perf(dashboard): keep session-DB, cron, PID-probe and log-tail I/O off the event loop (salvage #58238/#45491/#53511/#58389/#39140/#53966)

[kshitijk4poor]

Summary

Six event-loop / hot-path fixes for the dashboard backend, salvaged from five contributor PRs onto current main with authorship preserved via cherry-pick — the uvicorn event loop stops paying for session-DB reads, cron profile scans, gateway PID lock probes, and unbounded log-tail reads.

• fix(dashboard): keep status responsive when session db locks #58238 (@msh01) — /api/status active-session count runs in an executor with a 0.75s deadline and a read-only SQLite attach, so a locked/migrating state.db can no longer stall the status endpoint.
• fix(dashboard): offload cron profile scans #45491 (@BlackishGreen33, 2 commits) — all cron dashboard endpoints run their profile-scan/file I/O via run_in_threadpool (_call_cron_for_profile retargets module globals under a lock while doing file I/O — previously on the loop).
• fix(dashboard): cache gateway PID status probes #53511 (@0disoft) — get_running_pid() opens+locks gateway.lock on every call; dashboard polling churned FDs up to EMFILE. Adds a 1s TTL cache invalidated by pid/lock/runtime-status file signatures and by every in-process write site.
• fix(web): bound dashboard action log tails #58389 (@ooiuuii) — /api/actions/{name}/status log tails read the whole file; now a bounded reverse-chunk read (256KB cap) with partial-first-line handling.
• perf(db): cache SQLite schema init and optimize descendant resolution #39140 (@sebastianlutycz, extracted) — _session_latest_descendant fetched EVERY session row and built the tree in Python; now a recursive CTE loading only the target's descendant branch. (The PR's schema-init cache and Rust PTY bridge are intentionally NOT salvaged.)
• fix(dashboard): keep session DB reads off event loop #53966 (@0-CYBERDYNE-SYSTEMS-0, residual hunk) — GET /api/sessions flipped to sync def so FastAPI's threadpool runs the SessionDB read off the loop. (Its other two hunks already landed via [Bug]: Remote desktop over Tailscale: async routes block the asyncio loop 10-25s (list_profiles, /api/profiles/sessions) starving the WS; plus Chromium LNA + Electron net stalls #54523 / are superseded by fix(dashboard): keep status responsive when session db locks #58238.)

Follow-up commits (mine):

• Cycle guard on the descendant CTE: UNION ALL recurses forever on a corrupted parent chain (a→b→a) — reproduced live, query never returns. The old Python walk was cycle-safe via a seen-set. Switched to UNION (dedups the working set, terminates); regression test added and mutation-verified (UNION ALL hangs the test).
• Fresh-install guard for the read-only status probe: SessionDB(read_only=True)'s documented contract requires the DB file to exist; on a fresh install every /api/status poll paid an OperationalError. Short-circuit to 0 when state.db is absent, with tests.
• AUTHOR_MAP entries for the plain-email contributors (+ bare-noreply mapping for sebastianlutycz).

Notes for reviewers:

• The 1s None-result caching in get_running_pid_cached is safe for gateway-start detection: cache hits require both TTL freshness AND an unchanged file signature (pid/lock/runtime-status mtime_ns+size), so a gateway writing its pid file invalidates immediately. One legacy direct gateway.pid unlink in gateway/run.py --replace bypasses the in-process cache clear but is caught by the signature check.
• _run_cron_dashboard_io uses run_in_threadpool while two sibling helpers use run_in_executor — consolidation to one offload idiom is a reasonable follow-up sweep, not done here to keep contributor commits intact.

Validation

Check	Result
tests/hermes_cli/test_web_server.py + cron_profiles + gateway/test_status.py	476 passed
E2E (real imports, temp HERMES_HOME)	5MB log tail: 1ms bounded read, byte-exact vs naive; PID probe: 1 underlying call for 2 cached reads; active count via read-only DB; CTE resolves root->c1->c2
Cycle repro	a->b->a chain: UNION ALL never returns (confirmed twice); UNION returns instantly
ruff / ty vs merge-base	clean / 0 net-new (starlette import resolves in the real venv)

[tonydwb]

Code Review Summary

Verdict: Comment (token read-only - high surface area)

PR 60884 moves session-DB, cron, PID-probe and log-tail I/O off the event loop in the dashboard. Substantial performance refactor (7 files, 537 additions, 60 deletions). References multiple prior issues (#58238, #45491, #53511, #58389, #39140, #53966).

Well-scoped performance fix. LGTM - awaiting maintainer approval.