fix(gateway): close ResponseStore + dispose unowned adapter on reconnect failure by Fearvox · Pull Request #37679 · NousResearch/hermes-agent

Fearvox · 2026-06-02T22:06:32Z

Problem

Three separate code paths in the gateway's platform reconnect loop leak file descriptors on every retry. After ~12 hours of continuous failure the default 2560-fd ulimit is exhausted and the gateway becomes a zombie — every open() raises OSError: [Errno 24] Too many open files and the only working channel (Telegram) drops silently. See #37011 for the original report with reproduction steps and lsof evidence.

Root cause

APIServerAdapter.__init__ opens a ResponseStore SQLite connection that holds 2 fds (the database file and its WAL sidecar).
APIServerAdapter.disconnect() previously only stopped the aiohttp web server — the ResponseStore connection was never closed.
The reconnect watcher in _platform_reconnect_watcher constructs a fresh adapter on every retry attempt. When the connect call fails (3 paths: non-retryable error, retryable error, exception during connect), the adapter is dropped without ever being installed on self.adapters, so nothing else calls its disconnect(). The 2 ResponseStore fds stay open until GC sweeps the unreachable object — and Python's cyclic GC does not do that promptly for asyncio-bound native handles.

Rate: 2 fds × 1 retry × (3600s / 300s backoff cap) ≈ 12 fds/hour. At 2560-fd ulimit: ~12h to exhaustion.

Fix

APIServerAdapter.disconnect() now also calls self._response_store.close() (with a try/except so a SQLite close failure doesn't abort the aiohttp teardown).
New module-level helper _dispose_unused_adapter(adapter) in gateway/run.py that calls adapter.disconnect() and swallows any exception (so half-constructed adapters whose __init__ crashed don't kill the watcher loop).
_platform_reconnect_watcher calls _dispose_unused_adapter() in all three failure paths: non-retryable, retryable, and the except Exception arm. adapter = None is initialized before the try so the except arm can see the partial construction.

Tests

New file tests/gateway/test_platform_reconnect_fd_leak.py with 7 regression tests covering:

All three failure paths in the reconnect watcher (non-retryable, retryable, exception-during-connect) — each verifies that the unowned adapter's disconnect() was called and that the ResponseStore fds are released.
The _dispose_unused_adapter helper for the None and raising-disconnect() defensive cases.
The platform-level APIServerAdapter.disconnect() behavior: that it closes the ResponseStore (verified by checking the underlying sqlite3.Connection raises ProgrammingError on subsequent use), and that a ResponseStore.close() exception doesn't abort adapter shutdown.

The _CountingAdapter fixture tracks disconnect() invocations and an _open_fds counter that decrements on dispose, so the assertion is the literal observable behavior of the leak.

$ python3 -m pytest tests/gateway/test_platform_reconnect.py tests/gateway/test_platform_reconnect_fd_leak.py
collected 36 items
tests/gateway/test_platform_reconnect.py .............................   [ 80%]
tests/gateway/test_platform_reconnect_fd_leak.py .......                 [100%]
============================== 36 passed in 1.71s ==============================

Cluster note

There are 7+ open PRs all trying to fix this same fd leak from different angles (#37018, #37110, #37238, #37260, #37394, and a few others). None of them:

Rebases cleanly against current main — their stat shows 200-800 files changed because they're based on much older commits with intervening refactors.
Covers all three failure paths in the reconnect watcher (most only fix the non-retryable branch).
Adds regression tests for both the watcher and the platform-level close behavior.
Handles the __init__-crashed-half-constructed-adapter case.

This PR is a clean supersede that does all of the above. The Commits: 1, Additions: 421, Deletions: 1 stat speaks for itself.

Closes [Bug]: File descriptor leak in platform reconnect loop — adapter sqlite3 connections never closed on failed reconnect - gateway dead after ~12h uptime #37011
Supersedes fix(gateway): close ResponseStore on disconnect and clean up failed reconnect adapters #37018, fix(gateway): close ResponseStore DB connection on adapter disconnect #37110, fix(gateway): prevent response_store.db fd leak from reconnect loops #37238, fix(gateway): close leaked adapter fds in reconnect loop #37260, fix(gateway): close adapter resources on failed reconnect to prevent fd leak #37394
Pattern: the previous fd-leak cluster attempts each did one half; this PR consolidates all three failure paths plus the platform-level close.

