. rgTzstarted=zpid=z expected_sha=Nz inventory=rCrar` rz or z ()z" hides it from the other profiles)zB may hide it from other profiles: the profile list is unreadable: zXHost update-restart obligation (%s) is unwritable; armed the per-home marker %s instead.zYCould not arm the update-restart obligation in %s%s; an interrupted update will not warn.z Warning: could not record the pending gateway-restart obligation where every profile sees it (state dir not writable) - restart gateways with `hermes gateway restart` if this update is interrupted.)fileF)rmtimergetpidappendr8r9r7joinr"rF_named_profiles_existrjwarningr(errorprintsysstderr)ror_rarbrclineshiddenrls&$$$$ rarm_host_obligationrsk,SZhh } %biik]'; >wGH  k$&&fX%GH q+-v 7 LLl%'1  "zz+ % )xr#a()  k&!cdgchhijF ks01E E( E% E  E%( F3 FFcV^8dQhRR/#rNr)rs"rrrstrc^aa^RIHpHpHpHp\ V!4R, P 44pTFoSPR8XgVTPSP4'd5\P!\S\P44'gKk\;QJd TT3RlT4F 'gK RM RM!TT3RlT44pT'gK\T!S4\P 4'dKR# R# \\3dR#i;i)a}True when the install has a live named profile beside ``default``, read from a COMPLETE roster. ``profiles.list_profile_names`` suppresses enumeration errors and reads an unreadable roster as "default only"; here any error listing the roster or reading an entry's identity raises instead. Same identity rule as ``hermes_constants.named_profile_is_live`` (stdlib only: see above). )_PROFILE_IDENTITY_MARKERS PROFILE_ID_REget_default_hermes_rootprofile_tombstone_pathprofilesFdefaultc3<"TFKp\SV, \P4;o;'d\P!S4'*xKM R#5irW)_moderlstatstatS_ISDIR).0namehomemodes& r (_named_profiles_exist..sD>#<4!&dTk288 <<XXdllSWFXBXX#GGIJ 99 !)<)#<>333>#<>> 8E"8">II   1 2s%DD,+D,c$V^8dQhRRRRRR/#)r rrprobez Callable[[Path], os.stat_result]r intr)rs"rrrs"=#rcXV!V4P# \\3d^#i;i)zb``probe(path).st_mode``; 0 when absent. Any other error raises: unreadable is unknown, not absent.)st_moderr)rrs&&rrrs/T{""" 1 2s ))c 0V^8dQhRRRRRRRRRRR R /#) r rrr_rrarerbrcr rOr)rs"rrrs9...s.n.WZ.cf.ko.rc \V4pV'd \WEV4MRpTeT'dTP R4T8Xdr/p\ T4p T'dYI9d.T OTNTR&T 'gYhR&R^RT/p TeTP R4T 8wdYR&T'gR #\T/TCTC4R #R\R \P!4R \P!4R T;'gRRT;'gR/p T'd T.T R&YkR&Te R^RT/T R&\TPR R R7\Y 4R # \d"p\P RT4Rp?R#Rp?ii;i \d"p\P R T4Rp?R#Rp?ii;i \d"p\P RT4Rp?R#Rp?ii;i)Nz5Could not read the host update-restart obligation: %sFr_ownersfoundrCra inventoryTz2Could not amend host update-restart obligation: %sstartedpidarmed_by_profiler`rexist_okz2Could not write host update-restart obligation: %s)r> _baseline_forrFrjrkrJ_ownersr: ExceptionrKrtrrurparent) rr_rarbrcexistingrrlrTrrrLs &$$$$ rririsD!H8= et44 n1MQ]1]"$" U(///F8 "'w:x8  HLL$=$J"+;   $ 68 6v 6 7?499; ryy{GMMr ** G "G  )1j(C dkk4$?d$ U  LcR(  LLMs S &  I3OsGE$E4 #F# E1E,,E14 F ?FF # G.G  GcV^8dQhRR/#)r rrr)rs"rrrs   rc#"VPR\\4P R2, p\ VRRR7\ 4!VR, 4;_uu_4RxRRR4R# +'giR#;i5i)aSerialize every read-judge-write of the record across processes (``update_lock.marker_mutex``). The sidecar sits in a subdirectory: the state dir is the gateway lock dir, whose ``--replace`` cleanup unlinks every top-level ``*.lock``, and a deleted sidecar splits the lock in two. .z.mutexTrr0N)rrr$r%r _marker_mutex)rguards& rrhrhsZ KKAd#78==>fE EE%5 ) * *  + * * *sABA-# B- A> 8 Bc^RIp^RIp^RIHp\ VR4'd VP #RpVP PV4pVfjVPPW2P4pVPPV4pWAP V&VPPV4VP #)a#``update_lock.marker_mutex``. A historical updater imported ``update_lock`` before its pull and then lazily imports this pulled module, so its in-memory copy predates the mutex: load the pulled ``update_lock`` (stdlib-only) beside it, which locks the same sidecar every current process does.N) update_lock marker_mutexzhermes_cli._update_lock_pulled)importlib.utilr| hermes_clirhasattrrmodulesrJutilspec_from_file_locationrmodule_from_specloader exec_module) importlibr|rrpulledspecs rrrs&{N++''' +D [[__T "F ~~~55dHNN>Xv>qW\ ]F   FMM'2 3 : :7 CC /s CCc V^8dQhRRRR/#)r rrr rr)rs"rrr;st rc\P!VP44PR4# \dR#i;i)zThe record's current bytes (base64), ``None`` when absent: what a