`topic tail` showed the member name («Intra-Back») for posts from three
different sessions: REST posts carried no session identity, and every
read path resolved the author through the member table only.
- api POST /v1/messages accepts sessionPubkey and stores it on
topic_message + message_queue — only when a presence row proves the
key's member owns that session.
- api /messages + /stream and broker topicHistory return
COALESCE(session pubkey, member pubkey) and the session's latest
presence name, falling back to the member's.
- cli `topic post` sends the current session's pubkey.
No migration: topic_message.sender_session_pubkey already existed.
Broker test added (pgvector pg16); the api SQL was run against the same DB.
Spec: .artifacts/specs/2026-09-26-session-identity-and-routing.md §6
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
d506103527