From ca3566301373d871f05c1841dafe11cbd8e37a4d Mon Sep 17 00:00:00 2001
From: kshitijk4poor <82637225+kshitijk4poor@users.noreply.github.com>
Date: Sat, 25 Jul 2026 08:54:13 +0500
Subject: [PATCH] refactor: extract lineage_is_logical local + document TOCTOU
 re-query

Follow-up cleanup for PR #71123:
- Extract getattr(args, 'lineage', 'single') == 'logical' to a local
  (appeared 3x in the export block)
- Document that the double _collect_delegate_child_ids traversal in
  delete_session is an intentional TOCTOU guard inside the write txn
---
 hermes_cli/main.py | 6 ++++--
 hermes_state.py    | 6 ++++--
 2 files changed, 8 insertions(+), 4 deletions(-)

diff --git a/hermes_cli/main.py b/hermes_cli/main.py
index 5eb110489cd..f9640d19f58 100644
--- a/hermes_cli/main.py
+++ b/hermes_cli/main.py
@@ -16367,6 +16367,8 @@ def main():
                 db.close()
                 return
 
+            lineage_is_logical = getattr(args, "lineage", "single") == "logical"
+
             if args.session_id:
                 resolved_session_id = db.resolve_session_id(args.session_id)
                 if not resolved_session_id:
@@ -16386,7 +16388,7 @@ def main():
                             target_id,
                             include_lineage=(
                                 target_id == resolved_session_id
-                                and getattr(args, "lineage", "single") == "logical"
+                                and lineage_is_logical
                             ),
                         )
                     except FileExistsError as e:
@@ -16479,7 +16481,7 @@ def main():
                 try:
                     data, exported_path = _export_one(
                         row["id"],
-                        include_lineage=getattr(args, "lineage", "single") == "logical",
+                        include_lineage=lineage_is_logical,
                     )
                 except FileExistsError as e:
                     print(f"Skipping existing export: {e}. Pass --force to overwrite.")
diff --git a/hermes_state.py b/hermes_state.py
index 537ed280d50..63e3caa51b4 100644
--- a/hermes_state.py
+++ b/hermes_state.py
@@ -8993,8 +8993,10 @@ class SessionDB:
         session. When *expected_delete_ids* is provided, deletion proceeds only
         if the parent plus delegate cascade still matches that exact set. This
         lets export-before-delete callers fail closed if a new delegate appears
-        after they materialize their archive. Returns True if the session was
-        found and deleted.
+        after they materialize their archive. The delegate tree is re-walked
+        inside the write transaction on purpose (TOCTOU guard); the cost is
+        accepted for correctness. Returns True if the session was found and
+        deleted.
         """
         removed_delegate_ids: List[str] = []
         expected_ids = (