fix(state): four session-state fixes — safe close tracking, flush-cursor class fix, row-retry, usage-PK healer

[teknium1]

Salvage: four session-state / SQLite fixes (sqlite-session-state)

Combines four community session-state/SQLite fixes onto current main.

Fixes #75629, Fixes #73823
Closes #75699, Closes #75170, Closes #74934, Closes #73838

Credit: @trippyogi, @spfcraze, @Dannou, @RelaxJonh — all four commits carry the original authors' authorship (cherry-picked or --author).

1. TrackedConnection.close() ordering (#75699, @trippyogi) — cherry-picked as-is

hermes_cli/sqlite_safe_read.py untracked the connection before calling super().close(). A raising close (e.g. cross-thread ProgrammingError) left the FD open while has_live_connection() said false → the byte-probe advisory-lock guard could green-light a probe against a live connection (#75629). Now closes first, untracks only on success. Merge-ready; picked verbatim with the author's tests.

2. Flush-scan cursor invalidation at the marker-pop site (#75170, @spfcraze) + sibling-site class fix

The bounded flush-scan in _flush_messages_to_session_db_unlocked skips the identity-matched prefix of its previous snapshot, on the documented assumption that no code path pops _DB_PERSISTED_MARKER from a live dict in place.

• Cherry-picked: @spfcraze's fix at the finalize_turn fill site (agent/turn_finalizer.py) — without it the filled final answer was identity-skipped and content='' persisted; /resume replayed an empty reply (the Gateway can deliver assistant response without persisting assistant row #43849/Telegram: assistant responses not persisted to session DB (model re-answers old messages) #44100 class resurfacing via the perf cursor).
• Follow-up commit (fix-the-class, per the never-patch-predicates standing order): the micro-compaction defrag pass (agent/context_compressor.py::_defrag_rolling_summary) is the one sibling site that also pops the marker from a live dict in place (rewrites the newest MICRO marker's content). The compressor holds no agent reference, so the pop site raises _flush_scan_cursor_invalidated and the finalize_turn micro-compaction block consumes it, setting agent._db_flush_scan_prefix = None.
• Class inventory: the only other _DB_PERSISTED_MARKER pops (context_compressor.py ~175/224) operate on fresh copies — identity-breaking by construction, so the cursor already re-scans them; deliberately left alone.

3. 'no more rows available' retry gap (port of #74934, @Dannou/Dannoob)

Under dual gateway/agent WAL contention (FTS5 trigram sync holding the write lock on large appends), the SQLite engine raises a transient no more rows available error whose class varies by build — some surface it as InterfaceError, a sibling of DatabaseError, which escaped both retry branches in _execute_write on attempt 0 and killed the turn as session_persistence_failed.

The PR's diff predates the deadline-patience rewrite (8da8a78), so its constants changes (60 retries / 300 ms jitter / 2.0 s engine timeout) were intentionally not carried over — they're superseded by the patience budget. Fresh commit (authored as Dannoob, the email on pr-74934's commit) implementing the same idea against current main:

• extracted the jittered-sleep-within-deadline logic into a shared _sleep_before_retry helper (behavior-preserving for locked/busy),
• message-scoped retry of 'no more rows available' from OperationalError, DatabaseError (checked before the FTS-corruption rebuild path so it isn't misrouted), and a sqlite3.Error catch-all,
• anything else propagates untouched on attempt 0.

Tests: transient InterfaceError retried to success; unrelated InterfaceError propagates immediately; DatabaseError variant retried; exhausted patience surfaces the original error.

4. Unconditional session_model_usage PK heal (salvage of #73838, @RelaxJonh)

Installs whose state.db reached schema_version >= 22 before the task dimension landed carry a 5-column PK on session_model_usage. The reconciler ADDs task outside the key (SQLite can't ALTER a PK) and the version-gated v22 rebuild is unreachable (current_version < 22 already false) → every _record_model_usage upsert fails with an ON CONFLICT mismatch, aborting the enclosing transaction — token/cost accounting permanently dead (#73823).

Salvaged with the triage fix-ups:

• ported to SessionSchemaMixin in hermes_state_schema.py (schema code moved out of hermes_state.py in 21c7ae8; the PR targeted the old location),
• rebuild wrapped in a PRAGMA foreign_keys=OFF/ON window — the connection enables FKs before _init_schema, and INSERT OR IGNORE does not suppress FK violations, so a single orphaned usage row would have aborted the heal,
• COALESCE('') on the nullable reconciler-added task (and billing columns) during the copy,
• stale-v22+ regression tests: PK rebuilt + upsert restored on a DB whose version row is already current, orphan rows survive the FK window, healthy-DB no-op/idempotence, no _legacy_pk leftover table.

Verification

• Full sweep green: tests/state/, tests/test_hermes_state.py (137), tests/test_sqlite_lock_safe_inspection.py, tests/agent/test_micro_compaction.py, tests/agent/test_turn_finalizer_final_response_persistence.py, tests/run_agent/test_identity_flush.py — 216+ tests passing.
• Sabotage runs (fix reverted → new tests FAIL → fix restored) performed for every new regression test:
  • sibling-site defrag tests: 3/3 fail with the flag/finalizer wiring stashed;
  • no-more-rows tests: both retry tests fail with the hermes_state.py fix stashed (message-scoped propagation tests correctly still pass);
  • PK-heal tests: 3/4 fail with hermes_state_schema.py stashed (leftover-table test vacuously passes without the heal, as expected).
• Note: local linked SQLite is 3.50.4 (WAL-reset-bug fallback → journal_mode=DELETE), so tests ran in DELETE mode; no WAL-only assertions were added.
• Branch rebased onto current main (991f5f1e9e) immediately before push; full suite re-run post-rebase.

Infographic

[github-actions]

૮ >ﻌ< ა ci review

_{ran on 6795a59}

ℹ️ Info

Desktop E2E visual evidence · View test artifacts · View job

3 visual diffs.

_{inline evidence is publishing...}