Infographic

Copilot

Pull request overview

Note

Copilot was unable to run its full agentic suite in this review.

Adds regression coverage and runtime safeguards to prevent file-descriptor leaks when platform reconnect attempts fail and adapters are discarded.

Changes:

Add _dispose_unused_adapter() helper and invoke it in all reconnect watcher failure paths.
Update APIServerAdapter.disconnect() to close its ResponseStore (SQLite connection).
Add new regression tests covering the three watcher failure paths and the ResponseStore close behavior.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 7 comments.

File	Description
tests/gateway/test_platform_reconnect_fd_leak.py	Adds regression tests to ensure discarded adapters are disconnected and APIServer closes ResponseStore.
gateway/run.py	Introduces `_dispose_unused_adapter()` and uses it in reconnect watcher branches that drop adapters.
gateway/platforms/api_server.py	Ensures `disconnect()` closes `ResponseStore` and logs close failures.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

@@ -1755,6 +1755,46 @@ def _preserve_queued_followup_history_offset(
    return merged


+async def _dispose_unused_adapter(adapter: "BasePlatformAdapter") -> None:


+    if adapter is None:
+        return


+    try:
+        await adapter.disconnect()
+    except Exception:


+        if self._response_store is not None:
+            try:
+                self._response_store.close()
+            except Exception:
+                logger.debug(
+                    "Failed to close response store for %s", self.name, exc_info=True,
+                )


+        adapter = APIServerAdapter.__new__(APIServerAdapter)
+        adapter._mark_disconnected = lambda: None  # type: ignore[method-assign]
+        adapter._site = None
+        adapter._runner = None
+        adapter._app = None
+        adapter._response_store = store
+        adapter.platform = Platform.API_SERVER
+        return adapter


+        with pytest.raises(Exception):
+            store._conn.execute("SELECT 1").fetchone()


+                          new=AsyncMock(return_value=False)):
+            await _run_watcher_one_iteration(runner)
+
+        assert adapter._disconnect_calls >= 1, (


…ect failure Three separate code paths in the gateway's platform reconnect loop leaked file descriptors every retry, exhausting the default 2560-fd ulimit in ~12 hours of continuous failure and turning the gateway into a zombie that raises OSError: [Errno 24] on every open() (NousResearch#37011). Root cause: * APIServerAdapter.__init__ opens a ResponseStore SQLite connection that holds 2 fds (db file + WAL sidecar). * APIServerAdapter.disconnect() previously only stopped the aiohttp web server — the ResponseStore connection was never closed. * The reconnect watcher in _platform_reconnect_watcher constructs a fresh adapter on every retry attempt. When the connect call fails (3 paths: non-retryable error, retryable error, exception during connect) the adapter is dropped without ever being installed on self.adapters, so nothing else calls its disconnect(). Result: the 2 ResponseStore fds stay open until GC sweeps the unreachable object, which Python's cyclic GC does not do promptly for asyncio-bound native handles. 2 fds × 1 retry × (3600s / 300s backoff cap) ≈ 12 fds/hour. 2560 fds / 12 fds/hr ≈ 12h to ulimit exhaustion. Fix: * APIServerAdapter.disconnect() now also calls self._response_store.close() (with a try/except so a SQLite close failure doesn't abort the aiohttp teardown). * New module-level helper _dispose_unused_adapter(adapter) in gateway/run.py that calls adapter.disconnect() and swallows any exception (so half-constructed adapters whose __init__ crashed don't kill the watcher loop). * _platform_reconnect_watcher calls _dispose_unused_adapter() in all three failure paths: non-retryable, retryable, and the except Exception arm. adapter = None is initialized before the try so the except arm can see the partial construction. Tests: * New file tests/gateway/test_platform_reconnect_fd_leak.py with 7 regression tests covering all three failure paths, the _dispose_unused_adapter helper (None + raising-disconnect cases), and the APIServerAdapter ResponseStore close behavior (success + close-exception cases). The _CountingAdapter fixture tracks disconnect() invocations and an _open_fds counter that is decremented on dispose, so the assertion is the literal observable behavior of the leak. Refs: - Closes NousResearch#37011 (the original fd-leak report) - Supersedes NousResearch#37018, NousResearch#37110, NousResearch#37238, NousResearch#37260, NousResearch#37394 (7 competing open PRs all addressing the same root cause from different angles; none of them rebased cleanly against current main, and none covered all three failure paths in one fix with regression tests for both the watcher and the platform-level close behavior)

