+ WjKD aR0t\0tRt^RIt^RIt^RIt^RIt^RIt^RIt^RIt^RI t ^RI t ^RI t ^RI H t HtHtHt^RIHt^RIHt^RIHt^RIHtHtHtHtHtHtHtHtH t H!t!H"t"H#t#H$t$H%t%H&t&H't'H(t(^RI)H*t*H+t+H,t,H-t-^RI.H/t/^R I0H1t1H2t2^R I3H4t4^R I5H6t6]Pn!R 4t8^t9R t:^ t;RtRt?Rt@RtARtBRRltCRsD]^k]E;QJd.R]%4FNK 5M !R]%44tF]E;QJd.R]%4FNK 5M !R]%44tGR]]3R] ]!3/tHRtIR1tJRtKRP]KP4^,.]KP4^R2Uu.uFpR3VP4,NK up,R4.,4tORtPRtQRtRR tSR!tTR"tUR#R/R$R%lltVR&R'ltWR(R)ltX!R*R+4tYR,R-ltZR.R/lt[R#uupi)5zSchema creation, column reconciliation, and FTS DDL management for SessionDB. Plain mixin for ``hermes_state.SessionDB`` (no ``__init__``/state of its own). Must never import hermes_state (cycle); shared constants live in hermes_state_common. N)DictListOptionalSequenceget_hermes_home)report_startup_progress)safe_json_loads)DEFERRED_INDEX_SQLFTS_CJK_STALE_KEYFTS_REBUILD_DEFERRAL_KEY FTS_STALE_KEYFTS_SQLFTS_STORAGE_VERSIONFTS_TOOL_CONTENT_PREFIX_CHARSFTS_TRIGRAM_SQLLEGACY_FTS_SQLLEGACY_FTS_TRIGRAM_SQL SCHEMA_SQLSCHEMA_VERSION_FTS_CJK_TRIGGERS _FTS_TRIGGERS_ephemeral_child_sql_sql_json_extractfts_rebuild_admission)_drop_orphan_fts_shadow_tablesbase_index_recognisedbase_source_view_is_stalefts_layout_current)_read_proc_argv) _delete_meta _meta_row)is_sqlite_lock_error)next_title_in_lineage hermes_stateN@g @g @message_uid_backfillmessage_uid_backfill_idi?c0V^8dQhR\R\/#)pidreturn)intstr)formats"GC:\Users\johnn\AppData\Local\hermes\hermes-agent\hermes_state_schema.py __annotate__r18sEEEEc\\V4pV'dRPV4R,#R#) :NxNz)rjoin)r+argvs& r0_holder_cmdliner88s' 3 D#'388D>$ D-DDr2c#8"TFpRV9gK VxK R#5i) _trigram_N.0ns& r0 r?BsKA+:Jaas  c#>"TFq\9gKVxK R#5iN)_FTS_TRIGRAM_TRIGGERSr<s& r0r?r?CsVm@U7U11ms  FTz[COALESCE(content, '') || ' ' || COALESCE(tool_name, '') || ' ' || COALESCE(tool_calls, '') a_CREATE TABLE session_model_usage ( session_id TEXT NOT NULL REFERENCES sessions(id) ON DELETE CASCADE, model TEXT NOT NULL, billing_provider TEXT NOT NULL DEFAULT '', billing_base_url TEXT NOT NULL DEFAULT '', billing_mode TEXT NOT NULL DEFAULT '', task TEXT NOT NULL DEFAULT '', api_call_count INTEGER NOT NULL DEFAULT 0, input_tokens INTEGER NOT NULL DEFAULT 0, output_tokens INTEGER NOT NULL DEFAULT 0, cache_read_tokens INTEGER NOT NULL DEFAULT 0, cache_write_tokens INTEGER NOT NULL DEFAULT 0, reasoning_tokens INTEGER NOT NULL DEFAULT 0, estimated_cost_usd REAL NOT NULL DEFAULT 0, actual_cost_usd REAL NOT NULL DEFAULT 0, cost_status TEXT, cost_source TEXT, first_seen REAL, last_seen REAL, PRIMARY KEY (session_id, model, billing_provider, billing_base_url, billing_mode, task) ) aINSERT OR IGNORE INTO session_model_usage ( session_id, model, billing_provider, billing_base_url, billing_mode, api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen ) SELECT id, COALESCE(model, 'unknown'), COALESCE(billing_provider, ''), COALESCE(billing_base_url, ''), COALESCE(billing_mode, ''), COALESCE(api_call_count, 0), COALESCE(input_tokens, 0), COALESCE(output_tokens, 0), COALESCE(cache_read_tokens, 0), COALESCE(cache_write_tokens, 0), COALESCE(reasoning_tokens, 0), COALESCE(estimated_cost_usd, 0), COALESCE(actual_cost_usd, 0), cost_status, cost_source, started_at, COALESCE(ended_at, started_at) FROM sessions WHERE COALESCE(input_tokens, 0) + COALESCE(output_tokens, 0) + COALESCE(cache_read_tokens, 0) + COALESCE(cache_write_tokens, 0) + COALESCE(reasoning_tokens, 0) > 0zfCREATE UNIQUE INDEX IF NOT EXISTS idx_sessions_title_unique ON sessions(title) WHERE title IS NOT NULLziINSERT INTO state_meta (key, value) VALUES (?, '1') ON CONFLICT(key) DO UPDATE SET value = excluded.valuegINSERT INTO state_meta (key, value) VALUES (?, ?) ON CONFLICT(key) DO UPDATE SET value = excluded.valuezVDELETE FROM state_meta WHERE key IN ('fts_rebuild_high_water', 'fts_rebuild_progress')zEDELETE FROM state_meta WHERE key = 'fts_tool_full_content_high_water' delete_firstcHV^8dQhR\R\R\R\/#)r*tableindentrEr,)r.r-bool)r/s"r0r1r1s)  s C $ [^ r2cvRV,pV'd V RV R2MRpRV V RV RV RV R V R V R V R VR R 2#)zNLegacy inline (pre-v23) FTS re-population script fragment (whitespace pinned).r4 DELETE FROM z; rC INSERT INTO z(rowid, content) z SELECT id, z' COALESCE(content, '') || ' ' || z) COALESCE(tool_name, '') || ' ' || z COALESCE(tool_calls, '') zFROM messages; Nr;)rGrHrEpadbodys&&$ r0_legacy_inline_reinsert_sqlrQsp ,C-9cU,ugS )rD TF3%|E7*< %| %7 %9 %0 %CRz  +r2c0V^8dQhR\R\/#)r*identr,)r.)r/s"r0r1r1s00c0c0r2cBRVPRR4,R,#)zDouble-quote an SQL identifier."z"")replace)rSs&r0_qrWs sD) )C //r2c$V^8dQhR\/#r*r,)tuple)r/s"r0r1r1s""e"r2c\ft\P\4p\;QJd+.R\ VP 444FNK 5M$!R\ VP 4444s\#)aSELECT statements that fail iff a live store is behind SCHEMA_SQL. Read-only opens skip ``_reconcile_columns()`` (no DDL against another profile's live DB), so healing callers run these afterwards: a missing table/column raises at prepare time. Derived from SCHEMA_SQL (a hand-maintained list went stale within days). Columns are table-qualified: an unqualified double-quoted identifier that fails to resolve silently degrades to a string literal (SQLite misfeature) and would pass on the stale store.c3a"TF<wopRPRPV3RlV44\S44xK> R#5i)zSELECT {} FROM {} LIMIT 0, c3V<"TFp\S4 R\V4 2xK R#5i).N)rW)r=colrGs& r0r?9schema_read_probe_statements...s'8b]aVYBuI;a3y9Q]as&)N)r/r6rW)r=colsrGs& @r0r?