Fixes #145075

What was wrong

When a profile's state.db is a symlink to a folder outside the profile home (e.g. ~/.hermes/state.db → ~/.hermes-db/state.db), every in-gateway cron run failed with ProviderNotConfiguredError and "skill not found". The gateway worked out the profile home as Path(authority.db.db_path).resolve().parent. resolve() follows the link, so the cron run was scoped to ~/.hermes-db/, which has no .env, no skills/ and no credential pool. Config reads, the stored credential reference, /model alias lookups, orphan-grace, the single-authority lookup and the groups/Bots owner check all used the same pattern.

Fix

• _build_profile_authority records the reserved profile home on the authority (SessionAuthority.home), and session_authorities.authority_home(authority) returns it. Every former .resolve().parent site calls it: session_cron bind/unbind/execute, session_mutation_model ×3, session_policy, session_policy_credentials ×2, session_policy_refresh, session_viewer_close, authority_for_home, session_group_controls. Authorities built outside that path (single store, no reservation) fall back to the store's own directory, resolved.
  • Why not path arithmetic on db_path: the runner opens every store through hermes_state_registry.acquire(), which resolves the path. On a symlinked store db_path is already the link target, so no "don't resolve" variant can recover the home.
  • Why not profile_id: single-profile and test authorities carry a bare name ('default', 'p'), not a path.
• run_runtime._build_profile_authority checks store ownership by file identity (samefile(home/'state.db')), so a symlinked store is no longer refused as "does not belong to the reserved profile". It also refuses a store another served profile already owns: two homes linking one file would otherwise both build authorities, and the second epoch would make the first one's admissions stale.
• The retained-media sweep guard compares stores with samefile().

Salvage credit

• Salvaged from fix(gateway): scope profile work to the authority home, not a resolved state.db parent #145238 by @printplaatreparatie (the main fix, cherry-picked with authorship kept) and fix(gateway): accept a symlinked profile state.db as the profile's own store #143063 by @printplaatreparatie (the boot-time ownership check for the same symlink topology, cherry-picked).
• Sibling-site regression tests from fix(gateway): derive the profile home from authority.profile_id, not the db path #145834 by @princejain756 (Co-authored-by).

Changes on top

• The authority now carries its home. fix(gateway): scope profile work to the authority home, not a resolved state.db parent #145238's authority_home() used the unresolved db_path parent, which only works when the caller opened the store through the link. The real runner opens it via acquire() (resolved), so cron still scoped to the store directory there (Greptile caught this). The regression fixtures now open through acquire() as the gateway does.
• Refuse a store another served profile already owns (Greptile's shared-store finding on fix(gateway): accept a symlinked profile state.db as the profile's own store #143063's samefile check).
• Fixed one more site with the same bug: session_group_controls.dispatch_group_control refused every groups/Bots call on a symlinked store with profile_mismatch.
• Mapped the contributor email.

Test evidence

Red on origin/main, green on this head. 13 tests in test_session_cron_symlinked_store.py, test_authority_home_symlinked_store.py (sibling sites + group controls) and test_profile_authority_symlinked_store.py (boot ownership + shared store):

• main: 1 passed (the foreign-store rejection, which is unchanged), 9 failed, 3 errors
• head: 13 passed

Wider sweep: every test file in tests/{gateway,tui_gateway,tools,acp_adapter,plugins} that touches the changed modules or builds a SessionAuthority (437 files) gave 2608 passed, 0 failed, 8 skipped.

Live probe on an isolated HERMES_HOME (hermes-home/state.db → ../hermes-db/state.db, with an OpenRouter key in hermes-home/.env and one skill). It went through the real acquire(), the real run_runtime._build_profile_authority → initialize_session_authority → bind_owner, and the real session_cron.execute + _profile_runtime_scope, then ran resolve_runtime_provider() inside the job:

== MAIN  RuntimeError: session authority database does not belong to the reserved profile .../hermes-home
         (and with only that check fixed: HERMES_HOME=.../hermes-db, skill_visible=false, has_key=false)
== HEAD  owner bound for home: True
         {"HERMES_HOME": ".../hermes-home", "skill_visible": true, "provider": "openrouter", "has_key": true}

Infographic