audit(C20): OpenCode native multi-session identity and project attribution #159

Audit lineage

Parent: #128

Cluster: C20
Audit IDs: F38
Reviewed HEAD: eeb9e8f2b0435ac07e3f00f91ea1eb24176df4b3
Priority: P2 (scope-specific proposed implementation priority, not a retroactive finding severity).

Evidence

• validation #131
• independent-review #131

Current observed problem

• F38 — confirmed: SQL/record construction / ParsedFile return; isolated DB with s1/project-a and s2/project-b yields one ParsedFile with 3 records, Cwd empty and UUID empty; SQL scans sessionID but never uses it. project fallback uses database pathname. | Single-file record API drops native session ownership; project falls back to DB pathname. LoadToolSequences groups by source_path (queries.go:1079), not native session_id. No exact duplicate. | Introduce explicit per-record/session identity and project metadata or a multi-session parse contract before changing grouping; ingest native session directory and IDs, test two sessions/projects in one DB and stable UUIDs across mutations.

Expected contract / decision gate

Two sessions/projects in one source database remain distinct in list/search/sequences with stable proven native identities; updates preserve session ownership.

Decision/blocker: D16: per-record/session metadata versus multi-session reader API; no invented UUIDs or path-only grouping.

Scoped acceptance criteria

• Two sessions/projects in one source database remain distinct in list/search/sequences with stable proven native identities.
• updates preserve session ownership.

Required validation / smoke

Use current-HEAD source/LSP callers and narrowly affected behavior tests. Reproduce the linked report probes using /tmp fixtures with scrubbed HOME and BACKSCROLL_CONFIG_DIR; observe exit code, stdout/stderr and SQLite/file state, including negative controls. Tests must exercise behavior, not source-text assertions. Implementation must later pass the normal repository gate without weakening coverage; issue materialization itself runs no builds/tests.

Dependencies and duplicate reconciliation

• C19: 158

All-state issue inventory is searched immediately before creation; related closed history is not proof that these current observations are fixed. True cross-batch overlaps are owned by this one cluster, not an issue per ID.

Non-goals / safety boundaries

Do not change native origin/identity evidence, reasoning privacy, tokenizer/echo eligibility, perennial retention, historical migrations, or owner/follower/remediation locking merely to deduplicate code. Do not alter #128–#136 closure/tracker state as part of implementation.