/schema_read_probe_statements..sC' 5 t ( . .tyy8b]a8b/bdfgldm n n5sAA)_READ_PROBE_STATEMENTSSessionSchemaMixin_parse_schema_columnsrrZsorteditems)tabless r0schema_read_probe_statementsrjsc%#99*E!&' %flln5' ' %flln5' "  "!r2c&a]tRt^toRtV3RlRltV3RlRltV3RlRlt]V3RlR l4t ]V3R lR l4t V3R lR lt ]V3RlRl4t ]V3RlRl4t ]V3RlRl4tV3RlRlt]V3RlRl4tV3RlRltV3RlRlt]RRRR/V3R lR!ll4tV3R"lR#ltV3R$lR%ltR&R'/V3R(lR)lltV3R*lR+ltV3R,lR-ltV3R.lR/lt]V3R0lR1l4tV3R2lR3lt]V3R4lR5l4t]RPV3R6lR7ll4t]V3R8lR9l4tV3R:lR;ltV3R<lR=lt R>t!V3R?lR@lt"V3RAlRBlt#V3RClRDlt$V3RElRFlt%V3RGlRHlt&V3RIlRJlt'V3RKlRLlt(V3RMlRNlt)ROt*Vt+R'#)Qreu>See module docstring — mixin for SessionDB (Schema cluster).c8<V^8dQhRS[PRR/#r*cursorr,Nsqlite3Cursor)r/ __classdict__s"r0r1SessionSchemaMixin.__annotate__sGNNtr2c RVPR4P4pTF*wr4TP Y4pTPRYS34K, R# \PdR#i;i \Pd#p\ P RT4Rp?R#Rp?ii;i)a=Move inline prompt snapshots into the shared content-addressed table. Any ``OperationalError`` mid-loop returns instead of raising: partial migration is safe (the legacy column stays a read fallback; next init resumes), whereas propagating left the version below 25 and re-ran this on every open (gateway crash loop).zFSELECT id, system_prompt FROM sessions WHERE system_prompt IS NOT NULLNzMUPDATE sessions SET system_prompt_hash = ?, system_prompt = NULL WHERE id = ?zv25 prompt dedupe paused after contention (%s); unmigrated rows keep the legacy inline prompt and the next schema init resumes the migration.)executefetchallrpOperationalError_store_system_promptloggerwarning)selfrnrows session_idprompt prompt_hashexcs&& r0_dedupe_legacy_system_prompts0SessionSchemaMixin._dedupe_legacy_system_promptss  >>"jkttvD#' J "77G c -#'''   ++ t   s(A$A/A,+A,/B&B!!B&c:<V^8dQhRS[PRS[/#r*rnr,rprqrI)r/rrs"r0r1rss  GNN t r2cVPR4VPR4R# \Pd5pTPT4'ghTP T4Rp?R#Rp?ii;i)z:CREATE VIRTUAL TABLE temp._hermes_fts5_probe USING fts5(x)z"DROP TABLE temp._hermes_fts5_probeTNF)rurprw_is_fts5_unavailable_error_warn_fts5_unavailable)r{rnrs&& r0_sqlite_supports_fts5(SessionSchemaMixin._sqlite_supports_fts5s_  NNW X NN? @'' 22377  ' ' ,  s"&A/)A**A/c8<V^8dQhRS[PRR/#rmro)r/rrs"r0r1rss#DDW^^DDr2cVPV4\FLp\P!\P 4;_uu_4VP RV 24RRR4KN R# +'giKc;i)DROP TRIGGER IF EXISTS N)_drop_fts_triggersr contextlibsuppressrprwru)r{rntriggers&& r0_drop_all_fts_triggers)SessionSchemaMixin._drop_all_fts_triggerssW '(G$$W%=%=>>!8 BC?>)>>>s A** A; cP<V^8dQhRS[PRS[S[,RS[/#)r*rnnamesr,)rprqrr.rI)r/rrs"r0r1rss/QQgnnQXc]QtQr2c V'gR#RPRV44pRV R2p\VPV\V44P 4^,4\ V48#)z;True unless every trigger in *names* (one DDL half) exists.F,c3&"TFpRxK R#5i?Nr;r=_s& r0r?;SessionSchemaMixin._fts_triggers_missing..s3UUzGSELECT COUNT(*) FROM sqlite_master WHERE type = 'trigger' AND name IN ())r6r-rurZfetchonelen)rnr placeholderssqls&& r0_fts_triggers_missing(SessionSchemaMixin._fts_triggers_missings`xx3U33 WXdWeefg6>>#uU|4==?BCc%jPPr2c6<V^8dQhRS[S[,RS[/#)r*rr,)rr.rI)r/rrs"r0r1rss#SS#S4Sr2c V'gR#RPVP44P4pRV9;'dRV9#)z?True when trigger SQL is a broad AFTER UPDATE (missing ``OF``).Fr4zAFTER UPDATE OF zAFTER UPDATE ON )r6splitupper)rcompacts& r0#_fts_update_trigger_needs_narrowing6SessionSchemaMixin._fts_update_trigger_needs_narrowings@((399;'--/!0RR5G75RRr2c:<V^8dQhRS[PRS[/#r)rprqr-)r/rrs"r0r1rss***C*r2c VPV4pR V'dRMR,pRPRV44pRV R2pVPWS4P4pVUUu.uF wruVP V4'gKVNK" pppV'g^#VFpVPRV 24K \ V,wrVP VRV 4VP VRV 4RV9dVPV4TPR R4P4p T 'dTP T ^,4'd'TPT4\PR 4\PR \V44\V4#uuppi \d)TPT4\PR 4hi;i)aReplace broad AFTER UPDATE FTS triggers with AFTER UPDATE OF variants (``IF NOT EXISTS`` never replaces an existing broad trigger). No FTS rebuild: correctness was already gated by WHEN clauses; OF only skips trigger evaluation. Returns the number dropped.messages_fts_cjk_updater]c3&"TFpRxK R#5irr;rs& r0r?HSessionSchemaMixin._migrate_broad_fts_update_triggers..s ;llrzHSELECT name, sql FROM sqlite_master WHERE type = 'trigger' AND name IN (rr messages_ftsmessages_fts_trigramz2CJK FTS re-ensure after UPDATE OF migration failedzASELECT sql FROM sqlite_master WHERE type = 'trigger' AND name = ?zeCJK FTS UPDATE trigger missing or still broad after UPDATE OF migration; marked stale and unavailablezPMigrated %d broad FTS UPDATE trigger(s) to AFTER UPDATE OF (no rebuild required))messages_fts_updatemessages_fts_trigram_updater;)r)_db_has_legacy_inline_ftsr6rurvr_FTS_DDL_ensure_fts_schema_ensure_fts_cjk_schema Exception)_quarantine_cjk_after_update_of_migrationry exceptionrrzinfor) r{rn legacy_layout update_namesrrr|nameto_dropbase_sql trigram_sqlrows && r0"_migrate_broad_fts_update_triggers5SessionSchemaMixin._migrate_broad_fts_update_triggerss 66v> MB%A yy ;l ;; XYeXffgh~~c099;)-_ID1Y1YZ]1^44_D NN4TF; <!) 