The check-attribution CI job on NousResearch#37679 failed because the commit author email nolan@0xvox.com (a local git config mistake on this machine) is not in scripts/release.py AUTHOR_MAP. The commit itself is now re-authored to fearvox1015@gmail.com, and this follow-up adds the entry to AUTHOR_MAP so any future commits authored from this email also pass the check.

Fearvox · 2026-06-02T22:22:17Z

Pushed a fix for the two CI failures:

test (2) failure (this PR's only test failure): tests/hermes_cli/test_api_key_providers.py::TestMinimaxOAuthProvider::test_minimax_oauth_aux_model_registered was pinning the aux model in the legacy _API_KEY_PROVIDER_AUX_MODELS dict, which this PR correctly removed (mirrors the deepseek cleanup in 773a0fa). Updated the test to assert the new world order: the aux model comes from ProviderProfile.default_aux_model on the minimax-oauth profile, not the fallback dict. Same pattern that the profile-layer deepseek fix introduced.
check-attribution failure (both PRs): the commit author email was nolan@0xvox.com (a local git config mistake on this machine — should have been fearvox1015@gmail.com). Re-authored the commit and added the fearvox1015@gmail.com → Fearvox entry to scripts/release.py AUTHOR_MAP so the check passes for any future commits authored from this email.

Diff stat now:

scripts/release.py +1 line (AUTHOR_MAP entry)
tests/hermes_cli/test_api_key_providers.py updated test assertion

$ python3 -m pytest tests/hermes_cli/test_api_key_providers.py -v
============================= 165 passed in 14.37s =============================

Seven Copilot inline review comments on NousResearch#37679, four worth landing in a polish pass before merge: 1. _dispose_unused_adapter signature: 'BasePlatformAdapter' -> 'BasePlatformAdapter | None'. The function explicitly handles None and the reconnect watcher calls it with None in the except arm, so the annotation now matches the actual contract. 2. (duplicate of NousResearch#1 on a different line) — same fix. 3. except Exception in _dispose_unused_adapter — the reviewer asked about asyncio.CancelledError swallowing. On Python 3.8+ (Hermes requires 3.13, see pyproject.toml), CancelledError inherits from BaseException, NOT Exception, so the existing 'except Exception' does NOT swallow task cancellation. Added an explicit comment explaining the contract so future readers don't repeat the analysis. We don't re-raise because the watcher loop intentionally treats dispose failures as best-effort: a failed dispose on an unowned adapter should not take down the watcher that's keeping the gateway alive. 4. _response_store = None after close in api_server.py — the reviewer flagged this for idempotency. Decided to keep the non-None state intentionally: setting it to None cascades to ~9 callers that access self._response_store without a None check, and 'close() is idempotent on a closed sqlite3 Connection' means the current code is already safe. The type stays stable; LSP doesn't flag a cascade of reportOptionalMemberAccess errors. (This matches the pre-existing pattern in the codebase — e.g. _mark_disconnected doesn't reset state to None either.) 5. _build_adapter_with_store: reviewer worried about disconnect() failing on the self.name property if __init__ wasn't called. Already handled: we set 'adapter.platform = Platform.API_SERVER' so the 'self.platform.value.title()' property returns 'Api_Server' without raising. The exception-swallowing branch in disconnect() does call self.name via the logger.debug format, so this is a real path that needs the platform attribute, and we have it. 6. test_disconnect_closes_response_store: bare 'pytest.raises(Exception)' -> 'pytest.raises(sqlite3.ProgrammingError)'. The bare Exception matcher would silently accept AttributeError, OperationalError, env-related issues, etc. The specific exception type ('Cannot operate on a closed database') is the actual signal we want — proves the SQLite conn is closed, not just that *something* raised. 7. test_nonretryable_failure_disposes_unowned_adapter: assertion tightened from '>= 1' to '== 1' on adapter._disconnect_calls. The docstring said 'exactly once', the assertion now matches. Catches the hypothetical 'watcher disposes the same adapter twice' regression that '>=' would have missed.

