fix(identity): stabilize idless message revisions (#3898)

[Sinity]

Summary

Repair the exact-head identity and attachment-owner findings for PR #3898. The branch remains non-draft and is not being merged.

Problem

The exact review identified remaining collision and stability gaps: same-role same-timestamp idless siblings could be treated as conflicting on edit; whitespace native IDs diverged from missing IDs; duplicate physical coordinates could silently select a last writer; Claude owner evidence could omit attachment identity; and synthetic parser IDs could leak into public identity. The review also identified that the annotation successor's inventory must include annotation-batch:<id> rows without destroying that provenance.

Solution

• Separate the timestamped idless revision axis from mutable message content and compare its multiplicity during membership classification.
• Normalize whitespace native IDs before choosing the native-ID axis.
• Make owner resolution fail closed for duplicate physical coordinates, including duplicate native IDs at one coordinate, instead of relying on map overwrite order.
• Keep Claude attachment evidence in the private reorder-stable owner key even when explicit position evidence exists.
• Keep synthetic public IDs empty on the exact Codex reasoning and compaction paths named by the review; native Codex IDs remain unchanged. Established synthetic conventions in other parser families were not changed after their existing public-contract tests rejected a provider-wide sweep.
• Expand the durable annotation-owner successor contract to inventory both unscoped rows and annotation-batch:<id> rows, preserve the original batch scope, and store session ownership separately. No production backfill is performed here.

Acceptance and review matrix

Finding	Disposition	Evidence
Timestamped idless sibling edits collide or become contradictory	satisfied	SessionRevisionProjection.mutable_message_identities, multiplicity-aware membership, and test_timestamped_idless_sibling_edit_is_not_a_membership_conflict
Attachment-owner evidence is unstable or incomplete	satisfied	Claude private owner key includes attachment IDs; parser-to-writer and repeated-position anti-vacuity tests cover ownership
Duplicate physical coordinates or duplicate native IDs last-win	satisfied	MessageOwnerResolution records ambiguous physical coordinates and raises MessageOwnerAmbiguityError; both duplicate-coordinate tests exercise hash-route failure
Whitespace native IDs diverge from missing IDs	satisfied	_message_revision_match_id strips before branching; whitespace/missing projection equivalence test and writer regression pass
Synthetic public IDs leak from parser messages	satisfied within named Codex scope	Codex reasoning and compaction messages now retain empty provider IDs; parser tests prove the public field is empty and active-leaf resolution stays native-only
Annotation-batch owner scope	partial, retained outside this PR	successor polylogue-message-owner-scope-backfill is updated in the branch state with batch-row inventory, provenance preservation, separate durable session ownership, backup, transaction, idempotency, and reindex-preparation acceptance criteria

Bead disposition matrix

Assigned Bead	Whole-Bead disposition	Named successor
polylogue-slshy	partial	polylogue-message-owner-scope-backfill, polylogue-93xe, polylogue-xselt

Verification

• direnv exec . devtools test tests/unit/pipeline/test_message_identity_position_fallback.py tests/unit/archive/test_session_revision_membership.py tests/unit/sources/test_claude_web_normalization.py tests/unit/sources/test_parsers_codex.py tests/unit/sources/parsers/test_grok.py tests/unit/sources/parsers/test_antigravity.py tests/unit/sources/test_parsers_claude_design.py tests/unit/pipeline/test_archive_write.py::test_whitespace_only_native_message_id_falls_back_and_writes_blocks tests/unit/pipeline/test_archive_write.py::test_duplicate_message_coordinates_raise_loud_value_error tests/unit/pipeline/test_archive_write.py::test_merge_append_duplicate_message_coordinates_also_guarded: 218 passed in 10.59s.
• direnv exec . devtools test tests/unit/pipeline/test_message_identity_position_fallback.py: 10 passed in 1.10s after the duplicate-native anti-vacuity addition.
• direnv exec . devtools test tests/unit/sources/test_parsers_codex.py tests/unit/sources/parsers/test_grok.py tests/unit/sources/parsers/test_antigravity.py tests/unit/sources/parsers/test_parsers_claude_design.py was run with the repository's actual path as tests/unit/sources/test_parsers_claude_design.py: 147 passed in 7.62s.
• direnv exec . devtools verify --quick: success at 1eb36fdb171210ce6fc5440e6fef621605f5a58c, 24 steps passed, including format, lint, mypy, render, layering, policy, schema, and promotion checks.
• direnv exec . devtools verify: attempted, but refused before tests because this aging worktree has no seeded testmon receipt and requested --seed-testmon.
• direnv exec . devtools verify --all --skip-slow: attempted as a diagnostic and stopped after broad inherited failures; the exact focused repair routes above are the completion evidence. The known untouched baseline failure is tests/unit/pipeline/test_archive_write.py::TestValidationService::test_validation_uses_all_record_samples_by_default.
• No Beads command, durable backfill, source/user-tier mutation, index reset, semantic reindex, or merge was performed.

Review status

All unresolved GitHub review threads were enumerated. Addressed threads are replied to with exact evidence; the annotation-batch threads retain the explicit partial successor scope. A fresh exact-head Codex review is requested after pushing this head. No merge is requested.

Structured exact-head carrier

Summary by CodeRabbit

• Bug Fixes

  • Preserved marks and annotations across session-index rebuilds and legacy data migrations.
  • Improved session alias matching, including provider-qualified and native identifiers, while safely rejecting ambiguous matches.
  • Ensured message-targeted marks do not appear as session-level marks.
  • Improved attachment ownership when messages are reordered, duplicated, or lack provider IDs.
  • Prevented stale authority decisions from being treated as current.

• Reliability

  • Improved handling of id-less and timestamped messages during reindexing and revision comparisons.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds stable ownership for id-less and duplicate messages, propagates durable session ownership for marks and annotations, updates attachment and revision handling, and migrates affected fixtures to canonical archive identifiers.

Changes

Identity and owner-scope repair

Layer / File(s)	Summary
Stable message and attachment identity polylogue/core/*, polylogue/pipeline/ids.py, polylogue/sources/parsers/*	Messages and attachments now use owner coordinates, stable evidence keys, canonical identities, and explicit ambiguity handling.
Revision and attachment ownership writes polylogue/archive/*, polylogue/storage/attachment_relink.py, polylogue/storage/sqlite/archive_tiers/write.py	Mutable id-less identities affect revision comparison. Attachment writes and relinking use shared owner-key resolution.
Durable assertion owner scope polylogue/api/archive.py, polylogue/operations/mutation_actuators.py, polylogue/storage/sqlite/archive_tiers/*	Mark and annotation writes persist owner sessions. Reads resolve owners from durable scope or indexed message rows and apply session filters.
Canonical identity and incident coverage tests/*, polylogue/storage/raw_authority.py, .beads/issues.jsonl, docs/plans/*	Fixtures use canonical archive identifiers. Tests cover ownership and ambiguity cases. Authority fingerprints, web-shell filtering, and incident successor records were updated.

Estimated code review effort: 5 (Critical) | ~90 minutes

Possibly related PRs

• Sinity/polylogue#2058: Both PRs modify user-state mark and annotation storage.
• Sinity/polylogue#3816: Both PRs modify attachment and message ownership resolution.
• Sinity/polylogue#3874: Both PRs modify reindexing and recovery paths.

🚥 Pre-merge checks | ✅ 3 | ❌ 2

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 33.88% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.
Description check	⚠️ Warning	No pull request description was provided, so all required template sections and verification details are missing.	Add the required Summary, Problem, Solution, Verification, Bead disposition matrix, Changelog, and Risks and Follow-ups sections.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the primary change: stabilizing identity for id-less message revisions.

✨ Finishing Touches 💡 2

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feature/fix/positional-message-identity-roundout

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 91a17b84b1

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Resolve ownership without the first tag marker

When a provider session's native ID itself contains :n: or :p:—which the identity law permits because native IDs are opaque—find() stops at that embedded substring instead of the actual message-local delimiter. For example, a message ID such as codex-session:run:n:child:n:m1 is reported as belonging to codex-session:run, causing list_marks() and list_annotations() to return an incorrect session_id. Resolve the owner through the indexed message/session relation or another unambiguous representation rather than the first textual marker.

Useful? React with 👍 / 👎.

[Sinity]

Rechecked at exact head 1eb36fdb171210ce6fc5440e6fef621605f5a58c. The target reference is split only at the message: prefix, so embedded :n: or :p: tokens in the opaque message ID remain part of target_id. The earlier implementation concern is outdated; the current indexed lookup uses the complete message ID.

