Merge PR #7636: perf(sessions): call-scoped profile-home resolve cache

api/models.py

@@ -35,7 +35,7 @@ from api.config import (
     LOCK, STREAMS, STREAMS_LOCK, DEFAULT_WORKSPACE, DEFAULT_MODEL, PROJECTS_FILE, HOME,
     get_effective_default_model, _get_session_agent_lock,
 )
-from api.workspace import get_last_workspace, _resolve_path
+from api.workspace import get_last_workspace, _resolve_path, profile_home_resolve_cache_scope
 from api.usage import prompt_cache_hit_percent
 from api.agent_sessions import (
     _is_continuation_session,
@@ -7708,6 +7708,7 @@ def _state_projection_sidecar_metadata(sid: str) -> dict:
     return dict(metadata)
 
 
+@profile_home_resolve_cache_scope()
 def _load_cli_sessions_uncached(
     hermes_home: Path,
     db_path: Path,
@@ -8005,7 +8006,7 @@ def _load_cli_sessions_uncached(
                 cli_sessions.append({
                     'session_id': sid,
                     'title': _display_title,
-                    'workspace': str(get_last_workspace(profile=_cli_profile)),
+                    'workspace': _cli_workspace(),
                     'model': row['model'] or None,
                     'message_count': row['message_count'] or row['actual_message_count'] or 0,
                     'created_at': row['started_at'],

api/workspace.py

@@ -19,6 +19,8 @@ import stat
 import subprocess
 import sys
 import concurrent.futures
+import contextlib
+import contextvars
 import threading
 import time
 from collections.abc import Callable
@@ -207,6 +209,80 @@ def _is_remote_terminal_backend(terminal_cfg: dict | None) -> bool:
     return backend not in ('', 'local')
 
 
+# Call-scoped cache for `_resolve_profile_home_param`'s filesystem
+# `.resolve()` call. The webui's session list builds one `Session` per CLI
+# session row (`_load_cli_sessions_uncached`), and `Session.__init__` calls
+# `_resolve_profile_home_param(profile)` once per row -- with only one
+# profile in play (the common case) that is the SAME path resolved hundreds
+# of times per request. Individually a resolve() is ~1ms, but at a few
+# hundred sessions this compounded into multi-second sidebar hangs under
+# host load (confirmed via repeated "Slow WebUI request still running"
+# warnings pinned to this call site).
+#
+# IMPORTANT: this is deliberately NOT a process-lifetime cache. An earlier
+# revision of this fix cached forever, on the premise that a profile
+# argument always resolves to the same path for the life of the process --
+# but `Path.resolve()` is a filesystem call, not a pure function of
+# startup constants: a profile-home symlink can be retargeted while the
+# webui process keeps running for days/weeks, and `_safe_resolve()` below
+# deliberately falls back to returning the UNRESOLVED input after a
+# transient `OSError`/`RuntimeError`/`ValueError`, which a process-lifetime
+# cache would then serve forever. Both are real correctness bugs (caught in
+# PR #7636 review), not style nitpicks.
+#
+# Instead the cache is scoped to exactly ONE invocation of the hot loop
+# (`_load_cli_sessions_uncached`, wrapped below in `profile_home_resolve_cache_scope`)
+# via a `ContextVar` that holds a fresh dict only while that single
+# sidebar-list build is running, and is `None` everywhere else. Every other
+# call site -- and every request that isn't actively inside that one
+# build -- resolves fresh every time, exactly like pre-PR behavior, so a
+# symlink retarget or a transient resolve error is never masked past the
+# single call that would have paid for the redundant resolves anyway.
+_PROFILE_HOME_RESOLVE_SCOPE: "contextvars.ContextVar[dict[Path, Path] | None]" = (
+    contextvars.ContextVar("_PROFILE_HOME_RESOLVE_SCOPE", default=None)
+)
+
+
+@contextlib.contextmanager
+def profile_home_resolve_cache_scope():
+    """Enable memoization of `_resolve_profile_home_param` for one call.
+
+    Use as a decorator (or a `with` block) around the single hot-path
+    operation that resolves the SAME profile argument hundreds of times in a
+    tight loop -- currently `_load_cli_sessions_uncached` building the
+    CLI/cron session list. While active, repeated resolves of the same
+    profile argument are served from a dict that lives ONLY for the
+    duration of the call. Outside of it -- including before/after, and any
+    call site other than the one wrapped -- `_resolve_profile_home_param`
+    resolves fresh every time, with no caching, matching pre-PR behavior
+    exactly. Nested/reentrant use restores the previous (outer) value on
+    exit rather than clobbering it, so this is safe to nest.
+    """
+    token = _PROFILE_HOME_RESOLVE_SCOPE.set({})
+    try:
+        yield
+    finally:
+        _PROFILE_HOME_RESOLVE_SCOPE.reset(token)
+
+
+def _cached_safe_resolve_profile_home(pre_resolve: Path) -> Path:
+    """`_safe_resolve()` for profile-home paths.
+
+    Memoized only while a `profile_home_resolve_cache_scope()` is active
+    (see module doc above); otherwise resolves fresh every call, matching
+    pre-PR behavior.
+    """
+    cache = _PROFILE_HOME_RESOLVE_SCOPE.get()
+    if cache is None:
+        return _safe_resolve(pre_resolve)
+    cached = cache.get(pre_resolve)
+    if cached is not None:
+        return cached
+    resolved = _safe_resolve(pre_resolve)
+    cache[pre_resolve] = resolved
+    return resolved
+
+
 def _resolve_profile_home_param(profile: str | Path | None) -> Path:
     """Resolve a profile parameter (name string, directory path string, or Path) to a profile home Path.
 
