Module m0022_identity_store_links_backfill 

Backfill db_agent_identity_links, plus a db_accounts fallback mirror (reagentx P0 review, added after this migration’s first version — see identity::resolver::inject::resolve_account’s own doc comment for why the mirror is needed even though db_accounts itself stays on id_store as the authoritative store), from every reachable store into the new, permanently-global identity store — see docs/specs/SPEC_IDENTITY_STORE_SPLIT_2026_08_17.md.

Before this migration, an agent’s account link lived wherever id_store (registry::resolve_shared_store_path) happened to resolve at write time: the true global shared/store.db on the "stable" channel, or a throwaway <instance_dir>/identity-store.db on every local/dev/portable channel (isolated by default since PR #2431, docs/specs/SPEC_ISOLATED_AUTH_DEFAULT_BY_CHANNEL_2026_08_06.md) — the exact fragmentation docs/specs/REPORT_HISTORY_CONTINUITY_ACROSS_VERSION_UPGRADE_2026_08_17.md traces. Without this migration, every link written since 2026-08-06 would be invisible to the new always-global lookup — shipping the store split alone would REGRESS every existing non-stable-channel install (a working agent would suddenly fail its credential gate) instead of fixing it.

Sources scanned, read-only (never mutates a source):

1. The current channel’s objects.db (links can live there if id_store ever fell back to mstore, e.g. before 0011_shared_store_backfill applied).
2. The true global shared/store.db, resolved via registry::resolve_global_shared_root() — NOT MigrationContext’s own shared_store_path field, which is resolve_shared_store_path()’s result and therefore DOES redirect to a per-channel path under isolation (reagentx P1 review on this PR — the first version of this migration used ctx.shared_store_path here, silently skipping the real global store on every non-"stable" channel, exactly the isolation-unaware bug this migration exists to route around). A "stable"-channel run (or any run with AGENTMUX_ISOLATED_AUTH=0) may have written real links there.
3. Every sibling per-(channel,version) and per-dev-branch objects.db (registry::enumerate_objects_dbs, the same enumerator 0011_shared_store_backfill uses).
4. For each sibling objects.db, its sibling isolated identity store (<instance_dir>/identity-store.db — same instance_dir the objects.db lives under, derived by stripping data/db/objects.db) — this is the one that actually holds the fragmented, post-2026-08-06 links the whole redesign exists to reunify.

Deliberately UNCONDITIONAL on isolated_auth_enabled() (unlike 0011_shared_store_backfill’s sibling-scan, which skips other channels when isolated so a disposable test account store starts empty): this migration’s destination has no isolation concept at all — see the design doc §2.3 — so there is no “keep this run’s view empty” case to preserve.

Structs

M0022IdentityStoreLinksBackfill