Files
hermes-agent/agent
aleesposito85 6c6ce6149e fix(state): qualify lock/lease holder pid probes by PID namespace
A pid=<n> holder (compression lock, session turn lease, flock holder
record) is namespace-relative: process siblings sharing one state.db from
different PID namespaces (gateway + webui containers on one volume,
systemd PrivatePIDs=) see disjoint PID sets, so a sibling's live pid=
reads as absent to the namespace-blind probe and its unexpired row is
reclaimed under it. For a turn lease that ends the sibling's in-flight
turn ('another Hermes process took over this session'); for a compression
lock it splits the lineage; for a flock record it breaks a live lock.

Stamp every structured holder with the writer's PID-namespace identity
(/proc/self/ns/pid inode, via hermes_state_pidns) and qualify each probe:

* TTL-bounded rows (compression locks, turn leases): strict — a foreign
  or unstamped holder is never probed, it defers to its own expiry (at
  most the remaining TTL). A false defer self-heals at TTL; a false
  reclaim loses a reply. Strictness also stops the steal during a
  mixed-version rollout as soon as the reader restarts (the reader is
  the long-lived side of a container pair that restarts at different
  times), before every writer has restarted to stamp.
* No-expiry flock holder records: legal rollout — a foreign-namespace
  record is never probed, while an unstamped one keeps main's behavior
  (refusing to probe it would permanently disable orphaned-lock cleanup,
  the #100108 path). Protection begins as writers restamp.

Probe doubt already defers for the same reason (a wrongly-kept lease
self-heals; a wrongly-stolen one does not), so this extends an existing
contract rather than adding a new one.

(cherry picked from commit 4b1a29f63b8e6dec0a2724b5c2c4fac2bcc31c0e)
2026-10-03 17:44:58 +05:30
..
2026-09-11 09:31:13 -07:00