stage-355: 11-PR full sweep batch — metadata-only cache hit fixes + skill detail fix + phone UX + escaping + display-title projection + RFC update + test fixture hardening

[nesquena-hermes]

stage-355 — full PR sweep batch (v0.51.62)

Per Nathan's "full PR sweep" trigger. Eleven non-hold non-draft PRs all → MERGE QUEUE.

+1186 / -421 across 35 files. Eleven PRs from three contributors (franksong2702 × 9, Jordan-SkyLF × 1, dso2ng × 1).

Composition

Fixed (10)

PR	Author	LOC	Closes
#2244	franksong2702	+59/-1	#2243
#2249	franksong2702	+97/-0	#2248
#2241	dso2ng	+181/-12	—
#2250	franksong2702	+140/-34	refs #1880
#2253	franksong2702	+56/-0	—
#2255	franksong2702	+25/-3	#2254
#2257	franksong2702	+16/-17	—
#2259	franksong2702	+6/-0	#2258
#2234	Jordan-SkyLF	+158/-51	(post-v0.51.61 rebase)

Added (1)

PR	Author	LOC	Closes
#2238	franksong2702	+151/-43	#2231

Docs (1)

PR	Author	LOC	Closes
#2251	franksong2702	+311/-262	refs #1925

Highlights

• Metadata-only cache hit fixes (Fix Archive Session for metadata-only cache hits #2244 + Fix metadata-only cache hits in session mutation routes #2249) close a bug class affecting 4 routes: /api/session/archive, /api/session/pin, /api/session/rename, /api/personality/set. All 4 were silently failing when a sidebar/status preload left a _loaded_metadata_only=True stub in the LRU and a subsequent mutation tried to save it. Each route now reloads through Session.load(sid) before mutating, preserving the P0 DATA LOSS: metadata-only Session.save() wipes conversation history (v0.50.279+) #1558 data-loss guard.
• Skill detail backend fix ([codex] Fix blank skill detail views #2250 + UI guard [codex] Show skill detail API errors #2253) closes the long-standing Bug: Skills tab always shows root profile's skills regardless of active profile #1880 issue where Skills tab always showed root profile's skills. WebUI now resolves skill files multi-directory and reads SKILL.md directly instead of routing through agent (which rejected absolute paths).
• Phone sidebar UX refresh (Improve phone sidebar panel navigation #2238) gives the drawer 44px touch targets in a vertical strip, aligns PWA theme-color to sidebar chrome, and reserves bottom safe area for the composer.
• Read-only sidebar title projection (fix: reconcile stale sidebar display titles #2241) makes compressed-session sidebar rows show the fresher state.db title while keeping persisted JSON title immutable.
• XSS defensive cleanup ([codex] Escape model picker display text #2255) — model picker now escapes provider-supplied IDs/names before innerHTML.

Stage-355 maintainer fixes

Conflict resolution

tests/test_metadata_save_wipe_1558.py + CHANGELOG.md on #2249 merge — both #2244 and #2249 added tests at the same EOF insertion point and CHANGELOG entries. Kept both (#2244=archive test, #2249=parametrized pin/rename/personality test) since they cover complementary routes.

CHANGELOG.md cleanup — Previous v0.51.60 (stage-353) section in master had a stray "Phone-width layouts (refs #2231)" bullet that actually belongs to #2238 (this stage). Dropped from v0.51.60. Previous Unreleased section was polluted with stage-354 entries (#2228, old #2234 portion, #2236) mixed with stage-355 entries; rebuilt cleanly with proper v0.51.61 closing + new Unreleased.

Inconsistent style noted (non-blocking)

#2244 vs #2249 archive route — #2244 uses an inline fix at /api/session/archive, #2249 uses a _ensure_full_session_before_mutation() helper on the other 3 routes. Functionally equivalent for archive's hot path (the cache replacement is idempotent since the key already exists). Will file a follow-up issue to refactor archive → helper.

