fix: namespace migrated message identities

Author: Gini

AGENTS.md

@@ -46,3 +46,5 @@ Use `assistant-ui` as the preferred foundation for ONEVibe conversation threads,
 ## Sandbox artifact dependencies
 
 Artifact tooling required by an acceptance gate must be image/bootstrap managed and verified before the runtime reports ready. Never make a live agent install packages through the development proxy. Keep Claude's `--tools` availability mode-specific and use `--allowedTools` only as the separate approval layer; adding an approval allowlist does not remove a tool. Slide mode may receive a narrowly documented shell capability to invoke preinstalled renderers, while ordinary conversation modes must not.
+
+For legacy persistence migrations, assume identifiers were only unique inside one task directory. Derive globally unique durable IDs from conversation identity plus the original local ID, keep the transformation deterministic, and retain duplicate rejection inside a single conversation.

docs/LIVE-E2E-ENGINEERING-LOG.md

@@ -51,3 +51,5 @@ The deck gate failed: the sandbox lacked `python-pptx`/PDF libraries, package in
 The next POC slice bakes `pptxgenjs` and `pdf-lib` into the ONEComputer headless Claude bootstrap and verifies both modules before a sandbox may become ready. Slide jobs receive `NODE_PATH` for those managed modules and are instructed to produce a fixed six-file deliverable contract without installing packages at task time.
 
 Tool governance now distinguishes availability from approval. ONEVibe passes the same mode-specific list to Claude's `--tools` and `--allowedTools`: ordinary modes retain only path-confined file/search tools, while Slide mode additionally receives Bash solely to run the preinstalled renderer. This still requires a live negative test proving Bash is absent outside Slide mode and a real deck run proving the expected binary signatures.
+
+The first post-deployment rerun proved that the local API process was still the pre-change binary; its command journal lacked `NODE_PATH` and `--tools`, so that trial was rejected and its sandbox removed. Restarting from committed code then exposed a legacy-import collision: old conversations reuse identifiers such as `legacy_message_0`, while the relational message primary key is global. Migration now derives message IDs from the conversation ID plus original legacy ID, preserving deterministic reruns and same-conversation duplicate detection without cross-conversation collisions.

server/persistence/legacy-importer.test.ts

@@ -72,6 +72,20 @@ describe('LegacyJsonImporter', () => {
     } finally { database.close() }
   })
 
+  it('namespaces repeated legacy message ids by conversation while retaining duplicate detection within one conversation', async () => {
+    const { root, database, unitOfWork } = setup()
+    try {
+      const shared = [{ id: 'user-0', role: 'user', content: 'Shared legacy identifier', createdAt: now }]
+      writeTask(root, 'task-1', { messages: shared })
+      writeTask(root, 'task-2', { messages: shared })
+      const report = await new LegacyJsonImporter({ legacyRoot: root, unitOfWork }).importAll()
+      expect(report.imported.map((item) => item.sourceId)).toEqual(['task-1', 'task-2'])
+      expect(report.quarantined).toEqual([])
+      const ids = database.prepare('SELECT id FROM messages ORDER BY conversation_id').pluck().all()
+      expect(new Set(ids).size).toBe(2)
+    } finally { database.close() }
+  })
+
   it('quarantines malformed JSON with an explicit report and continues importing valid siblings', async () => {
     const { root, database, unitOfWork } = setup()
     try {

server/persistence/legacy-importer.ts

@@ -56,6 +56,8 @@ const optionalString = (value: unknown, field: string): string | undefined => {
 const parseJson = (source: string, filename: string): unknown => {
   try { return JSON.parse(source) as unknown } catch { throw new LegacyImportValidationError(`${filename} is not valid JSON`) }
 }
+const migratedMessageId = (conversationId: string, legacyId: string): string => `legacy_message_${createHash('sha256')
+  .update(conversationId).update('\0').update(legacyId).digest('hex').slice(0, 32)}`
 
 interface ValidatedLegacy {
   conversation: ConversationRecord
@@ -82,7 +84,7 @@ function validateLegacy(taskValue: unknown, messagesValue: unknown): ValidatedLe
       throw new LegacyImportValidationError(`messages[${sequence}].status is unsupported`)
     }
     return {
-      id: requiredString(value.id, `messages[${sequence}].id`),
+      id: migratedMessageId(id, requiredString(value.id, `messages[${sequence}].id`)),
       conversationId: id,
       turnId: null,
       sequence,