feat(state): persist sender device attribution

[OmarB97]

Why

Shared desktop/cloud sessions need to show where a human user message was typed without changing the model replay transcript. Upstream already has desktop cloud-channel UI that can consume sender_device, but the state schema and desktop hydration path do not persist or display it yet.

What

• Add a sender_device column to messages and bump the state schema version.
• Resolve a stable local device name from config.yaml, MeshBoard registry, Tailscale, then hostname, with caching and non-fatal fallback.
• Auto-stamp local user rows only; assistant/tool rows stay NULL, and get_messages_as_conversation() remains unchanged for prompt-cache stability.
• Preserve sender attribution through replace_messages() and surface it in the desktop user bubble metadata path.

Verification

• python3 -m pytest tests/test_hermes_constants.py::TestGetDeviceName tests/test_hermes_state.py::TestMessageStorage::test_user_message_sender_device_is_local_metadata tests/test_hermes_state.py::TestMessageStorage::test_append_message_sender_device_override_and_failure tests/test_hermes_state.py::TestMessageStorage::test_replace_messages_preserves_sender_device tests/test_hermes_state.py::TestSchemaInit::test_reconciliation_adds_missing_columns -q
• python3 -m pytest tests/test_hermes_constants.py tests/test_hermes_state.py -q
• python3 -m pytest tests/gateway/test_session_api.py tests/hermes_cli/test_web_server.py tests/tools/test_session_search.py -q
• python3 -m py_compile hermes_constants.py hermes_state.py
• npm --prefix apps/desktop run test:ui -- src/lib/chat-messages.test.ts src/lib/chat-runtime.test.ts
• npm --prefix apps/desktop run typecheck
• git diff --check

Also ran npm --prefix apps/desktop run test:ui -- src; it currently fails in unrelated upstream-main suites (pane-shell, use-gateway-boot, model-settings, streaming, toolset-config-panel). The focused sender-device UI tests and type-check pass.

MeshBoard: hermes-upstream-ports-desktop-lane-20260609

[teknium1]

Thanks for carrying attribution through storage and the desktop renderer. I found blocking gaps in the end-to-end contract.

Problems

• apps/desktop/src/types/hermes.ts:376 adds the field, but the REST endpoint used by getSessionMessages() filters it out in gateway/platforms/api_server.py:1697-1703; the desktop cannot hydrate a label.
• hermes_state.py:3445 derives missing attribution on the backend. Desktop sends only {session_id, text} at apps/desktop/src/app/session/hooks/use-prompt-actions/submit.ts:343-345, so a remote desktop would be labeled with the server's device name.
• session.resume also drops the metadata: tui_gateway/server.py:5669 loads conversation rows and _history_to_messages() at tui_gateway/server.py:4978-4983 emits only role/text for user messages.
• The branch is currently conflicting, and current main's effect_disposition persistence from a0a6cd80f5c7850fe1dcff4839c2d4cead44d1c8 must be retained during any salvage.

Suggested changes

• Define and transport a client-origin attribution value, then cover remote-client, REST hydration, resume fallback, and rewrite/compaction cases.
• Add the API and resume DTO propagation without putting attribution into get_messages_as_conversation().
• Resolve the opt-in/configuration design required by AGENTS.md:118-121 before auto-stamping every user row.

Automated hermes-sweeper review.

[teknium1]

getSessionMessages() reads GET /api/sessions/{id}/messages, but GatewayAPI._message_response() in gateway/platforms/api_server.py:1697-1703 has a safe-key whitelist that omits sender_device. This type will therefore never receive the field until the API serializer and its endpoint test are updated.

[teknium1]

This runs on the backend host, not the desktop client. prompt.submit currently carries only session_id and text (apps/desktop/src/app/session/hooks/use-prompt-actions/submit.ts:343-345), so remote/cloud clients will all be stamped with the server device. Please carry an explicit client-origin value through the protocol or narrow the feature to backend-origin attribution.