7 A (> L % / ++F3 ..SUqhj $BB3q6JJ>>vFH  fhklshtu7|;` >>vF  !UV s'FF4F!!3Gc:<V^8dQhRS[PRS[/#rr)r/rrs"r0r1rs$s# L L L4 Lr2c VPR4P4pVRJ;'dRV^,;'gR9#)uTrue when ``messages_fts`` is still external-content over the raw ``messages`` table (FTS_STORAGE_VERSION < 3): its index holds a TRUNCATED projection for long tool rows that the checker/'delete' commands re-read as FULL content, a mismatch by construction. Such an index cannot be repaired in place — it must be 'rebuild'-filled from the aligned ``messages_fts_src`` view exactly once.zLSELECT sql FROM sqlite_master WHERE type = 'table' AND name = 'messages_fts'Nmessages_fts_srcrLrur)rnrs& r0_fts_index_is_misaligned_source2SessionSchemaMixin._fts_index_is_misaligned_source#sCnn Z (* $KK#5c!fll#KKr2c><V^8dQhRS[PRS[RR/#r*rnddlr,Nrprqr.)r/rrs"r0r1rs1s, G Gw~~ GC GTX Gr2c \VPR4P44pRpRpVP4FpWER,, p\P !V4'gK0RVP 4rdVP4pVPR4'dTpKlVPR4'dTVPRR^4PR4pVPVPR^4^,4V8XdRpKVeVPV4RpVPV4EK VP 4'd\P!R 4hR#) uSRun *ddl* statement by statement, skipping each ``DROP TRIGGER IF EXISTS x`` / ``CREATE TRIGGER IF NOT EXISTS x …`` pair whose trigger already exists with the same body. ``DROP TRIGGER IF EXISTS`` on an existing trigger takes SQLite's write lock (the ``CREATE … IF NOT EXISTS`` forms do not), so the unconditional drop+recreate that lets a changed trigger body roll out would otherwise block every open of a settled database behind a sibling process's transaction. ``sqlite_master.sql`` stores the CREATE text verbatim minus ``IF NOT EXISTS`` and the ``;``, so an exact comparison decides. z:SELECT name, sql FROM sqlite_master WHERE type = 'trigger'NrLrCrzCREATE TRIGGER IF NOT EXISTS zIF NOT EXISTS ;zincomplete DDL statement)dictrurv splitlinesrpcomplete_statementstripr startswithrVrstripgetrrw) rnrstored pending_drop statementlinecurrentrdesireds && r0&_execute_ddl_skipping_settled_triggers9SessionSchemaMixin._execute_ddl_skipping_settled_triggers0s1fnn%abkkmn&*  NN$D  $I--i88!#Y__%6wMMOE 9::&  ?@@!//*:BBII#N::gmmD!4Q78GC#'L'|,# NN7 ##%$ ??  **+EF F r2c><V^8dQhRS[PRS[RR/#rr)r/rrs"r0r1rsTs+ K K'.. Ks Kt Kr2c RpVP4FCpW#R,, p\P!V4'gK0VPV4RpKE VP 4'd\P !R4hR#)zAExecute a DDL script without ``executescript``'s implicit commit.rLrCzincomplete FTS DDL statementN)rrprrurrw)rnrrrs&& r0!_execute_ddl_script_transactional4SessionSchemaMixin._execute_ddl_script_transactionalSsn NN$D  $I)))44y) % ??  **+IJ J r2c><V^8dQhRS[PRS[RR/#)r*rnlegacyr,Nr)r/rrs"r0r1rs_s(4=4=W^^4=PT4=Y]4=r2c aaaaV'g\S4'gR#\S4oS'gSPS4'gR#SPR4P 4RJoRVVVV3RllpS'g-SPR4V!4SPR4R#SP SV4R# \ d%SPR4SPR4hi;i)uRe-point ``messages_fts`` at the stable ``messages_fts_src`` projection view and rebuild it ONCE (FTS_STORAGE_VERSION 2 -> 3). A v1/v2 base index carries token streams the raw-``messages`` external-content source cannot read back (truncated long tool rows, and tool rows whose full content was indexed under an old high-water mark), so in-place continuity is not achievable — the ONLY valid transition is a full rebuild from the view, under the shared cross-process rebuild admission. Legacy inline DBs skip this entirely (their index is self-contained; they still take the DDL on the optimize path), and so does a definition no release of this code created (a newer release's, after a downgrade).NzSELECT 1 FROM messages LIMIT 1cV^8dQhRR/#r*r,Nr;)r/s"r0r1GSessionSchemaMixin._migrate_misaligned_fts_source..__annotate__ps > >$ >r2c<\FpSPRV 24K SPR4S'dSPR4SPSR\4S'dqSPR4\ SR4eRSP SR4pV'dSPR4M%Vf"\ FpSPRV 24K SP\4SP\4R#) rz!DROP TABLE IF EXISTS messages_ftszDROP VIEW messages_fts_srcrz8INSERT INTO messages_fts(messages_fts) VALUES('rebuild')fts_rebuild_high_waterNrHINSERT INTO messages_fts_trigram(messages_fts_trigram) VALUES('rebuild')) _FTS_BASE_TRIGGERSrurrr!_fts_table_proberB_CLEAR_REBUILD_MARKERS_SQL!_DROP_RETIRED_TOOL_HIGH_WATER_SQL)rtrigramrn has_messagesr{ stale_views r0do_alignCSessionSchemaMixin._migrate_misaligned_fts_source..do_alignps*!8?@+ NN> ?;<  # #FNG DYZV%=>J"33F >0 NN6 7  BC  **68< ! FGBC s C/C0c@<V^8dQhRS[PRS[RS[/#)r*rnrr,)rprqr.rI)r/rrs"r0r1rss&!!W^^!3!4!r2cHVPRV34P4RJ#)z=SELECT 1 FROM sqlite_master WHERE type = 'table' AND name = ?Nr)rnrs&&r0_sqlite_table_exists'SessionSchemaMixin._sqlite_table_existss(~~ KdW (*D! !r2c:<V^8dQhRS[PRS[/#rr)r/rrs"r0r1rssgnnr2c naVPS4'gVPS4'dR#VPSR4pVRJdVRJ#\FpSP RV 24K SP R4VP SR\ 4'gR#VPSV3Rl4R#)ayInstall the source-filtered trigram view and purge historical rows (v29 cron exclusion, v30 subagent exclusion: both only change the view/trigger predicate and rebuild from it). Legacy inline indexes stay opt-in (their content is private to the vtable). A v1 external layout whose vtable still declares ``tool_calls`` is left to ``optimize-storage``: swapping the view underneath would make 'rebuild' read a column the view no longer has. Otherwise the inverted index still holds excluded rows until FTS5 rebuilds from the new view, which runs under the shared cross-process admission gate. Returns False to hold schema_version back.TrFrz,DROP VIEW IF EXISTS messages_fts_trigram_srcc&<SPR4#)rrurnsr0DSessionSchemaMixin._migrate_trigram_cron_exclusion..sFNN#mnr2)r%_db_has_trigram_tool_calls_projectionrrBrurrr)r{rntrigram_existsrs&f r0_migrate_trigram_cron_exclusion2SessionSchemaMixin._migrate_trigram_cron_exclusions  ) )& 1 1T5_5_`f5g5g..v7MN  %"U* *)D NN4TF; <*EF&&v/EWW **  n r2c8<V^8dQhRS[PRR/#rmro)r/rrs"r0r1rss$ g g gSW gr2c RVnVP\RVR7VP R4R # \d\P RRR7L8i;i \d\P RRR7R #i;i) zFail closed after dropping the CJK UPDATE trigger mid-migration: clear availability, persist ``fts_cjk_stale``, drop any residual trigger so a later open cannot IF-NOT-EXISTS over a gap.F1rz*Could not persist CJK FTS stale breadcrumbTexc_infoz.DROP TRIGGER IF EXISTS messages_fts_cjk_updatez;Could not drop residual CJK UPDATE trigger after quarantineN)_fts_cjk_availableset_metar rrydebugrur{rns&&r0rM9RcCcU34cU2NOhNiivwxcU!C58KLM   NN5 