[chatgpt-codex-connector]

Update reindex coverage when closing the blocker

Closing polylogue-slshy here leaves both docs/plans/reindex-incident-coverage.json and tests/fixtures/reindex_incident_coverage/campaign_graph.json describing it as an in_progress blocking parser-stamps dependency with no receipt. resolve_default_incident_coverage() consumes those committed artifacts, so the reindex preflight cannot observe this completion; merely changing their status to closed would also trigger the validator's requirement for a live-proof receipt or named successor. Update the structured coverage records and evidence alongside this closure.

AGENTS.md reference: AGENTS.md:L294-L299

Useful? React with 👍 / 👎.

[Sinity]

The current head keeps polylogue-slshy explicitly in_progress and partial. docs/plans/reindex-incident-coverage.json records its named residual polylogue-message-owner-scope-backfill, and the campaign graph records both named child successors polylogue-xselt and polylogue-message-owner-scope-backfill. No closure or broad Beads mutation was made. The finding assumes a closed disposition and is stale against the current structured state.

[Sinity]

This remains intentionally partial on the new head. The structured disposition and carrier preserve polylogue-slshy as in_progress with polylogue-message-owner-scope-backfill, polylogue-93xe, and polylogue-xselt named for residual scope. This repair adds the duplicate-owner hash and Claude private evidence-key coverage without changing that disposition or performing the durable backfill.

[Sinity]

Rechecked at exact head. The bead remains explicitly partial and in progress, with the owner-backfill successor named in both .beads/issues.jsonl and the exact-head carrier. No closure mutation was made, so the coverage preflight is not being asked to treat this bead as complete.

[Sinity]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 74f32af738

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Preserve the owner when the indexed message is absent

When a durable message assertion outlives its rebuildable indexed row—for example after a hard delete or index reset—this fallback runs, but canonical message IDs are shaped like session_id:n:native_id or session_id:p:position.variant, so rpartition(":") returns session_id:n or session_id:p rather than the owning session (and becomes still less reliable when the native ID contains colons). Consequently list_marks() and list_annotations() expose the wrong session_id precisely while the indexed row is unavailable. Fresh evidence at this head is the newly explicit outlived-message fallback on these lines; preserve the owner in durable metadata or use another unambiguous representation instead.

AGENTS.md reference: AGENTS.md:L118-L122

Useful? React with 👍 / 👎.

[Sinity]

Rechecked at exact head. The current reader does not guess an owner from a message ID when the indexed message is absent; it returns an unresolved owner and leaves durable ownership to the named backfill successor. This outdated fallback concern is therefore not a branch-local regression.

[chatgpt-codex-connector]

Run the default verification before closing the bead

This closure records only 147 focused tests and the 24 quick gates, even though the change alters production identity/storage behavior and the repository explicitly states that devtools verify --quick has no tests and is not a substitute for the default baseline. Closing the bead as completed without running and recording devtools verify leaves the durable task state claiming satisfaction without the required affected-test selection; run the default final-head verification, classify the acknowledged red test, and then record the resulting evidence.

AGENTS.md reference: AGENTS.md:L344-L346

Useful? React with 👍 / 👎.

[Sinity]

The default gate was attempted at this repair head and refused before test execution because the aging worktree has no seeded testmon receipt. The bead remains partial, the exact focused repair routes and devtools verify --quick are recorded, and I am not claiming the default affected-test gate passed.

[Sinity]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 7921d08f11

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Bump the revision-membership fingerprint

When an existing archive has durable parser-census or authority verdicts stamped revision-membership-v2, this new role/timestamp/text anchor changes the SessionRevisionProjection semantics without changing RAW_AUTHORITY_PARSER_FINGERPRINT or superseding v2. For example, two idless turns with the same role and timestamp previously shared an attachment-owner anchor but are now distinguished by text; any verdict computed under the old projection remains classified as current by require_current_parser_source_census() and can be reused during replay/reindex instead of being recomputed. Bump the fingerprint and mark v2 superseded alongside this semantic change.

AGENTS.md reference: AGENTS.md:L114-L122

Useful? React with 👍 / 👎.

[Sinity]

Addressed at exact head. The revision-membership fingerprint already covers the parser semantics, and the new projection keeps timestamped idless identity on the role/timestamp axis while content remains mutable. The sibling-edit membership regression passes against the real projection and membership relation.

[chatgpt-codex-connector]

Batch indexed owner lookups before listing assertions

When a user has many message-target marks or annotations lacking the new durable scope, each result now executes its own SELECT against messages; list_annotations(session_id=...) executes it twice for every matching row. Because both list methods first load the complete assertion kind, this turns these public reads into O(N) SQLite statement executions and can make large user-state archives noticeably slow. Resolve legacy owners in one batched query or join instead of querying once per assertion.

Useful? React with 👍 / 👎.

[Sinity]

Addressed at exact head. _user_state_session_ids batches unresolved message IDs in chunks of 500 and performs one indexed query per chunk; the old per-assertion query pattern is no longer present. The existing batch-lookup regression remains green.

[chatgpt-codex-connector]

Include structured blocks in idless owner anchors

When two distinct idless messages have the same role, timestamp, and text but different structured blocks, this fallback still assigns them the same owner anchor. _session_hash_components() then substitutes that anchor for an idless attachment's message_id, so moving an attachment between those messages leaves both the attachment payload and revision identity unchanged; because the messages themselves did not change, session_content_hash() also matches and re-ingest skips the ownership update entirely. Fold the content-block payload into the idless anchor so structurally distinct messages cannot alias.

AGENTS.md reference: AGENTS.md:L136-L144

Useful? React with 👍 / 👎.

[Sinity]

Addressed at exact head. Structured blocks are part of _message_comparison_payload, so duplicate idless messages with different structured blocks receive distinct content keys. The owner-resolution tests exercise the block-sensitive branch.

[chatgpt-codex-connector]

Keep message marks out of session mark state

When a message-target mark is listed, this now emits the real owning session in session_id, but daemon/web_shell.py's loadUserState() treats every returned row as a session mark and calls setMarkLocal(m.session_id, m.mark_type, true) without checking target_type. Adding a pin or star to a message therefore makes the whole session appear pinned or starred, and removing the separate session-level mark only makes it reappear after reload. Filter non-session targets in that consumer or maintain target-scoped mark state.

Useful? React with 👍 / 👎.

[Sinity]

Addressed at exact head. loadUserState() now ignores non-session marks before calling setMarkLocal, and the focused privacy contract test asserts the guard. Message marks remain target-aware in the returned state.

[chatgpt-codex-connector]

Make the regression exercise the text-based anchor

The two fixtures still use different roles (user and model), while the pre-change fallback already included role plus timestamp. Making their timestamps equal therefore did not make the old implementation collide: both assertions passed before this commit, and reverting the newly added text component would remain green. Use the same role and timestamp with different text, or add an equivalent case, so this test actually fails under the timestamp-anchor implementation it claims to guard against.

Useful? React with 👍 / 👎.

[Sinity]

Addressed at exact head. The Drive owner regression now uses the same role and timestamp for the idless records, and the focused Drive/parser route remains green. This old test-shape concern is covered by the updated real-route evidence.

[Sinity]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. More of your lovely PRs please.

Reviewed commit: c1af5cc256

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/unit/cli/test_query_expression.py`:
- Line 2279: Update the `_mid` calls at the five affected fixture selections to
pass the selected message’s zero-based position explicitly: use positions 1, 1,
2, 2, and 3 in the order identified, while preserving the existing message IDs
and selection expectations.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 983b038d-182a-4c46-aa43-868fbab80197

📥 Commits

Reviewing files that changed from the base of the PR and between e386ccc and c1af5cc.

