Reject invalid and stale history cursors

[lihongguang-0014]

Scope

Keep the existing created_at|id history cursor format while rejecting malformed and stale cursors explicitly.

• Parse non-empty cursors as bounded ASCII-decimal signed-64-bit pairs; null and blank values retain legacy unpositioned behavior.
• Validate cursor ownership and read the canonical active/archive page in one SQLite snapshot. Deleted, reset, or cross-session anchors cannot silently become a latest-page read.
• Preserve archived rows whose original integer ID is unavailable without advertising an unusable continuation cursor.
• Return stable HISTORY_CURSOR_INVALID and HISTORY_CURSOR_INVALIDATED v4 errors.
• Recover Web Chat and Session Inspect through the Session Read boundary by retrying from latest and replacing stale canonical rows while preserving the live local tail. Background refresh and subscription reconciliation retain explicit recovery outcomes.

Windows CI follow-ups capture expected Goal observer warnings without rendering tracebacks inside the test deadline, preserve native Win32 error metadata for the existing bounded private-path contention handling, and use the current Python executable in execution fixtures. Two SQLite/install startup contracts run in the existing serial phase; the probe cancellation test always releases and drains its worker. Existing timeout limits, external-thread cancellation, durable-state assertions, and ACL/identity checks remain enforced.

Compatibility and Upgrade

No database, configuration, session, or desktop profile migration is required. Valid cursors retain their ordering behavior. Null/blank inputs remain compatible. Malformed or stale non-empty cursors now return explicit errors; Web clients recover through the current Session Read boundary. CLI error propagation requires no change.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: None

If None, reason: Standalone history consistency fix without a linked public issue.

Release Note

Release note: History pagination rejects malformed and stale cursors and Web retries safely from the latest page.

Tests

• After synchronizing main, five history-related Python files: 255 passed, 1 skipped. Four CI-repair-related files: 246 passed, 15 skipped.
• Native Win32 error regressions fail before the fix and pass afterward for access/sharing errors and a permanent-error control. Targeted Ruff, mypy, and whitespace checks pass.
• Final ingress file: 89 passed. Runtime Pack file: 49 passed, 2 skipped; two unchanged symlink tests fail locally with WinError 1314 because this Windows account lacks symlink privilege.
• Actual Windows gateway-sqlite runner selects both startup/cancellation regressions only in its serial phase: 2 passed, 10,356 deselected. Existing serial runner contracts also pass.
• Previous PR head 942a6ee5a: CI run 35157339327 passed all 38 executed jobs (2 conditional skips), including all Linux/Windows shards, WebUI validation/recovery, cross-platform Desktop E2E, and Windows Contract determinism. The Windows gateway-sqlite shard passed 10,284 parallel tests and 25 serial tests. Protected merge-queue validation runs separately. A later main update introduced generated aggregate conflicts; head b4df90f2b merges main and regenerates both aggregates from the combined schemas. Two independent generator passes agree; Python history/provider/SQLite checks pass 283 tests (1 skip), forced SQLite fallback passes 14 tests, six WebUI files pass 278 tests, and full WebUI typecheck passes. Fresh CI run 35169835119 passed all 39 executed jobs (2 conditional skips), including all Windows shards and cross-platform Contract determinism; protected queue validation remains separate.

Local checks use synthetic data and isolated test state. No credentialed provider run or released installer acceptance was performed.

Maintainer Live Check

Maintainer live check: no

Surface: gateway, browser

Safety

No secrets, local paths, private prompts/transcripts, channel identifiers, or private fixtures are included.

Third-Party Origin

Third-party origin: none

Details if non-none: N/A.

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.

[github-actions]

Merge queue CI: cancelled — run 35141021695, attempt 1.
Tested queue candidate: f072b462135a0fa93f8c4768177896218e300bc4. This result belongs to that combined tree, not necessarily the PR's current head.

• Windows high-risk (gateway-sqlite): cancelled
• Windows high-risk (desktop-installer-contracts): failure
• Desktop recovery E2E (macos-latest, profiles): cancelled
• Desktop recovery E2E (macos-latest, ownership): cancelled
• CI result: failure

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: success — run 35175036706, attempt 1.
Tested queue candidate: 614dc4c8b5a07573dc66af9481975a5a2422aad5. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.

[github-actions]

Merge queue CI: success — run 35175248413, attempt 1.
Tested queue candidate: 35bf251eb7913c0cb87bce0fc8195346ad2ddd6f. This result belongs to that combined tree, not necessarily the PR's current head.

The run summary lists reused suites and executed checks. A green PR check alone does not mean queue validation has passed.