The two Gemini robustness nits raced the #774 merge: the patch landed on the
branch after GitHub had merged the pre-patch head, so main shipped the
architecture without the migration-input hardening. This re-lands ONLY the
robustness fixes — no identity-semantics change.
- chat/runtime.py: parse identity_scheme with try/except (TypeError, ValueError)
-> fallback to legacy scheme 1; revision str(... or '') so a null becomes ''
(unverifiable -> conservative DIVERGED), not the literal 'None'.
- workbench/readers.py: stored_revision=written_at_revision or '' so a None
revision is handled identically by the shared reconcile helper.
- tests: malformed identity_scheme does not crash the load guard (migrates);
reader falls back to legacy on malformed scheme; reader missing revision is a
conservative break.
Verified: 50 identity/migration/reader tests pass. No lane/serving path touched.
ac5fb35d45