📒 Files selected for processing (52)

• .beads/issues.jsonl
• docs/plans/reindex-incident-coverage.json
• polylogue/api/archive.py
• polylogue/daemon/web_shell.py
• polylogue/operations/mutation_actuators.py
• polylogue/pipeline/ids.py
• polylogue/sources/origin_specs.py
• polylogue/sources/parsers/base_support.py
• polylogue/storage/raw_authority.py
• polylogue/storage/sqlite/archive_tiers/archive.py
• polylogue/storage/sqlite/archive_tiers/user_write.py
• tests/benchmarks/test_full_session_replace.py
• tests/benchmarks/test_graph_resolve_deferred_tail.py
• tests/fixtures/reindex_incident_coverage/campaign_graph.json
• tests/infra/identity.py
• tests/property/test_fts_identity_state_machine.py
• tests/property/test_write_path_state_machine.py
• tests/unit/api/test_facade_contracts.py
• tests/unit/archive/query/test_execution_control.py
• tests/unit/archive/test_with_units_projection.py
• tests/unit/cli/test_query_exec_laws.py
• tests/unit/cli/test_query_expression.py
• tests/unit/daemon/test_convergence_stages.py
• tests/unit/daemon/test_daemon_http_contracts.py
• tests/unit/daemon/test_web_reader.py
• tests/unit/devtools/test_incident_coverage_ledger.py
• tests/unit/pipeline/test_branching.py
• tests/unit/sources/test_claude_code_normalization_laws.py
• tests/unit/sources/test_parsers_drive.py
• tests/unit/storage/test_archive_search_contracts.py
• tests/unit/storage/test_archive_tiers_archive.py
• tests/unit/storage/test_archive_tiers_assertions.py
• tests/unit/storage/test_archive_tiers_ddl.py
• tests/unit/storage/test_attachment_acquisition.py
• tests/unit/storage/test_attachment_reacquisition.py
• tests/unit/storage/test_fts_identity_ledger.py
• tests/unit/storage/test_fts_repair_sql.py
• tests/unit/storage/test_incremental_rebuild_equivalence.py
• tests/unit/storage/test_lineage_normalization.py
• tests/unit/storage/test_marks_identity_preserving.py
• tests/unit/storage/test_message_query_reads.py
• tests/unit/storage/test_pl_fold.py
• tests/unit/storage/test_query_unit_time_expression.py
• tests/unit/storage/test_raw_authority_ledger.py
• tests/unit/storage/test_schema_safety.py
• tests/unit/storage/test_search_timeless_since_filter.py
• tests/unit/storage/test_session_insight_refresh.py
• tests/unit/storage/test_spec_driven_hydration.py
• tests/unit/storage/test_store_ops.py
• tests/unit/storage/test_unread_wire_batch_v46.py
• tests/unit/storage/test_user_state_target_kinds.py
• tests/visual/conftest.py

@codex review

Please review exact head 7a777f71acc60af8f265e3cfb954a9b52e03a5ba.

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 7a777f71ac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

@codex review Please perform a fresh substantive review of PR #3898 at exact head 19821c2. Prior Codex comments target older commits. The current CodeRabbit result is rate limited and does not provide substantive review.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 19821c2753

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Disambiguate duplicate idless attachment owners

When two idless messages have identical role, timestamp, text, and structured blocks—for example, a duplicated Drive turn—this content-only fallback gives both messages the same owner anchor. Moving an attachment from one duplicate occurrence to the other then leaves both the message payloads and the attachment's anchored payload unchanged, so session_content_hash() matches and re-ingest skips updating the persisted owner. Include a stable duplicate-occurrence discriminator so attachment reassignment between otherwise identical messages changes the session hash.

AGENTS.md reference: AGENTS.md:L138-L144

Useful? React with 👍 / 👎.

Addressed in 4a6dd1f. Duplicate idless owner anchors now receive a private discriminator from normalized message coordinates only in the attachment hash path. Public provider message IDs remain native or empty. The production ArchiveStore regression proves reassignment changes content_hash instead of incrementing skipped_sessions, and the reorder regression proves the owner set remains stable when retained parsed positions are reordered.

Addressed at exact head. Duplicate idless owner keys now use reorder-stable provider evidence when available and raise MessageOwnerAmbiguityError when evidence is indistinguishable. The real Claude reorder test reverses raw records and checks attachment ownership.

@codex review Please perform a fresh substantive review of PR #3898 at exact head 4a6dd1fa60c4394185ed22a860f4753f0e00de93. Recheck duplicate idless owner discrimination, Claude native-versus-private evidence-key separation, public empty IDs, reorder stability, owner reassignment hashing, and the explicit partial disposition with named residual successors.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4a6dd1fa60

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Keep duplicate-owner anchors stable across reorder

When two idless messages have identical comparison payloads and one owns an attachment, a provider reordering those raw records changes the parser-assigned position, so this discriminator changes even though the attachment stayed with the same source record. That changes attachment_identities and session_hash, turning a harmless re-export reorder into a new revision or raw-authority conflict. Fresh evidence at this head is the new position-derived occurrence discriminator; the added regression only reverses message objects whose position fields remain unchanged, so it does not exercise parser reassignment. Derive the private owner key from reorder-stable evidence rather than the normalized position.

AGENTS.md reference: AGENTS.md:L138-L144

Useful? React with 👍 / 👎.

Addressed. Duplicate idless owners now use reorder-stable provider evidence when available, while indistinguishable duplicates raise typed MessageOwnerAmbiguityError. The regression reverses raw Claude parser input and verifies attachment ownership, so it does not reuse already-positioned messages.

Addressed at exact head. Claude owner evidence includes attachment IDs even when explicit position evidence exists. The new repeated-position, omitted-variant anti-vacuity test fails if attachment evidence is removed from _owner_stable_key.

Preserve the full Claude attachment owner coordinate

When two idless Claude branch messages share a position but have different variant_index values, this gives attachments from both variants the same position-only owner coordinate. Both _message_owner_anchors and the production writer's _attachment_message_id_maps key their lookup maps only by that position, so the later variant overwrites the earlier one and an attachment nested under the earlier branch is hashed and stored against the wrong message. Fresh evidence at this head is the newly added position-only association; carry the full (position, variant_index) coordinate through the private attachment linkage.

AGENTS.md reference: AGENTS.md:L55-L60

Useful? React with 👍 / 👎.

Addressed. Claude attachments now carry the private MessageOwnerCoordinate with both position and variant_index through parser normalization. Hashing, archive writing, and attachment relink use the shared owner-resolution contract; the duplicate-native same-position writer test proves both variants retain their attachments.

Addressed at exact head. Claude attachment ownership carries the full private coordinate, including position and variant index, through normalization and the shared hash/write/relink owner-resolution path. The duplicate-native same-position writer regression proves both variants retain their attachments.

Keep timestamped idless identity stable across edits

When a provider re-exports an idless message after editing its text or structured blocks while retaining the original role and creation timestamp, this content-derived value changes even though it is used as the message's identity as well as its content. _message_axis_relation then sees the old and new revisions as mutually disjoint identities rather than one identity with revised content, so a cohort with an existing accepted head is quarantined as ambiguous instead of applying the update. This regression is new for timestamped idless messages—the previous fallback kept role and timestamp as the stable identity anchor—so use a content-independent discriminator for matching same-timestamp occurrences rather than folding mutable message content into the identity itself.

AGENTS.md reference: AGENTS.md:L118-L122

Useful? React with 👍 / 👎.

Addressed. Timestamped idless revision matching now uses only role and timestamp. Mutable text and blocks remain in the content payload, so the real Claude ingest test proves shared revision identity, changed session hash, and persisted edited block text.

Addressed at exact head. Timestamped idless revision identity is now role plus timestamp only; text and blocks stay in the mutable content payload. The real edit test proves identity continuity and changed persisted content.

Include batch-scoped annotations in the owner backfill

The successor inventories only message assertions with a missing scope_ref, but schema/batch annotation labels already have a nonempty scope_ref shaped as annotation-batch:<id>. Those durable message-target annotations are therefore excluded from this backfill even though _user_state_session_ids cannot obtain their owner from that scope and will lose the indexed fallback during the planned reset; changing their scope to session:<id> would instead destroy their batch provenance. Extend the residual design to preserve the annotation-batch scope while persisting the owner separately, otherwise the explicit partial disposition still leaves batch labels undiscoverable by session after reindex.

AGENTS.md reference: AGENTS.md:L131-L134

Useful? React with 👍 / 👎.

Retained as explicit partial scope outside this PR. The remote successor feature/maintenance/message-owner-scope-backfill remains the owner and must preserve annotation-batch:<id> provenance while adding durable session ownership separately. The PR matrix and exact-head carrier keep that residual visible.

Retained as explicit partial scope. The branch does not close the bead or perform the durable backfill. The updated successor contract preserves annotation-batch:<id> provenance while adding separate durable session ownership, and the exact-head carrier records that residual.

@codex Please perform a fresh substantive exact-head review of PR #3898 at b4d9580. Recheck the four P1 identity paths end to end: timestamped idless edit continuity with changed persistence, Claude private (position, variant_index) attachment ownership, reorder-stable duplicate idless evidence with typed ambiguity for indistinguishable duplicates, and duplicate-native hash/writer agreement at the raw-ingest skip boundary. Also verify the explicit partial batch-scoped annotation successor residual and do not treat it as satisfied.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b4d9580ce6

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Preserve timestamp identity when sibling timestamps collide

When two idless messages share a role and timestamp but have different bodies, this branch replaces their role/timestamp revision identity with the mutable content hash. If one message is later edited without changing its timestamp, its identity changes from the old-content hash to the new-content hash; because the unchanged sibling remains present, _message_axis_relation sees mutually unmatched identities and raw-authority processing can quarantine the revision against an existing head instead of persisting the edit. Fresh evidence beyond the earlier single-message repair is this exact-head duplicate branch—the regression covers only a session containing one message. Use content-independent stable evidence for the collision, or fail with typed ambiguity rather than making mutable content the revision identity.

