Function resolve_agent_definition_id 

pub(super) fn resolve_agent_definition_id(
    state: &AppState,
    agent_id: &str,
) -> Result<String, String>

Resolve an S1-authenticated agent id (the slug — AGENTMUX_AGENT_ID / bus:register id, e.g. “Agent3”) to the agent’s DEFINITION id, which is what db_agent_identity_links.agent_id stores (== AgentDefinition.id; see m0013 and identity/resolver/inject.rs::resolve_bindings_for_instance).

Every link-table operation reached from MuxAPI must go through this: MuxAPI callers authenticate with the slug, but writing the slug into the link table either trips the per-channel schema’s FOREIGN KEY (agent_id) REFERENCES db_agents(id) (v30, #3088 — was db_agent_definitions(id); a definition id still always satisfies it, since every definition has a db_agents mirror at the same id) (loud “FOREIGN KEY constraint failed” — the id_store fallback path when the 0011 shared-store backfill hasn’t applied), or — on the shared store, whose links table carries no agent_id FK — silently writes a row keyed by slug that the resolver (which reads by definition id) can never match. Reads have the mirror-image bug: listing links by slug always returns empty, so ownership checks reject and unlinks no-op.

A caller that already holds a definition id passes through unchanged (verified against agent_def_get), so internal non-S1 callers of the shared *_impl helpers stay valid.