fix(gateway): scope session lists before limiting

[GodsBoy]

What does this PR do?

Gateway users can now see useful same-chat history in /sessions and bare or numeric-fallback /resume, even when newer sessions from other chats on the same platform would previously consume the entire database fetch window.

The normal gateway path now applies the caller's indexed session_key before the SQL limit. Compression projection, current-session exclusion, and the existing _resume_row_visible and _resume_target_allowed authorisation checks remain in place. Telegram commands use the same recovered topic lane as normal message routing, while explicit authorised cross-lane resumes keep a compressed lineage on one routing peer.

This is preferable to increasing the source-wide over-fetch cap because a larger fixed window only postpones starvation. It does not migrate or backfill session data, and admin-only widening retains its existing behaviour.

Session-settled decisions carried from planning: exact lane filtering before limiting (user-approved); retaining post-query IDOR checks (user-directed); fixing both listing paths (user-approved); and avoiding migration while preserving one routing peer per moved compression lineage (user-directed).

Related Issue

Fixes #65500

Related: #54326

Related: #60138

Related: #62138

Related: #62278

PR #62138 overlaps only on the optional list_sessions_rich(session_key=...) primitive. If it lands first, this branch can rebase and drop that small overlapping hunk without changing the gateway fix.

Type of Change

• 🐛 Bug fix (non-breaking change that fixes an issue)
• ✨ New feature (non-breaking change that adds functionality)
• 🔒 Security fix
• 📝 Documentation update
• ✅ Tests (adding or improving test coverage)
• ♻️ Refactor (no behavior change)
• 🎯 New skill (bundled or hub)

Changes Made

• hermes_state.py: add indexed exact-lane filtering before result limiting, and keep compression ancestors aligned during an explicit routing move.
• hermes_cli/session_listing.py: expose exact-lane selection to shared session-listing policy without changing callers that omit it.
• gateway/slash_commands.py and gateway/session.py: scope both gateway list entry points, recover Telegram topic lanes, preserve admin widening, and keep explicit switch metadata consistent.
• tests/: cover busy same-platform installations, compression projection, current-session exclusion, full/search modes, Telegram topic recovery, admin and non-admin boundaries, null-key fail-closed behaviour, and cross-lane compressed resumes.

How to Test

1. Create more than 50 newer Telegram sessions under unrelated session_key values and at least 11 named roots in the caller's lane.

2. Run /sessions, bare /resume, /sessions full, and /sessions search <query> from the caller's lane. Verify the lists contain only exact-lane rows, retain older logical conversations, and exclude the current projected lineage where applicable.

3. Run the regression suite:

   scripts/run_tests.sh tests/test_hermes_state.py tests/hermes_cli/test_session_listing.py tests/gateway/test_resume_command.py tests/gateway/test_session.py -q

   Result: 565 tests passed, 0 failed.

Checklist

Code

• I've read the Contributing Guide
• My commit messages follow Conventional Commits (fix(scope):, feat(scope):, etc.)
• I searched for existing PRs to make sure this isn't a duplicate
• My PR contains only changes related to this fix/feature (no unrelated commits)
• I've run pytest tests/ -q and all tests pass
• I've added tests for my changes (required for bug fixes, strongly encouraged for features)
• I've tested on my platform: Linux

Documentation & Housekeeping

• I've updated relevant documentation (README, docs/, docstrings) - N/A beyond affected API docstrings
• I've updated cli-config.yaml.example if I added/changed config keys - N/A, no config changes
• I've updated CONTRIBUTING.md or AGENTS.md if I changed architecture or workflows - N/A, no architecture or workflow changes
• I've considered cross-platform impact (Windows, macOS) per the compatibility guide - no OS-specific runtime behaviour added; the Windows footgun scan passes
• I've updated tool descriptions/schemas if I changed tool behavior - N/A, no tool schema changes

Screenshots / Logs

Affected gateway reproduction

Personal and internal session identifiers are redacted. The affected Telegram lane returned only one named session even though the database contained 15 logical roots for that lane.

Query-order visual

This is a backend listing fix with no visual surface. An anonymised read-only reproduction on the affected installation produced:

Path	Source-wide candidates	Same-lane rows left after filtering	Exact-lane page after fix
/sessions	10	1	10 prior logical conversations
bare /resume	10	2, including the current conversation	10 same-lane candidates

The database contained 77 physical rows and 15 logical roots for the affected lane; session data, reset boundaries, compression metadata, and origin metadata were intact. No live database mutation was used to validate or implement the fix.

[alt-glitch]

This was generated by AI during triage.

Related: fixes #65500. It overlaps #62138 only on the optional list_sessions_rich(session_key=...) primitive and has broader gateway-command coverage.

[teknium1]

Thanks for addressing the query-ordering bug. The premise is confirmed on current main: bare/numeric /resume limits same-platform rows before _resume_row_visible (gateway/slash_commands.py:3786-3798), and /sessions similarly limits before its post-query visibility cut (hermes_cli/session_listing.py:65-83, gateway/slash_commands.py:3983-3989).

The proposed exact session_key predicate is aligned with the existing indexed routing field (hermes_state.py:907-908) and keeps the existing authorization checks in place. I found no substantive correctness issue in the PR diff during static review. GitHub reports the branch merge state as clean against current main.

Automated hermes-sweeper review.

[GodsBoy]

Current head merges cleanly with current main, and all checks on the head are green. @teknium1, please check and merge if you are happy with it.

[GodsBoy]

Refreshed this branch onto current main and resolved the test-suite refactor conflicts without restoring tests that upstream intentionally pruned.

Verification:

• 226 passed across the focused session DB, listing, resume, and gateway session suites
• Ruff clean on all touched files
• Full GitHub Actions CI passed, including all 8 Python test slices, E2E, Docker builds, Desktop E2E, supply-chain scans, and blocking lint checks
• GitHub reports the PR mergeable and clean
• A live merge-tree check remains conflict-free against the latest main after CI

Ready for maintainer review.