@@ -244,14 +320,14 @@ def _resolve_profile_home_param(profile: str | Path | None) -> Path:
     raw = str(profile).strip()
 
     if isinstance(profile, Path):
-        return _safe_resolve(profile.expanduser())
+        return _cached_safe_resolve_profile_home(profile.expanduser())
 
     # Strings are LOGICAL PROFILE IDS ONLY — no path-shaped strings, ever.
     if not _PROFILE_NAME_RE.fullmatch(raw):
         raise ValueError(f"invalid profile name: {raw!r}")
 
     from api.profiles import get_hermes_home_for_profile
-    return _safe_resolve(get_hermes_home_for_profile(raw))
+    return _cached_safe_resolve_profile_home(get_hermes_home_for_profile(raw))
 
 
 def _is_default_profile_home(profile_home: Path) -> bool:

docs/CONTRACTS.md

@@ -89,6 +89,14 @@ contributor guidance; it does not change runtime behavior or CI gates.
   `models_cache.json` refresh timestamps), the stat-identity fallbacks, and the
   schema/version stamps. Start here before changing model-catalog caching, the
   `/api/models` cache keys, or the Codex catalog dependency (#2443, #7540).
+- [`docs/architecture/profile-home-resolve-cache.md`](architecture/profile-home-resolve-cache.md):
+  current contract for the call-scoped memoization around
+  `_resolve_profile_home_param()` in `api/workspace.py`: what it caches, the
+  one-hot-loop scope (`_load_cli_sessions_uncached`) versus every other call
+  site getting fresh resolution, and the freshness guarantee that a symlink
+  retarget or transient resolve fallback is always observed on the next call.
+  Start here before widening this cache's scope or adding a similar
+  call-scoped cache elsewhere (#7636).
 
 When a change touches streaming, recovery, replay, compression, context
 reconstruction, cancellation, approval/clarify, session metadata, or run state,

