Release: msg_limit ceiling + row-loss-safe pagination (#6152 + #6154, @rh-id)

[nesquena-hermes]

Release: msg_limit ceiling + row-loss-safe pagination (#6152 + #6154)

Ships the coupled msg_limit ceiling pair by @rh-id (Ruby Hartono), gated and hardened.

What ships

• fix(routes): clamp GET /api/session msg_limit to a server-side ceiling #6152 (backend): GET /api/session?msg_limit= is clamped to [1, 500] via _parse_msg_limit(); sets _messages_truncated when clamped. The bare no-msg_limit path (branch/undo/jump-to-start) still returns the full transcript. Prevents an oversized/hostile msg_limit from forcing an unbounded payload.
• fix(frontend): route msg_limit-heavy paths around the server ceiling (#6152) #6154 (frontend): _loadOlderMessages grows the tail window below the ceiling and switches to bounded msg_before backward paging once the server would clamp; outline jump uses the bare full-transcript path instead of the old msg_limit=9999 hack. Drift-guard test keeps the mirrored constant in sync.

Gate findings fixed before ship (maintainer follow-up commit, Co-authored-by @rh-id)

Adversarial Codex review reproduced two silent row-loss regressions, both fixed:

1. A raw-row-heavy msg_before cursor page that textually repeated the current tail could be misclassified as the cumulative tail and wholesale-replace it (reproduced: 470 of 940 rows lost). Now gated on !useBeforePaging so cursor pages are always prepended.
2. A same-session refresh above the ceiling could shrink an already-loaded >500-row transcript to the last 500 (backend clamp). Over-ceiling reloads now use the bare full-transcript path.

Verification

• Codex adversarial re-gate (round 2): SAFE TO SHIP — 940/940 rows retained on cursor paging, 1000/1000 on refresh, no seam duplication, small sessions still use the fast tail window.
• Full pytest suite: 13,249 passed (sole failure = the known editable-install box artifact test_agent_runtime_revision_guard, CI-green on all shards — not related).
• Targeted + sessions/pagination/regression suites: green (126 + 29 focused).

Closes #6152
Closes #6154
Closes #6177

Credit: @rh-id (Ruby Hartono) — both original PRs. Note: @webtecnica's #6206 bundles this same work plus the #6177 metadata decoupling; reconciled to this pair (the original, CI-green, gated implementation). The #6177 metadata-exposure decoupling can follow as a separate step.

[greptile-apps]

Greptile Summary

This release ships two coupled changes from @rh-id: a server-side msg_limit ceiling (_MAX_MSG_LIMIT = 500) on GET /api/session and matching frontend pagination logic that gracefully handles the ceiling — along with two silent row-loss regressions found during adversarial review that were fixed before ship.

• Backend (api/routes.py): _parse_msg_limit() clamps ?msg_limit= to [1, 500], returning None for the bare no-msg_limit path (branch/undo/jump) so those callers still receive the full transcript. The existing _messages_truncated signal covers the clamped case.
• Frontend (static/sessions.js): _loadOlderMessages now chooses between tail-growth (below the ceiling) and msg_before backward paging (at/above the ceiling); _ensureMessagesLoaded falls back to the bare full-transcript path when the reload hint exceeds the ceiling to prevent silent shrink on refresh; outline jump drops the msg_limit=9999 hack in favour of the bare path.
• Row-loss fixes: useBeforePaging gating prevents a msg_before page from being misclassified as a cumulative tail (wholesale-replace), and the over-ceiling reload fallback prevents an already-loaded >500-row transcript from shrinking on refresh.

Confidence Score: 5/5

Safe to merge — all changed paths are well-guarded, the two pre-ship row-loss regressions are correctly addressed, and the test suite is comprehensive.

The backend change is a narrow, well-tested helper extraction with no schema or DB impact. The frontend pagination strategy switch is gated correctly: useBeforePaging is forced false before the suffix-continuity heuristic so cursor pages are never misclassified as cumulative tails, and the over-ceiling reload path correctly falls back to the bare full-transcript request. All boundary conditions are handled. The drift-guard test and comprehensive _parse_msg_limit suite reduce regression risk from future constant changes.

No files require special attention — the hand-mirrored _MSG_LIMIT_MAX constant is guarded by the drift test and will be retired once #6177 lands.