6r2cP<V^8dQhRS[PRS[RS[S[,/#)r*rn table_namer,)rprqr.rrI)r/rrs"r0r1rss+w~~38TX>r2c VPRV R24R# \d pTpRp?MRp?i\PdpTP T4'dATP T4'dTP T4MTPT4Rp?R#R\T4P49dRp?R#R\T4P49dhTpRp?MRp?ii;i\PRY$4R#) aTrue = queryable, False = absent, None = FTS module/tokenizer missing or content undecodable (index degraded, store accessible). Invalid UTF-8 surfaces as a bare UnicodeDecodeError on some builds and OperationalError("Could not decode to UTF-8") on others; both are caught so the probe never raises into init/recovery flows. Anything else (malformed schema, corrupt vtable) re-raises.zSELECT * FROM z LIMIT 0TNz no such tableFzdecode to utf-8zp%s probe encountered invalid UTF-8 in FTS content; search may return incomplete results until FTS is rebuilt: %s) ruUnicodeDecodeErrorrprwr_is_trigram_unavailable_error_warn_trigram_unavailablerr.lowerryrz)r{rnrr decode_excs&&& r0r#SessionSchemaMixin._fts_table_probes   NN^J!C$$C)c:<V^8dQhRS[PRS[/#rr)r/rrs"r0r1rss$LL7>>LW[Lr2c V\P!4pVPR\34P4pV'd\ V^,4MRp\V\4'dTM/p\VPRV44p\VPR^44^,p\VPRV44p \VPR^44^,p Ws8gV^8dTp\VU U u0uFwrV ^8gKV kK up p 4p WPR48wdT^rV\8dW7, \ 8dnVP#V\ R7pV'dO\$P'R W4VP)4p\VU U u0uFwrV ^8gKV kK up p 4p \+V 4;'d!V \,8;'dW9, \.8pRVR VRVRV RV RV R V/pVPR \\0P2!VR R734V'g RVnR#WnV'dB\$P'RWV , R, RP7RV 44\84M2V\8d(W7, \ 8d\$P'RW4\$P;RW(4R # \P dRpELi;i \\3dT^T^3wrxrEL.i;iuup p iuup p i)aRecord a deferral diagnostic for the foreign processes holding the DB; True = defer (holders remain). After ``_FTS_HOLDER_ESCALATE_ATTEMPTS`` deferrals spanning ``_FTS_HOLDER_ESCALATE_SECONDS``, provably inactive orphan Desktop backends are reaped and the holders re-checked. The orphan reap is the only exit, so a supervised peer (never an orphan) blocks forever: once the SAME PID set has blocked ``_FTS_HOLDER_FUTILE_ATTEMPTS`` deferrals over ``_FTS_HOLDER_FUTILE_SECONDS`` the record is marked ``futile`` and the escalation names the holders and the remedy that works from inside a gateway session (stop only the other holder; this process's own retry tick admits the rebuild). A changed holder set restarts that window.z2SELECT value FROM state_meta WHERE key = ? LIMIT 1N first_seenattempts holders_sinceholders_attempts holder_pids)min_age_secondszmReaped inactive orphan Desktop backend(s) %s after %d state.db FTS rebuild deferrals; checking holders again. last_seenfutilerDT) sort_keysFustate.db FTS repair has been blocked by the same holder(s) for %d deferrals over %.0f min (%s); waiting is futile. Stop ONLY the other holder(s) — this process keeps running and its own retry admits the rebuild within %.0fs of the holder leaving. `hermes doctor` shows this.r%r]c3D"TFpRV R\V4 2xK R#5i)zpid z: N)r8)r=r+s& r0r?BSessionSchemaMixin._defer_stale_fts_for_holders..5s#V+3DR(<'=>+s zstate.db FTS repair remains blocked after %d deferrals by holder(s) %s. Stop the listed processes (this process's own retry then rebuilds), or run `hermes sessions optimize-storage` with every holder stopped. `hermes doctor` reports this degraded state.zDeferred stale state.db FTS rebuild while foreign processes hold the database or WAL sidecars (%s); canonical writes and LIKE search remain available (deferral %d).)timerur rrpErrorr isinstancerfloatrr- TypeError ValueErrorrg_FTS_HOLDER_ESCALATE_ATTEMPTS_FTS_HOLDER_ESCALATE_SECONDS%_reap_inactive_orphan_desktop_holdersryerror_foreign_state_db_holdersrI_FTS_HOLDER_FUTILE_ATTEMPTS_FTS_HOLDER_FUTILE_SECONDSjsondumps_fts_deferred_holder_pidsr6_FTS_STALE_RETRY_SECONDSrz)r{rnforeign_holdersnowrparsedrecordr(r)r*r+r+_pathr,reapedr/ diagnostics&&& r0_defer_stale_fts_for_holders/SessionSchemaMixin._defer_stale_fts_for_holderssiik ..DG_Fahj  -0Q(T%fd33 Svzz,<=J6::j!459H!&**_c"BCM"6::.@!#DEI   zA~JOOOjcsQwccOOP **]3 3.11+ 4 49IMi9i??1M@F NOU#'"@"@"B$O%WOjcsUVwccO%WX k"   ; ; q q@SWq@q  *k3 Hm]h ],>@PRZ\b   u %tzz*'M N -1D *)4&  LLo!#6$"> V+VVXp  6 63;KOk;k LLZ[c   w  {}} C :& SDGCQRN AJ-1A SP&Xs<%K 3A:K> L L ' L% 7L% K;:K;>LLtimeout_secondsNc@<V^8dQhRS[PRS[RS[/#r*rnrr,r)r/rrs"r0r1rsDs,IIIDIcgIr2c TVP4pV'dVPW4'dR#\VPVR7;_uu_4pV'g!\P R4RRR4R#VP WR7uuRRR4# +'giR#;i)zAtomically rebuild stale base/trigram indexes and resume syncing. *timeout_seconds* bounds the admission wait (None = full startup budget, ``0`` = non-blocking retry). Fails closed: holders or a lost admission race leave the breadcrumb set.F)rMzDeferred stale state.db FTS rebuild: another process holds the rebuild authority; canonical writes and LIKE search remain available.Nr)r=rKrdb_pathryrz_recover_stale_fts_locked)r{rnrrMrDadmitteds&&$$ r0_recover_stale_fts%SessionSchemaMixin._recover_stale_ftsDs88: t@@YY "4<< Q QU]I R Q11&1HR Q Q QsB:B B' c <V^8dQhRS[/#rY)rI)r/rrs"r0r1rsTs;;T;r2c  VP'gR#VP4eRVnRVnR#VP'gVP fR#\ P!4p\VRR4pV\VRR48dIVe<\VP4UUu0uFwr4V^8gKVkK upp4V8XdR#RVn\\VRR44pVR8:d\pW,Vn\\V\R4R,\4VnVP ;_uu_4VP eVP'g RRR4R#VP P#4pVP%V4pVP'WgRR 7pV'dVP)V4RVn\*P,!