From 7d1c9aeab739842fa42112c95d086a9897f2d513 Mon Sep 17 00:00:00 2001
From: Teknium <127238744+teknium1@users.noreply.github.com>
Date: Fri, 28 Aug 2026 11:04:26 -0700
Subject: [PATCH] fix: log swallowed reclaim failures + pin ContextVar dispatch
 invariant (review follow-up for #91217)

---
 gateway/run.py  | 11 +++++++++++
 hermes_state.py |  7 +++++++
 2 files changed, 18 insertions(+)

diff --git a/gateway/run.py b/gateway/run.py
index 581162a05b..9976234f95 100644
--- a/gateway/run.py
+++ b/gateway/run.py
@@ -14072,6 +14072,17 @@ class GatewayRunner(GatewayAuthorizationMixin, GatewayKanbanWatchersMixin, Gatew
                 # parameter, and a keyword call would TypeError into the
                 # failure branch — turning a passing suite into a silent
                 # no-op watcher. Arity is probed above.
+                #
+                # INVARIANT (do not weaken): this task is created inside
+                # ``_profile_runtime_scope(profile_home)`` but typically RUNS
+                # after the scope exits. It still sees the profile's home and
+                # secret scope only because ``set_hermes_home_override`` and
+                # ``set_secret_scope`` are ContextVar-based — ensure_future
+                # copies the current Context into the Task. If either seam is
+                # ever migrated to a thread-local or module global, secondary-
+                # profile handoffs silently regress to primary-config delivery
+                # (the exact bug fixed in #91217) while still recording
+                # handoff_state='completed'.
                 inflight[session_id] = asyncio.ensure_future(
                     _dispatch(row, session_id, session_db, profile_name)
                 )
diff --git a/hermes_state.py b/hermes_state.py
index 7c20af3dbd..3da58aa600 100644
--- a/hermes_state.py
+++ b/hermes_state.py
@@ -15247,6 +15247,13 @@ class SessionDB(SessionSearchMixin, SessionSchemaMixin, SessionPortabilityMixin)
         try:
             return self._execute_write(_do) or []
         except Exception:
+            # Swallow but never silently: a persistently failing reclaim
+            # leaves poisonous 'running' rows in place (sessions that can
+            # never hand off again), so the operator needs a trace of it.
+            logger.warning(
+                "reclaim_stale_running_handoffs failed; stranded 'running' "
+                "handoff rows (if any) were left in place", exc_info=True,
+            )
             return []