Fix Kanban DB write safety and JSON error handling

[ha001985]

Summary

Adds busy_timeout lock-contention mitigation, write_txn depth tracking keyed by connection/thread, per-board write serialization, corrupt/init JSON handling so Desktop does not get empty stdout, and preserves the list --json array contract.

Changes

• DB write safety: busy_timeout raised to 30s; write_txn depth tracking per connection/thread to detect and reject nested writes
• Per-board serialization: boards now serialize all writes through a dedicated RLock path
• Corrupt/init JSON guard: list --json catches corrupt/invalid JSON and falls back gracefully instead of emitting empty stdout
• Contract preservation: list --json always returns a JSON array (never empty, never malformed)

Tests

• Test proof: 350 passed, 1 skipped
• Stress proof: 8 threads × 20 writes, integrity_check=ok; 5 writers + 5 readers, integrity_check=ok
• Live validation: 20 tasks created, 5 links, 5 archived, block/complete/unblock operations all succeeded, JSON parse confirmed valid, dry-run dispatch clean

Validation

Live validation was run on a fresh test board kanban-postfix-validation with the following results:

• 20 tasks created, 5 dependency links established, 5 tasks archived
• Block/complete/unblock operations all succeeded
• hermes kanban list --json returned valid JSON with correct status breakdown (ready=10, todo=2, done=2, blocked=1)
• PRAGMA integrity_check returned ok at every phase
• Dry-run dispatch executed without error

Breaking changes

None. The Kanban board is backwards-compatible with existing data. Gateway auto-dispatch remains disabled by default (HERMES_KANBAN_DISPATCH_IN_GATEWAY=0) as the correct production default.

[alt-glitch]

Competes with #33325 and #32759 — all three add busy_timeout and write-safety hardening to kanban SQLite. Root issue: #32532. Consider consolidating.

[ha001985]

Competes with #33325 and #32759 — all three add busy_timeout and write-safety hardening to kanban SQLite. Root issue: #32532. Consider consolidating.

Thanks for the context. I’m happy to consolidate with #33325 / #32759 and align this PR with the preferred direction.

This PR overlaps on busy_timeout, but it also includes a few additional pieces that may be useful for the final consolidated fix:

• write_txn depth tracking keyed by connection/thread
• per-board write serialization behavior
• corrupt/init JSON handling so Desktop does not receive empty stdout
• preservation of the list --json array contract for the Kanban UI
• cmd_kanban exit-code propagation
• focused regression tests and concurrency stress tests

Validation performed locally:

• tests/hermes_cli/test_kanban_db.py → 175 passed
• tests/hermes_cli/test_kanban_core_functionality.py → 175 passed, 1 skipped
• stress: 8 threads × 20 writes → integrity_check=ok
• stress: 5 writers + 5 readers → integrity_check=ok
• live validation board: 20 tasks, 5 links, 5 archived, block/complete/unblock operations, list --json parse check, integrity_check=ok at every phase

Please let me know whether you’d prefer:

1. I rebase this PR on top of one of the existing PRs,
2. I split out only the non-overlapping parts,
3. or I close this PR and move the useful pieces into the preferred consolidation branch.

[teknium1]

Thanks for the detailed validation and for offering to consolidate with the related write-safety PRs.

Problems

• The proposed dispatcher pidfile is not an atomic lock: two processes can both pass the existence check, overwrite the file, and dispatch concurrently. Current main instead has a board-scoped non-blocking OS file lock in hermes_cli/kanban_db.py:1415-1497, used by dispatch at hermes_cli/kanban_db.py:7222.
• The _cmd_init() error handling cannot handle initialization failures because kanban_command() calls kb.init_db() before handler dispatch (hermes_cli/kanban.py:924-936).
• The fixed 30-second busy-timeout tests are stale: current main defaults to 120 seconds at hermes_cli/kanban_db.py:1287-1313 and already retries safe transaction boundaries in commit 204a67f0c85b721f55bd11a924c5cd814c09cbe6.

Suggested changes

• Preserve the still-needed list --json corrupt-init array response in the pre-dispatch error path, with a focused regression test.
• Drop the pidfile and timeout/RLock portions in favor of current main's lock and retry mechanisms.

Automated hermes-sweeper review.