+ jHjw <Rt^RIHt^RIt^RIt^RIt^RIHtHt^RI H t H t H t H t^RIHtHtHt]P&!]4t] !RR44t] !RR 44tRER R lltR R R R RRRRRRRR/tR RR RRRRRRRRR/tRFt]!RR04tRRltRRltRGRRllt ]RR l4t!R!R"lt"R#R$lt#R%R&lt$R'R(lt%R)R*lt&R+R,lt'R-R.lt(R/R0lt)R1R2lt*R3R4lt+R5R6lt,R7R8lt-R9R:lt.R;RRR/R?R@llt/RARBlt0RCRDlt1R#)HaMRuntime inventory + update plan for the fleet-update pipeline. One read-only pass answering, BEFORE any mutation: which Hermes runtimes run on this machine, how each is deployed, which ones this update touches, and how each restarts. Every collector is a side-effect-free probe, so ``hermes update --plan`` is safe on a live fleet. ) annotationsN)contextmanagersuppress) dataclassfieldasdictfields)AnyCallableOptionalc]tRt^t$RtR]R&R]R&RtR]R&RtR]R &RtR ]R &Rt R ]R &R t R]R&] !] R7t R]R&RtR#) RuntimeRecordz9One running (or expected) Hermes runtime on this machine.strkindprofileN Optional[int]pidmanual supervisor Optional[str]code_sha code_version restart_viadefault_factorydictdetail)__name__ __module__ __qualname____firstlineno____doc____annotations__rrrrrrrr__static_attributes__r@/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_inventory.pyr r sPC I LCJ"Hm""&L-&K.FD.r&r c]tRt^#t$RtRtR]R&RtR]R&RtR]R &R t R ]R &R t R ]R &] !] R7t R]R&] !] R7tR]R&RRlt]RRl4tRtR #) UpdatePlanz@The full pre-update picture: install shape + runtimes + actions.unknownrinstall_methodTboolupdatable_in_placez hermes updateupdate_mechanismNr expected_shaexpected_versionrlistprofilesruntimescV^8dQhRR/#)returndict[str, Any]r)formats"r' __annotate__UpdatePlan.__annotate__/sr&c \V4#N)r)selfs&r'to_dictUpdatePlan.to_dict/s d|r&c V^8dQhRRRR/#)r5datar7r6r)r)r8s"r'r9r:3s  ^  r&c H\V4Uu0uFq"PkK ppT!R/VP4UUu/uFwrEWC9gK VR8wgKWEbK uppBp\\4Uu0uFq"PkK ppVP R4;'g.UUUu.uFPp\ V\ 4'gK\R/VP4UUu/uFwrEWG9gK WEbK uppBNKR upppVnV#uupiuuppiuupiuuppiuupppi)zMInverse of :meth:`to_dict` (the plan crosses the post-swap hand-off as JSON).r3r)dataclass_fieldsnameitemsr get isinstancerr3) clsrAffields_kvplan record_fieldsrs && r' from_dictUpdatePlan.from_dict2s$4C#89#8a66#89Ytzz|X|tqq|dZdad|XY)9-)HI)HA)H IXXj)//R/ /:a3F PM OaggiNida1;MTQTiN O/   :XIN s@D D  D D 0D%DD D+D1 DDr)rr r!r"r#r+r$r-r.r/r0rr1r2r3r> classmethodrPr%rr&r'r)r)#sqJ#NC###+c+"&L-&&*m*40Hd040Hd0  r&r)c(V^8dQhRRRRRRRR/#) r5rint service_pidssetwindows_service_pids set | Noner6rr)r8s"r'r9r9?s*CsR\hkr&cV'd W9dR#W9dR#\\4;_uu_4^RIHpHpV!4'd RRR4R#V!4'd RRR4R#RRR4R# +'giR#;i)z.Classify how a live gateway PID is supervised.windows-servicer)is_macossupports_systemd_servicesNsystemdlaunchdservice)r Exceptionhermes_cli.gatewayr[r\)rrUrWr[r\s&&& r'_detect_supervisor_for_pidrb?sk ;!  )  J $ & &   ::        sA4 A4A44 B r]r^desktoprZ manual-serve respawn-argv desktop-sshz6systemctl restart (drain-first SIGUSR1 when supported)z6launchctl kickstart -k (drain-first, per-label domain)z&Desktop app respawns its serve backendz;sc.exe stop before venv mutation, sc.exe start after updatez9stop before code swap, relaunch with recorded launch argszJthe remote Desktop that spawned it over SSH respawns it when it reconnectsc$V^8dQhRRRRRR/#)r5rrrr6r)r8s"r'r9r9ks!993999r&c.\PVR4#)u\Machine-readable restart mechanism id for a runtime. THE policy table (#91277 Phase 2): restart execution consumes these ids via :func:`match_runtime_outcomes` / the update's restart phase, and the receipt records per-runtime outcomes against them. Display strings are derived by :func:`describe_restart_mechanism` — never the other way around. r)_RESTART_MECHANISMSrF)rrs&&r'_restart_mechanismrjks  " ":x 88r&c$V^8dQhRRRRRR/#)r5 mechanismrrr6r)r8s"r'r9r9vs!#r&cZ\PV4;'gVR8wdRV R2#R#)z5Human-readable description of a restart mechanism id.defaultz hermes -p z gateway restartzhermes gateway restart)_MECHANISM_DESCRIPTIONSrF)rlrs&&r'describe_restart_mechanismrpvs; " & &y 1  29Y2F*WI-.Ldr&c8V^8dQhRRRRRRRRRRR RR RR R /#) r5rrrrrrrr rextrar6r r)r8s"r'r9r9}sN     "/ =@  (+ =@  r&c l\R RTRTRTRTRV'd \V4MRRVR\W14/VB#) zJA :class:`RuntimeRecord` with ``restart_via`` derived from its supervisor.rrrrrNrrr)r rrj)rrrrrrrrs&&&&&&,r'_runtimert}sd    " (+ 8B "*X CO 'z; @E r&cV^8dQhRR/#)r5labelrr)r8s"r'r9r9s22#2r&c#v"RxR# \d"p\PRY4Rp?R#Rp?ii;i5i)zdRun one inventory collector; a failure is logged at debug and yields fewer rows, never an exception.Nz %s failed: %s)r`loggerdebug)rvexcs& r'_prober{s-2 2 _e112s 9 9 61969c V^8dQhRRRR/#r5rMr)r6Noner)r8s"r'r9r9sNNNNr&c \R4;_uu_4^RIHpHpHpV!4pV!4pT;'gTVnVR9;'dV'*Tn\R4;_uu_4^RIHpV!4pVe=RVnVP'd$VP'dVPVnRRR4V!V4Vn RRR4R# +'giL';i +'giR#;i)zInstall-method probe)detect_install_methodget_managed_system%recommended_update_command_for_methodzImage provenance probe)read_image_provenanceNF)gitr*) r{hermes_cli.configrrrr+r-hermes_cli.image_provenancervalidmanagerr.)rMrrrmethodmanagedr provenances& r'_collect_install_shapers & ' 'vv&($&%//"(,>">"N"Nw;, - - I.0J%*/'### (:(:(:*4*<* supervisor`` over the service-PID sets; each probe degrades to an empty set.zService-PID probe)_get_service_pidsT) all_profilesNz#Windows SCM service-ownership probe)find_windows_gateway_servicesc<\VSS4#r<)rb)rrUrWs&r'(_supervisor_classifier..s1#|EYZr&)rVr{rarrrT gateway_pid)rrr_rUrWs @@r'_supervisor_classifierrsL # $ $8(d;DDsu  %!