\.P04;_uu_4VP P34RRR4VuuRRR4#uuppi +'giL";i +'giR#;i \4d\6P9R R R 7R#i;i) uRetry a deferred stale-FTS rebuild (gateway housekeeping tick). ``_recover_stale_fts`` fails closed at open, leaving search on LIKE; live write/search paths must never start a full rebuild, and a gateway opens state.db once for days, so "next open" never comes. Bounded doubling backoff, non-blocking admission, no new thread. True only when the index was rebuilt and sync triggers restored. Never raises. This is the in-process retry: bounded backoff from ``_FTS_STALE_RETRY_SECONDS`` doubling to ``_FTS_STALE_RETRY_MAX_SECONDS``, non-blocking admission (``timeout=0``) so a live holder is skipped and tried again later, no new thread — the caller is an existing periodic tick (gateway housekeeping). See #100108, #97940. FNgrB_fts_stale_retry_after_fts_stale_retry_intervalr(g@)rrMzUIn-process retry of the deferred stale state.db FTS rebuild failed; will retry later.Tr) _fts_stale_quarantine_reasonrYrZ read_only_connr3 monotonicgetattrrgr=r6rCminmax_FTS_STALE_RETRY_MAX_SECONDS_lockrnrrUrrrrpr4commitrryrz) r{rE deferred_pidsr+rHintervalrnr recovereds & r0retry_deferred_fts_recovery.SessionSchemaMixin.retry_deferred_fts_recoveryTs  " " $ 0+.D '-0D * >>>TZZ/nn&A4H 7= =$'+'E'E'GS'G3QR7'GS))-0D *'BCHI s?/H&)n#), 2C 83 >@\* & ::%T___ **,77? 33F[^3_ //758D2((77JJ%%'8 T.87  NNgrv    sg) H* 9H* 1I I&I'I1B I;H0  I I0 I ;I I II"I=<I=c@<V^8dQhRS[PRS[RS[/#rOr)r/rrs"r0r1rss'///4/TX/r2c VPVR4RJpT;'g!V'*;'dVPV4pRP R\ 44pV'd VR, pVR, pV'dM\V'd\MR,pV\R^4, pV'dV\R^RR7, pM[\V'd\MR,pVR , pV'd VR , pV\R ,\,R ,, pR V,V,R \ R\ R2,pVP!V4RTnRTnY@n\0P;R4R# \P\3dRpELhi;i \Pdp\"P$!\P&4;_uu_4TP(P+4RRR4M +'giM;iTP-T4TP(P/4\0P3RT4Rp?R#Rp?ii;i)zBody of :meth:`_recover_stale_fts`; caller holds rebuild authority. One write transaction, so no canonical writer slips between rebuild and trigger restoration.rTrLc3."TF pRV R2xK R#5i)rrNr;)r=rs& r0r??SessionSchemaMixin._recover_stale_fts_locked..s]}G4WIQ?}sz*DROP TABLE IF EXISTS messages_fts_trigram;zODROP VIEW IF EXISTS messages_fts_trigram_src;DROP TABLE IF EXISTS messages_fts;r)rEz9INSERT INTO messages_fts(messages_fts) VALUES('rebuild');zIINSERT INTO messages_fts_trigram(messages_fts_trigram) VALUES('rebuild');rzBEGIN IMMEDIATE;z&DELETE FROM state_meta WHERE key IN ('z', 'z ');COMMIT;NzfAutomatic rebuild of stale FTS indexes failed (%s); canonical writes remain enabled with FTS detached.FzVRebuilt stale state.db FTS indexes from canonical messages and restored sync triggers.)r_trigram_tokenizer_availablerp DatabaseErrorr r6rrrrQrrrrr r executescriptrrr4r^rollbackrreryr<r[ _fts_enabled_trigram_availablerz) r{rnrtrigram_presentrdrop_sql rebuild_sql recovery_sqlrs &&$ r0rS,SessionSchemaMixin._recover_stale_fts_lockeds l"33F__bee eK  )K 76}oTJbIccmn o     .  "1opU%%'9: #"O #6$$ $$W]]33 ##%4333  ' ' / JJ    LLEFI  sBF F,F)(F),I0,I+-H I+ H! A I++I0c:<V^8dQhRS[PRS[/#rr)r/rrs"r0r1rss  7>> d r2c zRpVPRV 24VPRV R24TPRT 24R# \PdIpTPT4'ghTP T4Rp?TPRT 24R#Rp?ii;i TPRT 24i;i)zAProbe trigram support without publishing a persistent FTS object.ztemp.hermes_fts5_trigram_probezDROP TABLE IF EXISTS zCREATE VIRTUAL TABLE z( USING fts5(content, tokenize='trigram')NFT)rurprwr!r")r{rnprobers&& r0ro/SessionSchemaMixin._trigram_tokenizer_availables0.ug67 < NN25'9ab c NN25': ;'' 55c::  * *3 / NN25': ;   NN25': ;s)AB!)BB$B!!B$$B:cR<V^8dQhRS[RS[S[S[S[S[3,3,/#)r* schema_sqlr,)r.r)r/rrs"r0r1rss-..#.$sDcN7J2K.r2c  Rp\P!VPR44P4p\P !\ 4;_uu_4^RIHpV!4R, R, p\P!VPRR74p\V\4'd(VPR4V8XdVPR4MRp\V\4'dc\;QJd*R VP!44F 'dK R M R M!R VP!444'd VuuRRR4#RRR4\"P$!R 4pVP'V4/pVP)R 4P+4Fwp/p VP)RV R24P+4p V FawrrppV 'dV .M.pV'dV'gVP-R4VeVP-RV 24RP/V4W&Kc WV&K VP14Ve\P !\ 4;_uu_4VP2P5R R R7\6P8!\;VP24RR7wpp\<P>!VRRR7;_uu_4p\P@!RVRV/V4RRR4\<PB!VV4RRR4V#V# +'giEL;i TP14i;i +'giL\;i +'giT#;i)uCExpected columns per table: execute SCHEMA_SQL in an in-memory database and read PRAGMA table_info (no regex). Memoized on disk keyed by a DDL hash (~85ms per startup otherwise); only the reference-side parse is cached — diffing the LIVE database still runs every startup. A corrupt/stale cache degrades to recomputation.Nutf-8rcachezschema_columns.jsonencoding schema_hashric3"TFmp\V\4;'dQ\;QJd*RVP44F 'dK RM RM!RVP444xKo R#5i)c3B"TFp\V\4xK R#5irA)r5r.)r=vs& r0r?ESessionSchemaMixin._parse_schema_columns...s.Y=az!S/A/A=sFTN)r5rallvalues)r=rbs& r0r?;SessionSchemaMixin._parse_schema_columns..sN0fu^b 4&YY33.Y4;;=.Y333.Y4;;=.Y+YYfusA7 A7A7 +A7FTz:memory:zNSELECT name FROM sqlite_master WHERE type='table' AND name NOT LIKE 'sqlite_%'PRAGMA table_info("")zNOT NULLzDEFAULT r4)parentsexist_okz.schema_columns.)dirprefixw)"hashlibsha256encode hexdigestrrrhermes_constantsrr@loads read_textr5rrrrrpconnectrqrurvappendr6closeparentmkdirtempfilemkstempr.osfdopendumprV)r cache_pathr_homeblobriref table_columnsrrbr_cidcol_namecol_typenotnulldefaultpkpartsfdtmpfhs& r0rf(SessionSchemaMixin._parse_schema_columnss  nnZ%6%6w%?@JJL   + + A7*-BBJ::j22G2DED+5dD+A+Adhh}F]alFlTXXh'rvF&$''CC0flfsfsfu0CCC0flfsfsfu0--, + +ooj)    j )79M++`hj(*{{%8R#@AJJLFJBDHw*2XJEr Z0* xy%9:%(XXe_DNGK&*c" IIK  !$$Y//!!''t'D"**s:3D3D/EN`aCYYr399RII}k8]SUWX: 3 + 0 }O, + +< IIK :90/ s^B!L%:L%(L%L%0A:L9+L93AL91A-M!M :M!% L6 9M  M M!! M2 c8<V^8dQhRS[PRR/#rmro)r/rrs"r0r1rssDr2c  VP\4pVP4Fwr4VPRV R24P 4pT'gK3TUu0uF qf^,kK ppTP4F1wrY9dK TPRT R\T4 RT 24K3 K R# \ P dKi;iuupi \ P drp \T 4P4p RT 9d\PRY8T 4Rp ? K\T 4'dh\PR Y8T 4Rp ? KRp ? ii;i) zADD every SCHEMA_SQL column missing from the live tables (SCHEMA_SQL is the single source of truth; column additions need no version-gated migration).rrz ALTER TABLE "z " ADD COLUMN r4zduplicate columnzreconcile %s.