Summary

When a user launches a profile (e.g. hermes --tui -p A) while ~/.hermes/active_profile points to a different profile B, the TUI gateway, slash worker, and systemd gateway service open profile B's state.db, logs, and sessions instead of profile A's. The TUI shows "ready" but never responds — messages go into the wrong profile's session store.

Root Cause

hermes_state.DEFAULT_DB_PATH = get_hermes_home() / "state.db" is evaluated at module import time, before _apply_profile_override() in hermes_cli/main.py has corrected HERMES_HOME to the requested profile.

The same race affects:

• tui_gateway/server.py's module-level _hermes_home
• Any subprocess (_SlashWorker) that inherits a stale shell HERMES_HOME
• The systemd gateway service, which sets HERMES_HOME=~/.hermes and relies on active_profile resolution at runtime

Reproduction

1. hermes profile use B (writes B to ~/.hermes/active_profile)
2. From another terminal: hermes --tui -p A
3. TUI shows "ready" but agent never responds
4. Forensic check: ls -la /proc/$(pgrep -f tui_gateway.entry)/fd/ | grep state.db → points to profile B's state.db

Changes

hermes_state.py — Lazy DEFAULT_DB_PATH

Replace the eager constant:

DEFAULT_DB_PATH = get_hermes_home() / "state.db"  # evaluated at import time

With a lazy descriptor that defers resolution until first attribute access:

DEFAULT_DB_PATH: _LazyDefaultDBPath = _LazyDefaultDBPath()

The descriptor preserves the module-level name (so from hermes_state import DEFAULT_DB_PATH still works) and provides a _reset() method for test fixtures that swap HERMES_HOME via monkeypatch.

tui_gateway/server.py — Explicit HERMES_HOME in slash worker env

_SlashWorker now explicitly injects HERMES_HOME into the child env when missing, preventing inheritance of a stale shell value.

tools/session_search_tool.py — Comment update

Notes that DEFAULT_DB_PATH is now lazy-resolved.

Testing

• All 174 test_hermes_state.py tests pass
• Manual verification: launched TUI with mismatched active_profile, confirmed FDs now point to the correct profile's state.db

Related Issues

• [Bug]: cron under profile-scoped launchd gateway falls back to default ~/.hermes instead of profile HERMES_HOME #4707 — Same class of bug (cron under profile-scoped launchd gateway)
• Operator follow-up: finish HERMES_HOME/profile isolation smoke quirks #4671 — Operator follow-up: finish HERMES_HOME/profile isolation
• Multi-profile gateway is not safe: kill_gateway_processes() and release_all_scoped_locks() are profile-blind #4587 — Multi-profile gateway kill_gateway_processes() is profile-blind
• gateway stop kills ALL profile gateways instead of only the current profile #4402 — gateway stop kills ALL profile gateways
• Bug: profiles do not isolate system credentials (/root shared across profiles) and Docker setup does not persist tool configuration outside /opt/data #4426 — profiles do not isolate system credentials / HOME semantics

Note to Reviewers

The _LazyDefaultDBPath approach preserves backward compatibility (same import path, same attribute access patterns) while fixing the core race. An alternative would be to audit every import site and convert them to function calls, but that's a larger refactor with more breakage risk. The lazy descriptor is the minimal safe fix.