$ 5 6 6DHeHghHgWG$7$7 8Hgh 7 [Z % $ i 7 6s)"B''B?7B:B?' B7 :B?? C c(V^8dQhRRRRRRRR/#) r5rMr) profile_homesr1seenset[int]r6r~r)r8s"r'r9r9s/&h&hJ&ht&h8&hX\&hr&c\4p\R4;_uu_4^RIHpHp^RIHpVFwrxV!V4p V e?V wrW9dKTPV 4^RIH p V !V 4p V 'dT MV!V 4pMFV!V4p V eW9dKcV!VR, 4;'g/p VPV 4V!V 4pVPP\RWzWPR4V PR 444K RRR4\R 4;_uu_4^R IHpV!4F|pVP V9gKVPVP 4VPP\RVP"VP V!VP 444K~ RRR4R# +'giL;i +'giR#;i) uPer-profile gateways: control-socket identity first (declared by the process itself, including supervisor provenance — no argv/PID inference), ``gateway_state.json`` fallback, then PID-file mapped gateways no status record covers.zGateway-state inventory)live_gateway_pid_for_homeread_runtime_status)_socket_identityN)launch_supervisorzgateway_state.jsongatewayrrzPID-file gateway inventory)find_profile_gateway_processes)rr{gateway.statusrrhermes_cli.update_receiptraddgateway.control_socketrr3appendrtrFrarrr)rMrrrrrrrhomesockrrecordrdeclaredsuprprocs&&& r'_collect_gateway_runtimesrsv()J ) * *Q>*MG#D)D" ; D-V4"*h 3 05;#+,T4H-HIOOR  o MM )W3 S]H^`f`j`jky`z!{ |-+ +6 , - -E24Dxxt#" $$XitxxQ[\`\d\dQe%fg5 . -7 + *6 . - -s,AG34G(A%G(G A*G G  G$ cV^8dQhRR/#)r5r6r1r)r8s"r'r9r9s  d r&c\\4;_uu_4^RIHpVP 4uuRRR4# +'gi.#;i)u Loaded launchd dashboard/serve jobs for supervisor classification. The probe itself is darwin-gated (``[]`` on every other host); here any failure also degrades to ``[]`` — classification falls back to the spawner probe and never aborts the inventory. See #116503.main_dashboardN)rr` hermes_clir_loaded_launchd_backend_jobs)_dashs r'_loaded_backend_launchd_jobsrs4 )  6113     Is 9 A c(V^8dQhRRRRRRRR/#) r5entryrrrTjobsr1r6z"tuple[str, str, int | None] | Noner)r8s"r'r9r9s)4cJlr&c d\\4;_uu_4^RIHp^RIHp\ P!\VPR4;'gR44;'gRpVPWW$!V4R7uuRRR4# \dRpL2i;i +'giR#;i)u``(domain, label, live_pid)`` of the loaded launchd job owning this ledger row, if any. A KeepAlive LaunchAgent backend's recorded spawner (the bootstrap shell) is long dead, so the spawner probe alone misreads the row as ``manual-serve`` — and a respawn-argv restart then fights the job's own KeepAlive respawn. The loaded-job match (live PID, an ancestor, or the normalized ``ProgramArguments``) is the authoritative classification. See #116503.r)_process_ancestorsargvrN) ancestors) rr`rrhermes_cli.dashboard_procsrshlexsplitrrF ValueError_launchd_job_owning_backend)rrrrrcmdlines&&& r'_launchd_owner_for_ledger_entryrs )  6A kk#eii&7&=&=2">?GG4G00tOabeOf0g    G    s4 B>B %B (B BBBB B/ c V^8dQhRRRR/#)r5rrTr6ztuple[str, str | None] | Noner)r8s"r'r9r9s  s /L r&c\\4;_uu_4^RIHpVP V4uuRRR4# +'giR#;i)a``(unit, scope)`` of the systemd unit whose live ``MainPID`` is *pid*, if any. A unit-launched backend sets neither ``HERMES_SPAWN`` nor ``HERMES_PARENT_PID``, so the spawner probe reads ``manual-serve`` and the update tells the user to "ask the owner to relaunch `hermes dashboard`" for a process systemd owns (#141021). Ownership is the unit's MainPID, not cgroup membership (a hand-started dashboard inside some unrelated unit's cgroup is still manual); ``None`` off Linux, when unreadable, or when no unit owns it.rN)rr`rr_systemd_owner_for_pid)rrs& r'_systemd_owner_for_ledger_pidrs4 )  6++C0     s : A c V^8dQhRRRR/#)r5rrr6r,r)r8s"r'r9r9s    r&c ^RIHpT!\P!\ VP R4;'gR444# \ dR#i;i)zIs this row the backend a (possibly remote) Desktop spawned over SSH? The canonical argv predicate also classifies rows written before the ledger carried ``isolated``, which is exactly the pre-update serve the first update after this change inventories.)is_desktop_ssh_backend_argvrrF)hermes_cli._startup_fastrrrrrFr)rrs& r'_is_desktop_ssh_ledger_entryrsJE*5;;s599V;L;R;RPR7S+TUU s.AA AAc$V^8dQhRRRRRR/#)r5rMr)rrr6r~r)r8s"r'r9r9!s!&&:&X&$&r&c \R4;_uu_4^RIHpHp\ 4pV!4EFpVP R4VP R4rvV\ 9g\V\4'dWq9dKNVPV4RVP R4;'gRRVP R4;'gRRVP R4R VP R 4/pV'd \WWV4MR p V 'dR V ^,V ^,uqR &VR &MS\V4'dRp M?V!V4RJdRp M0\V4;p 'dRV ^,V ^,uqR&VR&MRp VPP\\!V4\!VP R4;'gR4WzVR74EK R R R 4R # +'giR #;i)uqServe/dashboard backends from the spawn ledger — runtimes the gateway collectors can never see (a manual `hermes serve --host ` for a remote Desktop, a long-lived `hermes dashboard`). ledger_entries() live-verifies (pid, create_time) so PID reuse never fabricates a row. Desktop- supervised backends (spawner still alive) restart via the Desktop's own respawn, not ours. A backend owned by a loaded launchd job is classified ``launchd`` (kickstart restart, never a detached argv respawn) — the spawner probe cannot see that (#116503); one that is a systemd unit's MainPID is ``systemd`` for the same reason (#141021).z Serve/dashboard ledger inventory)ledger_entriesspawner_is_deadpurposerrrhostport create_timeNr^launchd_domain launchd_labelrfFrcr] systemd_unit systemd_scoperdrrn)r)r{hermes_cli.process_identityrrrrF _SERVE_KINDSrGrTrrrrr3rrtr) rMrrr launchd_jobsrrrrjobrunits && r'_collect_ledger_runtimesr!s 2 3 3O35 #%E 99Y/51ASl**S#2F2F#+ HHSM &)//R69J9P9Pb &)=%))M:RFP\1%lKaeCPY[^_`[acfghciM #34f_6M-e44+  '50& 6s;;;NWY]^_Y`bfghbiK >2F?4K+ MM G c%))I"6"C"C)Dc^d" 1& 4 3 3 3s%BG&G-G/GCG G& cV^8dQhRR/#)r5r6r)r)r8s"r'r9r9Js:r&c\4p\V4\R4;_uu_4^RIHpV!RR7pVP R4VnVP R4VnRRR4.p\R4;_uu_4^R IH pV!4pVUUu.uFwrVVNK uppVn RRR4\4p\WV4\W4V# +'giLy;iuuppi +'giLL;i) uBuild the pre-update plan. Read-only; never raises — every collector degrades independently. The result is embeddable in the update receipt and printable via :func:`print_update_plan`. zCode-identity probe)get_code_identityT)refreshshaversionNzProfile enumeration)_profile_homes)r)rr{hermes_cli.version_inforrFr/r0rrr2rVrr)rMridentityrrrD_rs r'collect_runtime_inventoryrJs   !6!6 789 LT]]]4==1W XY === LM +C ,>+?r BC==.5.>.>.>G$$R()*B b(9 }ERYRdRdQefiejkl  :7;N;NPWP_P_ `abc!r&c$V^8dQhRRRRRR/#)r5rrrobjectr6r,r)r8s"r'r9r9xs& J J JF Jt Jr&c\V4PR4PR^4R,pVR8XdRMRV 2pVRV 2RV 209#) uDoes *unit* name a ``hermes-serve*``/``hermes-dashboard*`` unit for *profile*? (OWN vocabulary; the gateway's ``hermes-gateway*`` names never cover serve/dashboard runtimes.) Exact names only — ``work`` must not claim ``hermes-serve-workbench`` — and a scope prefix (``user/hermes-serve``) is tolerated because the restart phase records scope-qualified identities in some lists. See #100479. .service/rnr-z hermes-servezhermes-dashboardr removesuffixrsplit)rrrDsuffixs&& r'_serve_unit_matches_profilerxs] t9 ! !* - 4 4S! `` — they do not contain the substring ``hermes-gateway``, so a successful macOS kickstart must still credit the planned default gateway. A scope prefix (``user/hermes-gateway``, ``gui/501/ai.hermes.gateway``) is stripped the same way serve units are. rrrnzhermes-gateway-zai.hermes.gateway-zgateway-r>rhermes-gatewaygateway-defaultai.hermes.gatewayr)rr_rDs&& r' _gateway_service_matches_profiler si w< $ $Z 0 7 7Q ? CD)\\\ ogY/3EgY1OS[\c[dQef ffr&c$V^8dQhRRRRRR/#)r5rOr namesrVr6r,r)r8s"r'r9r9s&TTTsTtTr&cxa\;QJdV3RlV4F 'gK R# R#!V3RlV44#)c3P<"TFp\SPV4xK R#5ir<)r r).0rDrOs& r' $_gateway_named_in..s SUT/ 4@@U#&TF)any)rOr sf&r'_gateway_named_inrs. 3SUS33S3S3SUS SSr&stale_serve_pidsfailed_respawn_pidsexternal_gateway_pidslive_gateway_pidscDV^8dQhRRRRRRRRRRR RR R R R R R RRRR/ #)r5rMr)restarted_servicesr1relaunched_profilesexternally_supervised_profiles killed_pidsrV failed_unitsrrXrrrzdict[str, set[int]] | Noner6list[dict[str, Any]]r)r8s"r'r9r9s|XX X-1XHLX$(X7:XJNX!X?IX& X 2 X  Xr&c aaaaaaaaa.p T;'g.U u0uFp \V 4kK up oT;'g.U u0uFp \V 4kK up o\T;'g.4\T;'g.4,oT;'g \4U u0uFp \V 4kK up oVeVU u0uFp \V 4kK up MRoT;'g \4U u0uFp \V 4kK up oT;'gR U u0uFp \V \4'gKV kK up oV eYV P 4UUU u/uF9wr\V4VU u0uFp \V \4'gKV kK up bK; up ppMRoRVVVV3Rllp/oVP Fnp\V\ 4'gKVPR8XgK.V!V4'dK>SPVP^4^,SVP&Kp RVVVVVVVVV3 RllpVP Fp\V\ 4'gKT PRVPRVPR VPR VPR V!V4/RUu/uF4pTVP;'g/9gK VVPV,bK6 upC4K V #uup iuup iuup iuup iuup iuup iuup iuup ppiuupi \d"p\P!R T4Rp?T #Rp?ii;i)uReconcile the plan's runtimes against what the restart phase DID. The platform restart branches each re-discover their own targets, so a runtime the plan saw can be missed with no signal. Returns one ``{kind, profile, pid, mechanism, outcome}`` row per planned runtime; outcome is ``restarted``, ``stopped``, ``failed``, ``deferred``, ``external`` or ``unaccounted`` (no bookkeeping mentions it — the blind-spot tripwire). Never raises. Serve/dashboard runtimes are reconciled in their OWN vocabulary and never borrow the gateway's outcome: with ``stale_serve_pids`` a pre-update serve whose incarnation is gone counts as ``restarted``, one still alive