Fearvox · 2026-06-02T22:39:14Z

Addressed the worth-doing Copilot review comments in a polish commit:

#37664 (minimax M3):

✅ Copilot Support passing morph snapshot id #2 — Added import model_tools to tests/agent/test_minimax_provider.py so the legacy aux-model test class triggers plugin discovery explicitly (was order-dependent before).
✅ Copilot Architecture planning #3 — Replaced hard-coded hermes_cli/models.py:298 line number with the symbol _PROVIDER_MODELS['minimax'] in the new test file's docstring.
⏭️ Copilot Terminal tool #1 — Declined the fallback-dict safety net suggestion. The deepseek precedent (commit 773a0fa) explicitly removed deepseek from the same dict for the same reasoning; we want consistency, not per-provider fragmentation. Explained in the commit body.

#37679 (fd-leak):

✅ Copilot Terminal tool #1, Support passing morph snapshot id #2 — Updated _dispose_unused_adapter signature to BasePlatformAdapter | None.
✅ Copilot Architecture planning #3 — Added an explicit comment explaining that asyncio.CancelledError inherits from BaseException (not Exception) on Python 3.8+, so the existing except Exception does not swallow task cancellation. Hermes requires Python 3.13 per pyproject.toml. We do not re-raise explicitly because the watcher loop intentionally treats dispose failures as best-effort.
✅ Copilot Fix VM instance sharing across tasks #6 — Replaced bare pytest.raises(Exception) with pytest.raises(sqlite3.ProgrammingError) so the test only passes when the SQLite conn is actually closed, not on any unrelated exception.
✅ Copilot some cleanups #7 — Tightened adapter._disconnect_calls assertion from >= 1 to == 1. Catches the hypothetical 'watcher disposes the same adapter twice' regression that >= would have missed.
⏭️ Copilot Fix terminal interactivity #4 — Declined setting _response_store = None after close. The current code is already safe (close() is idempotent on a closed sqlite3 Connection) and setting to None would cascade to ~9 callers that don't have None checks, generating LSP cascade errors. The reviewer's concern is real but the cost-benefit favors the current code.
⏭️ Copilot Update snapshot #5 — Already handled. _build_adapter_with_store sets adapter.platform = Platform.API_SERVER so the read-only self.name property returns without AttributeError when the logger fires in the close-exception path.

Both branches re-pushed. Local test runs:

minimax: 221/221 pass
fd-leak: 36/36 pass

The check-attribution CI job on #37679 failed because the commit author email nolan@0xvox.com (a local git config mistake on this machine) is not in scripts/release.py AUTHOR_MAP. The commit itself is now re-authored to fearvox1015@gmail.com, and this follow-up adds the entry to AUTHOR_MAP so any future commits authored from this email also pass the check.