docs/architecture/profile-home-resolve-cache.md

@@ -0,0 +1,87 @@
+# Profile-home resolve call-scoped cache (`api/workspace.py`)
+
+This document records the current scope, ownership, and freshness contract for
+the call-scoped memoization added around `_resolve_profile_home_param()` in
+`api/workspace.py`. It describes shipped behavior and changes no runtime
+behavior. It was added after PR #7636 review flagged this cache lifecycle as
+an undocumented runtime contract.
+
+## What is cached
+
+- **What:** the resolved `Path` returned by `_safe_resolve()` for a given
+  pre-resolve profile-home `Path`, inside `_cached_safe_resolve_profile_home()`.
+- **Key:** the unresolved profile-home `Path` passed in.
+- **Store:** a plain `dict[Path, Path]` held by the
+  `_PROFILE_HOME_RESOLVE_SCOPE` `contextvars.ContextVar`, which defaults to
+  `None` (no active scope).
+
+## Scope: one call, not the process lifetime
+
+The cache is deliberately **call-scoped**, not process-lifetime. It exists only
+for the duration of one wrapped call to `_load_cli_sessions_uncached` — the
+CLI/cron sidebar session-list build that resolves the same profile argument
+once per `Session` row (hundreds of times per request in the common case,
+which is the N+1 this cache fixes). `profile_home_resolve_cache_scope()` sets
+the `ContextVar` to a fresh `{}` on entry and resets it to the previous value
+in a `finally` block on exit, so no cache entry survives past the single call
+it was created for. An earlier revision of this fix cached for the life of the
+process; that was reverted in review (see #7636) because `Path.resolve()` is a
+filesystem call, not a pure function of process-startup constants.
+
+## Ownership: which call sites get caching
+
+- `profile_home_resolve_cache_scope()` is applied, as a decorator, to exactly
+  one call site today: `_load_cli_sessions_uncached` in `api/models.py`.
+- Every other caller of `_resolve_profile_home_param()` /
+  `_cached_safe_resolve_profile_home()` — and every call to those functions
+  from outside an active scope, including calls that happen before or after
+  the one wrapped call — gets **no caching**: `_PROFILE_HOME_RESOLVE_SCOPE.get()`
+  returns `None`, and `_cached_safe_resolve_profile_home()` falls straight
+  through to a fresh `_safe_resolve()` call, exactly matching pre-PR behavior.
+- Nested/reentrant use of `profile_home_resolve_cache_scope()` restores the
+  previous (outer) value on exit rather than clobbering it, so nesting is safe
+  but still never leaks a cache entry past the scope that created it.
+
+## Freshness guarantee
+
+Because the cache is call-scoped and discarded in `finally` after each use, a
+profile-home symlink retarget or a transient `_safe_resolve()` fallback
+(`OSError`/`RuntimeError`/`ValueError`, which deliberately returns the
+unresolved input) is always observed fresh on the **next** call — the cache
+never outlives the call that populated it. The only staleness window is
+*within* a single call, i.e. across the hundreds of `Session` rows built by one
+`_load_cli_sessions_uncached` invocation — which is correct and intended, since
+nothing about a profile's home path should change mid-call.
+
+## Change protocol
+
+1. If a new hot loop needs this memoization, wrap it with
+   `profile_home_resolve_cache_scope()` (as a decorator or a `with` block) at
+   its own call boundary — do not widen the existing scope on
+   `_load_cli_sessions_uncached` to also cover unrelated code.
+2. Do not turn this into a process-lifetime or otherwise longer-lived cache.
+   The scoping is the fix for the correctness bugs described above, not an
+   incidental detail.
+3. This is a runtime contract: changes here update this document and are
+   described in the PR body.
+
+## Tests
+
+`tests/test_profile_home_resolve_caching.py` covers: repeated resolves within
+one scope hit the cache once
+(`test_resolve_profile_home_param_caches_within_one_scope`,
+`test_resolve_profile_home_param_caches_within_one_scope_for_profile_name`);
+two separate scopes never share state, so a symlink change between them is
+observed on the second scope
+(`test_cache_does_not_persist_across_separate_scopes`); calls outside any
+scope never cache at all (`test_no_caching_outside_any_scope`); the decorator
+is actually wired onto `_load_cli_sessions_uncached`
+(`test_scope_decorator_use_matches_load_cli_sessions_uncached_wiring`); and the
+N+1 fix itself, both that it dedupes resolves on a cold sidecar-cache miss
+(`test_load_cli_sessions_uncached_dedupes_profile_home_resolve_on_sidecar_cache_miss`)
+and that resolve calls scale linearly with the fix disabled
+(`test_load_cli_sessions_uncached_profile_home_resolve_scales_with_fix_disabled`).
+
+## References
+
+PR: #7636.

