Blank session history after restart when summary diffs embed huge file contents #17622

Summary

Large legacy message.summary.diffs[*].before/after payloads can make a non-empty session render as a blank history view after restart/reopen.

I hit this with a local session that still had:

• 660 messages
• 3344 parts
• running tool parts = 0
• latest completed message around 2026-03-15 15:40:58

but the desktop app reopened the session as an empty timeline.

Evidence

• The affected session was not empty in SQLite.
• 8 user messages embedded oversized summary.diffs[*].before/after payloads.
• The largest single message.data row was about 79,009,021 bytes.
• Total message.data for the session was about 345 MB.
• The oversized summaries included .agent-history/EVENTS.jsonl / MANIFEST.json.

Root Cause

Snapshot.diffFull() currently returns full file contents in FileDiff.before/after, and those diffs are persisted into two places:

1. session_diff storage via SessionSummary.summarizeSession()
2. user.summary.diffs via SessionSummary.summarizeMessage()

That means a large text file diff can be written directly into message.data. When an old session is reopened, Session.messages() / MessageV2.page() hydrates those oversized rows and the renderer ends up trying to load a giant history payload just to render the timeline.

Expected

One oversized diff should not make a session unreadable. Session history should still open, and diff metadata should degrade safely.

Actual

The session title loads, but the timeline can come back blank after restart/reopen even though the session data is still present.

Proposed Fix

Two-layer fix:

1. Write-side protection

   • bound inline FileDiff.before/after payloads
   • keep file, status, additions, deletions
   • record before_bytes, after_bytes, trimmed: true
   • clear inline contents when the payload is oversized

2. Read-side protection

   • sanitize legacy oversized summary.diffs on read so old sessions become readable again without manual DB cleanup

I have a patch for this and can open a PR immediately.