---
id: ADR-PFM-OPS-008
title: A visit’s identity is minted by the console and its attribution by the server
product_area: platform
module: operations
revision: 1
status: proposed
design_intent: confirmed
source_sha:
  services-platform: ad3f6a6582843008ed0f5a17b131878d15829af1
  react-console: baf6dae382d6f41dce976c7f848667ccc37e076f
decision: >-
  Identify a visit with a client-generated occurrence key reused on retries, and derive its person, workspace
  and time on the server.
constrains:
  - DOM-PFM-OPS-002
  - WF-PFM-OPS-008
  - SVC-PFM-OPS-audit
origin: 'services-platform:docs/audit-events.md#2026-10-12 — Final acceptance'
alternatives:
  - option: Deduplicate solely by person and record
    why_not: Repeated visits to the same record must remain separate occurrences.
  - option: Accept client attribution and timestamps
    why_not: A caller could attribute activity to another person or alter its recorded time.
consequences:
  - Repeated delivery returns the already recorded visit.
  - Using the same key for another target causes a conflict.
  - The browser fallback produces a key the server rejects.
supersedes: []
evidence:
  - 'react-console at baf6dae: lib/record-views/tracking/visit.ts.'
  - >-
    services-platform at ad3f6a6: modules/audit/aws/api/audit-api-mapper.ts,
    services/record-views/record-view.ts.
  - >-
    codex examination 2026-10-23: checked the pinned source anchors, planning references and enforcement
    boundaries; unresolved limits are recorded in module findings.
---

# A visit’s identity is minted by the console and its attribution by the server

## Context

A navigation report may be delivered repeatedly over an unreliable connection.

## Decision

Let the client identify the occurrence and the server establish attribution. Resolve the target under current authority before inserting or returning a duplicate.

## Alternatives Considered

Person-and-record matching loses later visits. Client-supplied attribution cannot provide a trustworthy server account.

## Consequences

Occurrence identity makes retransmission repeatable without letting clients choose the event’s author.