tests/test_profile_home_resolve_caching.py

@@ -0,0 +1,349 @@
+"""Regression test: `_resolve_profile_home_param` memoizes its filesystem
+`.resolve()` call, but ONLY for the duration of a single
+`profile_home_resolve_cache_scope()` (currently wrapping
+`_load_cli_sessions_uncached`, the sidebar's session-list build).
+
+Building the CLI session list calls `_resolve_profile_home_param(profile)`
+once per session row (`Session.__init__`), so with hundreds of sessions on
+the same profile the unscoped code redundantly re-resolved the identical
+path via a filesystem `.resolve()` on every single row.
+
+An earlier revision of this fix cached the result in a plain process-lifetime
+module dict. That was flagged in PR #7636 review: `Path.resolve()` is a
+filesystem call, not a pure function of process-startup constants -- a
+profile-home symlink can be retargeted while the webui process keeps
+running, and `_safe_resolve()` deliberately falls back to the UNRESOLVED
+input after a transient error, so a process-lifetime cache could serve a
+stale or wrong path for the rest of the process's life.
+
+This file tests the corrected, call-scoped design:
+  (a) within one scope, repeated resolves of the same argument hit the cache
+      (single underlying `_safe_resolve()` call) -- same benefit as before.
+  (b) across two SEPARATE scopes (simulating two different requests/list
+      builds), the cache does NOT persist -- `_safe_resolve()` runs again
+      fresh on the second scope, proving no cross-request staleness.
+  (c) outside any scope, `_resolve_profile_home_param` resolves fresh every
+      time with no caching at all, matching pre-PR behavior exactly.
+"""
+import sys
+from pathlib import Path
+from unittest.mock import patch
+
+sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
+
+import api.workspace as ws  # noqa: E402
+import api.models as models  # noqa: E402
+
+
+def test_resolve_profile_home_param_caches_within_one_scope(tmp_path):
+    """(a) Same as the original test, but the cache now requires an active scope."""
+    home_dir = tmp_path / "profile_home"
+    home_dir.mkdir()
+
+    with patch.object(ws, "_safe_resolve", wraps=ws._safe_resolve) as spy:
+        with ws.profile_home_resolve_cache_scope():
+            first = ws._resolve_profile_home_param(home_dir)
+            second = ws._resolve_profile_home_param(home_dir)
+            third = ws._resolve_profile_home_param(home_dir)
+
+    assert first == second == third == home_dir.resolve()
+    assert spy.call_count == 1, (
+        "expected the filesystem resolve() to run once within one scope and "
+        f"be served from cache thereafter, but it ran {spy.call_count} times"
+    )
+
+
+def test_resolve_profile_home_param_caches_within_one_scope_for_profile_name(tmp_path):
+    """(a), second branch: a logical profile-NAME STRING (not a Path) resolves
+
+    through `get_hermes_home_for_profile()` before hitting the same
+    `_cached_safe_resolve_profile_home()` memoization. Confirms the
+    within-scope cache is genuinely hit for named profiles too, not just
+    explicit Path callers.
+    """
+    home_dir = tmp_path / "named_profile_home"
+    home_dir.mkdir()
+
+    with patch("api.profiles.get_hermes_home_for_profile", return_value=home_dir), \
+            patch.object(ws, "_safe_resolve", wraps=ws._safe_resolve) as spy:
+        with ws.profile_home_resolve_cache_scope():
+            first = ws._resolve_profile_home_param("myprofile")
+            second = ws._resolve_profile_home_param("myprofile")
+            third = ws._resolve_profile_home_param("myprofile")
+
+    assert first == second == third == home_dir.resolve()
+    assert spy.call_count == 1, (
+        "expected the filesystem resolve() to run once within one scope and "
+        f"be served from cache thereafter, but it ran {spy.call_count} times"
+    )
+
+
+def test_cache_does_not_persist_across_separate_scopes(tmp_path):
+    """(b) Two separate scoped calls (simulating two different requests) must
+
+    NOT share a cache -- the whole point of the PR #7636 review fix. If a
