hermes - 💡(How to fix) Fix bug(tui_gateway): TOCTOU race in _get_db() — concurrent requests can create duplicate SessionDB connections

Summary

tui_gateway/server.py:_get_db() (line 338) uses a bare if _db is None: guard with no lock. The tui_gateway server handles concurrent HTTP requests, so two simultaneous requests can both see _db is None, both call SessionDB(), and create duplicate database connections.

_db = None  # no lock

def _get_db():
    global _db, _db_error
    if _db is None:          # ← race: two threads enter simultaneously
        from hermes_state import SessionDB
        try:
            _db = SessionDB()  # ← both construct a SessionDB

Impact

• SessionDB likely opens a SQLite file connection; duplicate connections can trigger database is locked errors under WAL mode or corrupt write state.
• The file already imports threading and uses locks elsewhere (_stdout_lock, _cfg_lock) — _get_db was simply missed.

Fix

Add _db_lock = threading.Lock() alongside _db = None and apply double-checked locking to _get_db(). Same pattern as #24731 / #24734.