fix(observatory): preserve source identity on unchanged reindex

src/k1link/sessions/store.py

@@ -9,7 +9,7 @@ import shutil
 import sqlite3
 import stat
 import threading
-from collections.abc import Iterator
+from collections.abc import Iterator, Mapping
 from contextlib import contextmanager
 from pathlib import Path
 from typing import Any, Literal, cast
@@ -1118,10 +1118,16 @@ class SessionStore:
         with self._lock, self._connect() as connection:
             connection.execute("BEGIN IMMEDIATE")
             existing = connection.execute(
-                "SELECT plugin_id, archive_id, allowed_root, session_root, created_at_utc "
-                "FROM observation_sessions WHERE session_id = ?",
+                "SELECT * FROM observation_sessions WHERE session_id = ?",
                 (candidate.session_id,),
             ).fetchone()
+            previous_snapshot = (
+                None
+                if existing is None
+                else _catalog_snapshot_sha256_for_session(
+                    connection, candidate.session_id, session_row=existing
+                )
+            )
             unclaimed_pre_plugin_row = existing is not None and (
                 existing["plugin_id"] == "" and existing["archive_id"] == ""
             )
@@ -1271,6 +1277,20 @@ class SessionStore:
                     for source in sources
                 ],
             )
+            if existing is not None:
+                reconciled = dict(connection.execute(
+                    "SELECT * FROM observation_sessions WHERE session_id = ?",
+                    (candidate.session_id,),
+                ).fetchone())
+                reconciled["updated_at_utc"] = existing["updated_at_utc"]
+                if _catalog_snapshot_sha256_for_session(
+                    connection, candidate.session_id, session_row=reconciled
+                ) == previous_snapshot:
+                    # Discovery is not a source mutation. Preserve the exact
+                    # admitted snapshot when every session/source/artifact field
+                    # is identical; real changes still commit with the new clock.
+                    connection.rollback()
+                    return
             connection.commit()
 
     @contextmanager
@@ -1571,7 +1591,7 @@ def _catalog_snapshot_sha256_for_session(
     connection: sqlite3.Connection,
     session_id: str,
     *,
-    session_row: sqlite3.Row | None = None,
+    session_row: sqlite3.Row | Mapping[str, object] | None = None,
 ) -> str:
     row = (
         session_row
@@ -1597,7 +1617,7 @@ def _catalog_snapshot_sha256_for_session(
 
 
 def _catalog_snapshot_sha256(
-    session_row: sqlite3.Row,
+    session_row: sqlite3.Row | Mapping[str, object],
     source_rows: list[sqlite3.Row],
     artifact_rows: list[sqlite3.Row],
 ) -> str: