+ jHjRt^RIHt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI t ^RI HtHtHt^RIHtRt]R,tRt] P,!4tRR ltRR R lltR R ltRRRlltRRlt!RR]4t!RR]4t!RR]4t !RR]4t!]]3RRll4t"RRlt#RRlt$R R!lt%R"R#lt&RR$R%llt'R&R'lt(R(R)lt)R*R+lt*^t+R,R-lt,R.R/lt-R0R1lt.R2R3lt/R4R5lt0R6R7lt1R8R9lt2R:R;lt3RR<R=llt4R>R?lt5RR@RAllt6RB^RCR/t7RDRRER/RFRGllt8RRHRIllt9RJRKlt:RLRMlt;RNROltRTRUlt?RVRWlt@RXRYltARZR[ltBR\R]ltCR^R_ltDR`RaltERbRcltFRdReltG]H!43RfRglltIRhRiltJRRjRklltKRRlRmlltLRnRoltMRpRqltNRrRsltORtRultPRvRwltQRtRRxRyltSRzR{ltTR|R}ltUR~RltVRRltWRRltXRRltYRRltZRRlt[RRlt\RRlt]RRlt^RRlt_Rt`RtaRRltbRRltcRRltdRRlteRRRlltfR#)u Durable record of the gateways and services ``hermes update`` paused on Windows. The pause token used to live only in the updater's memory (plus an ``atexit`` resume), so a killed updater (console closed, ``taskkill``, power loss) left every paused gateway and SCM service stopped with nothing on disk saying so. The record is written under the ROOT Hermes home BEFORE anything is stopped, names its owner (pid + creation time, the update-marker identity format), is rewritten as the token changes, and is removed only after a verified resume. A later launch whose owner check finds the updater dead (and no update live) resumes it. One record per checkout (the file name carries a key of the install root): a checkout sharing the home never imports, relabels or certifies another checkout's paused set — its tree gate says nothing about the other tree. Resuming is gated on a whole tree: no interrupted-pull marker; at the pre-update HEAD, no tracked change beyond the ones present at pause time (git died before moving HEAD); at a moved HEAD, dependencies current for it where a launch syncs them (a build step may rewrite tracked files there). Every pause folded into a record keeps its own baseline (``baselines``): each one taken at the current HEAD must hold. Otherwise the record stays for the next launch, which runs after the interrupted-pull restore and the dependency sync. Custody: every mutation (write, claim, retire, discharge) happens while holding a kernel lock on ``/.hermes-update-paused-gateways.lock`` (flock / msvcrt, released by the kernel when the holder dies; the file is never deleted), and the read → judge → mutate decision is made inside that hold. A recovering launch claims a record by publishing ``...claim`` with its own identity already inside (atomic replace), then retires the source; a crash between the two leaves two files with ONE obligation id (``pause_id``), and an update that folds orphaned sets into its own record lists their ids under ``absorbed`` before retiring them. Readers treat a file whose id another file carries as a copy, never as a second obligation, and the next mutator retires it. Completing an obligation first adds its ids to ``.retired`` (atomic), then unlinks its files: an unlink Windows refuses (a reader holding the file without FILE_SHARE_DELETE) leaves a copy that is redundant by id, never an obligation that executes again. The list is read only under the mutex, and only its absence means "nothing retired": a list that cannot be read means unknown, so nothing is claimed and the list is never rewritten from that read. A list that reads but does not parse is unknown too while any record or claim exists; with none left it guards nothing and is set aside as ``.corrupt``. ) annotationsN)contextmanagerredirect_stdoutsuppress)Pathz.hermes-update-paused-gatewaysz.lockg$@cV^8dQhRR/#returnr)formats"C/home/ubuntu/.hermes/hermes-agent/hermes_cli/update_pause_record.py __annotate__r=s//d/c^\\4P4P^,#))r__file__resolveparentsr rr install_rootr=s > ! ! # + +A ..rc V^8dQhRRRR/#)r root Path | Noner strr )r s"r rrAsjj{jcjrc\P!\PP \ T;'g \ 444PR44P4R,#)utf-8:N N) hashlibsha256ospathnormcaserrencode hexdigest)rs&r _install_keyr$AsI >>"''**3t/E/E|~+FGNNwW X b b deh iircV^8dQhRR/#rr )r s"r rrEsNNTNrcN^RIHpV!4\ R\4 R2, #)get_default_hermes_root..json)hermes_constantsr) RECORD_STEMr$r(s r record_pathr.Es#8 " $+a 7Gu'M MMrc V^8dQhRRRR/#)r pid int | Noner dictr )r s"r rrJs P P* P Prc^RIHpVf\P!4M \ V4pVP V4pRTRVfR/#RVR 2/#)a1``{"pid", "ct"}`` with ``ct`` spelled like the update marker's line 3 (``ct:``). The creation time comes from the probe :func:`identity_is_live` judges with (``update_lock.process_create_time``: psutil, else stdlib), so a host without psutil still writes a provable identity instead of ``ct=None``. update_lockNr0ctzct:z.3f) hermes_clir5rgetpidintprocess_create_time)r0r5createds& r identityr<JsP '"))+#c(C--c2G 3god OOS ;N OOrc V^8dQhRRRR/#)r ident dict | Noner boolr )r s"r rrVseeKeDerc^RIHpT;'g/pTPVPR4;'g^VPR4;'gR4RJ#)aThe update marker's incarnation rule (``update_lock.incarnation_live``) for a recorded identity. Unprovable (alive, no readable creation time) counts as live: a record is never taken from, nor a paused process restarted over, a process that may still be the one recorded. r4r0r6NF)r7r5incarnation_liveget)r>r5s& r identity_is_liverDVsM ' KKRE  ' ' %(8(=(=Auyy?V?VRV W_d ddrc]tRt^atRtRtR#)RecordConflictz9The record names another pause whose owner is still live.r N__name__ __module__ __qualname____firstlineno____doc____static_attributes__r rr rFrFasCrrFc]tRt^etRtRtR#) RecordBusyz>#f,''++~~(* D6)N!OPP JJt   $  !K     #  '    "  !"K     #  sS,G:FB0G:$2GA G#F>'GG:F;;G:>GGG77G:cV^8dQhRR/#)r r rr )r s"r rrsrc \P!R4pV'dV#\\4;_uu_4^RIp^RIHp^RIHpVPRRR7pVeNVPe@VPP4'd \VP4uuRRR4#VPR4VP4reV!VP44PR4pVPVP!4VP#Wv4, V4pVe,VP4'd\V4uuRRR4#RRR4R# +'giR#;i)aQThe git ``hermes update`` runs, found without installing anything: PATH's, else the copy install.ps1 staged in PM's store (``_subprocess_compat.expose_pm_git`` puts it on PATH only inside the updater). A bare ``git`` on such an install dies with WinError 2, so every gate read would fail and the paused gateways would never be restarted.gitN)paths)LockfileT)allow_outdated)shutilwhichr Exceptionpmrqpm.lockrrinstalled_packagebinaryis_filer get_packagecurrent_target lockfile_pathversion store_root store_entry) foundrwrqrrrecordedpackagetargetrstageds r _git_executablers LL E  )  $''d'C  HOO$?HOOD[D[D]D]x'  ../1B1B1D5..0199%@ 0 0 2W5H5H5Y Y[ab  &.."2"2v;       sAE!E!-BE! E!! E2 c$V^8dQhRRRRRR/#)r rrargsrr z"subprocess.CompletedProcess | Noner )r s"r rrs"tC$Frc ^RIHpV!\4R\V4.VRRRR\P ^RR7 # \ \\P3dR#i;i) zA read-only git query in the updater's custody (``update_custody.run_git``: job-bound on Windows inside an update, custody config in argv); ``None`` when git cannot run.)run_gitz-CTrreplaceF)capture_outputtextencodingerrorsstdintimeoutcheckN) hermes_cli.update_custodyrrr subprocessDEVNULLOSError ValueErrorSubprocessError)rrrs&* r _gitrse2)4T;TRV]a ' ASAS]_gln n Z!;!; <s2; AAc V^8dQhRRRR/#)r rrr str | Noner )r s"r rrs))4)J)rc\VRRR4pVeVP^8wdR#VPP4;'gR#) rev-parsez--verifyHEADN)r returncodestdoutstrip)rresults& r head_sharsB $ Z 8F ~**a/ ==   ( (D(rc V^8dQhRRRR/#)r rrr list[str] | Noner )r s"r rrs$#3rc~\VRRRR4pVeVP^8wdR#\4pVPP R4p^pV\ V48dWW4,pV^, p\ V4^8dK3VP VR,4V^,R9gK[V^, pKf\V4#) zVTracked paths that differ from HEAD (index or worktree); ``None`` when git cannot say.statusz--porcelain=v1-zz--untracked-files=noN:NNRC)rrsetrsplitlenaddsorted)rrrqentriesindexentrys& r tracked_changesrs $"2D:P QF ~**a/ EEmm!!$'G E #g,    u:>  %) 8t  QJE %=rc$V^8dQhRRRRRR/#)r tokenr2rrr r )r s"r rrs!d+rcaT;'g \4pVPR\P!4P4oVPR.4p\ ;QJdV3RlV4F 'gK RM RM!V3RlV44'g)\ V4;p'dVPRS/VC4V#)zRecord what "the tree before this update" was, for the whole-tree gate: one baseline per pause (idempotent for this token's ``pause_id``), next to the baselines of the pauses it absorbed.pause_id baselinesc3J<"TFqPR4S8HxK R#5i)rNrC).0brs& r stamp_tree..s@iuuZ H,is #TF)r setdefaultuuiduuid4hexany tree_stateappend)rrrstaters&& @r stamp_treers  ! !<>D DJJL,<,<=H  b1I 3@i@333@i@ @ @zZ^O_F_eF_*h8%89 Lrc V^8dQhRRRR/#)r rrr r?r )r s"r rrsSSTSkSrc VR, P4'gR#\V4pR\V4RTRT;'g.Uu/uFq"\W, 4bK up/#uupi)zZHEAD, the tracked changes and their bytes now; ``None`` when *root* is not a git checkout..gitNpre_shadirty_at_pause dirty_digests)existsrr_digest)rdirtyr s& r rrse 6M ! ! # # D !E x~'7 U[[b[Q[TGDK$88[Q SSQsA%c V^8dQhRRRR/#)r r rr rr )r s"r rrs$:rc\P!VP44P4# \dR#i;iN)rr read_bytesr#rr s&r rrs8~~doo/0::<< s14 AAc$V^8dQhRRRRRR/#)r rr?rrr Noner )r s"r rrs! , ,[ ,# ,$ ,rc@V'd VPR4'd V'gR#VPR4;'g.FDpVPR4VR,8XgK"\0VPR.4mVk4VR&KF \/VCRR/C4R#)aPersist, BEFORE git writes the tree, the commit this run's checkout move goes to, on this pause's own baseline: an unmoved HEAD is later judged against what THAT move could write, never against refs a later fetch replaced. Raises when it cannot be recorded: the move must not run.rNr move_targets resume_neededT)rCrwrite)rrbaselines&& r mark_movers  *--VIIk*00b0 << #uZ'8 8'-.Y ^R0P.YRX.Y'ZH^ $1 *U *OT *+rc V^8dQhRRRR/#r rrr zset[str] | Noner )r s"r rrs   ? rc \4p\V4Fap\VRRRRRVR4pVeVP^8wdR#VP \ RVP PR444Kc V#) uTracked paths that differ between HEAD and any of *targets* — all a fast-forward, reset or merge toward them can write; ``None`` when git cannot say.diffz --name-onlyrz --no-renamesrz--Nr)rrrrupdatefilterrr)rtargetsrqrrs&& r _paths_betweenrsneE/D&-~vvW[\ <4??a/ VD$++"3"3D"9:; " Lrc V^8dQhRRRR/#rr )r s"r rrs))D)_)rc|\VRRR4p\VRRR4pVe'VP^8wgVeVP^8wdR#WPP4, P RR R 7P R 4pTUu0uF1qDP 4'gKTP 4^,kK3 up\TPP 44,pT'd\T4\8dR#\Y4# \ d.pL\dR#i;iuupi) aFor a pause with no recorded move (:func:`mark_move`: none attempted, or a record from before it was kept): the paths between HEAD and a commit the checkout fetched (``FETCH_HEAD``) or tracks (``refs/remotes``). ``None`` when git cannot say or nothing was fetched (target unknown).rz --git-path FETCH_HEADz for-each-refz--format=%(objectname)z refs/remotesN utf-8-sigrrr ) rrrr read_textrFileNotFoundErrorrrr_MAX_MOVE_TARGETSr)rwhererefsfetchedliners& r _paths_a_move_could_writers {L, ?E n&> OD }((A-TUAU,,,,..99;W`9agghlm ,3C74jjltzz|A7Cc$++J[J[J]F^^G c'l%66 $ ((  Cs+ ADD9*D9 D6(D61D65D6c(V^8dQhRRRRRRRR/#) r rrrr2r rr r@r )r s"r rrs.HHHHSHTHrcY!PR4;'g.9dR#VPR4pVRJ;'g$VPV4\W, 48H#)z*path* is as the pause saw it: dirty then, with the same bytes now (a baseline from before digests were kept has only the name).rFrN)rCr)rrr digestss&&& r _seen_at_pausersT LL!1288b9ll?+G d? G Ggkk$/74;3GGGrc(V^8dQhRRRRRRRR/#)r rrchanges list[str]at_head list[dict]r r )r s"r rr"s(y:)rc~aa VFo \V V3RlV44pV'gK#S PR4S PR4rTV'd \SV4MV'd \4M \ S4pVfTM'VUu.uFqw0VmT;'gRm9gKVNK uppV'gKVu# .