Reject invalid and stale history cursors

[lihongguang-0014]

Scope

Keep the existing created_at|id history cursor format while making malformed and stale cursors fail explicitly.

• Parse non-empty cursors as bounded ASCII-decimal signed-64-bit pairs; null and blank values retain their legacy unpositioned behavior.
• Validate cursor ownership and read the canonical active/archive page in one SQLite snapshot, so deleted, reset, or cross-session anchors cannot silently become a latest-page read.
• Preserve old archived rows whose original integer id is unavailable; they remain visible but do not advertise an unusable continuation cursor.
• Return stable HISTORY_CURSOR_INVALID and HISTORY_CURSOR_INVALIDATED v4 errors.
• Recover Web Chat and Session Inspect through their current Session Read boundary by retrying from latest and replacing stale canonical rows while preserving the live local tail.

This rebuild uses the extracted application/Gateway adapters on current main. It does not modify the former monolithic RPC handler, add a cursor format or migration, change CLI logic, or introduce a second Web pagination state machine.

Compatibility and Upgrade

No database, configuration, persisted session, or desktop profile migration is required. Valid cursors keep their ordering behavior. Null/blank inputs remain compatible. Clients that sent malformed or stale non-empty cursors now receive an explicit non-retryable error instead of an unrelated latest window; existing CLI error propagation already handles these codes without code changes.

Branch

Base branch: main

Target exception: N/A

Issue

Linked issue: None

If None, reason: Standalone history consistency fix without a linked public issue.

Release Note

Release note: History pagination rejects malformed and stale cursors and Web retries safely from the latest page.

Tests

• Python: 88 focused application, adapter, RPC, characterization, and SQLite snapshot tests passed.
• CLI: 6 all-history pagination tests passed.
• Web: 115 focused Session Read, Chat history, and Session Inspect tests passed; full Web architecture and TypeScript checks passed.
• Contracts: Gateway generation --check passed.
• Static: targeted Ruff and mypy passed; git diff --check passed.

No credentialed provider, full browser E2E, released desktop installer, or live cross-platform run was performed. CI remains authoritative for platform coverage.

Maintainer Live Check

Maintainer live check: no

Surface: gateway, browser

Safety

No secrets, local paths, private prompts/transcripts, channel identifiers, or private fixtures are included.

Third-Party Origin

Third-party origin: none

Details if non-none: N/A.

Documentation Changes

• Links point to existing repository files or stable external pages.
• Code fences and Markdown render correctly on GitHub.
• Examples avoid real secrets, local private paths, and private transcripts.