perf(dashboard): trim session-list payloads + paginate session messages (salvage #60347/#43653/#47437)

[kshitijk4poor]

Summary

Session-list API payloads shrink ~97% and session transcripts become pageable: list rows stop carrying the rendered system_prompt blob (stripped at the API layer AND skipped inside SQLite), and GET /api/sessions/{id}/messages accepts limit/offset.

Salvages three complementary contributor PRs onto current main with authorship preserved via cherry-pick:

• fix(api): add pagination to GET /api/sessions/{id}/messages #60347 (@mahdiwafy) — pagination on GET /api/sessions/{id}/messages (limit clamped at 500, default unchanged = full transcript for backward compat).
• fix(api): strip system_prompt/model_config from session list rows #43653 (@OmarB97) — strip system_prompt/model_config from /api/sessions and /api/profiles/sessions rows, ?full=1 escape hatch, tests. A 21-row response measured 528KB with 96% dead weight.
• perf(state): add compact_rows to skip system_prompt blob in session list queries #47437 (@CodeForgeNet) — compact_rows=True SQL projection so SQLite never copies the blob out of the B-tree page (extracted from a stale-base branch; only the substantive hunks salvaged).

Follow-up commits (mine):

• The original perf(state): add compact_rows to skip system_prompt blob in session list queries #47437 hardcoded column list was cut against a June schema and silently dropped 11 current columns (incl. desktop sidebar fields git_branch/git_repo_root and gateway routing fields). Replaced with a SCHEMA_SQL-derived projection (only system_prompt excluded) + a mutation-verified guard test pinning the schema↔projection contract.
• Wired compact_rows=(not full) so ?full=1 returns complete rows end-to-end; threaded compact_rows through the compression-tip projection so projected tips can't reintroduce the blob; applied it at the remaining hot list callers (/api/status count, _session_latest_descendant fallback, /api/sessions/stats).
• get_messages(offset=N) without limit silently ignored the offset (SQLite needs LIMIT for OFFSET) — fixed with LIMIT -1, regression test.
• Pagination tests for fix(api): add pagination to GET /api/sessions/{id}/messages #60347 (shipped none): page order, offset-past-end, soft-deleted-row interaction.
• AUTHOR_MAP entries for both plain-email contributors.

Notes for reviewers:

• model_config is still fetched by the compact SQL projection (it's used in WHERE predicates and by internal callers) and stripped at the API layer; measured payload win comes from system_prompt.
• The messages endpoint's default limit=None intentionally still returns the full transcript — the desktop currently depends on that; a bounded default is a separate behavioral decision.
• Follow-up candidate (not this PR): get_messages still does SELECT * per message row; a column projection for reasoning blobs would compound the win.

Supersedes #42196 (@mijanx) and #60436 (@sitkarev) — both attacked the same payload problem and can be closed in favor of this; their diagnosis is credited. Also supersedes the already-closed #25628.

Validation

Check	Result
tests/test_hermes_state.py	339 passed
tests/hermes_cli/test_web_server.py	361 passed
E2E (real imports, temp HERMES_HOME, 38KB prompts)	list payload 117KB -> 3KB (97.4%); full=1 returns blob; pages reassemble exactly
Guard test mutation check	dropping a column from the projection fails the test
ruff / ty vs merge-base	clean / 0 net-new

[mahdiwafy]

Reviewed the salvage work as the original author of #60347 (pagination). This is solid — thanks for the improvements:

• compact_rows SQL projection derived from SCHEMA_SQL is the right approach. The original perf(state): add compact_rows to skip system_prompt blob in session list queries #47437 had a hardcoded column list that silently dropped 11 fields — your schema-derived projection with a guard test prevents that regression permanently.
• LIMIT -1 for offset-without-limit is a good catch that we missed in the original PR. SQLite needs LIMIT for OFFSET to work, and the default behavior silently ignored the offset parameter.
• Pagination tests cover edge cases we didn't — active flag filtering, offset-past-end, reassembly across pages.
• Threading compact_rows through compression-tip projection and all list callers (/api/status, /api/sessions/stats, _session_latest_descendant, tui_gateway) is thorough.

Closed our #60347 in favor of this — the salvage covers it and more. Thanks for preserving authorship via cherry-pick.

[tonydwb]

Code Review Summary

Verdict: Comment (token read-only)

PR 60883 trims session-list payloads and paginates session messages in dashboard. Performance fix (6 files, 341 additions, 25 deletions). References prior issues (#60347, #43653, #47437). No security issues or debug artifacts detected.

LGTM - awaiting maintainer approval.