first owner puts back. Any other read error raises: custody is never guessed.rN)rr read_bytesrr)rs&rrr;s< 1299'BB s25 AAc V^8dQhRRRR/#)r rcrr r2r)rs"rrrDs % %3 %4 %rc\4pV'd$T\\V4;'g/49dR#\V4;_uu_4\ W4RRR4R# +'giR#;i)a Hand back ``owner``'s stake in the record. When no other run still owes through it, the record goes back to what its first owner found (``found``; absent = unlinked). A record without ``owner`` was rewritten since (another run's newer pull): it is theirs and stays. Raises OSError when the record cannot be rewritten (the caller keeps the debt armed). Judged and rewritten under ``_record_mutex``, which every arm takes too, so no arm can land between the look and the write and be undone by it (kshitijk4poor F22/N05). N)r(rr>rh_release_locked)rcrs& rrelease_host_obligationrDsM !D Ed);)A)Ar!BB t  $    s A!! A2 c$V^8dQhRRRRRR/#)r rrrcrr r2r)rs"rrrTs!##$#s#t#rc\V4pVe \V4M.pW9dR#VUu.uF qDV8wgK VNK ppV'd\V/VCRV/C4R#VPR4e \P !VR,RR7MRpTfTPRR7R#\Y4R#uupi \ \3dR#i;i)NrrT)validate missing_ok) r>rr:rJr b64decode TypeErrorrHunlinkr7)rrcr0rr remainingrs&& rrrTs $ F & 2WV_F "1Fq5jFI1d;v;x;<DJJJwDWDc  4@im } t $d"2 z "sB4B44B99C Cc$V^8dQhRRRRRR/#)r rrdatabytesr r2r)rs"rrrgs!   E d rc~\P!VPRVP R2RR7wr#\P !VR4;_uu_4pVP V4VP4\P!VP44RRR4\P!W04\P R8wd_\P"!TP\P$4p\P!T4\P&!T4R#R# +'giL;i \dW\P!\4;_uu_4\P!T4RRR4h +'gih;ii;i \P&!T4i;i)z``data`` at ``path`` as one durable record: a fresh 0600 ``mkstemp`` file (never written through a planted alias), fsynced, renamed over ``path``, then the rename itself made durable.r_z.tmp)dirprefixsuffixwbNnt)tempfilemkstemprr%rfdopenwriteflushfsyncfilenoreplace BaseException contextlibsuppressrFrropenO_RDONLYclose)rrfdtmphandle directorys&& rr7r7gs4;;499+Q7GPVWGB  YYr4 F LL  LLN HHV]]_ %! 3  ww$GGDKK5  HHY  HHY  !    ) ) IIcN* * )  HHY sHEAD-E=F$- D= 8E-F!-F  F! F  F!$F<cV^8dQhRR/#)r r r2r)rs"rrr}s P Pt Prc\4PRR7R# \d"p\P RT4Rp?R#Rp?ii;i)a!Discharge the record this install's readers judged (``_owed_path``). Never raises. That is this install's own record whenever it has one. An older release's unkeyed record names no install: while this install has its own record, the unkeyed one may be another installation's standing debt that nothing here judged, so it stays (review S3 residual). It goes only when it was the record judged (this install armed none): it keeps its old meaning, owed by whichever install reads it, and an upgrade's own interrupted debt must stay dischargeable. Trz2Could not clear host update-restart obligation: %sN)r.rrFrjrk)rls rclear_host_obligationr}s?P t, P I3OOPs A AA cV^8dQhRR/#)r r zOptional[dict[str, str]]r)rs"rrrs3rc\4pVfR#R\VPR4;'gR4/pVPR4pVe\P!V4VR&V#)a#The obligation in the legacy ``key=value`` field shape, or ``None`` when unarmed. Keeps one parser for both sources: the fields a reader needs (``expected_sha``, the serialized ``inventory``) are identical whether they came from the host record or from an in-flight legacy per-home marker. Nr_r`r)r?rrJr8r9)r0rTrs robligation_fieldsrs`" #F ~c&**^"<"B"BC DF ;'I"jj3{ Mrc V^8dQhRRRR/#)r sharr r2r)rs"rrrs''S'T'rc(a\V3RlR4R#)zFRecord that the host process was restarted onto ``sha``. Never raises.c <TPRS;'gRR\P!4R\P!4/R7#)rr`rat) restarted)rXrrurt)r0rs&rrY-mark_host_restart_completed..s4v}}syyb%VZ\`\e\e\g/h}irzstamp restart completion onNr\)rsfrmark_host_restart_completedr si%'rc$V^8dQhRRRRRR/#)r changezCallable[[dict], None]whatrr r2r)rs"rrrs'SS1SSSrcR\4p\V4fR#\V4;_uu_4\V4pVf RRR4R#V!V4\W#4RRR4R# +'giR#;i \d"p\ P RY4Rp?R#Rp?ii;i)zRead, ``change`` and rewrite an armed record under ``_record_mutex`` (an arm's new owner stake is never overwritten by a stale copy). Never raises; no record, no write.Nz/Could not %s host update-restart obligation: %s)r.r>rhr:rrjrk)r rrr0rls&& rr]r]s rRr^rmrrxrricontextmanagerrhrrrrrrr7rrr r]rrrrrr%sA*#    44(   2 3 2.U"SZ &  B :>OQ`b,')+'HL']_'np'T..b   *H D& % #& , P"'S" Rr