From 82b3b70aaaf0117dd3264183f9702eca6cff3ea8 Mon Sep 17 00:00:00 2001
From: Aditya Vikram Singh <247195684+avs-io@users.noreply.github.com>
Date: Sun, 23 Aug 2026 23:25:04 +0530
Subject: [PATCH] docs(hermes): record restore wipe-both ledger contract
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Owner ruling: state.db restored from backup without wiping the ledger
re-credits regrowth. Wipe both stores or accept the overcount. A
high-water-mark guard is rejected because it would eat 150→0→40 resets.
---
 src/hermes-session-ledger.ts | 7 ++++---
 1 file changed, 4 insertions(+), 3 deletions(-)

diff --git a/src/hermes-session-ledger.ts b/src/hermes-session-ledger.ts
index 07e0c307..7d176d4c 100644
--- a/src/hermes-session-ledger.ts
+++ b/src/hermes-session-ledger.ts
@@ -12,9 +12,10 @@ import type { CachedCall, ProviderSection } from './session-cache.js'
 // - Reset 150 → 0 → 40 is in contract: an all-zero (or shrinking) snapshot
 //   advances last-seen without a negative observation; later growth is new
 //   spend on the observation day.
-// - Restoring `state.db` from a backup is OUT OF CONTRACT. The cursor resets
-//   with the restored row; later regrowth is emitted again and lifetime
-//   overcounts. There is no high-water-mark guard.
+// - Restores are out of contract: state.db restored from backup without
+//   wiping the ledger ⇒ regrowth is re-credited; wipe both or accept it.
+//   A post-reset high-water-mark guard is rejected: it would eat genuine
+//   150→0→40 resets, which are treated as new spend by design.
 // - Recovery horizon is the warm session-cache baseline. `seedHermesCursorsFromProviderSection`
 //   copies cached lifetime totals into missing cursors so growth *since the
 //   last warm parse* is recovered. Growth dropped *before* that parse stays