fix(session): follow compression continuations for transcript reads

[konsisumer]

What changed and why

Per the follow-up on 2026-06-07, this narrows the issue to transcript-read paths that still use the pre-compression session id directly. gateway /resume already redirects through SessionDB.resolve_resume_session_id(), but both hermes_cli.web_server and gateway.platforms.api_server were still reading /api/sessions/{id}/messages from the stale root id. After compression, that can leave Desktop or remote session readers hydrating an empty conversation even though the live transcript exists on the continuation child session.

This patch makes both message-read endpoints resolve the session id through resolve_resume_session_id() before loading messages, and returns the resolved live session id in the API response. It also adds regressions for the local web server and gateway session API so compressed conversations hydrate from the continuation tip instead of the empty root.

Fixes #34089

How to test

• Run pytest tests/gateway/test_session_api.py -q -k "session_messages_follow_compression_tip or session_crud_and_message_history"
• Run pytest tests/hermes_cli/test_web_server.py -q -k "get_session_messages_follows_compression_tip or search_dedupes_compression_lineage_to_tip or search_keeps_branch_specific_hits_on_branch"
• Manual sanity check: create a session, compress it into a child continuation, then fetch /api/sessions/<old-root-id>/messages and confirm the response returns the child session_id and the child transcript.

What platforms tested on

• macOS sandbox: python -m py_compile hermes_cli/web_server.py gateway/platforms/api_server.py tests/hermes_cli/test_web_server.py tests/gateway/test_session_api.py
• macOS sandbox: direct SessionDB.resolve_resume_session_id() sanity check confirmed root -> tip and message load from the continuation.
• Full pytest execution of the touched web/gateway suites was not possible in this sandbox because fastapi/starlette are not installed here and aiohttp test servers cannot bind localhost sockets under the worker restrictions.

[liuhao1024]

✅ Verified — compression continuation chain resolution in session message reads

Reviewed the diff for resolve_resume_session_id() integration in both API server and web server session message endpoints.

• Correct continuation chain: api_server.py:1457 and web_server.py:5455 both call resolve_resume_session_id() after initial ID resolution, ensuring compressed sessions redirect to their live continuation — matching the existing /resume behavior.
• Response consistency: Both endpoints return resolved_id (the tip session) in the response, so callers see the actual session ID, not the stale pre-compression ID.
• Test coverage: Two independent test files cover the gateway (test_session_api.py) and web server (test_web_server.py) paths with proper compression simulation (end_session → create continuation → replace_messages → verify redirect).

The fix is complete and consistent across both entry points. No issues found.

[konsisumer]

For maintainer context on #34089, which already has two open PRs:

• fix(agent): sync logging session context on compaction id rotation #39994 (JimStenstrom) — syncs the logging session context on compaction id rotation (agent/conversation_compression.py).
• test(gateway): add compression session_id rotation integration tests (#34089) #39005 (rodboev) — keeps the agent/gateway routing-table session_id in sync; notes the core fixes landed in fix(compression): prevent session-id fork from concurrent compressions #34351.

This PR is intentionally scoped to a distinct, non-overlapping surface: the transcript-read endpoints (gateway/platforms/api_server.py, hermes_cli/web_server.py) that still hydrate /api/sessions/{id}/messages from the pre-compression root id. It shares no files with #39994 / #39005, so it complements rather than duplicates them.

Caveat: if #34351 + #39005 already make the read endpoints resolve the continuation tip end-to-end, this becomes redundant and can be closed — otherwise it covers the read path they do not touch.

[teknium1]

Merged via #41882 (commit 3714caa on main). Your commit was cherry-picked with your authorship preserved in git log.

This closes the last #34089 read-path gap — Desktop and remote API readers now follow the compression continuation tip instead of hydrating an empty root. Clean, well-scoped fix with regression coverage for both endpoints. Thanks!

(CI on the salvage PR only ever failed on a transient GitHub-release-CDN 504 in the ripgrep install step — unrelated to the change; admin-merged once the code was verified green on every test shard.)