Seven Copilot inline review comments on NousResearch#37701, all worth landing in a polish pass before merge: 1. tools/vision_tools.py:432 — temp file leak + Windows handle. Switched tempfile.NamedTemporaryFile(...).name (which leaves a stale open file handle on Windows) to tempfile.mkstemp + explicit os.close(fd) before PIL reopens the path. The hard-coded .png suffix is now derived from the actual format we save (PNG vs JPEG), so downstream MIME detection that reads the file extension doesn't get lied to. 2. tools/vision_tools.py:436 — pre-cap tempfile orphaned on Pillow-resize path. Pre-fix, the cleanup only ran on the early fast-path return; the Pillow-resize loop returned a candidate with the tempfile still on disk, accumulating orphans. Fix uses contextlib.ExitStack: register the unlink as a callback when the tempfile is created, run the entire function body in a try/finally that calls _precap_stack.__exit__() exactly once at the end (regardless of which return path was taken). Failure paths also pop_all() the stack to avoid double-unlink. 3. agent/conversation_compression.py:688 — decode_error was assigned but never used. Now passed to logger.debug() so the operator has a breadcrumb when dimension decode fails. Removed the variable name from the public docstring contract. 4. agent/conversation_compression.py:694 — same as NousResearch#3 (duplicate on a different line of the pre-fix version). Same fix. 5. agent/conversation_compression.py:687 — short-circuit by byte condition first, only perform dimension decode when URL is within target_bytes (the tiny-but-tall case). Polarity was initially inverted in my first polish pass; corrected so the decode fires when the byte gate alone would miss the violation (the exact case NousResearch#25837/NousResearch#37677 reported). 6. tools/vision_tools.py:336 — grammar: "it brick the session" → "it bricks the session". One-character fix. 7. tests/tools/test_oversized_image_dimension.py:32 — unused imports Optional and patch. Removed. All 252 tests on this branch pass (11 vision + 29 reconnect + 47 minimax + 165 api_key_providers; test_platform_reconnect_fd_leak lives on the separate NousResearch#37679 fd-leak branch). Diff stat: 3 files changed, 205 insertions, 135 deletions.

The check-attribution CI job on NousResearch#37679 failed because the commit author email nolan@0xvox.com (a local git config mistake on this machine) is not in scripts/release.py AUTHOR_MAP. The commit itself is now re-authored to fearvox1015@gmail.com, and this follow-up adds the entry to AUTHOR_MAP so any future commits authored from this email also pass the check.

Seven Copilot inline review comments on NousResearch#37679, four worth landing in a polish pass before merge: 1. _dispose_unused_adapter signature: 'BasePlatformAdapter' -> 'BasePlatformAdapter | None'. The function explicitly handles None and the reconnect watcher calls it with None in the except arm, so the annotation now matches the actual contract. 2. (duplicate of #1 on a different line) — same fix. 3. except Exception in _dispose_unused_adapter — the reviewer asked about asyncio.CancelledError swallowing. On Python 3.8+ (Hermes requires 3.13, see pyproject.toml), CancelledError inherits from BaseException, NOT Exception, so the existing 'except Exception' does NOT swallow task cancellation. Added an explicit comment explaining the contract so future readers don't repeat the analysis. We don't re-raise because the watcher loop intentionally treats dispose failures as best-effort: a failed dispose on an unowned adapter should not take down the watcher that's keeping the gateway alive. 4. _response_store = None after close in api_server.py — the reviewer flagged this for idempotency. Decided to keep the non-None state intentionally: setting it to None cascades to ~9 callers that access self._response_store without a None check, and 'close() is idempotent on a closed sqlite3 Connection' means the current code is already safe. The type stays stable; LSP doesn't flag a cascade of reportOptionalMemberAccess errors. (This matches the pre-existing pattern in the codebase — e.g. _mark_disconnected doesn't reset state to None either.) 5. _build_adapter_with_store: reviewer worried about disconnect() failing on the self.name property if __init__ wasn't called. Already handled: we set 'adapter.platform = Platform.API_SERVER' so the 'self.platform.value.title()' property returns 'Api_Server' without raising. The exception-swallowing branch in disconnect() does call self.name via the logger.debug format, so this is a real path that needs the platform attribute, and we have it. 6. test_disconnect_closes_response_store: bare 'pytest.raises(Exception)' -> 'pytest.raises(sqlite3.ProgrammingError)'. The bare Exception matcher would silently accept AttributeError, OperationalError, env-related issues, etc. The specific exception type ('Cannot operate on a closed database') is the actual signal we want — proves the SQLite conn is closed, not just that *something* raised. 7. test_nonretryable_failure_disposes_unowned_adapter: assertion tightened from '>= 1' to '== 1' on adapter._disconnect_calls. The docstring said 'exactly once', the assertion now matches. Catches the hypothetical 'watcher disposes the same adapter twice' regression that '>=' would have missed.

