Description
Window delivery retries after an OTLP export failure, while access.logins observes identities in memory during collection. The current identity index accepts the same login ray again on each retry, consuming candidate capacity and potentially changing match behavior. This was found during Wave 2 review; internal/identity is outside that wave.
Acceptance Criteria
- #1 Replaying the same Access login row after a failed export leaves one identity candidate and consumes capacity once.
- #2 Distinct login rows remain individually matchable, including rows with the same timestamp.
- #3 A regression test exercises the retry path through the collector and scheduler.
Definition of Done
- #1 just check (fmt-check, lint, vet, test, tidy-check, build, vuln)
- #2 just ci before a change that touches the Dockerfile, goreleaser or the image (adds snapshot + image)
- #3 Every new signal or attribute name declared in internal/semconv and listed in docs/signals.md
Implementation Plan
Deduplicate replayed Access rows with bounded non-PII fingerprints while retaining distinct same-time rows; verify scheduler retry behavior and capacity bounds.
Final Summary
Access replay retains one candidate per source row while preserving distinct same-time rows. Prechange retry and collision regressions failed; focused race tests, reviewed integration, exact-SHA just ci, and CI at the v0.3.0 release SHA passed. No new signal names were introduced.