Prevent channel conversation events from persisting to the wrong workspace

[ElioNeto]

Original issue tinyhumansai#2602 by @YOMXXX on 2026-05-25T05:49:47Z

---

Summary

Channel conversation persistence can write in-flight channel events into the wrong workspace when the active workspace changes while events are still being processed.

Problem

The channel conversation persistence subscriber persists DomainEvent::ChannelMessageReceived and DomainEvent::ChannelMessageProcessed into a workspace-backed JSONL store, but those event payloads do not carry workspace identity. The subscriber therefore relies on process-level workspace state or the workspace captured during subscriber registration, which creates ambiguity across login/workspace switches.

Minimal repro shape:

1. Start processing a channel message in workspace A.
2. Switch login/workspace before the received/processed event is handled by the conversation persistence subscriber.
3. The event can be persisted under the wrong workspace, or under a stale workspace binding, instead of the workspace that produced the event.

Environment: desktop/core event-bus flow; identified during review of tinyhumansai#2445.

Solution (optional)

Thread explicit workspace identity through the affected DomainEvent variants and publishers, then have workspace-scoped subscribers reject or route events whose workspace identity does not match their target store. This likely needs updates around src/core/event_bus/events.rs, src/openhuman/channels/runtime/dispatch.rs, and src/openhuman/memory_conversations/bus.rs plus regression coverage for workspace switches.

Acceptance criteria

• Repro gone — Channel conversation events are persisted only to the workspace that produced the event, even if login/workspace changes before subscriber handling.
• Regression safety — Unit or integration coverage exercises received and processed channel events across a workspace switch/stale subscriber scenario.
• Diff coverage ≥ 80% — the fix PR meets the changed-lines coverage gate (Vitest + cargo-llvm-cov, enforced by .github/workflows/coverage.yml).
• Event contract documented — Workspace-bearing domain events document how publishers and subscribers should route or reject stale workspace events.

Related

• Follow-up from fix: harden workspace routing and local-first gates tinyhumansai/openhuman#2445 review discussion: fix: harden workspace routing and local-first gates tinyhumansai/openhuman#2445 (comment)