#uupi)a$Tracked changes at an unmoved HEAD that git may have left half-written, for the first baseline that has any. A change the pause did not see counts only on a path the update's move could write: a build/sync step (or the user) rewriting any other tracked file is not git's doing, and holding the set for it would keep gateways stopped until someone cleans the file. The move is the one recorded before it ran, so a later fetch never narrows it; with none recorded the fetched refs stand in, and when even those are unknown every unseen change counts.c3R<"TFp\SSV4'dKVxK R#5irr)rr rrs& r r _half_written..*s aWTN4QY[_<`DDWs' 'r move_pathsr )rrCrrr) rrr unexpectedrrqwritabler tornrs f&& @r _half_writtenr"saWaa  !n5x||L7Q4;>$0%UnosUt%-zZ3wZT[v]e[vinititrt[vSvDDZ3w 4K I4xsB:B:B:c(V^8dQhRRRRRRRR/#)r rrrr2rrr r )r s"r rr6s0jjtjDj3CjHXjrcaaaSPR4'd\SSR,.4MRoSeVfR#\VVV3RlV44#)zPaths a move from *found*'s HEAD to the current one wrote that do not hold the current commit's bytes: tracked changes on them that were not already there, byte for byte, when the move started. ``None`` when git cannot say.rNc3b<"TF$qS9gK \SSV4'dK VxK& R#5irr)rr rrrs& r rtorn_by_move..=s(i74h.>$~VZ\acgGh$$7s // /)rCrr)rrrrsff&@r torn_by_mover 6sIB?c V^8dQhRRRR/#r rr2r r@r )r s"r rrgs  d t rcVPR4;'g.p\V4;'d5\;QJdRV4F 'dK R# R#!RV44#)aEvery pause in the set already found HEAD unreadable and none bound a tree move since. The gateways were serving exactly this tree when they stopped, and no step of the update wrote a file (``_checkout_move`` records its targets/paths before git writes), so restarting them leaves the tree as they knew it. Without this a ``.git`` git rejects (an empty ``HEAD``) kept the set stopped on every later launch, since no update can fetch until the checkout is repaired. rc3"TFhpVPR4RJ;'dIVPR4;'g+VPR4;'gVPR4'*xKj R#5i)rNrrrr)rrs& r r-_paused_on_unreadable_head..psb#A iD jj!%%*?*i*i155CV*i*iZ[Z_Z_`hZi%jjsA2A2A2A2FT)rCr@all)rrs& r _paused_on_unreadable_headr*gse +&,,"I  ?  ss##ssss## rc$V^8dQhRRRRRR/#)r rr2rrr ztuple[bool, str]r )r s"r rrus"[D v  "4 ( / / 1 1V V~ <)%00; ;IIk*00b 'Di55+;t+C11iD&bY%% *:d*B!h 5 526$55CXC^C^\^:_!Yb f&d+GBB 8eeLU\ghii K  ]DTF"SERSY\\] s4B B= B:B:"B:#B55B:= C  C r0r6ownerr c(V^8dQhRRRRRRRR/#) r rr2rJr?r rr rr )r s"r rrs/pppp;pRVprcT;'g \4p\4;_uu_4\V4pVRJ;'d+VR,PR4VPR48HpVeV'gVPR4\ \ 448wd!\ V RVPR4 R24h\VPR44'd'\ V RVR,PR 4 24h\V\\VR,444Vf V'dVe VR,M \4p\VR ^RVR\ \ 44RV/4RRR4R# +'giR#;i) zPersist *token*. The owner of the same pause is kept; another pause's orphaned set is merged into *token* (in place, so this run's resume brings it back); a live one refuses.Nrrrz- holds gateways paused for another checkout (r.rJz' holds gateways paused by live process r0schema) r.rmrIrCrrrFrD merge_intodrop_never_stoppedr2r<rB)rrJr existingsames&$$ r rrs?  ;=D :t#bb(9(=(=j(IUYYWaMb(b  ||N+s<>/BB$v-Z[c[g[ghv[wZxxy%z{{ W 566$v-TU]^eUfUjUjkpUqTr%stt u0hw6G1HI J =)-(2FHW%HJEdXq'5.#lnJ]_fhmno sA E95B=E93.s#UpkofgVYZ]^_Z`VaVakos!# stop_sent stopper_pid stop_markersrJN) rmaprrCrr8itemsr9rr<)rpidsrSrWms&&& r mark_stop_requestedras %%qs3 :J0K0Q0Qr'R%qUpkoUp%qrE C;)?)E)E2 FGE+99;E-~ . 9 ? ?R~fmfsfsqsezeze|D}e|]a]^SQ[RUVWRXEXe|D}~E. %xz"E~s)Dc V^8dQhRRRR/#r rr2r rr )r s"r rrs S S$ S Src \0\\VPR4;'g.4m\\ V44k4VR&\ V\ 4R7R# \dp\RT RT 24Rp?R#Rp?ii;i)aIPersist that *pid*'s stop request was issued (its planned-stop marker is on disk, or the POSIX pause records it just before its socket request): from here a live *pid* is draining and keeps its restart debt until it exits. Best effort: the marker itself is evidence until this lands; its consumer checkpoints before unlinking it.rYr\u4 ⚠ Could not record the stop request for gateway rEN) rr]rrCr9rr<rprint)rr0rHs&& r mark_stop_sentrfs|  X#c599[+A+G+GR"H X#cRUh- XYE+S e8:& S DSEC5QRRSs A$$ B /BB c$V^8dQhRRRRRR/#r r rmarkerr2r rr )r s"r rrs!!!T!4!D!rc 8^RIHp\VR,4p\\ 44FwrEVR,pVP R4;'g/P V4p\VP R44\VP R448wg6Y6P R4;'g.9gV'dV!Wp4'gK\ 0\\VP R4;'g.4mVk4VR&\WE4K R#) zCheckpoint a validated gateway consume BEFORE its marker disappears. Called under the pause mutex by the consumer. Preserve the holder's identity; this is evidence of a stop, not a transfer of the updater's custody. )_same_hermes_home target_pidrr[rZrUrYN) gateway.statusrkr_filesr.rCrr]rB)r rirkr0srcr2r recorded_paths&& r mark_stop_consumedrqs 1 f\" #CKM* W >288b==cB  -( )SM1J-K Kyy)9:@@bA$,=m,R,R #$Rc#uyy/E/K/K&L$Rc$RSkc +rc V^8dQhRRRR/#)r marker_pathrr r )r s"r rrsAAAArcFVPVPR,4#)z .accepted)r^r8)rss&r _accepted_pathrus  !1!1K!? @@rc$V^8dQhRRRRRR/#rhr )r s"r rrs&mmTm4mDmrc  \\V4\V44R# \d pTpRp?MRp?ii;i\ TRRR7;_uu_4p\ P !/TCRR/CT4TP4TP4\P!TP44RRR4R# +'giR#;i \d0p\RT RT R T 2\PR 7Rp?R#Rp?ii;i) a3The consumer's receipt when it cannot checkpoint into the record (busy mutex, refused replace): this incarnation accepted the request and drains until it exits, however long past the request's TTL. Written beside the marker, in the gateway's own home, never into the record. A home that refuses the new file (an ACL, a read-only directory) still lets the kept request be rewritten in place: stamped ``accepted`` it is the receipt. Torn mid-write it reads malformed, which recovery holds as unknown, never as "not asked". The consumer accepts the stop either way.Nzr+rr5acceptedTu1 ⚠ Could not record the accepted stop request rEz; file)rBrur2rrbr9r:truncater;rr<r=resysstderr)r rirHrefusedrAs&& r mark_stop_acceptedrsnT*DL9 m $w / /2 II22T2B 7 KKM HHJ HHRYY[ ! 0 / / / m A$r'RTUXTYZadakakllmsF" 949CA"B?5C? C CC D $DD c$V^8dQhRRRRRR/#)r rr2r rr rr )r s"r rrs!..T...rcT;'g \4p\4;_uu_4\V4pVe;VR,PR4VPR48Xd\ WV3.4RRR4R# +'giR#;i)zQRemove the record only while it still names this pause (decided under the mutex).Nrr)r.rmrIrC_retire)rr rPs&& r dischargersd  ;=D :  HW$5$9$9*$ES]I^$^ D(+, - s A A;; B c V^8dQhRRRR/#rcr )r s"r rr!s Z Z Z ZrcVPR4'dVPR4'dR#VPR4'gVPR4'd(/VCRR/CpVPRR4\V4R#\V4R# \d%p\ R\ 4 RT 24Rp?R#Rp?ii;i) uZMirror the token after a resume attempt: done → delete; anything still owed → rewrite.rrecoveryNrresume_deferredTu1 ⚠ Could not update the paused-gateway record rE)rCpoprrrrer.)rowedrHs& r syncr!s 99Z EIIj$9$9Z 99_ % %3D)E)E3e3_d3D HH& - $K e  Z A+-PRSVRWXYYZs)B B %B B CB>>CcV^8dQhRR/#)r r r@r )r s"r rr0s^^^rc^RIHp\4pVPV4'*;'dVP V4#)zA live update other than the one this process belongs to. The update tree holding the checkout lock (this process plus the partner whose marker it adopted) is not "elsewhere".r4)r7r5rholds_checkout_lockupdate_in_progress)r5rs r _live_update_elsewherer0s6' >D..t4 4 ] ]9W9WX\9]]rc V^8dQhRRRR/#)r r rr list[Path]r )r s"r rr8sII$I:Irc\VPP\P!VP4 R244#)z.*.claim)rr`globescaper8rs&r _claimsr8s1 $++""dkk$))&<%=X#FG HHrc V^8dQhRRRR/#)r r rr r )r s"r rr<s((((rc$VPR4#)z.retired) with_suffixrs&r _retired_pathr<s   J ''rc V^8dQhRRRR/#)r r rr set[str]r )r s"r rr@s!!4!H!rc\V4pVPRRR7p\ P!T4PR4p\T\4'g \Y4#TUu0uFp\T4kK up# \d\4u#\dp\ RT RT 24ThRp?ii;i \\3dRpLi;iuupi)zThe completed obligation ids (call under the mutex). Only an absent list is empty: one that exists but cannot be read raises :class:`RetiredUnknown`, so a completed obligation is never claimed again and the list is never rewritten from a read that failed.rrrz,cannot read the retired paused-gateway list rENids)rrrrrrQr9rFrCrAttributeErrorrGr_quarantine_retiredr)r rrrHris& r _retiredr@s4 FfYG jj""5) c4 "400 CqCFC   u fKF8SUVYUZ[\beef  ' !s:B%B=+CB:B:"B:#B55B:=CCc$V^8dQhRRRRRR/#)r r rrr rr )r s"r rrTs!  d D X rcXVP4'g\V4'd\RV R24hVPR4p\P !W4\RT 2\PR7\4# \ dp\RT RT 24ThRp?ii;i) a A retired list that reads but does not parse. While a record or claim of this checkout exists the list may be the only proof it is complete: unknown, fail closed. With none left it guards nothing, and keeping it would abort every Windows update: set it aside and go on.z the retired paused-gateway list z is malformedz.corruptz;cannot set aside the malformed retired paused-gateway list rENuQ ⚠ Set aside a malformed paused-gateway history (no paused set refers to it): ry) rrrQrrrrrer|r}r)r rcorruptrHs&& r rrTs {{}} ?x}UVV  ,Gu 6# ]^e]f gzz 5L uZ[aZbbdehdijkqttus B B)B$$B)c$V^8dQhRRRRRR/#)r r rcarrierslist[tuple[Path, dict]]r rr )r s"r rrds"  $ "9 d rc VUUUu0uF[wr#VR,PR4.VR,PR4;'g.OFqD'gK \V4kK K] pppp\V4pWV8:g)\\ V4R^R\ We,4/4VF5wrx\ \4;_uu_4VP4RRR4K7 R#uupppi +'giKS;i)aComplete the obligations *carriers* hold (call under the mutex): their ids (and every id they absorbed) go on the durable retired list FIRST; a failed read or write raises and deletes nothing. Then the files go; one that cannot be deleted is a redundant copy from here on.rrabsorbedrMrN) rCrrrBrrrrr?) r r_srcr2rrretiredro_bodys && r rrds%- bHjd']&&z2[d7m6G6G 6S6Y6YWY[q_` 3q6[ HC btnG >mD)Haw}@U+VW  g   JJL   b   s=C" C"C"C)) C: c$V^8dQhRRRRRR/#)r rorr2r2r r )r s"r rrrs!===T=d=rcVPR8XdVPR4MVPR4p\V\4'dV#\#)zWWho holds *src*: a record's owner, a claim's claimer (published with the claim itself).r+rJclaimer)suffixrCrGr2UNOWNED)ror2held_bys&& r _holderrrs=#&::#8dhhwdhhy>QG $//7.s41t)QQ c<SV,#rr )rrs&r _redundant..s PSTUPVr)keyc38<"TFqS8wgK VxK R#5irr )rrkeeps& r rrs8Fq4iFr) rCrrrrrr9valuesnextmaxr) rrrrror2oid redundantby_idcopiesrrs &f& @@r _redundantrsL!#H =$$Z066B6C   C# .75I#%E $w-##J/5526  >co(-32F MM#    S" % , ,S 1<B>B>+ B; c V^8dQhRRRR/#)r r rr rr )r s"r rrs  ; $ rc NT;'g \4pVP4'g3\V4'g"\V4P4'gR#\ \ 4;_uu_4\ 4;_uu_4\V4wrpVF3p\ \4;_uu_4VP4RRR4K5 \V4RRR4RRR4R# +'giKe;i +'giL.;i +'giR#;i)zZDelete copies of obligations another file already carries (crash leftovers of a transfer).N) r.rrrrrOrmrrr?_prune_retired)r _found_heldrros& r retire_redundantrs  ;=D ;;==}T7J7Q7Q7S7S *  vxx#*4= yC'"" #" t (  #"" (x   s<4D+D 2C,D D, C=7 D D D D$ c V^8dQhRRRR/#)r r rr rr )r s"r rrs ) ) )$ )rc \V4p\\V.\V4O54Uu.uF q"fKVNK ppV'gR#VUu0uF$p\ VR,P R44kK& ppW,p\ \4;_uu_4V'd$\\V4R^R\V4/4M\V4P4RRR4R#uupiuupi +'giR#;i)zYForget retired ids no file carries any more (a carrier that cannot be read raises first).NrrrMr) rr]rIrrrCrrrBrrr?)r rr2bodiesrcarriedrs& r rrstnG"4$)?)?@ U@tdd@F U 8>?1s1W:>>*-.G?  D '    --!UF4L/Q R $  & & (   V@   sC%C% *C*AC// D c V^8dQhRRRR/#)r rorr ztuple[Path, dict] | Noner )r s"r rrst0rc x\4pVPVP R\P!4 R\ P !4PR, R24p\4;_uu_4\V4pVe(VPR4\\448wd RRR4R#\V4wrEpW9g!W9gYUUu0uFwrxVkK upp9d RRR4R#\4VR&\VPR4;'g^4^,VR&\!W#4\#\$4;_uu_4VP'4RRR4RRR4W#3#uuppi +'giL!;i +'giTX3#;i \$dR#i;i)aTake *src* (an orphaned record or a dead claimer's claim) for this process; ``None`` when a concurrent launch won it or holds the mutex. The claim is published with our identity inside, then the source is retired; a crash between leaves a same-id copy :func:`_redundant` drops.r*:NNz.claimNrrr)r.r^r8rr8rrrrmrIrCrrrr<r9rBrrr?) ror miner2rrrr_s & r claimrsU =D >>TYYKq Qtzz|7G7G7K6LFS TD XX9D|txx73|~;NNX'.dm #F){c.