perf(sessions): page catalogs and share external history snapshots

[kev1n77]

Summary

Reduce repeated work when discovering external sessions, opening long histories, and expanding the workspace session list.

• Reuse source observations and workspace ownership calculations within a discovery batch; skip unchanged snapshot/index writes.
• Page the default workspace catalog and reuse revision-bound, filtered/sorted catalog snapshots. Keep the existing full-list path for older hosts and unsupported filters.
• Share immutable history bodies and catalogs across tail/window reads, copying only the requested turns.
• Preserve observed ordering across catalog refreshes, pinned historical versions, native forks, and older-host compatibility.

Related: #3424. The separate imported-session mode fix is #3439; both PRs target main independently.

Type and Areas

Type: Performance improvement, refactor, regression fix, tests, docs.

Areas: Rust core and session persistence services; Desktop/CLI session catalog adapters; Web UI navigation and session history.

Motivation / Impact

Opening or expanding a session list previously repeated catalog traversal, filtering/sorting, and ownership work. Reading different windows of one external history also repeatedly parsed and cloned the entire frozen body.

The default list now requests its visible page and reuses the same catalog revision during expansion. History windows share a bounded cache while refreshing live view metadata separately. A 240-turn fixture verifies one snapshot read, one catalog build, and only 18 copied turns across its tail/catalog/window reads. A 655-record catalog fixture succeeds with only the five selected metadata files available, proving that the first page does not scan every session directory.

Verification

Rebased onto upstream/main at 01081d3f8; the four performance/review commits were preserved unchanged by git range-diff.

cargo test --locked -p openbitfun-core --no-default-features --features external-sources,git,product-search --lib -- external_session_import:: agentic::persistence::manager::tests session_fork_ agentic::persistence::session_branch::tests agentic::session::session_manager::tests::restore_session_ --quiet
cargo test --locked -p openbitfun-services-core --no-default-features --features local-storage --lib -- session::page::tests session::metadata_store::tests session::offline_import json_store::tests --quiet
pnpm --dir src/web-ui run test:run src/app/components/NavPanel/sections/sessions src/app/components/NavPanel/workspaceSessionView.test.ts src/flow_chat/store/FlowChatStore.test.ts src/infrastructure/api/service-api/SessionAPI.test.ts
pnpm --dir src/web-ui exec tsc --noEmit
pnpm run lint:web
pnpm run check:web
pnpm run check:core-boundaries:test
pnpm run check:core-boundaries
git diff --check upstream/main...HEAD
node scripts/check-git-object-sizes.mjs --base upstream/main --head HEAD

• Core: 136 passed, 4 opt-in tests ignored; storage: 43 passed; frontend: 359 passed across 20 files. Type checking and Git checks passed.

• check:web passed after running node scripts/generate-miniapp-chat-styles.mjs to match this Windows checkout's generated CSS line endings. The initial failure was in an unchanged upstream MiniApp artifact; normalized content was identical. That temporary generated-file change is excluded from this PR.

• cargo test --locked -p openbitfun-cli --bin openbitfun session_catalog_query_keeps_legacy_peers_and_workspace_identity_compatible -- --quiet passed during implementation before this rebase. The Desktop payload test previously compiled but its executable could not start on this machine (0xc0000139); it is not counted as passing runtime coverage.

• CI repair (6dab34b8d): the previous Frontend Build stopped at the core-boundary gate because it only recognized the old two-argument metadata page call. The guard now requires the services-core store and forwards cursor, limit, and query; the old and query-aware store entrypoints remain required. Added regression coverage rejects dropped parameters, wrong ownership, and removed entrypoints. All 154 boundary tests pass, and the complete boundary check passes in a clean temporary checkout (the main working directory contains an inaccessible pre-existing dependency link). This repair changes only the checker and its tests.

• Follow-up CI repair (ef39e5788): preserve the catalog snapshot refresh/device-switch invalidators and explicitly read them in the memo, matching adjacent ordering-revision memos. This resolves react-hooks/exhaustive-deps without dropping either dependency. Full pnpm run lint:web passes (0 errors, 11 existing warnings), the 359 focused frontend tests pass again, and pnpm run check:web passes.

• GitHub CI on ef39e5788: run 39042685396 passed. Frontend Build passed all checks, including 1,029 test files / 11,486 tests and the production/mobile builds. All three Rust and all three CLI platform jobs passed, as did the final Rust / CLI Validation check and Repository Object Sizes. Impact-gated jobs retained their normal skipped status.

Reviewer Notes

• This PR and fix(sessions): restore valid modes when continuing imported history #3439 can each merge into the current main. A local merge preview identifies one shared edit in deferred/tracking.rs: when combining them, keep fix(sessions): restore valid modes when continuing imported history #3439's mode-normalization call in this PR's overlay_view_metadata helper for both cold reads and cached/refreshed views. The second PR will need a rebase after the first is merged.
• Cursors bind the query and catalog revision. Refresh/reset paths preserve the ordering already observed by the client; hosts that do not acknowledge the query retain the existing fallback.
• Cache entries are scoped by storage owner/session/version and validated on reuse. Eviction only releases memory; retained disk snapshots remain available for older windows and forks.
• Existing persisted and wire shapes remain readable; optional query fields do not require older hosts to support the new paging path.
• Remote workspace, remote control, Peer Device Mode, and Detached Dispatch were not exercised on live remote hosts. Coverage here is focused local/compatibility fixtures, not desktop/provider end-to-end validation.
• AI-assisted. Testing level: lightly tested, with focused local coverage and the full CI run above; no live desktop/model or remote end-to-end run.

Checklist

• This PR is focused and does not include secrets, temporary prompts, generated scratch files, or unrelated artifacts.
• Relevant verification is recorded above, or skipped checks are explained.
• User-facing strings, docs, and locales are updated where applicable.