%s: %sNz;reconcile %s.%s failed; store remains behind SCHEMA_SQL: %s)rfrrhrurvrprwrWr.r#ryrr"rz) r{rnexpectedr declared_colsr|r live_colsrrrmessages && r0_reconcile_columns%SessionSchemaMixin._reconcile_columnssE--j9)1)9 %J ~~(;JYZ[cZd#ef '<*:++   1 // !#hnn.G)W4 %:JRUV +C00NNUWamp s5#B;C#C;CCE"17E.)EE"c`<V^8dQhRS[PRS[RS[S[S[,,/#)r*rnrGr,)rprqr.rlist)r/rrs"r0r1rs&s4 U U U Uc@S Ur2c VPRV R24P4pV'gR#\ RV4RR7Uu.uF q3^,NK up# \PdRpLNi;iuupi)zPRIMARY KEY column names of *table* in key order; None when the table is missing or has no columns (SCHEMA_SQL creates it correctly).rrNc3F"TFq^,'gKVxK R#5i)Nr;)r=rs& r0r?6SessionSchemaMixin._live_pk_columns..0s%>A1aas! !cV^,#)rr;)rs&r0r5SessionSchemaMixin._live_pk_columns..0s aPQdr2)key)rurvrprwrg)rnrGr|rs&& r0_live_pk_columns#SessionSchemaMixin._live_pk_columns%sy >>$7wb"ABKKMD$%>%>NSTS!STT '' D  Us#AA7A43A4c P<V^8dQhRS[PRS[RS[RS[RS[RR/#)r*rnrG legacy_namercopy_sqlr,Nr)r/rrs"r0r1rs3s>!!w~~!c!!RU!ad!uy!r2c *VPpVP'd\PWW#WE4R#VP R4\PWW#WE4TP R4R# \ dTP R4hi;i)uRENAME *table* to *legacy_name*, CREATE it fresh from *ddl*, copy rows back with *copy_sql*, DROP the legacy copy, recreate *indexes* — as ONE write transaction. The writer connection is autocommit (``isolation_level=None``), so without an explicit BEGIN each statement commits on its own and a sibling process opening the same state.db between RENAME and CREATE runs SCHEMA_SQL's ``CREATE TABLE IF NOT EXISTS`` first: our CREATE then fails with "table already exists", every row is stranded in *legacy_name* and the live table is empty. BEGIN IMMEDIATE holds the write lock for the whole rebuild so the sibling blocks (and retries under its lock patience) instead of interleaving; any failure rolls the RENAME back.NzBEGIN IMMEDIATEROLLBACKCOMMIT) connectionin_transactionre_rebuild_table_statementsrur)rnrGrrrindexesconns&&&&&& r0_rebuild_table!SessionSchemaMixin._rebuild_table2s        8 8 Zb l ()   8 8 Zb l x   NN: &  s A44Bc<V^8dQhRR/#rr;)r/rrs"r0r1rsKs  Y] r2cVPRV RV 24VPV4VPV4VPRV 24VFpVPV4K R#)z ALTER TABLE z RENAME TO z DROP TABLE Nr)rnrGrrrrrs&&&&&& r0r,SessionSchemaMixin._rebuild_table_statementsJs\eWK }EFsx 23C NN3 r2c8<V^8dQhRS[PRR/#rmro)r/rrs"r0r1rsSs  w~~ $ r2c VPVR4pVe VRR.8XdR#\PRV4VPVRRRR4R#) aRebuild ``gateway_routing`` when its PRIMARY KEY predates scoping (``session_key TEXT PRIMARY KEY``): the reconciler ADDs ``scope`` but SQLite cannot ALTER a PK, so every routing write fails (ON CONFLICT mismatch / cross-scope UNIQUE violation). Newest row wins a cross-scope session_key collision (INSERT OR REPLACE in updated_at order). Early builds of the routing-index migration (#59203) created the table with ``session_key TEXT PRIMARY KEY`` and no ``scope`` column. ``_reconcile_columns()`` ADDs the missing ``scope`` column on those databases, but SQLite cannot ALTER a primary key, so the shipped composite ``PRIMARY KEY (scope, session_key)`` never lands. On such tables every write path is broken: gateway_routingNscope session_keyz]gateway_routing has legacy primary key %r; rebuilding with composite (scope, session_key) keygateway_routing_legacy_pkzCREATE TABLE gateway_routing ( scope TEXT NOT NULL DEFAULT '', session_key TEXT NOT NULL, entry_json TEXT NOT NULL, updated_at REAL NOT NULL, PRIMARY KEY (scope, session_key) )zINSERT OR REPLACE INTO gateway_routing (scope, session_key, entry_json, updated_at) SELECT COALESCE(scope, ''), session_key, entry_json, updated_at FROM gateway_routing_legacy_pk ORDER BY updated_at ASC)rryrr)r{rnpk_colss&& r0_heal_gateway_routing_pk+SessionSchemaMixin._heal_gateway_routing_pkSsa''0AB ?g'=)AA  kmt   %'B  E r2c8<V^8dQhRS[PRR/#rmro)r/rrs"r0r1rsrs65657>>65d65r2c VPVR4pVeRV9dR#\PR\V44VP R4VP VRR\ R\4VP R 4R# \Pd!p\PRT4Rp?LCRp?ii;i TP R 4i;i) uHRebuild ``session_model_usage`` when its PRIMARY KEY lacks ``task``: installs already at v22+ when ``task`` landed carry the 5-column PK, the reconciler ADDs ``task`` but SQLite cannot ALTER a PK, and the v22 rebuild is unreachable — every upsert then fails (ON CONFLICT mismatch), silently zeroing accounting. Idempotent. FK-off window: INSERT OR IGNORE does NOT suppress FK violations, so an orphaned usage row would abort the rebuild (PRAGMA foreign_keys is a no-op inside a transaction; none is open here). OR IGNORE: COALESCE(task, '') on legacy NULL rows can collide with a genuine ''-task row — keep the first. Installs whose ``state.db`` reached ``schema_version >= 22`` before the ``task`` dimension was added carry a 5-column PRIMARY KEY ``(session_id, model, billing_provider, billing_base_url, billing_mode)``. See #73823. session_model_usageNtaskzdsession_model_usage has legacy primary key %r (missing task); rebuilding with composite 6-column keyzPRAGMA foreign_keys=OFFsession_model_usage_legacy_pkaINSERT OR IGNORE INTO session_model_usage ( session_id, model, billing_provider, billing_base_url, billing_mode, task, api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen ) SELECT session_id, model, COALESCE(billing_provider, ''), COALESCE(billing_base_url, ''), COALESCE(billing_mode, ''), COALESCE(task, ''), api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen FROM session_model_usage_legacy_pkz'session_model_usage PK heal skipped: %szPRAGMA foreign_keys=ON) rryrrgrur_SESSION_MODEL_USAGE_HEAL_DDL_SESSION_MODEL_USAGE_INDEX_SQLrprwr)r{rnrrs&& r0_heal_session_model_usage_pk/SessionSchemaMixin._heal_session_model_usage_pkrs''0EF ?f/  r 7O  01 5   -/NPm9"/5 > NN3 4'' I LLBC H H I NN3 4s*BB7B2-B:2B77B::C c \RRR7VPP4pVP\4VP V4VP V4VPV4VPR4VPV\4\P !