Verification

• Targeted pytest (12 PR surfaces): 205/205 pass in 9.4s
• Full pytest: exit 0
• run-browser-tests.sh: 20/20 QA + 11/11 API checks PASSED in 104s
• Live UI smoke on 8789: zero JS errors; all PR surfaces verified live
• Phase 5 strict merge-marker check: zero markers
• Python + JS syntax: clean across all 35 modified files
• CI on each constituent PR (latest SHA): 3/3 SUCCESS

Opus Advisor Review

SHIP all 11. No blockers.

Opus directly verified:

• fix: reconcile stale sidebar display titles #2241 state.db query performance — NOT N+1. read_session_lineage_metadata does batched 500-id IN (...) chunks against PRIMARY KEY; the fix: reconcile stale sidebar display titles #2241 addition just extracts state_title from already-fetched rows ✓
• fix: reconcile stale sidebar display titles #2241 generic title regex — _sidebar_title_is_generic_webui uses strict equality OR Hermes WebUI #<digits-only>; won't false-positive on user-renamed titles like "Hermes WebUI bug investigation" ✓
• fix: reconcile stale sidebar display titles #2241 display_title collision check — no other consumer uses this field name ✓
• [codex] Fix blank skill detail views #2250 skill resolution precedence — list and view endpoints use identical _active_skill_search_dirs first-match-wins, byte-identical extension set vs agent's tools/skills_tool.py ✓
• [codex] Show skill detail API errors #2253 error guard — data.success === false || data.error correctly treats empty string as falsy ✓
• [codex] Escape model picker display text #2255 escaping — both ui.js dropdown branches escape m.id and m.name; provider error message also escaped ✓
• [codex] Fix start.sh dotenv filtering load #2257 dotenv — clean mktemp → grep → source → rm pattern at start.sh:43-50 ✓
• Improve phone sidebar panel navigation #2238 touch targets — 44×44 present in style.css for .sidebar-nav .nav-tab, .panel-icon-btn, .icon-btn,.mic-btn,.voice-mode-btn; viewport-fit=cover + safe-area insets wired ✓
• Fix Archive Session for metadata-only cache hits #2244 vs Fix metadata-only cache hits in session mutation routes #2249 style — functionally equivalent; the inline fix's SESSIONS[sid] = s is a replacement so no eviction needed ✓

Two non-blocker follow-ups Opus surfaced (will file after merge)

1. Refactor /api/session/archive to use _ensure_full_session_before_mutation (cosmetic — functionally equivalent today).
2. fix: use documented aux model for update summaries #2234 _split_summary_category regex — only recognizes notice/worth knowing/worth/note/what you'll notice/users will notice. If LLM emits Caveat: or Important:, those bullets are silently dropped (the fallback only fires when notice_items is empty). Worth broadening the regex or falling through unrecognized prefixes into a notice bullet.

Closes / refs

• Closes #2243 (via Fix Archive Session for metadata-only cache hits #2244 archive-session fix)
• Closes #2248 (via Fix metadata-only cache hits in session mutation routes #2249 pin/rename/personality helper)
• Closes #2254 (via [codex] Escape model picker display text #2255 model picker escaping)
• Closes #2258 (via [codex] Harden update-link git fixture #2259 test fixture pin)
• Refs Bug: Skills tab always shows root profile's skills regardless of active profile #1880 (via [codex] Fix blank skill detail views #2250 — partial, broader profile-scoped skills work)
• Refs RFC: Make WebUI a thin observability/control client over Hermes Agent runtime #1925 (via docs(runtime): codify #1925 adapter contract and migration gates #2251 — RFC update only)
• Refs feat: add per-target update summaries #2207 (via fix: use documented aux model for update summaries #2234 — refines update banner)
• Refs Improve phone panel icon touch targets #2231 (via Improve phone sidebar panel navigation #2238 — phone sidebar UX)

Stats

35 files changed, 1186 insertions(+), 421 deletions(-) + 1 maintainer commit (CHANGELOG cleanup)