+    symlink were retargeted between the two "requests", the second scope
+    must be free to observe the new target; that's only possible if
+    `_safe_resolve()` is invoked again fresh on scope #2.
+    """
+    home_dir = tmp_path / "profile_home"
+    home_dir.mkdir()
+
+    with patch.object(ws, "_safe_resolve", wraps=ws._safe_resolve) as spy:
+        with ws.profile_home_resolve_cache_scope():
+            ws._resolve_profile_home_param(home_dir)
+            ws._resolve_profile_home_param(home_dir)
+        assert spy.call_count == 1
+
+        # Second, separate scope -- simulates a later, independent request.
+        with ws.profile_home_resolve_cache_scope():
+            ws._resolve_profile_home_param(home_dir)
+            ws._resolve_profile_home_param(home_dir)
+
+    assert spy.call_count == 2, (
+        "expected the second scope to re-resolve fresh (no cross-scope/"
+        f"cross-request caching), but _safe_resolve ran {spy.call_count} times total"
+    )
+
+
+def test_no_caching_outside_any_scope(tmp_path):
+    """(c) Outside a scope, every call resolves fresh -- matching pre-PR
+
+    behavior exactly, since most call sites of `_resolve_profile_home_param`
+    are NOT the sidebar list-build hot loop and must never see a cached
+    (possibly stale) result.
+    """
+    home_dir = tmp_path / "profile_home"
+    home_dir.mkdir()
+
+    with patch.object(ws, "_safe_resolve", wraps=ws._safe_resolve) as spy:
+        first = ws._resolve_profile_home_param(home_dir)
+        second = ws._resolve_profile_home_param(home_dir)
+        third = ws._resolve_profile_home_param(home_dir)
+
+    assert first == second == third == home_dir.resolve()
+    assert spy.call_count == 3, (
+        "expected every call outside an active scope to resolve fresh with "
+        f"no caching, but _safe_resolve ran {spy.call_count} times for 3 calls"
+    )
+
+
+def test_scope_decorator_use_matches_load_cli_sessions_uncached_wiring():
+    """Sanity check that `profile_home_resolve_cache_scope()` is usable as a
+
+    decorator (the way it wraps `_load_cli_sessions_uncached` in
+    `api/models.py`), and that the ContextVar is active only during the
+    decorated call.
+    """
+    assert ws._PROFILE_HOME_RESOLVE_SCOPE.get() is None
+
+    @ws.profile_home_resolve_cache_scope()
+    def _inside():
+        return ws._PROFILE_HOME_RESOLVE_SCOPE.get()
+
+    cache_during_call = _inside()
+    assert cache_during_call is not None
+    assert ws._PROFILE_HOME_RESOLVE_SCOPE.get() is None
+
+
+def _make_cli_sessions_uncached_fixture(tmp_path, n, *, message_count=3):
+    """state.db + matching MODERN WebUI sidecars (message_count present in the
+    prefix, literal 'default' profile string -- exactly what real production
+    sidecars carry, confirmed against a live deployment's webui/sessions/*.json)
+    for `n` cron rows.
+
+    A "modern" sidecar (one that carries `message_count` in its JSON-prefix)
+    is required to reach the fast branch of `Session.load_metadata_only()`
+    (a single `Session(**parsed)` construction) instead of falling back to the
+    legacy `cls.load()` re-parse path -- see #5854. That keeps this fixture
+    isolated to the exact N+1 call shape under test: one `Session.__init__`
+    (and therefore one `_resolve_profile_home_param` call) per sidecar row.
+    """
+    import sqlite3
+    import time
+
+    db_path = tmp_path / "state.db"
+    conn = sqlite3.connect(str(db_path))
+    conn.executescript(
+        """
+        CREATE TABLE sessions (
+            id TEXT PRIMARY KEY,
+            source TEXT,
+            session_source TEXT,
+            title TEXT,
+            model TEXT,
+            started_at REAL NOT NULL,
+            message_count INTEGER DEFAULT 0,
+            parent_session_id TEXT,
+            ended_at REAL,
+            end_reason TEXT
+        );
+        CREATE INDEX idx_sessions_started ON sessions(started_at);
+        CREATE TABLE messages (
+            id TEXT PRIMARY KEY,
+            session_id TEXT,