#F=SFDAaF=S2S X'jDOdhhuo223a7DK $ %'"" # :>T #"X : sx'F*98F1F*;F E; ' F0F*:)F$3FF (F0F*;F F F F' F*'F** F98F9cV^8dQhRR/#)r r ztuple[dict | None, list[Path]]r )r s"r rrs  5 rc \4R.r\4Fwr#\V4pVfKVPV^,4\ 4;_uu_4\ V^,4;'g V^,p\ V\\VR,444pRRR4K W3# +'giK;i)zFor ``hermes update``: claim every orphaned pause and merge their sets. The caller records the merged set durably (its ``absorbed`` ids name the claims), then :func:`release_claims`.Nr) rrrrrmrIrNrOr2)adoptedclaimsrorwonr2s r adopt_orphansrsBVi Cj ;  c!f XXA<))3q6D *!C=$C=c$V^8dQhRRRRRR/#)r rr2r0rr bool | Noner )r s"r rr+s&MMDMsM{Mrc VPR4;'g/P\V44pV'gR#^RIHp\ W\ V4V4\ W\ \ V44R43pRV9dR#RV9dR#R#)uThe planned-stop marker this update's stopper wrote for *pid* is still on disk (the gateway's watcher has not consumed it yet): the request was issued even if the updater died before :func:`mark_stop_sent` — or the gateway's receipt of accepting it (:func:`mark_stop_accepted`). A marker naming another stopper (a user's ``hermes gateway stop``) is not. ``None``: one of them exists but cannot be read or parsed — the stop may have been accepted, so it is unknown.r[F)_PLANNED_STOP_MARKER_TTL_SNT)rCrrmr_names_requestrru)rr0r rverdictss&& r _request_on_diskr+s IIn % + + 0 0S :D 9u4:7QRu>$t*+EtLNH8#4L1ALuLrc ,V^8dQhRRRRRRRRR R /#) r rr2r0rr rttl_sr1r rr )r s"r rr<s/<<$ ??rc V^8dQhRRRR/#rr )r s"r rris$4rc $\V4pRVPR4;'g/P4UUu/uFwr#\V4V9gKW#bK uppRVPR4;'g.Uu.uF&p\VPR44V9gK$VNK( upRVPR4;'g.Uu.uF&p\VPR44V9gK$VNK( up/p\ W4V#uuppiuupiuupi)zRemove and return ``{"profiles", "unmapped", "posix_units"}`` whose recorded process is still running: it was asked to stop and has not exited yet, so it can only be restarted once it has.rrr0r)rrCr^rr)rliverWr0rdrainings& r split_drainingr#is e D599Z3H3N3NB2U2U2Wl2W[^_b[cgk[kVQV2Wl:)>)D)D")Dc)D1QUUSX\IZ^bIbQQ)DcEIIm,D,J,J,Ji,JasSTSXSXY^S_O`dhOh,JikH U O mcis#DD9!D D !D +D c$V^8dQhRRRRRR/#)r rr?rr2r r )r s"r rrts!++k+D+T+rc aa a a aaSeSM RRR/R.R./oRSR&SPR.4o S PV 3RlVPR4;'g.44SPR.4o S PV 3R lVPR 4.VPR4;'g.O44SPR/4pVPR4;'g/P4Fwr4VPW44K SPR.4oSPV3R lVPR4;'g.44SPR /4pVPR 4;'g/P4FwrFVPWF4K R V9gR S9dVPR 4VPR4rVf&\ VPR 4;'g/4;rx\ 0\ \SPR 4;'g.4m\ \V4m4SR &\ 0\ \SPR4;'g.4m\ \T;'g.4m4SR&SPR/4p VPR4;'g/P4Fwr:V PW:4K VPR4'd&RSR&RV9dSPRVR,4VPR4'dSVR,SR&SPR.4oSPV3RlVPR4;'g.44SPR.4o S PV 3RlVPR4;'g.44S 'dxSPR.4PV3RlS 44SPR.4SPR/4PVPR4;'g/4S#)zFold an orphaned pause into this update's token so its resume brings both sets back; its obligation id (and every id it absorbed) is recorded so a leftover copy is never resumed twice.rTr unmapped_pidsrrc38<"TFqS9gK VxK R#5irr )rrrs& r rmerge_into..}sU >19BTQQ >rrc3L<"TFq'gK VS9gKVxK R#5irr )rrrs& r rr(s#vZ!^_AdemuduAAZs $$ $rc38<"TFqS9gK VxK R#5irr )rrrs& r rr(R >B >UU B/H OOv J 7Z7;;z;R;X;XVXZvv B/Hkk*-33::< D&= B/H OORw{{:6<<"<RR!!,3JKK -33::<c&=7"&6%&?!++&674  #GKK $=$C$CD DI"()m3sEII>N4O4U4USU+V)mY\]`bkYl)m"n#$dc#uyy/E/K/K&L$dsSVX\XbXb`bOc$dek   12 6D$[[)>?EE2LLN )O{{,--+/'( G +   2G.s,`D_qUU6]]D_srTFr2rr-r,)r@rCr)rs&r _has_workrAs  *%QQ,`EIIjDYD_D_]_D_,`,`EIIjDYD_D_]_D_,`)`QQ99Z(QQ,1IIm,DQQHM RkHlQQpupypy{PqQ RRrc$V^8dQhRRRRRR/#r claim_pathrr2r2r rr )r s"r rrs!   D T rc ^RIHpV!4pVP\44'gg\ \ 4;_uu_4\ 4;_uu_4\T/\V4;'gTCR\/C4RRR4RRR4R#\W4VP4R# +'giL8;i +'giR#;i TP4i;i)zResume under the checkout lock, so no update mutates the tree between the gate and the verified start; an update that took the checkout after our claim gets the set back untouched.) UpdateLockrN) hermes_cli.update_lockrFacquire_checkoutrrrrmrBrIr_resume_fencedrelease)rDr2rFfences&& r _resume_claimedrLs2 LE  ! !,. 