The check-attribution CI job on NousResearch#37679 failed because the commit author email nolan@0xvox.com (a local git config mistake on this machine) is not in scripts/release.py AUTHOR_MAP. The commit itself is now re-authored to fearvox1015@gmail.com, and this follow-up adds the entry to AUTHOR_MAP so any future commits authored from this email also pass the check.

Seven Copilot inline review comments on NousResearch#37679, four worth landing in a polish pass before merge: 1. _dispose_unused_adapter signature: 'BasePlatformAdapter' -> 'BasePlatformAdapter | None'. The function explicitly handles None and the reconnect watcher calls it with None in the except arm, so the annotation now matches the actual contract. 2. (duplicate of #1 on a different line) — same fix. 3. except Exception in _dispose_unused_adapter — the reviewer asked about asyncio.CancelledError swallowing. On Python 3.8+ (Hermes requires 3.13, see pyproject.toml), CancelledError inherits from BaseException, NOT Exception, so the existing 'except Exception' does NOT swallow task cancellation. Added an explicit comment explaining the contract so future readers don't repeat the analysis. We don't re-raise because the watcher loop intentionally treats dispose failures as best-effort: a failed dispose on an unowned adapter should not take down the watcher that's keeping the gateway alive. 4. _response_store = None after close in api_server.py — the reviewer flagged this for idempotency. Decided to keep the non-None state intentionally: setting it to None cascades to ~9 callers that access self._response_store without a None check, and 'close() is idempotent on a closed sqlite3 Connection' means the current code is already safe. The type stays stable; LSP doesn't flag a cascade of reportOptionalMemberAccess errors. (This matches the pre-existing pattern in the codebase — e.g. _mark_disconnected doesn't reset state to None either.) 5. _build_adapter_with_store: reviewer worried about disconnect() failing on the self.name property if __init__ wasn't called. Already handled: we set 'adapter.platform = Platform.API_SERVER' so the 'self.platform.value.title()' property returns 'Api_Server' without raising. The exception-swallowing branch in disconnect() does call self.name via the logger.debug format, so this is a real path that needs the platform attribute, and we have it. 6. test_disconnect_closes_response_store: bare 'pytest.raises(Exception)' -> 'pytest.raises(sqlite3.ProgrammingError)'. The bare Exception matcher would silently accept AttributeError, OperationalError, env-related issues, etc. The specific exception type ('Cannot operate on a closed database') is the actual signal we want — proves the SQLite conn is closed, not just that *something* raised. 7. test_nonretryable_failure_disposes_unowned_adapter: assertion tightened from '>= 1' to '== 1' on adapter._disconnect_calls. The docstring said 'exactly once', the assertion now matches. Catches the hypothetical 'watcher disposes the same adapter twice' regression that '>=' would have missed.

The check-attribution CI job on NousResearch#37679 failed because the commit author email nolan@0xvox.com (a local git config mistake on this machine) is not in scripts/release.py AUTHOR_MAP. The commit itself is now re-authored to fearvox1015@gmail.com, and this follow-up adds the entry to AUTHOR_MAP so any future commits authored from this email also pass the check.