\P4;_uu_4VPR4P#4eVPR4RRR4VP%V4pVPR \&34P#4pVRJVnVP('dVP+V4V'gVP-V4VPR 4P#4pVfVPR \.34\0P0P3\0P44P74pVP9R R \;\<P>!443RV3\@R3.4MVPCW^,V4VPEV4V'd#VPGV4VPIV4VPPK4R# \Pd"p\PRT4Rp?ELJRp?ii;i +'giEL;i)zCreate tables and FTS if missing, reconcile columns, run data migrations. Column additions are declarative via _reconcile_columns(), so reordered migrations can never skip a column; schema_version remains for data migrations only.@state_db_init_schemaphasezCREATE INDEX IF NOT EXISTS idx_messages_platform_msg_id ON messages(session_id, platform_message_id) WHERE platform_message_id IS NOT NULLz/idx_messages_platform_msg_id create skipped: %sNz3SELECT 1 FROM messages WHERE active IS NULL LIMIT 1z3UPDATE messages SET active = 1 WHERE active IS NULLz.SELECT 1 FROM state_meta WHERE key = ? LIMIT 1z*SELECT version FROM schema_version LIMIT 1z/INSERT INTO schema_version (version) VALUES (?)z;INSERT OR IGNORE INTO state_meta (key, value) VALUES (?, ?)store_instance_idstore_created_at_utcr )&rr^rnrqrrrrrurprwryrrr rrrrr r[rrrdatetimerEUTC isoformat executemanyr.uuiduuid4_MESSAGE_UID_BACKFILL_DONE_run_data_migrations_ensure_unique_title_index _init_fts_stamp_settled_fts_layoutre)r{rnrfts5_available stale_rowrnow_isos& r0 _init_schemaSessionSchemaMixin._init_schemasJ -CD""$Z( ' %%f- ))&1 Q NNe  33F> ^ $ % '  (*  NN14I3ObKc3d e  r2cD<V^8dQhRS[PRS[RS[RR/#)r*rncurrent_versionrr,N)rprqr-rI)r/rrs"r0r1rss;WWWW7>>WWCWWaeWWjnWWr2c  p\RRR7V^8d\P!\P4;_uu_4VP R\ RR4 R\R4 24VP R \ RR4 R\ RR 4 R 24R R R 4V^8dVPV4V^8dK\P!\P4;_uu_4VP \4R R R 4V^8dVPV4V^8d4V'd,VPV4'dVPRRVR7V^8dVP!V4VP#V4RpV^8dV'dVP%V4pV\&8d.V'd$V'dVP R\&34R #R #R #R # +'giELR;i \d"p\PR T4R p?ELcR p?ii;i +'giEL+;i)zVersion-gated chain for DATA migrations only (row backfills); column additions never belong here. Advances schema_version at the end unless FTS5 is unavailable.rstate_db_data_migrationsrzUPDATE sessions SET model_config = json_set(COALESCE(model_config, '{}'), '$._delegate_from', parent_session_id) WHERE parent_session_id IS NOT NULL AND model_configz$._delegate_fromz IS NULL AND sessionszUPDATE sessions SET model_config = json_set(COALESCE(model_config, '{}'), '$._delegate_from', '__orphaned__') WHERE parent_session_id IS NULL AND z$._branched_fromz IS NULL AND title IS NULL AND message_count <= 25 AND EXISTS (SELECT 1 FROM messages m WHERE m.session_id = sessions.id AND m.role = 'tool') AND NOT EXISTS (SELECT 1 FROM sessions ch WHERE ch.parent_session_id = sessions.id)Nz)v18 gateway metadata backfill skipped: %sfts_optimize_availabler rTz%UPDATE schema_version SET version = ?)rrrrprwrurr-_backfill_gateway_metadata_from_sessions_jsonrryr!_SESSION_MODEL_USAGE_V20_SEED_SQL _migrate_v22_session_model_usage_db_needs_fts_storage_upgraderr_advance_message_uid_backfillr r)r{rnr rrfts_migrations_completes&&&& r0r'SessionSchemaMixin._run_data_migrationss -GH R $$W%=%=>>-^=OPQR/ ;< >,^=OPQR,^=OPQRPP ?$ R  OBB6J R $$W%=%=>>@A? R   1 1& 9 R Nt7Y7YZ`7a7a MM2CM G R   . .v 6 **62"& R N'+&J&J6&R #2 ^ +0GN NNB^DU VM[0G +S?>>0 O H#NN O?>>s1AG!(G5,H$! G2 5 H!HH!$ H5 c8<V^8dQhRS[PRR/#rmro)r/rrs"r0r1rsss;;GNN;t;r2c T\V\4eR#\V\4pV'd\V^,4M^pVP R4P 4^,;'g^p\ P!4\,pW48djV\,pVP RW634TpW48gK0\ P!4V8gKLVP\\V4VR7R#VP\RVR7\V\4R#)aMint ``message_uid`` onto rows written before the column existed, one bounded slice per open. A single full-table UPDATE held the write lock for 261 s on an 835k-row / 4.8 GB store, so every sibling process timed out with "database is locked". Rowid-range chunks commit one at a time (the writer connection is autocommit) and an open spends at most ``_MESSAGE_UID_BACKFILL_BUDGET_S`` after its first chunk, so a large store converges over later opens. Until then a legacy row simply has no uid, which every reader already treats as "no identity yet". The walk is keyed on ``rowid``, not ``id``: on the declared table ``id INTEGER PRIMARY KEY`` is the rowid alias (same plan), but a store converted from JSONL still carries ``id TEXT`` with no PRIMARY KEY (``_reconcile_columns`` adds columns, never rebuilds the key), where ``MAX(id)`` is a str and an ``id`` range compares lexicographically (#141467).NzSELECT MAX(rowid) FROM messageszsUPDATE messages SET message_uid = lower(hex(randomblob(16))) WHERE rowid > ? AND rowid <= ? AND message_uid IS NULLrr ) r!r_MESSAGE_UID_BACKFILL_CURSORr-rurr3r__MESSAGE_UID_BACKFILL_BUDGET_S_MESSAGE_UID_BACKFILL_CHUNKrr.r )r{rnr done_throughhighdeadliners&& r0r0SessionSchemaMixin._advance_message_uid_backfillss V7 8 D  <=&)s3q6{q ~~?@IIKANSSRS>>#&DD! #>>E NNIKWJ_ a!L"t~~'78'C :C 0Nrsession_model_usage_v21aINSERT INTO session_model_usage ( session_id, model, billing_provider, billing_base_url, billing_mode, task, api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen ) SELECT session_id, model, billing_provider, billing_base_url, billing_mode, '', api_call_count, input_tokens, output_tokens, cache_read_tokens, cache_write_tokens, reasoning_tokens, estimated_cost_usd, actual_cost_usd, cost_status, cost_source, first_seen, last_seen FROM session_model_usage_v21z+v22 session_model_usage rebuild skipped: %s) rurr_SESSION_MODEL_USAGE_V22_DDLrrprwryr)r{rn legacy_pkrs&& r0r3SessionSchemaMixin._migrate_v22_session_model_usages M nhjI   -/HJf ?