Summary

Fixes two Tests failures observed on main (and therefore propagating to every open PR):

FAILED tests/hermes_cli/test_gateway_service.py::TestGeneratedSystemdUnits::test_user_unit_avoids_recursive_execstop_and_uses_extended_stop_timeout
FAILED tests/hermes_cli/test_gateway_service.py::TestGeneratedSystemdUnits::test_system_unit_avoids_recursive_execstop_and_uses_extended_stop_timeout

Reference run: 25250051126 on 5d3be898a.

Root cause

hermes_cli/gateway.py:1635 computes:

_drain_timeout = int(_get_restart_drain_timeout() or 0)
restart_timeout = max(60, _drain_timeout) + 30

The default agent.restart_drain_timeout was bumped to 180s, which makes the rendered systemd unit emit TimeoutStopSec=210. The two assertions in TestGeneratedSystemdUnits were still pinned to TimeoutStopSec=90 (formerly correct when the default was 60s), so they fail on every CI run.

Fix

Compute the expected value from the same helper the unit generator uses:

@staticmethod
def _expected_timeout_stop_sec() -> int:
    drain = int(gateway_cli._get_restart_drain_timeout() or 0)
    return max(60, drain) + 30

…then assert f"TimeoutStopSec={self._expected_timeout_stop_sec()}" in unit. The assertion now tracks the configured default rather than hardcoding a literal.

Validation

$ pytest tests/hermes_cli/test_gateway_service.py::TestGeneratedSystemdUnits -q
3 passed in 1.82s

Scope

• ✅ No production code change (test-only fix)
• ✅ Both system=True and system=False units re-validated
• ✅ Issue Gateway process not cleaned up on unclean shutdown after provider timeout — bash/sleep children SIGKILL'd by systemd #8202's invariant ("TimeoutStopSec must exceed drain_timeout") is still asserted, just expressed correctly

Out of scope

The other ~13 main-CI failures (gateway-restart kill semantics, dotenv vs os.environ, Dockerfile pid1, etc.) — happy to send those as separate focused PRs.