Important Files Changed

Filename	Overview
api/routes.py	Adds _parse_msg_limit() helper and _MAX_MSG_LIMIT = 500 constant; replaces inline parse/clamp logic with the tested helper. Clean and minimal change to the handler.
static/sessions.js	Adds _MSG_LIMIT_MAX mirror constant, boundedReloadLimit ceiling guard in _ensureMessagesLoaded, and two-strategy logic in _loadOlderMessages. Both silent row-loss regressions are correctly fixed.
static/outline.js	Removes msg_limit=9999 hack from outline jump, replacing it with the bare no-msg_limit path so the full transcript is returned regardless of the new backend ceiling.
tests/test_session_msg_limit_ceiling.py	New unit test suite for _parse_msg_limit: covers absent/empty/malformed input, legitimate sizes, over-ceiling clamp, exact-ceiling pass, and zero/negative clamp-to-one.
tests/test_msg_limit_ceiling_drift.py	New drift-guard test: extracts both constants from source via regex, skips gracefully when JS mirror is absent, asserts equality once both are present.
tests/test_issue3162_ensure_messages_loaded.py	Replaces fragile fixed-character-window extraction with brace-balanced parsing. Robust improvement that won't need future bumps as the function grows.
tests/test_api_timeout.py	Updates timeout assertions to match the new ternary-split api() calls; both the msg_before and msg_limit paths are verified to carry timeoutMs:120000.
tests/test_cross_session_message_load_isolation.py	Adds globalThis._MSG_LIMIT_MAX = 500 to the JS test harness so _ensureMessagesLoaded's new boundedReloadLimit check resolves correctly.
tests/test_webui_external_refresh_frontend.py	Updates source-text assertions to match the new boundedReloadLimit variable and its ceiling check in _ensureMessagesLoaded.
CHANGELOG.md	Release-authored CHANGELOG entry for the msg_limit ceiling + pagination fix. Clear and detailed.

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[User scrolls up — _loadOlderMessages] --> B{requestedLimit >= _MSG_LIMIT_MAX?}
    B -- No: below ceiling --> C[Tail-growth request\nmsg_limit=requestedLimit]
    B -- Yes: at/above ceiling --> D[msg_before paging\nmsg_before=_oldestIdx&msg_limit=30]
    C --> E{tailMatches?\nsuffix continuity check}
    E -- Yes: tail intact --> F[Wholesale-replace S.messages\nwith larger tail window]
    E -- No: race/diverge --> G[Fallback: fetch msg_before page\nthen prepend]
    D --> H[tailMatches forced false\n!useBeforePaging short-circuit]
    H --> I[Reuse msg_before page directly\nprepend to S.messages]
    F --> J[Update _oldestIdx + _messagesTruncated\nrenderMessages]
    G --> J
    I --> J
    K[_ensureMessagesLoaded on refresh] --> L{reloadLimit > _MSG_LIMIT_MAX?}
    L -- No --> M[Bounded reload: msg_limit=reloadLimit]
    L -- Yes --> N[Bare full-transcript path\nno msg_limit — no silent shrink]
    O[Outline jump _jumpToMessage] --> P[Bare full-transcript path\nno msg_limit — gets every row]

Loading

%%{init: {'theme': 'base', 'themeVariables': {"darkMode": true, "background": "#0d1117", "primaryColor": "#21262d", "primaryTextColor": "#e6edf3", "primaryBorderColor": "#8b949e", "lineColor": "#8b949e", "textColor": "#e6edf3", "edgeLabelBackground": "#161b22", "actorBkg": "#21262d", "actorBorder": "#8b949e", "actorTextColor": "#e6edf3", "actorLineColor": "#8b949e", "signalColor": "#8b949e", "signalTextColor": "#e6edf3", "noteBkgColor": "#373320", "noteBorderColor": "#d4a72c", "noteTextColor": "#f0e6c0", "labelBoxBkgColor": "#21262d", "labelBoxBorderColor": "#8b949e", "labelTextColor": "#e6edf3", "loopTextColor": "#e6edf3", "activationBkgColor": "#30363d", "activationBorderColor": "#8b949e"}}}%%
flowchart TD
    A[User scrolls up — _loadOlderMessages] --> B{requestedLimit >= _MSG_LIMIT_MAX?}
    B -- No: below ceiling --> C[Tail-growth request\nmsg_limit=requestedLimit]
    B -- Yes: at/above ceiling --> D[msg_before paging\nmsg_before=_oldestIdx&msg_limit=30]
    C --> E{tailMatches?\nsuffix continuity check}
    E -- Yes: tail intact --> F[Wholesale-replace S.messages\nwith larger tail window]
    E -- No: race/diverge --> G[Fallback: fetch msg_before page\nthen prepend]
    D --> H[tailMatches forced false\n!useBeforePaging short-circuit]
    H --> I[Reuse msg_before page directly\nprepend to S.messages]
    F --> J[Update _oldestIdx + _messagesTruncated\nrenderMessages]
    G --> J
    I --> J
    K[_ensureMessagesLoaded on refresh] --> L{reloadLimit > _MSG_LIMIT_MAX?}
    L -- No --> M[Bounded reload: msg_limit=reloadLimit]
    L -- Yes --> N[Bare full-transcript path\nno msg_limit — no silent shrink]
    O[Outline jump _jumpToMessage] --> P[Bare full-transcript path\nno msg_limit — gets every row]

Loading

_{Reviews (2): Last reviewed commit: "test: fix two node-harness tests broken ..." | Re-trigger Greptile}

[cutter-sh]

🎬 Cutter preview — PR #6213

Scroll to load older messages — Load earlier messages keeps paging older history on long transcripts without dropping already-loaded rows.

Jump to message via outline — Outline jump scrolls the full transcript to Question 700 even in a 1400-message chat.