AGENTS.md reference: AGENTS.md:L138-L144

Useful? React with 👍 / 👎.

Addressed at exact head. Same-role same-timestamp idless siblings retain one mutable revision axis, while membership compares multiplicity for that axis rather than treating changed sibling content as a native-ID conflict. The new sibling-edit regression is green.

Record batch-scoped labels in the owner-backfill successor

For message-target annotation labels, scope_ref is already annotation-batch:<id>, so this successor's inventory of only rows with a missing scope_ref excludes them; replacing that scope with session:<id> would also destroy their batch provenance. After the planned index reset, _user_state_session_ids therefore still has neither a durable session owner nor its indexed fallback for those labels. Fresh evidence at this exact head is that the committed successor acceptance criteria still neither inventory non-session scopes nor specify a separate durable owner field, despite the review reply describing that residual as retained. Add the batch-scoped case explicitly to the successor's scope and acceptance contract; it remains partial and must not be treated as satisfied.

AGENTS.md reference: AGENTS.md:L131-L134

Useful? React with 👍 / 👎.

Retained as explicit partial scope. The branch updates polylogue-message-owner-scope-backfill to inventory both missing-scope message assertions and annotation-batch:<id> rows, preserve the batch scope, and store session ownership separately. No production backfill is claimed here.

Fall back to full coordinates when stable evidence collides

When two idless or duplicate-native Claude messages carry the same explicit position but omit variant_index, normalization later assigns distinct variant indices, but _owner_stable_key was already derived from their identical explicit-position evidence. If their bodies differ, their final owner keys are distinct and neither enters ambiguous_keys, so this dict silently overwrites the duplicated stable key; attachment_message_owner_key() consults that map before the full physical coordinate and consequently assigns attachments from both variants to the last message. Fresh evidence beyond the earlier full-coordinate repair is this exact-head stable-key map—the regression always supplies explicit variant indices and cannot exercise the collision. Count stable-evidence occurrences and fall through to the complete (position, variant_index) coordinate when that evidence is non-unique.

AGENTS.md reference: AGENTS.md:L55-L60

Useful? React with 👍 / 👎.

Rechecked at exact head and found this specific case already handled: content-discriminating duplicate records get distinct content keys before stable evidence is used, while attachment evidence is also included in the stable key. The new repeated-position evidence test covers the formerly colliding case; no code change is needed for the stated bodies-differ case.

Treat stripped-empty native IDs as idless

When one export represents a missing native message ID as whitespace and another represents it as "", this condition takes different paths: the whitespace value is truthy and returns the stripped empty string as identity, while the empty value receives the role/timestamp content anchor. Storage normalizes both forms to NULL and therefore persists the same position/variant message identity, but their session hashes and revision identities differ, so an otherwise unchanged re-export can miss the raw-ingest skip boundary or be quarantined against an existing accepted head. Test the stripped value for truthiness and route whitespace-only IDs through the idless anchor, matching _stored_message_native_id.

AGENTS.md reference: AGENTS.md:L55-L60

Useful? React with 👍 / 👎.

Addressed at exact head. _message_revision_match_id strips provider_message_id before checking truthiness, so whitespace-only and missing IDs take the same fallback path. The projection-equivalence regression and writer whitespace regression are green.

@codex review Please perform a fresh substantive exact-head review of PR #3898 at commit 1eb36fdb171210ce6fc5440e6fef621605f5a58c.

Recheck the repaired identity laws, same-role same-timestamp idless sibling edits, whitespace native IDs, duplicate physical coordinates including duplicate native IDs, Claude attachment-owner stability with repeated positions and omitted variants, Codex synthetic public IDs, and the explicit annotation-batch successor scope. Please report only findings that reproduce against this exact head, with file/line evidence and severity. Do not treat the retained annotation backfill as complete; it is intentionally partial and named in the carrier.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 1eb36fdb17

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Prefer stable owner evidence before mutable content

When two timestamped idless messages share a role/timestamp but have distinct bodies, this branch selects each body-derived content_id even when the parser supplied stable owner evidence, such as Claude or Drive attachment IDs. If the attachment-owning sibling is later edited without changing its timestamp or attachment, its owner anchor changes; _attachment_hash_payload folds that anchor into the attachment identity, so _relation sees one attachment removed and another added and classifies the legitimate re-export as a conflict. With an existing accepted raw, raw-authority processing therefore quarantines the edit instead of updating the session; prefer unique stable owner evidence before the mutable content discriminator.

AGENTS.md reference: AGENTS.md:L138-L144

Useful? React with 👍 / 👎.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 9cac733cac

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Keep attachment identity out of owner evidence

When an idless Claude export has two same-role, same-timestamp turns and a file is reassigned from one turn to the other, these IDs move with the file and therefore produce the same owner_stable_key in both revisions. message_owner_resolution() prefers that key over the owning message's content, and _attachment_hash_payload() then records the same owner anchor; because Claude files are not part of the message blocks, the entire session content hash remains unchanged. Re-ingest consequently skips the revision and leaves attachment_refs pointing to the old message. Use owner-specific stable evidence independent of the attachment itself, or fail closed when none exists.

AGENTS.md reference: AGENTS.md:L138-L144

Useful? React with 👍 / 👎.

Preserve session aliases after the index row disappears

When the caller supplies a native ID, provider-form ID, or unique prefix rather than the canonical session ID, normal resolution accepts it while the session exists, but after a delete or index reset this fallback passes the unresolved token through unchanged. Durable marks and annotations store their owner as the canonical session:<origin:native_id>, so both list_marks(session_id=...) and the identical annotation path compare that canonical owner against the alias and return no rows. Preserve enough durable identity to resolve the same accepted aliases without index.db, or perform an ambiguity-checked match against durable canonical owners.

AGENTS.md reference: AGENTS.md:L118-L122

Useful? React with 👍 / 👎.

@circleci rerun

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: d3ea5649ab

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Preserve edited content when comparing idless revisions

When timestamped idless messages retain the same role, timestamp, and multiplicity across an edit, this branch ignores their changed content and classifies the two projections as equal. In the production membership path, if provider_updated_at is absent or unchanged, _equal_content_representative() then chooses the lexicographically smaller content-derived raw_id, so an older export can remain accepted and the edited message is marked superseded_equivalent instead of being materialized. Fresh evidence beyond the previously discussed direct-write regression is this production classifier behavior; represent mutable edits with an ordering that reliably selects the new revision rather than equality with an arbitrary hash tie-break.

AGENTS.md reference: AGENTS.md:L138-L144

Useful? React with 👍 / 👎.

Keep Drive attachment IDs out of owner evidence

For two same-role, same-timestamp, same-text idless Drive chunks, moving a metadata-only attachment from one chunk to the other leaves this attachment-derived stable key unchanged because it follows the file rather than its owning turn. Such metadata attachments are collected by _collect_chunk_attachments() but need not enter either message's hashed blocks, so the message payloads and attachment payload remain identical and session_content_hash() skips the re-ingest, leaving attachment_refs attached to the old message. Derive the owner key from evidence independent of the attachment, or fail closed when no such evidence exists.

AGENTS.md reference: AGENTS.md:L138-L144

Useful? React with 👍 / 👎.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e654d98994

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Namespace fallback identities outside native IDs

When an opaque provider-native ID equals the generated __polylogue_msg_content_anchor__:<hash> for an idless message in the same session, both messages receive the same comparison identity. Because that identity is then marked mutable, _message_axis_relation() ignores content differences for both messages; an edit to the native-ID message can therefore be classified as equal and an older raw retained. Encode native and fallback identities in disjoint hash namespaces rather than relying on a string prefix that native IDs are not prohibited from using.

AGENTS.md reference: AGENTS.md:L55-L60

Useful? React with 👍 / 👎.

Preserve event ownership for duplicate native IDs

When Claude emits duplicate native message IDs and either occurrence carries thinking configuration, edit metadata, or web-tool evidence, these events retain only the duplicated native ID. The writer deliberately excludes duplicate IDs from its by_native_id map (write.py:4351-4363), so every such event is persisted with source_message_id=NULL even though normalization now has an exact evidence_key and position/variant coordinate for its originating occurrence. Carry that private coordinate through ParsedSessionEvent so these per-message events remain linked after duplicate occurrences are materialized.

Useful? React with 👍 / 👎.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 609ff8085b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

Honor explicit leaf evidence for duplicate message IDs

When Claude supplies the same native ID for multiple records and the later occurrence is explicitly marked is_active_leaf, a top-level active_leaf_message_provider_id with that duplicated ID already resolves to the first occurrence's unsuffixed evidence key, so this explicit-leaf fallback never runs. The code then overrides leaf_values to mark the first occurrence as the leaf and the actual leaf as false, producing an incorrect active transcript path. Prefer the unique occurrence-level leaf marker whenever the top-level native ID is duplicated, or only resolve the top-level ID when it is unique.

Useful? React with 👍 / 👎.

Stabilize duplicate evidence keys across record reordering

When duplicate native IDs also share a timestamp and lack explicit positions, these occurrence suffixes are assigned from raw array order and are subsequently used as the final tie-breaker in ordered_flat. Reversing two otherwise unchanged records therefore swaps which body receives the unsuffixed key and reverses their normalized positions; because duplicate native IDs are stored using position/variant identity, a harmless export reorder changes public message IDs and transcript order. Derive the ordering key from reorder-stable record evidence, using occurrence numbering only after that deterministic ordering.

AGENTS.md reference: AGENTS.md:L55-L60

Useful? React with 👍 / 👎.

Actionable comments posted: 11

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@polylogue/api/archive.py`:
- Around line 314-326: Bound the durable owner lookup around the visible
assertions query instead of fetching every active mark and annotation row.
Update the query and supporting logic used by _resolve_user_state_target to
restrict results to plausible session-prefixed target_ref or scope_ref values,
preferably leveraging an index on those columns, while preserving the existing
unresolved-token fallback behavior.
- Around line 344-353: Update _durable_session_alias_matches and its caller
_resolve_durable_user_state_session_id to mirror
ArchiveStore.resolve_session_id’s two-stage resolution: collect and return exact
native-id matches first, and only evaluate native-id prefix matches when the
exact tier is empty. Ensure exact token matches are ranked ahead of prefix
matches so “abc” resolves to origin:abc rather than becoming ambiguous with
origin:abcd, while preserving ambiguity errors within the selected tier.

In `@polylogue/pipeline/ids.py`:
- Around line 373-379: Update the `provider_counts` comprehension in the
surrounding ID-mapping logic to strip `message.provider_message_id` before
testing truthiness, excluding whitespace-only IDs from the counter. Keep the
existing `provider_keys` filtering aligned so empty stripped IDs do not create
false ambiguity for attachments.
- Around line 394-438: Add explicit handling around the session
content-hash/projection and attachment-write boundary that catches
MessageOwnerAmbiguityError from attachment_message_owner_key(). Reject the
session and return before any conn.commit() can persist session or project rows,
ensuring both session_content_hash() and _write_attachments() ambiguity paths
fail closed consistently.

In `@polylogue/sources/parsers/claude/common.py`:
- Around line 1287-1291: Update the active_leaf_message_provider_id assignment
in ClaudeMessageNormalization to convert an empty native_provider_message_id to
None, while preserving None when normalized_active_leaf is absent and retaining
non-empty IDs unchanged.

In `@polylogue/storage/attachment_relink.py`:
- Around line 359-362: Handle MessageOwnerAmbiguityError around
attachment_message_owner_key in the attachment loop within
_match_session_payload, marking only that attachment as
UnrecoverableAttachmentReason.NO_AUTHORITATIVE_RAW (or a dedicated ambiguity
reason) and continuing with the remaining attachments. Import the exception
alongside the existing helpers, while preserving normal owner resolution and
recoverable matching behavior.

In `@polylogue/storage/sqlite/archive_tiers/archive.py`:
- Around line 5511-5528: Choose one consistent contract for unresolved owners
and apply it to both list_marks and list_annotations: either omit ownerless rows
from unfiltered results or retain session_id as an empty string. Update both
methods accordingly and document the behavior in each method’s docstring,
including the existing session-filtered exclusion and the unfiltered case.
Affected site polylogue/storage/sqlite/archive_tiers/archive.py#L5511-L5528
(list_marks) requires the contract and documentation;
polylogue/storage/sqlite/archive_tiers/archive.py#L5694-L5705 (list_annotations)
must apply the same behavior and extend its docstring.

In `@polylogue/storage/sqlite/archive_tiers/user_write.py`:
- Around line 621-638: In polylogue/storage/sqlite/archive_tiers/user_write.py
lines 621-638, update upsert_mark to preserve an existing message owner scope
when owner_session_id is absent; add and reuse a shared helper that returns the
explicit session scope or reads the existing assertion envelope, and use it for
scope_ref. Apply the same helper and preservation rule in upsert_annotation at
lines 752-752; non-message targets should continue producing no owner scope.

In `@tests/unit/archive/test_session_revision_membership.py`:
- Around line 1213-1222: Update the test case for classify_membership_revisions
to use raw IDs whose alphabetical order favors the older revision, while keeping
the newer revision’s observed_at_ms value later. Preserve the expected
accepted_raw_ids result so the assertion can only pass when
_equal_content_representative applies the observed_at_ms tiebreak.

In `@tests/unit/devtools/test_incident_coverage_ledger.py`:
- Around line 62-70: Update the assertions in the incident coverage test to
match the current ledger: expect polylogue-slshy’s bead_status to be closed,
expect residual_successor to reference only polylogue-xselt, and assert the
child_bead_ids set contains only polylogue-xselt.

In `@tests/unit/sources/test_parsers_codex.py`:
- Line 681: Rename test_reasoning_reordering_keeps_synthetic_revision_identity
to reflect that it verifies content-derived revision identity across message
reordering, removing the obsolete synthetic-identity wording while leaving the
test body unchanged.

🪄 Autofix

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 18c57785-3004-46a1-8ea0-df952388b1ec

📥 Commits

Reviewing files that changed from the base of the PR and between c1af5cc and 609ff80.

📒 Files selected for processing (27)

• .beads/issues.jsonl
• docs/plans/reindex-incident-coverage.json
• polylogue/api/archive.py
• polylogue/archive/session_revision_membership.py
• polylogue/core/message_owner.py
• polylogue/pipeline/ids.py
• polylogue/sources/parsers/base_models.py
• polylogue/sources/parsers/base_support.py
• polylogue/sources/parsers/claude/code_parser.py
• polylogue/sources/parsers/claude/common.py
• polylogue/sources/parsers/codex.py
• polylogue/sources/parsers/drive.py
• polylogue/sources/parsers/local_agent.py
• polylogue/storage/attachment_relink.py
• polylogue/storage/raw_authority.py
• polylogue/storage/sqlite/archive_tiers/archive.py
• polylogue/storage/sqlite/archive_tiers/user_write.py
• polylogue/storage/sqlite/archive_tiers/write.py
• tests/fixtures/reindex_incident_coverage/campaign_graph.json
• tests/unit/archive/test_session_revision_membership.py
• tests/unit/cli/test_query_expression.py
• tests/unit/devtools/test_incident_coverage_ledger.py
• tests/unit/pipeline/test_message_identity_position_fallback.py
• tests/unit/sources/test_claude_web_normalization.py
• tests/unit/sources/test_parsers_codex.py
• tests/unit/storage/test_archive_tiers_archive.py
• tests/unit/storage/test_marks_identity_preserving.py

💤 Files with no reviewable changes (1)

• .beads/issues.jsonl

🚀 Performance & Scalability | 🔵 Trivial

Consider bounding the durable owner scan.

This read selects every active mark and annotation row and materializes it with fetchall(), then scans the full canonical-id set in Python for each unresolved token. The fallback fires per unresolved session token, including on write paths through _resolve_user_state_target.

The cost is proportional to total mark and annotation count, not to the number of plausible owners. Two options bound it. Push the alias shapes into SQL so SQLite can filter with an index on scope_ref/target_ref. Or add an index on (kind, status) and select only the distinct session:-prefixed values.

This is advice, not a blocker; the fallback only runs after the index misses.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@polylogue/api/archive.py` around lines 314 - 326, Bound the durable owner
lookup around the visible assertions query instead of fetching every active mark
and annotation row. Update the query and supporting logic used by
_resolve_user_state_target to restrict results to plausible session-prefixed
target_ref or scope_ref values, preferably leveraging an index on those columns,
while preserving the existing unresolved-token fallback behavior.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Prefer exact matches before prefix matches, as the index resolver does.

The docstring claims the same alias shapes as the index. The suffix branch does not match the index. ArchiveStore.resolve_session_id tries the exact native id first and only widens to a prefix match when the exact lookup finds nothing. That two-stage rule exists so sibling native ids abc and abcd do not make the token abc ambiguous.

Here both shapes are evaluated in one predicate. With durable owners origin:abc and origin:abcd, the token abc matches both, and _resolve_durable_user_state_session_id raises ValueError("session id alias 'abc' is ambiguous"). The index resolves the same token to origin:abc.

The raised ValueError is not caught by the callers. list_marks (Line 6978) and list_annotations (Line 7074) catch only SessionNotFoundError, so the error reaches the API caller. add_mark and save_annotation fail the same way through _resolve_user_state_target.

Rank matches and return the exact tier when it is non-empty.

🐛 Proposed fix to mirror the index resolver's exact-before-prefix rule

-def _durable_session_alias_matches(token: str, canonical_id: str) -> bool:
-    """Apply the same exact/provider/prefix/suffix alias shapes as the index."""
-    if token == canonical_id or canonical_id.startswith(token):
-        return True
-    if ":" in token:
-        provider_token, native_id = token.split(":", 1)
-        provider_origin = origin_from_provider(Provider.from_string(provider_token)).value
-        return canonical_id == f"{provider_origin}:{native_id}"
-    _, separator, native_id = canonical_id.partition(":")
-    return bool(separator and (native_id == token or native_id.startswith(token)))
+def _durable_session_alias_match_rank(token: str, canonical_id: str) -> int | None:
+    """Rank one alias match: 0 is exact evidence, 1 is prefix-widened evidence.
+
+    Mirrors ``ArchiveStore.resolve_session_id``: an exact canonical id, an
+    exact provider-qualified id, or an exact native id outranks any
+    prefix-widened match, so a sibling native id cannot make an exact token
+    ambiguous.
+    """
+    if token == canonical_id:
+        return 0
+    if ":" in token:
+        provider_token, native_id = token.split(":", 1)
+        provider_origin = origin_from_provider(Provider.from_string(provider_token)).value
+        if canonical_id == f"{provider_origin}:{native_id}":
+            return 0
+        return 1 if canonical_id.startswith(token) else None
+    _, separator, canonical_native_id = canonical_id.partition(":")
+    if separator and canonical_native_id == token:
+        return 0
+    if canonical_id.startswith(token):
+        return 1
+    if separator and canonical_native_id.startswith(token):
+        return 1
+    return None

Then select the best-ranked tier in the caller:

-    matches = {canonical_id for canonical_id in canonical_ids if _durable_session_alias_matches(token, canonical_id)}
-    if len(matches) > 1:
-        raise ValueError(f"session id alias {token!r} is ambiguous")
-    return next(iter(matches), None)
+    ranked: dict[int, set[str]] = {}
+    for canonical_id in canonical_ids:
+        rank = _durable_session_alias_match_rank(token, canonical_id)
+        if rank is not None:
+            ranked.setdefault(rank, set()).add(canonical_id)
+    if not ranked:
+        return None
+    matches = ranked[min(ranked)]
+    if len(matches) > 1:
+        raise ValueError(f"session id alias {token!r} is ambiguous")
+    return next(iter(matches))

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	def _durable_session_alias_matches(token: str, canonical_id: str) -> bool:
	"""Apply the same exact/provider/prefix/suffix alias shapes as the index."""
	if token == canonical_id or canonical_id.startswith(token):
	return True
	if ":" in token:
	provider_token, native_id = token.split(":", 1)
	provider_origin = origin_from_provider(Provider.from_string(provider_token)).value
	return canonical_id == f"{provider_origin}:{native_id}"
	_, separator, native_id = canonical_id.partition(":")
	return bool(separator and (native_id == token or native_id.startswith(token)))
	def _durable_session_alias_match_rank(token: str, canonical_id: str) -> int | None:
	"""Rank one alias match: 0 is exact evidence, 1 is prefix-widened evidence.
	Mirrors ``ArchiveStore.resolve_session_id``: an exact canonical id, an
	exact provider-qualified id, or an exact native id outranks any
	prefix-widened match, so a sibling native id cannot make an exact token
	ambiguous.
	"""
	if token == canonical_id:
	return 0
	if ":" in token:
	provider_token, native_id = token.split(":", 1)
	provider_origin = origin_from_provider(Provider.from_string(provider_token)).value
	if canonical_id == f"{provider_origin}:{native_id}":
	return 0
	return 1 if canonical_id.startswith(token) else None
	_, separator, canonical_native_id = canonical_id.partition(":")
	if separator and canonical_native_id == token:
	return 0
	if canonical_id.startswith(token):
	return 1
	if separator and canonical_native_id.startswith(token):
	return 1
	return None

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@polylogue/api/archive.py` around lines 344 - 353, Update
_durable_session_alias_matches and its caller
_resolve_durable_user_state_session_id to mirror
ArchiveStore.resolve_session_id’s two-stage resolution: collect and return exact
native-id matches first, and only evaluate native-id prefix matches when the
exact tier is empty. Ensure exact token matches are ranked ahead of prefix
matches so “abc” resolves to origin:abc rather than becoming ambiguous with
origin:abcd, while preserving ambiguity errors within the selected tier.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Filter provider_counts on the stripped id, not the raw id.

Line 374 tests message.provider_message_id for truthiness but counts message.provider_message_id.strip(). A whitespace-only native id is truthy and contributes an "" entry to provider_counts. Two such messages put "" into ambiguous_provider_ids. Line 376-379 then skips those messages, so unique_provider_keys never holds "".

The result is asymmetric. An attachment whose message_provider_id is whitespace-only strips to "" at line 432, matches "" in ambiguous_provider_ids, and raises MessageOwnerAmbiguityError at line 434 even though no real provider id is duplicated. Strip before the truthiness test so both sides agree.

🐛 Proposed fix

     provider_counts = Counter(
-        message.provider_message_id.strip() for message in messages if message.provider_message_id
+        message.provider_message_id.strip() for message in messages if message.provider_message_id.strip()
     )

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@polylogue/pipeline/ids.py` around lines 373 - 379, Update the
`provider_counts` comprehension in the surrounding ID-mapping logic to strip
`message.provider_message_id` before testing truthiness, excluding
whitespace-only IDs from the counter. Keep the existing `provider_keys`
filtering aligned so empty stripped IDs do not create false ambiguity for
attachments.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Description: Trace MessageOwnerAmbiguityError handling across hash and write paths.
set -euo pipefail

echo "== raise sites =="
rg -nP -C3 '\bMessageOwnerAmbiguityError\b' --type=py

echo "== callers of attachment_message_owner_key =="
rg -nP -C6 '\battachment_message_owner_key\s*\(' --type=py

echo "== callers of session_revision_projection / session_content_hash =="
rg -nP -C4 '\b(session_revision_projection|session_content_hash)\s*\(' --type=py -g '!tests/**'

Repository: Sinity/polylogue

Length of output: 172

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== repo files matching ids.py / archive_tiers / hash functions =="
fd -a 'ids\.py$|write\.py$' polylogue 2>/dev/null | sed 's#^\./##' || true
echo

echo "== all MessageOwnerAmbiguityError occurrences in tracked Python files =="
git ls-files '*.py' | xargs rg -n -C3 '\bMessageOwnerAmbiguityError\b' || true
echo

echo "== all attachment_message_owner_key occurrences in tracked Python files =="
git ls-files '*.py' | xargs rg -n -C5 '\battachment_message_owner_key\s*\(' || true
echo

echo "== all session_revision_projection / session_content_hash occurrences in tracked Python files (excluding tests) =="
git ls-files '*.py' | grep -vE '(^|/)tests?/' | xargs rg -n -C4 '\b(session_revision_projection|session_content_hash)\s*\(' || true
echo

echo "== target file outline =="
ast-grep outline polylogue/pipeline/ids.py --view compact 2>/dev/null || true

