fix(routing): bind a sticky pin to the account identity it was placed under

[iceteaSA]

Branched off main at v0.5.2. Single commit, 935 pass / 0 fail (from 930).

The pin recorded a slot, not an account

StickyAssignment.accountId is 'main' or a fallback's storage id — a slot. Which ChatGPT account occupies that slot can change underneath it: switching the main account does it, and so does re-logging a fallback, because upsertAccount dedups identity → id → label and deliberately reuses the storage id.

When that happens every session pinned to the slot stays pinned, but to a different account than the operator chose, with a cold prompt cache. Cache warmth is the entire justification for pinning, so the pin was then protecting a cache that does not exist while also overriding the operator's choice.

Placement now records the identity alongside the slot, and a pin whose recorded identity differs from the account's current one is treated as absent — the session is placed again against real quota. This mirrors what QuotaEntry.accountId and setFallback already do one layer over; the mechanism was in the codebase, it just was not applied to pins.

Two constraints that mattered more than the feature

Fail open. Invalidation fires only when both identities are known strings and they differ. Identity is not always resolvable, and invalidating on missing data would re-place sessions at random and bust the caches this mode exists to protect — strictly worse than the bug. An unknown on either side retains the pin.

Migration retains. Every pin written before this change carries no identity. Dropping them on first resolve would clear every warm cache on upgrade, so they are retained and stamped instead; the check works from the second resolve onward.

Both are absence assertions, which is worth stating because it changes how they were verified.

Testing

Six production hunks, each mutated individually. Reverse-removal proves a positive assertion, but it cannot prove an absence one — deleting code moves it further into compliance with "unknown never invalidates", so the test can never redden. Those three used the inverse mutation instead: make the code invalidate unconditionally and confirm the fail-open tests break.

Hunk	Mechanic	What reddened
hasStickyIdentityMismatch	reverse-removal	known identity change no longer re-places
fail-open typeof gates	inverse	pre-upgrade + current-unknown retention both break
migration stamp	reverse-removal	pre-upgrade pin no longer stamped
tolerant read	inverse	malformed identity no longer normalized away
wireAccountIdByAccount threading	reverse-removal	integration placement breaks
churn clause	inverse	matching identity starts rewriting every resolve

The churn one is worth calling out: a matching-identity pin must not trigger a write on every resolve, or the unlocked fast path stops being fast and every request takes the lock.

Also verified rather than assumed: the threading feeds from the serving account's identity (wireAccountId on the candidate) and not the internal quota key — that key is the literal 'main' for whichever account is primary, so using it would have silently defeated the whole change while leaving every test green. TTL expiry, the 256-entry cap, and LRS eviction are untouched, and the wire identity does not reach any log line.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

---

Summary by cubic

Bind sticky pins to the actual account identity so switching the main account or re‑logging a fallback no longer keeps sessions pinned to the wrong (cold‑cache) account. Old: pins recorded only the slot; New: pins store a wire account id and are treated as absent only when both the stored and current identities are known and differ.

• Pass wireAccountIdByAccount into placement and persist wireAccountId on pins; stamp pre‑upgrade pins on first resolve.
• Fail‑open: unknown identity on either side retains the pin; malformed stored identities are ignored without dropping the pin.
• Exclude only the invalidated pin from pending‑byte accounting when choosing its replacement; other sessions’ pins remain counted.
• Avoid rewrite churn: skip writes when identities match; update metadata only on inputBytes growth, lastSeen touch, or first identity stamp.

^{Written for commit a7b1745. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 4 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>