is ``unaccounted``; without the probe an untouched serve stays ``unaccounted``. A Desktop-supervised serve is ``deferred`` only when the survivor probe RAN and still lists its pid: the restart phase is forbidden to restart it out from under the app (it hosts the live Desktop chats), so it is handed back to its supervisor and surfaced. Without a probe result it remains ``unaccounted``, rather than claiming the app owns an unknown incarnation. ``failed_respawn_pids`` (serves the dashboard cleanup stopped and could not bring back) read ``failed`` before the probe, whose "gone" is exactly what a failed respawn looks like (#109290). The probe itself fails closed (unreadable ledger -> every planned serve is listed as surviving), so ``deferred`` means "not shown to be gone", not "observed alive". See #111494. ``live_gateway_pids`` (profile -> gateway PIDs alive for that profile AFTER the restart phase: control-socket identity, or a runtime-status record whose PID is still live) carries the same incarnation evidence for gateways: the plan identifies a gateway by the profile it SERVES, while the restart bookkeeping names the SERVICE it runs under, and those two disagree whenever a service serves a profile its name does not encode — a root-home launchd label running the sticky active profile, a hash-suffixed systemd unit for a custom ``HERMES_HOME``. No name rule can bridge that, so a planned PID that is gone while a gateway answers for the same profile counts as ``restarted``. A missing successor, or the planned PID still answering, stays ``unaccounted`` — the tripwire keeps its teeth. That credit needs an unambiguous baseline: a profile with SEVERAL planned gateway runtimes cannot be attributed to one successor (the fleet probe publishes at most one row per profile), so one replacement cannot have replaced two planned processes. Such a profile keeps the name-path verdict instead of letting an untouched sibling vanish behind a successor that can only have replaced one of them. That resolves conservatively on purpose: pairing a successor to the planned process it replaced would need a start-time identity that neither the plan record nor the fleet row carries, and a tripwire firing on an anomalous plan is the intended direction. Credit is deliberately NOT gated on restart bookkeeping either: the failure this fallback exists for already had bookkeeping (``restarted_services`` named the service label — only the profile↔label name match failed), and a gateway launchd respawned by itself has no restart-phase record at all while the fleet row still proves its successor runs the new code. See #91277. They never borrow the gateway's outcome: ``relaunched_profiles`` and ``hermes-gateway*`` name a different process that shares the profile, nothing more. See #100479. ``external_gateway_pids``: gateway pids the post-restart fleet probe verified as serving a DIFFERENT checkout than this updater (a ``profiles/`` symlinked to a separate install). An untouched gateway in that set is ``external`` — another install owns its restart — instead of ``unaccounted``. No evidence keeps the tripwire armed. See #120240. Nc V^8dQhRRRR/#)r5rOr r6r,r)r8s"r'r9,match_runtime_outcomes..__annotate__s [ [] [t [r&c<VPeVPS9dR#VPS9dR#\VS4;'g \VS4#)zHTerminal verdict already available from the restart phase's bookkeeping.T)rrr)rO failed_setkilled relaunched restarted_sets&r'_bookkeeping_resolves5match_runtime_outcomes.._bookkeeping_resolvessFuu QUUf_yyJ&$Q 3ZZ7HM7Z Zr&rc V^8dQhRRRR/#)r5rOr r6rr)r8s"r'r9r!s4 F4 F 4 F#4 Fr&c< aSPRJ;'dSPS9pSP\9dV'dR#SPS9gA\;QJdV3RlS4F 'gK RM RM!V3RlS44'dR#S eSPS 9dR#SP\ 9d S eR#R#S eR#\;QJdV3R lS 4F 'gK RM RM!V3R lS 44'dR#R#SP S 9dR#V'dR#\SS4'dR#\SS 4'dR#S eSPeS PSP 4pSPSP ^4^8pV'dSPV9d V'gR#V'd?\PR SSP ,SP SP4M>V'g7\PR SP SPSP4SPS9dR #R#) Nstoppedc3P<"TFp\SPV4xK R#5ir<rr)rurOs& r'r;match_runtime_outcomes.._outcome..s$2qfpab3NqyyZ[3\3\fprTFfailed restarteddeferred unaccountedc3P<"TFp\SPV4xK R#5ir<r-)rsrOs& r'rr/s$)k]jXY*EaiiQR*S*S]jru%s planned gateway runtimes for profile %r still need a verdict — successor evidence cannot attribute the restart, leaving pid %s on the name pathutNo post-restart gateway evidence for profile %r (planned pid %s via %s) — reconciling on restart bookkeeping aloneexternal) rrrrrCLIENT_OWNED_SERVE_SUPERVISORSrrrFrxryr) rO killed_herelive ambiguousr6failed_respawnsr#r$pending_gatewaysr%r& stale_serves successorss f r'_outcome(match_runtime_outcomes.._outcomes%%t+??Kvv%$55O+ss2qfp2qsss2qfp2q/q/q#+\0I'<<#AA#/ *(+(&)c)k]j)kccc)k]j)k&k&k{~q~~yyJ&"  J// M22"%!%%*; "~~aii0,00A>B AEE-i&LLa(3QYY LLC 155!-- "#(!2: E Er&rrrrloutcomez)Runtime-outcome reconciliation failed: %sr)rr)rrVrTrGrEr3r rrFrrrrrr`rxry)rMrrrrrrrrroutcomesr.r5prpidsr'_plannedr?rOrKrzr6r;r#r$r<r%r&r=r>s&$$$$$$$$$ @@@@@@@@@r'match_runtime_outcomesrFsr&(H]G'3'9'9r'9;'9c!f'9; *<*B*B*BD*BAQ*BD ,223c:X:^:^\^6__ #.#7#7#%#79#7Q#a9=M=Y(89(81A(89_c ,?,H,H35,HJ,Ha3q6,HJ 5 ; ; ;S ;! 1c@RAA ;S!,YjXoXoXq rXq}wS\tBt!z!S/AAAtB BXq r   [ [,. H8]33 8R1(;;5E5I5I(JZJZ\]5^ab5b !1!12& 4 F4 F4 FlA!]++QVVY 5!