@@ -27426,7 +27426,7 @@ var __webpack_unused_export__;
  * SPDX-License-Identifier: Apache-2.0
  */
 __webpack_unused_export__ = ({ value: true });
-__webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = exports.J = exports.l = void 0;
+exports.ix = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = __webpack_unused_export__ = exports.J = exports.l = void 0;
 var BasicTracerProvider_shim_1 = __nccwpck_require__(77254);
 Object.defineProperty(exports, "l", ({ enumerable: true, get: function () { return BasicTracerProvider_shim_1.BasicTracerProvider; } }));
 var BatchSpanProcessor_shim_1 = __nccwpck_require__(98462);
@@ -27442,7 +27442,7 @@ __webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_t
 __webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_trace_1.AlwaysOnSampler; } });
 __webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_trace_1.ParentBasedSampler; } });
 __webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_trace_1.TraceIdRatioBasedSampler; } });
-__webpack_unused_export__ = ({ enumerable: true, get: function () { return sdk_trace_1.SamplingDecision; } });
+Object.defineProperty(exports, "ix", ({ enumerable: true, get: function () { return sdk_trace_1.SamplingDecision; } }));
 //# sourceMappingURL=index-shim.js.map
 
 /***/ }),
@@ -170090,7 +170090,7 @@ const SCOPE_NAME = "detsys-ts";
 * `$lib_version` that the PostHog instrumentation reported, and which told
 * nobody anything.
 */
-const LIBRARY_VERSION = "2.1.2";
+const LIBRARY_VERSION = "2.1.3";
 /**
 * The OTLP/HTTP collector for all Actions.
 * The exporters add `/v1/traces` and `/v1/logs` to this URL.
@@ -170157,6 +170157,41 @@ const OTLP_EXPORT_VARIABLES = [
 * contextFromTraceparent} correct no matter when they're called.
 */
 const PROPAGATOR = new core_build_src.W3CTraceContextPropagator();
+/** OpenTelemetry's vendor key in `tracestate`. */
+const TRACE_STATE_KEY = "ot";
+const RANDOMNESS_HEX_DIGITS = 14;
+/**
+* The sampling randomness for `source`, as lowercase hexadecimal. Hashed,
+* because a sampler compares this against a threshold and that is only fair
+* if the value is uniformly distributed.
+*/
+function samplingRandomnessOf(source) {
+	return (0,external_node_crypto_.createHash)("sha256").update(source).digest("hex").slice(0, RANDOMNESS_HEX_DIGITS);
+}
+/**
+* Records every span, and gives every trace it starts the same randomness.
+*
+* Each execution phase is a trace of its own, so a sampler keying on trace
+* randomness would keep a job's `main` phase and drop its `post`. One shared
+* value gets one decision for both. This discards nothing itself; the
+* collector decides what to keep.
+*/
+var SharedRandomnessSampler = class {
+	constructor(randomness) {
+		this.traceState = new core_build_src.TraceState().set(TRACE_STATE_KEY, `rv:${randomness}`);
+	}
+	shouldSample(context) {
+		const parent = src.trace.getSpanContext(context);
+		const isRoot = parent === void 0 || !src.isSpanContextValid(parent);
+		return {
+			decision: index_shim/* SamplingDecision */.ix.RECORD_AND_SAMPLED,
+			traceState: isRoot ? this.traceState : parent.traceState
+		};
+	}
+	toString() {
+		return "SharedRandomnessSampler";
+	}
+};
 const SEVERITY = {
 	debug: build_src.SeverityNumber.DEBUG,
 	info: build_src.SeverityNumber.INFO,
@@ -170280,6 +170315,7 @@ var Telemetry = class {
 			})).merge(resources_build_src.detectResources({ detectors: [resources_build_src.envDetector] }));
 			this.tracerProvider = new index_shim/* BasicTracerProvider */.l({
 				resource,
+				...options.samplingRandomnessSource === void 0 ? {} : { sampler: new SharedRandomnessSampler(samplingRandomnessOf(options.samplingRandomnessSource)) },
 				spanProcessors: [new index_shim/* BatchSpanProcessor */.J(new exporter_trace_otlp_http_build_src/* OTLPTraceExporter */.Q())]
 			});
 			this.loggerProvider = new sdk_logs_build_src/* LoggerProvider */.IB({
@@ -170890,6 +170926,8 @@ const ATTR_NIX_STORE_TRUST = "detsys.nix.store_trust";
 const ATTR_NIX_STORE_VERSION = "detsys.nix.store_version";
 const ATTR_NIX_STORE_CHECK_METHOD = "detsys.nix.store_check_method";
 const ATTR_NIX_STORE_CHECK_ERROR = "detsys.nix.store_check_error";
+const ATTR_IDENTITY_STORED = "detsys.identity.stored";
+const ATTR_IDENTITY_STORE_ERROR = "detsys.identity.store_error";
 const ATTR_ATTACHMENT_NAME = "detsys.attachment.name";
 const ATTR_ATTACHMENT_PATH = "detsys.attachment.path";
 const STATE_KEY_EXECUTION_PHASE = "detsys_action_execution_phase";
@@ -171115,11 +171153,15 @@ var DetSysAction = class {
 				});
 				const correlationHashes = JSON.stringify(this.getCorrelationHashes());
 				process.env.DETSYS_CORRELATION = correlationHashes;
-				try {
-					await withSpan("store_identity", async () => {
+				await withSpan("store_identity", async (span) => {
+					try {
 						await writeCorrelationHashes(correlationHashes);
-					});
-				} catch {}
+						span.setAttribute(ATTR_IDENTITY_STORED, true);
+					} catch (e) {
+						span.setAttribute(ATTR_IDENTITY_STORED, false);
+						span.setAttribute(ATTR_IDENTITY_STORE_ERROR, stringifyError$1(e));
+					}
+				});
 				if (!await this.preflightRequireNix()) {
 					this.addEvent(EVENT_PREFLIGHT_REQUIRE_NIX_DENIED);
 					return;
@@ -171169,7 +171211,8 @@ var DetSysAction = class {
 		this.telemetry.start({
 			serviceName: `${this.actionOptions.name}-action`,
 			serviceVersion: dist_text(process.env["GITHUB_ACTION_REF"]),
-			resourceAttributes: await this.telemetryResourceAttributes()
+			resourceAttributes: await this.telemetryResourceAttributes(),
+			samplingRandomnessSource: this.getInvocationId()
 		});
 	}
 	/**