Seven Copilot inline review comments on NousResearch#37679, four worth landing in a polish pass before merge: 1. _dispose_unused_adapter signature: 'BasePlatformAdapter' -> 'BasePlatformAdapter | None'. The function explicitly handles None and the reconnect watcher calls it with None in the except arm, so the annotation now matches the actual contract. 2. (duplicate of NousResearch#1 on a different line) — same fix. 3. except Exception in _dispose_unused_adapter — the reviewer asked about asyncio.CancelledError swallowing. On Python 3.8+ (Hermes requires 3.13, see pyproject.toml), CancelledError inherits from BaseException, NOT Exception, so the existing 'except Exception' does NOT swallow task cancellation. Added an explicit comment explaining the contract so future readers don't repeat the analysis. We don't re-raise because the watcher loop intentionally treats dispose failures as best-effort: a failed dispose on an unowned adapter should not take down the watcher that's keeping the gateway alive. 4. _response_store = None after close in api_server.py — the reviewer flagged this for idempotency. Decided to keep the non-None state intentionally: setting it to None cascades to ~9 callers that access self._response_store without a None check, and 'close() is idempotent on a closed sqlite3 Connection' means the current code is already safe. The type stays stable; LSP doesn't flag a cascade of reportOptionalMemberAccess errors. (This matches the pre-existing pattern in the codebase — e.g. _mark_disconnected doesn't reset state to None either.) 5. _build_adapter_with_store: reviewer worried about disconnect() failing on the self.name property if __init__ wasn't called. Already handled: we set 'adapter.platform = Platform.API_SERVER' so the 'self.platform.value.title()' property returns 'Api_Server' without raising. The exception-swallowing branch in disconnect() does call self.name via the logger.debug format, so this is a real path that needs the platform attribute, and we have it. 6. test_disconnect_closes_response_store: bare 'pytest.raises(Exception)' -> 'pytest.raises(sqlite3.ProgrammingError)'. The bare Exception matcher would silently accept AttributeError, OperationalError, env-related issues, etc. The specific exception type ('Cannot operate on a closed database') is the actual signal we want — proves the SQLite conn is closed, not just that *something* raised. 7. test_nonretryable_failure_disposes_unowned_adapter: assertion tightened from '>= 1' to '== 1' on adapter._disconnect_calls. The docstring said 'exactly once', the assertion now matches. Catches the hypothetical 'watcher disposes the same adapter twice' regression that '>=' would have missed.

The check-attribution CI job on #37679 failed because the commit author email nolan@0xvox.com (a local git config mistake on this machine) is not in scripts/release.py AUTHOR_MAP. The commit itself is now re-authored to fearvox1015@gmail.com, and this follow-up adds the entry to AUTHOR_MAP so any future commits authored from this email also pass the check.

Seven Copilot inline review comments on #37679, four worth landing in a polish pass before merge: 1. _dispose_unused_adapter signature: 'BasePlatformAdapter' -> 'BasePlatformAdapter | None'. The function explicitly handles None and the reconnect watcher calls it with None in the except arm, so the annotation now matches the actual contract. 2. (duplicate of #1 on a different line) — same fix. 3. except Exception in _dispose_unused_adapter — the reviewer asked about asyncio.CancelledError swallowing. On Python 3.8+ (Hermes requires 3.13, see pyproject.toml), CancelledError inherits from BaseException, NOT Exception, so the existing 'except Exception' does NOT swallow task cancellation. Added an explicit comment explaining the contract so future readers don't repeat the analysis. We don't re-raise because the watcher loop intentionally treats dispose failures as best-effort: a failed dispose on an unowned adapter should not take down the watcher that's keeping the gateway alive. 4. _response_store = None after close in api_server.py — the reviewer flagged this for idempotency. Decided to keep the non-None state intentionally: setting it to None cascades to ~9 callers that access self._response_store without a None check, and 'close() is idempotent on a closed sqlite3 Connection' means the current code is already safe. The type stays stable; LSP doesn't flag a cascade of reportOptionalMemberAccess errors. (This matches the pre-existing pattern in the codebase — e.g. _mark_disconnected doesn't reset state to None either.) 5. _build_adapter_with_store: reviewer worried about disconnect() failing on the self.name property if __init__ wasn't called. Already handled: we set 'adapter.platform = Platform.API_SERVER' so the 'self.platform.value.title()' property returns 'Api_Server' without raising. The exception-swallowing branch in disconnect() does call self.name via the logger.debug format, so this is a real path that needs the platform attribute, and we have it. 6. test_disconnect_closes_response_store: bare 'pytest.raises(Exception)' -> 'pytest.raises(sqlite3.ProgrammingError)'. The bare Exception matcher would silently accept AttributeError, OperationalError, env-related issues, etc. The specific exception type ('Cannot operate on a closed database') is the actual signal we want — proves the SQLite conn is closed, not just that *something* raised. 7. test_nonretryable_failure_disposes_unowned_adapter: assertion tightened from '>= 1' to '== 1' on adapter._disconnect_calls. The docstring said 'exactly once', the assertion now matches. Catches the hypothetical 'watcher disposes the same adapter twice' regression that '>=' would have missed.