%%VWVcVcenpxyzp{m0Qk0Q1UV[\[c[c[i[igiUj188A;0Qkm O{<D99JSB rbl G @#FF OGsLLK' LLK,L%L9L LK10 L;K6 L L*K;> L LL,L2L L "L?LL  7LL L+A'LALL 8L L  L'LL  L M!L==Mc V^8dQhRRRR/#)r5rBrr6r,r)r8s"r'r9r95s77*>747r&c VUu.uF4qPR4R8XgKVPR4R8XgK2VNK6 ppV'dI\4\R4VF-p\RVR, RVR , R VR , R 24K/ VUu.uF4qPR4R8XgKVPR4R8wgK2VNK6 ppV'de\4\R 4VFIpVPR4R8XdRMRp\RVR, RVR , R VR , RV 24KK VUu.uFqPR4R8XgKVNK ppV'dH\4\R4VF,p\RVR, RVR , R VR , 24K. VUu.uFqPR4R8XgKVNK ppV'gR#\4\R4VF6p\RVR, RVR , R VR , RVR, 24K8 \R4\;QJdRV4F 'gK RM RM !RV44'd\R4\R4\;QJdRV4F 'gK RM RM !RV44'd^RIHpVFvpVPR4\ 9gKVPR 4'gK8V!VR ,VPR!44Fp\R"V R#VR , 24K Kx \;QJdR$V4F 'gK RM RM !R$V44'd,\ PR%8Xd \R&4\R'4R#uupiuupiuupiuupi)(u+Print a loud warning for runtimes the restart phase never touched. Returns True when at least one planned runtime is unaccounted; the caller escalates like a STALE/DOWN fleet row (an owed ``gateway_restart`` follow-up) — a promised restart silently missed is the class this phase exists to kill. rAr2rlreuf ⚠ Manual serve restarts deferred to their owner (reminders retained until the old processes exit):rrrrrrzW: relaunch `hermes serve` / `hermes dashboard`, or reconnect Desktop for an SSH backenduP ℹ Left to the Desktop app (still on pre-update code until it is relaunched):rfzZowned by a Desktop connected over SSH; it picks up the update when that Desktop reconnectsz.relaunch the Desktop app to pick up the updaterr6uR ℹ Left to their own install (separate checkout, not restarted by this update):r3Fu7 ⚠ Planned runtimes the restart phase never touched:u ✗ u — planned mechanism: z' Restart them manually, then verify:c3P"TFqPR4\9xK R#5irNrFrros& r'r.report_unaccounted_runtimes..[s =f55= ,f$&Tz< hermes gateway restart # active profilez; hermes -p gateway restart # named profilec3P"TFqPR4\9xK R#5irJrKrLs& r'rrN^s 9&Q55=L (&rO)_systemd_restart_commandsrrz z # pid c3"TF:qPR4\9;'dVPR4'*xK< R#5i)rrNrKrLs& r'rrNhs4[TZquuV} ,JJQUU>5J1JJTZs "AAlinuxzJ systemctl --user restart hermes-serve.service # unit-managed servez2 relaunch `hermes serve` / `hermes dashboard`)rFrrhermes_cli.main_dashboardrQrsysplatform) rBrMrr2actionr6missedrQcommands & r'report_unaccounted_runtimesrZ5s/" mAUU9%5%CakHZ^lHlaaF m   vwA HQvYKr!I,vahZH_` a#o8auuY'7:'E!%%P[J\`nJn8Ho  `aA{+}<sBr  HQvYKr!I,vahZuVHU V$F8auuY'7:'E8HF  bcA HQvYKr!I,vahZH I! GAUU9%5%FaaF G  G CD  6 2a l^6!E(C[\]^i\j[klm 34 s =f =sss =f === LM KL s 9& 9sss 9& 999 HAuuV} ,~1F1F8>9JAEERaLbcGF7)9QuXJ?@ d 3[TZ[333[TZ[ [ [||w&bc F G an pGHs9N5N5N5N:1N: N:N?N?8OOc V^8dQhRRRR/#r}r)r8s"r'r9r9os B B B Br&c^RIHpVPP4pVe VP 4VP R&R#R# \ d"p\PRT4Rp?R#Rp?ii;i)z@Attach the inventory to the active update receipt. Never raises.NrMz$Could not record plan in receipt: %s) rupdate_receipt_currentrFr>rAr`rxry)rMurcurrentrzs& r'record_plan_in_receiptraos^B.++//#  #'<<>GLL   B ;SAABsAA A3A..A3r<)serve dashboard)NN)2r# __future__rloggingrrU contextlibrr dataclassesrrrrrCtypingr r r getLoggerrrxr r)rbriror frozensetr7rjrprtr{rrrrrrrrrrrr rrFrZrarr&r'rks# /LL**   8 $  / /  /  6.y)Y 9(..=G G 7TO_ & "+I}+E!F9 22N.[(&hR &  &R2d* J gT X$(XLPX)- X 59 Xv7t Br&