/ "'' M LLF L L Ms-AAB'BBc8<V^8dQhRS[PRR/#rmro)r/rrs"r0r1rss+++D+r2c  aVP\4R# \PEd1TPR4TPR4P 4p/p\ TT3RlRR7F+pTP T^,.4PT4K- SPSP,pTP4EF wrg\T4Uu.uF$pSPT^,4T8XgK"TNK& Muupip pT 'd T ^,MT^,p T R,FCvr\TPT4p TPRY34\P!RYm4KE TFWwrppY^,8wgKSPT4T8wgK.TPR T 34\P!R Y4KY EK TP\4TPR 4R# \P"d=TPR 4TPR 4\P%R 4R#i;i\P&dR#i;i)aUnique title index. Older DBs may hold duplicate titles from before the constraint. Per title a user-owned (user/NULL) row beats llm > derived (``_title_rank``). User rows are never dropped: the oldest keeps the title and newer ones become ``Title #k`` in started_at order, so the "#N"-preferring lookup still opens the newest (#126764). Among auto titles only, the newest highest-ranked keeps it; lower-ranked auto titles are cleared. Each change is logged. Must never abort opening the DB, so the repair is guarded.zSAVEPOINT title_repairzSELECT rowid, title, title_source, started_at FROM sessions WHERE title IN (SELECT title FROM sessions WHERE title IS NOT NULL GROUP BY title HAVING COUNT(*) > 1)cV<SPV^,4V^,V^,3#)r*) _title_rank)rr{s&r0r?SessionSchemaMixin._ensure_unique_title_index..s't7G7G!7MqQRtUVWXUY6Zr2T)rreverse:NNz-UPDATE sessions SET title = ? WHERE rowid = ?z-Renamed duplicate user session title %r to %rz0UPDATE sessions SET title = NULL WHERE rowid = ?z%Cleared duplicate %s session title %rzRELEASE title_repairzROLLBACK TO title_repairzICould not repair duplicate session titles; unique title index not createdN)ru_TITLE_UNIQUE_INDEX_SQLrpIntegrityErrorrvrg setdefaultr_TITLE_SOURCE_RANKTITLE_SOURCE_USERrhreversedr)r#rryrzr4rrw)r{rnr|groupsr user_ranktitlegroupruserskeeprowidrrenamed_titlesource_startedsf& r0r-SessionSchemaMixin._ensure_unique_title_indexs$  NN2 3%% n NN3 4 n~~n(*+-!$,ZdhiC%%c!fb188=j 33D4J4JK $*LLNLE)1_14;K;KAaD;QU^;^QQ_E_',58%(D%*2YY "78I8I5"Q'VY`Xhi'VX]g&/.__annotate__s 8 8 8r2c<SPSRS4SnSP'gR#SPSRS4SnSPSSSPR7S'gSP S4R#R#)rNrrr)rrsrtrr)rrn legacy_ftsr{rsr0ensure_and_rebuild8SessionSchemaMixin._init_fts..ensure_and_rebuilds{$($;$;FNT\$]!(((*.*A*A&J`bm*n')):t?V?V*"//7"r2c,<SPSSSR7#)rD)r)rnrEr{trigram_enabledsr0r.SessionSchemaMixin._init_fts..sD$=$= &z?%>%r2N)rrmessages_fts_cjk)rrr[rrUrrsrtrrrrrBrrr) r{rnorphan_repairedbase_triggers_missingtrigram_triggers_missingrFrrErIrs ff @@@@r0rSessionSchemaMixin._init_ftss 33F; 9 P   / /z / J ???&&vj&AA++F3X]]!]D$;d>U$,Z$8 !Hk**63EFkk.\kJk "**63HIvvMcgvMv % 8 8%226;MN$($;$;FNT\$]!$$$&*&=&=fF\^i&jO.=D+&+C::"    ? ##F+PUUUD3d6M1 0s B!! B1 c8<V^8dQhRS[PRR/#rmro)r/rrs"r0r1rs;s %%GNN%W[%r2c \4R, R, pVP4'gR#\VRRR7;_uu_4p\P!V4pRRR4\ X\ 4'gR#VP4EFRwrV\V4PR4'g\ V\ 4'gK>VPR4pV'gKYVPR 4p\ V\ 4'dTMRp TPR VPR 4;'gTV eV PR 4MRVPR 4V eV PR4MRVPR4V e\P!V4MRVPR4'gVPR4'd^M^\V434EKU R# +'giEL;i)uOne-time v18 backfill of gateway metadata from sessions.json. Only fills NULL columns — never overwrites data written by newer code.rz sessions.jsonNrrrrr}originaiUPDATE sessions SET session_key = COALESCE(session_key, ?), chat_id = COALESCE(chat_id, ?), chat_type = COALESCE(chat_type, ?), thread_id = COALESCE(thread_id, ?), display_name = COALESCE(display_name, ?), origin_json = COALESCE(origin_json, ?), expiry_finalized = CASE WHEN COALESCE(expiry_finalized, 0) = 0 AND ? = 1 THEN 1 ELSE expiry_finalized END WHERE id = ?rchat_id chat_type thread_id display_nameexpiry_finalizedmemory_flushed) rexistsopenr@loadr5rrhr.rrrurA) r{rn sessions_filefdatarentryr}rW origin_dicts && r0r@SessionSchemaMixin._backfill_gateway_metadata_from_sessions_json;s}()J6H ##%%  -w 7 7199Q6565tTlff0WWWWr;;>MMB++ZA<A>, -DF#88LF#r2c<V^8dQhR\PRR/#)r*rr,N)rp Connection)r/s"r0r1r1ps  !3!3  r2c\VP44VP'dVP4R#R#)a-Bring a raw ``state.db`` connection to the canonical SCHEMA_SQL shape and commit. Single durable-shape authority for callers that open ``state.db`` outside SessionDB. The async-delegation tool used to carry its own CREATE TABLE and ALTER column list for ``async_delegations``; it drifted from SCHEMA_SQL (same-name columns with different nullability/defaults depending on which authority touched the database first, #94691). This helper instead replays the canonical DDL (every statement is IF NOT EXISTS/idempotent) through :func:`apply_declared_schema`. N)rtrnrre)rs&r0reconcile_state_schemarxps,$++-(  r2cVV^8dQh/^\9d\\,;R&#)r*rd)__conditional_annotations__rrZ)r/s"r0r1r1s$x/..yr2)z]CREATE INDEX IF NOT EXISTS idx_session_model_usage_session ON session_model_usage(session_id)zVCREATE INDEX IF NOT EXISTS idx_session_model_usage_model ON session_model_usage(model)z# z ))]rzrkrrrloggingr@rrprr3rtypingrrrrrrhermes_startup_watchdogrutilsr hermes_state_commonr r r r rrrrrrrrrrrrrhermes_state_ftsrrrrhermes_state_holdersrhermes_state_searchr r!hermes_state_errorsr"hermes_state_titlesr# getLoggerryr9r:r>r?rCrcrrrrr8rdrZrBrrrrrr6rrr#rr-rRrrrrQrWrjrertrxr1)lnrzs0@r0rs   11-;! 220745   > * !#!# %38"!$E +/. KKKKKUVmVUUVmVV G_-tnF\5] ^a"!, $yy"--/23'D'O'O'QRSTV'WX'Wx"((*'WXY  %H!<mpnv%l! QV 0 ""ffR% $ U(Ys$ G