1 1 g   *&X$z*:*B*Bd&XYPW&X Y!) z(  !)    s0C*B1 C C1 C <C C C*c$V^8dQhRRRRRR/#rCr )r s"r rrs!66t646D6rc\4;_uu_4\V4;'gTp\\VR,44p\ V4pRRR4\ XX4\ V4pVPRRR7\V4'dU\R\PR7^RI H p\\P4;_uu_4V!V4RRR4MRVR&\!W$V4\#WW#4R# +'giL;i +'giL=;i \d*p\R T R 2\PR7Rp?LoRp?ii;i \!Y$T4\#YY#4i;i) rNT)rruE→ Restarting gateway(s) paused by an interrupted `hermes update`...ry)%_resume_windows_gateways_after_updateFru. ⚠ Could not restart every paused gateway: z0. Run `hermes update` or `hermes gateway start`.)rmrIrOr2r#_hold_backing_off_relaunch_keysrrArer|r}hermes_cli.update_cmd_windowsrOrrv_back_off_unready _hand_back)rDr2rr" attemptedrOrHs&& r rIrIs( J''4"4W #67!%(  eX&u%I LLtdL36 U   Y`c`j`j k [ ,,5e<-,&+E/ " %H5:U5- -, : >seD((.1jj : :: %H5:U5slgN@g @c V^8dQhRRRR/#rr )r s"r rrscc$c8crcVPR4;'g/Uu0uFpRV 2kK upVPR4;'g.Uu0uF/q"PR4'gKRVPR4 2kK1 up,VPR4;'g.Uu0uF0pRVPR4;'gVPR 4 2kK2 up,#uupiuupiuupi) rprofile:rr? unmapped:r0runit:unitlabelr)rr8rs& r rQrQs+099Z+@+F+FB+F G+F4xv +F G3899Z3H3N3NB3N`3NaRWRWX^R_)155<.)3N` aBG))MBZB`B`^`B`aB`QquuV}66g78B`a bc G`asC$ C)(C)%C.C.c$V^8dQhRRRRRR/#)r rr2rr rr )r s"r rrs& R RT R R$ Rrc a \P!4pVPR4;'g/P4UUu0uF2wr4T\VPR4;'g^48gK0VkK4 uppo VR,P VR,P4UUu/uFwrVRV 2S 9gKWVbK upp4VR,P V 3RlVR,44VR,P4UUu/uFwrVRV 2S 9gKWVbK uppVR&VR,Uu.uFqwVR,9gKVNK upVR&VPR4;p'dIVR,P V 3RlV44VUu.uFqwVR,9gKVNK upVR&R #R #uuppiuuppiuuppiuupiuupi) zMove the profile/unmapped/supervised entries still inside their relaunch backoff from *token* into *held* (beside the draining ones): owed, not relaunched by this launch.relaunch_retrynext_atrrXrc3<"TF:qPR4'gKRVPR4 2S9gK6VxK< R#5i)r?rYr0Nrrrwaitings& r r$_hold_backing_off..s=t'8!EE&MAPYZ[Z_Z_`eZfYgNhlsNsAA'8sAA Arc3<"TF;pRVPR4;'gVPR4 2S9gK7VxK= R#5i)rZr[r\Nrrbs& r rrds@"lequuV}?^?^PQPUPUV]P^>_7`dk7k11esAA AN)rerCr^rVrr8) rrnowrrnrWrr1rcs && @r rPrPs ))+C&+ii0@&A&G&GR%N%N%P{%PzsTWZ_`e`i`ijs`t`y`yxyZzTzss%P{GeJ.?.E.E.Ge.GdaXVWUX>]dKdTQT.GeftuZ'8tt*/ *;*A*A*Ce*C$!RSQT~]dGd*CeE*$)*$5S$5q$zBR9R$5SE* -((u( ]"""le"ll+0Q5aT-=P4P5Qm) |eeS RsB$F=(F=5F=+G >G G "G :GGG-Gc(V^8dQhRRRRRRRR/#)r rr2rUrrr rr )r s"r rrs.ZZTZhZdZtZrc \VPR4;'g/4pVPR4'g\V4pVFpWT9dVPVR4K\ VPV4;'g/PR4;'g^4^,pRVR\ P !4\ \^\ V^, ^4,,\4,/W5&K \V4\V4,pVP4UUu/uFwrXWW9gK WXbK uppVR&R#uuppi)zStart or extend the backoff of each attempted entry the resume left owed (not ready, not launched); forget it for one that came back. A tree-gate deferral attempted nothing.r_rNattemptsr`) r2rCrQrr9remin_RELAUNCH_RETRY_BASE_S_RELAUNCH_RETRY_MAX_Sr^) rrUrretryunreadyrrjrrs &&& r rSrSs +,22 3E 99& ' ' 'C! #t$EIIcN00b55jAFFQG!KH$h 499;&c(Q,.B)BBDYJ[<[\EJ  % >$#7 7DE c ,V^8dQhRRRRRRRRRR/#) r rDrr2r2rr"r rr )r s"r rrs6MM4MtMDMDMTMrc /VPR4;'g/CVR,CVR&.VPR4;'g.OVR,OVR&VPR4'd*.VPR4;'g.OVR,OVR&\VPR4;'gMVPR4;'g4VR,;'g#VR,;'gVPR44p\\4;_uu_4\ 4;_uu_4V'dLVP 4UUu/uFwrVVR 9gKWVbK ppp\ V/VCR/VCRR/CR\/C4M*\\4T\V4;'gT3.4R R R 4R R R 4R #uuppi +'giL ;i +'giR #;i) utRetire the claim when nothing is owed; else hand it back unowned for the next launch — this launch may live for hours (a chat) — which retries at once, except a relaunch that did not become ready (its backoff, :func:`_back_off_unready`). A draining process stays owed until it has exited and been restarted. A failed rewrite leaves our claimer line, dead once we exit.rrrrrrTrN)rr) rCr@rrrmr^rBrrr.rI)rDr2rr"rrvaluekepts&&&& r rTrTs REIIj177RQHZrs^#J#    @@. 7 "  oo /jN PeDWDGGdWdeGe(>0)&S , )(H(j  . D"* !T4 ptpp$ # S!&Am.. Z^I(!(  = U^T_2@   )0    (19 M"<*g @ +\R 6<c RZ"M& P Pr