test: update cancel/settle source-shape assertions to bounded tail

#7310/#7625: the cancel HTTP fallback and settle restore now request the
bounded tail (msg_limit=30) instead of the bare full-transcript shape.
test_cancelled_turn_status and test_live_to_final_anchor_visible_order
assert the exact URL string inside the extracted cancel/settle blocks; the
assertions' intent (embedded SSE payload applied BEFORE the HTTP fallback;
fallback fetch precedes fallback apply) is unchanged, so the pinned
strings are updated to the new bounded shape and the ordering contracts
are untouched.

Also moves the settle-path truncation-signal restore after the
localStorage/update-url block so the 1800-char proximity window in
test_session_rotate_url_sync keeps containing the tab-state sync lines.

static/messages.js

@@ -7057,17 +7057,16 @@ function attachLiveStream(activeSid, streamId, uploaded=[], options={}){
           ? [..._stagedMessages,..._currentVisibleMessages.slice(_stagedMessages.length)]
           : _stagedMessages;
         S.messages=_filterRecoveryControlMessages(_resolvedMessages || []);
-        // Bounded settle reload returns a tail window: keep the Load-earlier
-        // paging gate honest instead of leaving the previous (possibly full)
-        // transcript's truncation state stale (#7310/#7625).
-        if(typeof _messagesTruncated!=='undefined') _messagesTruncated=!!session._messages_truncated;
-        if(typeof _oldestIdx!=='undefined') _oldestIdx=session._messages_offset||0;
         _attachProjectedAnchorSceneToLastAssistant(S.messages);
         if(typeof _hydrateTodosFromSession==='function') _hydrateTodosFromSession(S.session);
         if(S.session&&S.session.session_id){
           try{localStorage.setItem('hermes-webui-session',S.session.session_id);}catch(_){}
           if(typeof _setActiveSessionUrl==='function') _setActiveSessionUrl(S.session.session_id);
         }
+        // Bounded settle reload returns a tail window: keep the Load-earlier
+        // paging gate honest (#7310/#7625).
+        if(typeof _messagesTruncated!=='undefined') _messagesTruncated=!!session._messages_truncated;
+        if(typeof _oldestIdx!=='undefined') _oldestIdx=session._messages_offset||0;
         if(typeof _adoptRegenerationRevision==='function')_adoptRegenerationRevision(session);
         const _markerOnlyAssistantError=_replaceMarkerOnlyAssistantWithStreamError(S.messages);
         if(_markerOnlyAssistantError&&typeof showToast==='function') showToast('No response received after context compression. Please retry.',5000,'error');

tests/test_cancelled_turn_status.py

@@ -219,7 +219,9 @@ class TestCancelledTurnPersistenceGuards:
         assert "const _applyCancelSessionPayload=(sessionPayload)=>" in block
         assert "const _cancelSessionPayload=_cancelData&&typeof _cancelData.session==='object'?_cancelData.session:null;" in block
         assert "if(_applyCancelSessionPayload(_cancelSessionPayload)) return;" in block
-        assert "const data=await api(`/api/session?session_id=${encodeURIComponent(activeSid)}`);" in block
+        # #7310/#7625: the HTTP fallback is a bounded tail now — the full
+        # transcript was being re-walked/re-redacted on every cancel recovery.
+        assert "const data=await api(`/api/session?session_id=${encodeURIComponent(activeSid)}&messages=1&resolve_model=0&msg_limit=30&expand_renderable=1`);" in block
         assert block.index("if(_applyCancelSessionPayload(_cancelSessionPayload)) return;") < block.index("const data=await api("), (
             "Cancel handler must apply the terminal SSE session payload before falling back "
             "to /api/session so captured _partial reasoning/tool rows are visible immediately."

tests/test_live_to_final_anchor_visible_order.py

@@ -829,7 +829,10 @@ def test_cancel_settlement_attaches_projected_anchor_scene_before_render():
     assert fetch_idx < attach_idx < carry_idx < render_idx
 
     embedded_idx = cancel.index("if(_applyCancelSessionPayload(_cancelSessionPayload)) return;")
-    fallback_get_idx = cancel.index("const data=await api(`/api/session?session_id=${encodeURIComponent(activeSid)}`);")
+    # #7310/#7625: the HTTP fallback is a bounded tail now (full-transcript
+    # reloads were stacking on every cancel recovery); ordering contract below
+    # is unchanged.
+    fallback_get_idx = cancel.index("const data=await api(`/api/session?session_id=${encodeURIComponent(activeSid)}&messages=1&resolve_model=0&msg_limit=30&expand_renderable=1`);")
     fallback_apply_idx = cancel.index("if(data&&data.session) _applyCancelSessionPayload(data.session);")
     assert embedded_idx < fallback_get_idx < fallback_apply_idx