+            role TEXT,
+            content TEXT,
+            timestamp REAL
+        );
+        CREATE INDEX idx_messages_session ON messages(session_id, timestamp);
+        """
+    )
+    now = time.time()
+    sids = []
+    for i in range(n):
+        sid = f"cron_job{i:04d}_{int(now) + i}"
+        sids.append(sid)
+        conn.execute(
+            "INSERT INTO sessions (id, source, session_source, title, model,"
+            " started_at, message_count, parent_session_id, ended_at, end_reason)"
+            " VALUES (?, 'cron', 'cron', NULL, 'deepseek/deepseek-chat', ?, 1,"
+            " NULL, NULL, NULL)",
+            (sid, now + i),
+        )
+        conn.execute(
+            "INSERT INTO messages (id, session_id, role, content, timestamp)"
+            " VALUES (?, ?, 'user', 'cron task', ?)",
+            (f"cron_msg_{sid}", sid, now + i),
+        )
+    conn.commit()
+    conn.close()
+
+    session_dir = tmp_path / "sessions"
+    session_dir.mkdir()
+    for sid in sids:
+        (session_dir / f"{sid}.json").write_text(
+            '{"session_id": "%s", "title": "Renamed %s", "created_at": 1.0,'
+            ' "updated_at": 2.0, "archived": false, "message_count": %d,'
+            ' "profile": "default", "messages": []}'
+            % (sid, sid, message_count),
+            encoding="utf-8",
+        )
+    return db_path, sids
+
+
+def _count_profile_home_resolve_calls(call_args_list, expected_profile_home):
+    """Filter a `_safe_resolve` spy's call list down to just the profile-home
+
+    branch (`pre_resolve == expected_profile_home`), excluding the unrelated
+    per-row `_safe_resolve()` call that resolves the session's `workspace`
+    path (same call count either way -- not part of this PR, not what
+    greptile's comment or the production stack trace was about).
+    """
+    return sum(
+        1 for call in call_args_list
+        if call.args and call.args[0] == expected_profile_home
+    )
+
+
+def test_load_cli_sessions_uncached_dedupes_profile_home_resolve_on_sidecar_cache_miss(tmp_path):
+    """Real N+1 reproduction for PR #7636 review comment (greptile,
+    api/models.py:7711): on a COLD `_SIDECAR_METADATA_CACHE` (fresh process,
+    or the first time each sid's sidecar is seen), `_state_projection_sidecar_metadata`
+    falls through to `Session.load_metadata_only(sid)` for EVERY row that has a
+    sidecar -- and that constructs a real `Session` via `Session.__init__`,
+    which resolves the session's `profile` param through
+    `_resolve_path -> _remote_terminal_workspace_candidate ->
+    _remote_terminal_cwd -> _resolve_profile_home_param -> _safe_resolve()`,
+    matching the exact stack trace captured in production
+    ("Slow WebUI request still running", 5-17s, pinned to this call site).
+    Real production sidecars carry the literal string "default" for `profile`
+    (confirmed against a live deployment's webui/sessions/*.json), which is
+    what this fixture uses too.
+
+    This is a DIFFERENT code path than the direct dict-projection rows
+    greptile's comment focused on -- it fires from the sidecar-metadata
+    overlay, not from the row-to-dict projection itself. It IS covered by
+    `@profile_home_resolve_cache_scope()` on `_load_cli_sessions_uncached`,
+    because contextvars propagate through ordinary synchronous nested calls
+    (no thread pool / executor / asyncio task is involved anywhere in this
+    call chain) -- proven here by counting only the profile-home-resolving
+    `_safe_resolve()` invocations (filtered by argument), not the session's
+    unrelated per-row workspace-path resolve, which this PR never touched and
+    still runs once per row regardless.
+    """
+    from unittest import mock
+
+    import api.profiles as profiles
+    import api.workspace as ws
+
+    models.clear_sidecar_metadata_cache()
+    n = 60
+    db_path, sids = _make_cli_sessions_uncached_fixture(tmp_path, n)
+
+    with (
+        mock.patch("api.models.get_claude_code_sessions", return_value=[]),
+        mock.patch("api.models.get_last_workspace", return_value=str(tmp_path)),