Repository: Sinity/polylogue

Length of output: 38111

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== ids.py relevant implementation =="
sed -n '620,775p' polylogue/pipeline/ids.py
echo

echo "== ingest_worker exception handling around content hash/load and write =="
sed -n '700,860p' polylogue/pipeline/services/ingest_worker.py
echo

echo "== revision_governance exception handling for content hash/projection/write =="
sed -n '240,320p' polylogue/storage/sqlite/archive_tiers/revision_governance.py
sed -n '1760,1810p' polylogue/storage/sqlite/archive_tiers/revision_governance.py
sed -n '2148,2175p' polylogue/storage/sqlite/archive_tiers/revision_governance.py
echo

echo "== write.py attachment mapping/write flow =="
sed -n '240,290p' polylogue/storage/sqlite/archive_tiers/write.py
sed -n '3360,3435p' polylogue/storage/sqlite/archive_tiers/write.py
sed -n '3435,3535p' polylogue/storage/sqlite/archive_tiers/write.py
sed -n '3535,3605p' polylogue/storage/sqlite/archive_tiers/write.py
echo

echo "== repo-level MessageOwnerAmbiguityError catchers =="
git ls-files '*.py' | xargs rg -n -C4 'except\s+(.*MessageOwnerAmbiguityError|Exception)\b|raise\s+(.*MessageOwnerAmbiguityError|Exception)\b|MessageOwnerAmbiguityError' || true

Repository: Sinity/polylogue

Length of output: 50373

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== ids.py _session_hash_components and functions =="
sed -n '620,775p' polylogue/pipeline/ids.py
echo

echo "== ingest_worker load/write boundary =="
sed -n '730,795p' polylogue/pipeline/services/ingest_worker.py
echo

echo "== revision_governance boundaries =="
sed -n '260,290p' polylogue/storage/sqlite/archive_tiers/revision_governance.py
sed -n '1776,1810p' polylogue/storage/sqlite/archive_tiers/revision_governance.py
sed -n '2152,2175p' polylogue/storage/sqlite/archive_tiers/revision_governance.py
echo

echo "== revision_governance try blocks around these functions =="
rg -n -C2 'try:|except Exception|except .*:' polylogue/storage/sqlite/archive_tiers/revision_governance.py | grep -n -C2 'write_parsed_session_to_\(load=\|write_parsed_session_to_\(content_hash=\|session_revision_projection\|session_content_hash\|_write_attachments\|MessageOwnerAmbiguityError' || true
echo

echo "== write.py write_parsed_session_to_archive exception handling and attachment block =="
sed -n '230,300p' polylogue/storage/sqlite/archive_tiers/write.py
sed -n '3360,3580p' polylogue/storage/sqlite/archive_tiers/write.py
sed -n '3600,3680p' polylogue/storage/sqlite/archive_tiers/write.py
echo

echo "== write.py try blocks near write_parsed_session_to_archive =="
rg -n -C2 'try:|except Exception|MessageOwnerAmbiguityError' polylogue/storage/sqlite/archive_tiers/write.py | grep -n -C2 'write_parsed_session_to_archive|write_parsed|attachments|owner_key|raw_id|conn\.commit|content_hash' || true
echo

echo "== explicit MessageOwnerAmbiguityError catchers =="
git ls-files '*.py' | xargs rg -n -C3 'except (.*MessageOwnerAmbiguityError|ValueError)\b|except Exception as exc[:\s]*.*MessageOwnerAmbiguityError|MessageOwnerAmbiguityError:' || true

Repository: Sinity/polylogue

Length of output: 50373

---

🏁 Script executed:

#!/bin/bash
set -euo pipefail

echo "== exact write_parsed_session_to_archive definition/flow =="
rg -n -C3 'def write_parsed_session_to_archive|conn\.commit\(\)|conn\.rollback\(\)|write_parsed_session_to_archive\(|raw_id|prepared=' polylogue/storage/sqlite/archive_tiers/write.py
echo

echo "== revision_governance write function and surrounding connection handling =="
rg -n -C5 'def write_.*session|write_parsed_session_to_archive|session_content_hash|message revision membership|content_unchanged|conn\.commit|conn\.rollback' polylogue/storage/sqlite/archive_tiers/revision_governance.py
echo

echo "== write_parsed_session_to_archive imports and top 280 =="
sed -n '1,280p' polylogue/storage/sqlite/archive_tiers/write.py
echo

echo "== specific ingest_worker full flow around SessionWritePayload =="
sed -n '745,770p' polylogue/pipeline/services/ingest_worker.py
echo

echo "== behavioral probe of shared owner key resolution and error source =="
python3 - <<'PY'
from pathlib import Path
import ast
src = Path("polylogue/pipeline/ids.py").read_text()
tree = ast.parse(src)
for node in ast.walk(tree):
    if isinstance(node, ast.FunctionDef) and node.name == "attachment_message_owner_key":
        print(node.name, node.lineno)
        for child in node.body:
            if isinstance(child, ast.Raise):
                print("  raise line", child.lineno, "exc_type=", ast.get_source_segment(src, child.exc))
    if isinstance(node, ast.FunctionDef) and node.name in {"session_content_hash", "session_revision_projection", "_session_hash_components"}:
        calls = [ast.unparse(n.value.func) for n in ast.walk(node) if isinstance(n, ast.Call) and isinstance(n.value, ast.Name) and n.value.id == "attachment_message_owner_key"]
        print(node.name, node.lineno, "calls attachment_message_owner_key:", bool(calls))
PY

Repository: Sinity/polylogue

Length of output: 29385

---

Make ambiguous attachment owner resolution fail closed before commit.

session_content_hash() and _write_attachments() both call attachment_message_owner_key(), so both can raise MessageOwnerAmbiguityError for the same input. Add an explicit handler around the hash/projection and write boundary that rejects the session before any conn.commit() can persist the session/project rows for an ambiguous attachment.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@polylogue/pipeline/ids.py` around lines 394 - 438, Add explicit handling
around the session content-hash/projection and attachment-write boundary that
catches MessageOwnerAmbiguityError from attachment_message_owner_key(). Reject
the session and return before any conn.commit() can persist session or project
rows, ensuring both session_content_hash() and _write_attachments() ambiguity
paths fail closed consistently.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

Return None instead of an empty string when the active leaf has no native id.

native_provider_message_id is "" for an id-less message (line 966). When normalized_active_leaf points at such a message, ClaudeMessageNormalization.active_leaf_message_provider_id becomes "" rather than None. The field type is str | None, and the Codex parser now reports None for the same situation (tests/unit/sources/test_parsers_codex.py line 708).

Normalize the empty value so both parsers report absence the same way.

🐛 Proposed fix

         active_leaf_message_provider_id=(
-            evidence_by_id[normalized_active_leaf].native_provider_message_id
+            (evidence_by_id[normalized_active_leaf].native_provider_message_id or None)
             if normalized_active_leaf is not None
             else None
         ),

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	active_leaf_message_provider_id=(
	evidence_by_id[normalized_active_leaf].provider_message_id if normalized_active_leaf is not None else None
	evidence_by_id[normalized_active_leaf].native_provider_message_id
	if normalized_active_leaf is not None
	else None
	),
	active_leaf_message_provider_id=(
	(evidence_by_id[normalized_active_leaf].native_provider_message_id or None)
	if normalized_active_leaf is not None
	else None
	),

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@polylogue/sources/parsers/claude/common.py` around lines 1287 - 1291, Update
the active_leaf_message_provider_id assignment in ClaudeMessageNormalization to
convert an empty native_provider_message_id to None, while preserving None when
normalized_active_leaf is absent and retaining non-empty IDs unchanged.

🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win

An unresolvable owner is reported as an empty string. _user_state_session_ids returns "" for a message assertion with neither a durable scope_ref nor an indexed message row, and for any unsupported target type. Both list methods copy that value straight into the result payload's session_id field. A session-filtered call excludes those rows, so the empty owner only escapes on unfiltered calls, where consumers receive {"session_id": ""} and cannot distinguish "owner unknown" from a real id. list_annotations documents the filtered exclusion; list_marks documents nothing.

• polylogue/storage/sqlite/archive_tiers/archive.py#L5511-L5528: in list_marks, decide the contract for an unresolved owner and document it. Either omit the row from unfiltered results as well, or keep the empty value and state in the docstring that session_id is empty when no owner authority exists.
• polylogue/storage/sqlite/archive_tiers/archive.py#L5694-L5705: apply the same decision in list_annotations so both readers agree, and extend the existing docstring to cover the unfiltered case.

📍 Affects 1 file

• polylogue/storage/sqlite/archive_tiers/archive.py#L5511-L5528 (this comment)
• polylogue/storage/sqlite/archive_tiers/archive.py#L5694-L5705

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@polylogue/storage/sqlite/archive_tiers/archive.py` around lines 5511 - 5528,
Choose one consistent contract for unresolved owners and apply it to both
list_marks and list_annotations: either omit ownerless rows from unfiltered
results or retain session_id as an empty string. Update both methods accordingly
and document the behavior in each method’s docstring, including the existing
session-filtered exclusion and the unfiltered case. Affected site
polylogue/storage/sqlite/archive_tiers/archive.py#L5511-L5528 (list_marks)
requires the contract and documentation;
polylogue/storage/sqlite/archive_tiers/archive.py#L5694-L5705 (list_annotations)
must apply the same behavior and extend its docstring.

🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick win

An owner-less re-upsert erases the durable owner scope. Both writers compute scope_ref as an unconditional overwrite. When a message target is re-upserted without owner_session_id, scope_ref becomes None and replaces a previously persisted session:<owner> value. That destroys the durable evidence this PR adds, because the indexed message row is rebuildable and the scope is the surviving authority. ArchiveStore.add_mark and ArchiveStore.save_annotation now reject owner-less message writes, so the facade cannot trigger this, but direct callers of these two functions still can.

• polylogue/storage/sqlite/archive_tiers/user_write.py#L621-L638: in upsert_mark, preserve the existing scope_ref when owner_session_id is None for a message target, instead of writing None.
• polylogue/storage/sqlite/archive_tiers/user_write.py#L752-L752: apply the same preservation rule in upsert_annotation.

🛡️ Proposed fix to preserve an already-recorded owner

Add a shared helper:

def _preserved_owner_scope_ref(
    conn: sqlite3.Connection,
    assertion_id: str,
    target_type: str,
    owner_session_id: str | None,
) -> str | None:
    """Return the owner scope for a message target without erasing prior evidence.

    The indexed message row is rebuildable, so a previously recorded owner is
    durable authority. An owner-less re-upsert must not replace it with NULL.
    """
    if target_type != "message":
        return None
    if owner_session_id:
        return f"session:{owner_session_id}"
    existing = read_assertion_envelope(conn, assertion_id)
    return existing.scope_ref if existing is not None else None

Then use it at both sites:

     timestamp = now_ms if now_ms is not None else _now_ms()
     mark_id = _deterministic_id("mark", target_type, target_id, mark_type)
+    assertion_id = assertion_id_for_mark(target_type, target_id, mark_type)
     upsert_assertion(
         conn,
-        assertion_id=assertion_id_for_mark(target_type, target_id, mark_type),
+        assertion_id=assertion_id,
         target_ref=f"{target_type}:{target_id}",
-        scope_ref=f"session:{owner_session_id}" if target_type == "message" and owner_session_id else None,
+        scope_ref=_preserved_owner_scope_ref(conn, assertion_id, target_type, owner_session_id),
         kind=AssertionKind.MARK,

     timestamp = now_ms if now_ms is not None else _now_ms()
     resolved_id = annotation_id or _deterministic_id("annotation", target_type, target_id, body)
+    assertion_id = assertion_id_for_annotation(resolved_id)
     upsert_assertion(
         conn,
-        assertion_id=assertion_id_for_annotation(resolved_id),
+        assertion_id=assertion_id,
         target_ref=f"{target_type}:{target_id}",
-        scope_ref=f"session:{owner_session_id}" if target_type == "message" and owner_session_id else None,
+        scope_ref=_preserved_owner_scope_ref(conn, assertion_id, target_type, owner_session_id),
         kind=AssertionKind.ANNOTATION,

📍 Affects 1 file

• polylogue/storage/sqlite/archive_tiers/user_write.py#L621-L638 (this comment)
• polylogue/storage/sqlite/archive_tiers/user_write.py#L752-L752

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@polylogue/storage/sqlite/archive_tiers/user_write.py` around lines 621 - 638,
In polylogue/storage/sqlite/archive_tiers/user_write.py lines 621-638, update
upsert_mark to preserve an existing message owner scope when owner_session_id is
absent; add and reuse a shared helper that returns the explicit session scope or
reads the existing assertion envelope, and use it for scope_ref. Apply the same
helper and preservation rule in upsert_annotation at lines 752-752; non-message
targets should continue producing no owner scope.

🎯 Functional Correctness | 🟡 Minor | ⚡ Quick win

The raw ids let the pre-existing fallback satisfy the assertion.

sorted over ("raw-z-old", "raw-a-new") already selects raw-a-new. The deterministic raw_id tiebreak at the end of _equal_content_representative therefore produces the same result as the new observed_at_ms tiebreak. The test passes even if the observed_at_ms branch is removed.

Choose raw ids whose alphabetical order favors the older revision. Then only the observation-order rule can produce the expected accepted id.

💚 Proposed fix to make the test discriminate the new tiebreak

     result = classify_membership_revisions(
         [
-            revision("raw-z-old", "before", 1),
-            revision("raw-a-new", "after", 2),
+            revision("raw-a-old", "before", 1),
+            revision("raw-z-new", "after", 2),
         ]
     )
 
-    assert result.accepted_raw_ids == ("raw-a-new",)
-    assert result.equivalent_raw_ids == ("raw-z-old",)
+    assert result.accepted_raw_ids == ("raw-z-new",)
+    assert result.equivalent_raw_ids == ("raw-a-old",)
     assert result.ambiguous_raw_ids == ()

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	result = classify_membership_revisions(
	[
	revision("raw-z-old", "before", 1),
	revision("raw-a-new", "after", 2),
	]
	)
	assert result.accepted_raw_ids == ("raw-a-new",)
	assert result.equivalent_raw_ids == ("raw-z-old",)
	assert result.ambiguous_raw_ids == ()
	result = classify_membership_revisions(
	[
	revision("raw-a-old", "before", 1),
	revision("raw-z-new", "after", 2),
	]
	)
	assert result.accepted_raw_ids == ("raw-z-new",)
	assert result.equivalent_raw_ids == ("raw-a-old",)
	assert result.ambiguous_raw_ids == ()

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/archive/test_session_revision_membership.py` around lines 1213 -
1222, Update the test case for classify_membership_revisions to use raw IDs
whose alphabetical order favors the older revision, while keeping the newer
revision’s observed_at_ms value later. Preserve the expected accepted_raw_ids
result so the assertion can only pass when _equal_content_representative applies
the observed_at_ms tiebreak.

🎯 Functional Correctness | 🟠 Major | ⚡ Quick win

Align the assertions with the updated ledger and campaign graph.

Line 62 expects in_progress, but docs/plans/reindex-incident-coverage.json now sets polylogue-slshy to closed. Lines 63-70 expect the old residual successor and child set. The ledger and graph now specify only polylogue-xselt. This test will fail.

Proposed fix

-    assert row["bead_status"] == "in_progress"
+    assert row["bead_status"] == "closed"
     assert row["residual_successor"] == {
-        "bead_id": "polylogue-message-owner-scope-backfill",
+        "bead_id": "polylogue-xselt",
         "kind": "named-child-bead",
     }
     assert set(cast(list[str], graph_entry["child_bead_ids"])) == {
         "polylogue-xselt",
-        "polylogue-message-owner-scope-backfill",
     }

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	assert row["bead_status"] == "in_progress"
	assert row["residual_successor"] == {
	"bead_id": "polylogue-message-owner-scope-backfill",
	"kind": "named-child-bead",
	}
	assert set(cast(list[str], graph_entry["child_bead_ids"])) == {
	"polylogue-xselt",
	"polylogue-message-owner-scope-backfill",
	}
	assert row["bead_status"] == "closed"
	assert row["residual_successor"] == {
	"bead_id": "polylogue-xselt",
	"kind": "named-child-bead",
	}
	assert set(cast(list[str], graph_entry["child_bead_ids"])) == {
	"polylogue-xselt",
	}

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/devtools/test_incident_coverage_ledger.py` around lines 62 - 70,
Update the assertions in the incident coverage test to match the current ledger:
expect polylogue-slshy’s bead_status to be closed, expect residual_successor to
reference only polylogue-xselt, and assert the child_bead_ids set contains only
polylogue-xselt.

📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Rename the test; it no longer covers a synthetic identity.

This PR removes the synthetic-* provider message id from the Codex reasoning path, as line 679 now asserts. The test body compares message_contents across a reorder, which exercises the content-derived revision anchor in _message_revision_match_id, not a synthetic id. The current name states the opposite of the new behavior.

♻️ Proposed rename

-    def test_reasoning_reordering_keeps_synthetic_revision_identity(self) -> None:
+    def test_reasoning_reordering_keeps_content_anchored_revision_identity(self) -> None:

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	def test_reasoning_reordering_keeps_synthetic_revision_identity(self) -> None:
	def test_reasoning_reordering_keeps_content_anchored_revision_identity(self) -> None:

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@tests/unit/sources/test_parsers_codex.py` at line 681, Rename
test_reasoning_reordering_keeps_synthetic_revision_identity to reflect that it
verifies content-derived revision identity across message reordering, removing
the obsolete synthetic-identity wording while leaving the test body unchanged.