Files
hermes-agent/tests/hermes_cli
Teknium 92189e2d0a fix: POSIX update pause drains turns first and survives a killed update cleanly
Review fixes for the pre-swap gateway pause (independent review of a029ec2):

- Every gateway is drained before the code swap: the control socket's
  pause-for-update runs the request_restart drain (the post-update restart's
  SIGUSR1 path) and the update waits within the fleet's canonical budget
  (_gateway_drain_budget, 1905 s by default) with progress lines. systemd
  units and launchd jobs are stopped through their supervisor only after
  their drained gateway has exited, which also keeps Restart=/KeepAlive from
  relaunching it mid-update. A gateway that does not take the drain gets the
  supervisor stop / SIGTERM as before. The request is recorded (stop_sent)
  before it is sent and carries no planned-stop marker: the marker watcher
  takes the immediate signal-stop path and could fire first. Before: a
  supervised gateway got systemctl stop / bootout at once
  (restart_drain_timeout=0 cuts an in-flight turn), a bare one was SIGKILLed
  after 70 s.
- The pause record stores canonical identities (pause_record.identity), so
  recovery recognises a still-live gateway; the native birth stamp stays on
  the entry for _alive.
- Supervised posix_units go through drop_never_stopped / split_draining /
  backoff / hand-back like every other entry: a killed update no longer owes a
  live unit it never stopped, nor relaunches one still draining.
- Unknown cgroup membership (either side unreadable) never authorises
  stopping the unit; cgroup v1 name=systemd is read when v2 is absent.
- A record that cannot be written restores the token exactly (fresh or
  adopted), so the checkout's tree gate is not armed by a pause that never
  happened.
- A replayed bare gateway's environment follows the restart watcher it
  replaces: the launch profile's own named home keeps the launcher env (an
  exported bot token can be its only credential); every other home and the
  multiplexing root get the served-profile factory.
- Resuming a paused unit runs the definition repair the fleet restart runs
  first (_repair_unit_without_fatal_exit_park; launchd plist refresh).
- Shared POSIX tests use platforms("posix") instead of a module skipif, so
  the macOS lane imports them.

e2e cell (e) now reads the recorded stop request (record stop_sent) instead of
the planned-stop marker, which the drain path no longer writes.
2026-10-07 04:39:00 -07:00
..