+        mock.patch("api.models.ensure_cron_project", return_value="cron-pid"),
+        mock.patch("api.models.SESSION_DIR", tmp_path / "sessions"),
+        # Isolate the measurement: `_remote_terminal_cwd()` also calls
+        # `get_config_for_profile_home()` right after `_resolve_profile_home_param()`,
+        # and THAT helper does its own two direct, uncached `_safe_resolve()` calls
+        # on the same profile-home path (api/config.py, a pre-existing, separate
+        # hot path this PR does not touch and greptile's comment did not raise).
+        # Left unmocked those calls alias onto the same argument value and would
+        # make an unrelated inefficiency look like a failure of THIS cache.
+        mock.patch("api.config.get_config_for_profile_home", return_value={}),
+        mock.patch.object(ws, "_safe_resolve", wraps=ws._safe_resolve) as safe_resolve_spy,
+    ):
+        result = models._load_cli_sessions_uncached(tmp_path, db_path, None)
+
+    assert len(result) == n
+    profile_home_resolves = _count_profile_home_resolve_calls(
+        safe_resolve_spy.call_args_list, profiles._DEFAULT_HERMES_HOME
+    )
+    # Every row's sidecar was a genuine cache miss (fresh clear above), so
+    # Session.load_metadata_only() ran -- and therefore Session.__init__() ran
+    # -- once per row: len(sids) separate `_resolve_profile_home_param("default")`
+    # calls. Without the fix each of those pays its own `_safe_resolve()`
+    # filesystem call; with the fix active only the FIRST one does, and the
+    # remaining len(sids) - 1 are served from the call-scoped cache.
+    assert profile_home_resolves == 1, (
+        f"the profile-home _safe_resolve() ran {profile_home_resolves} times across "
+        f"{n} sidecar-miss rows sharing one profile -- expected exactly 1 (the rest "
+        "should be served from the call-scoped cache)"
+    )
+
+
+def test_load_cli_sessions_uncached_profile_home_resolve_scales_with_fix_disabled(tmp_path):
+    """Companion to the test above: calling the UNDECORATED function directly
+
+    (bypassing `profile_home_resolve_cache_scope()` via `__wrapped__`, i.e.
+    reproducing pre-PR behavior) shows the real filesystem resolve DOES scale
+    linearly with row count -- confirming the dedup measured above is the
+    scope's doing, not an artifact of some other cache.
+    """
+    from unittest import mock
+
+    import api.workspace as ws
+
+    models.clear_sidecar_metadata_cache()
+    n = 60
+    db_path, sids = _make_cli_sessions_uncached_fixture(tmp_path, n)
+
+    with (
+        mock.patch("api.models.get_claude_code_sessions", return_value=[]),
+        mock.patch("api.models.get_last_workspace", return_value=str(tmp_path)),
+        mock.patch("api.models.ensure_cron_project", return_value="cron-pid"),
+        mock.patch("api.models.SESSION_DIR", tmp_path / "sessions"),
+        # Same isolation as the test above -- see its comment.
+        mock.patch("api.config.get_config_for_profile_home", return_value={}),
+        mock.patch.object(ws, "_cached_safe_resolve_profile_home", wraps=ws._cached_safe_resolve_profile_home) as memo_spy,
+        mock.patch.object(ws, "_safe_resolve", wraps=ws._safe_resolve) as safe_resolve_spy,
+    ):
+        undecorated = models._load_cli_sessions_uncached.__wrapped__
+        result = undecorated(tmp_path, db_path, None)
+
+    assert len(result) == n
+    # The memoizing function is still called once per row either way...
+    assert memo_spy.call_count == n
+    # ...but with no active scope it never hits its cache branch, so every
+    # single call pays its own real filesystem resolve.
+    import api.profiles as profiles
+    profile_home_resolves = _count_profile_home_resolve_calls(
+        safe_resolve_spy.call_args_list, profiles._DEFAULT_HERMES_HOME
+    )
+    assert profile_home_resolves == n, (
+        f"expected the profile-home _safe_resolve() to run once per row ({n}) with no "
+        f"active cache scope, but it ran {profile_home_resolves} times"
+    )