Include directory account_id in observation_scope (SBS-1079)

[btsouth]

Summary

observation_scope (shared by capacity-event observation and enforcement tracking) hashed only provider|source|email|org. Codex directory seats that share a login email — personal + Team — therefore shared one baseline. A drop on the Team seat looked like a confirmed surprise reset of the personal seat, and a missing core window on one seat was flagged unavailable on the other.

Directory snapshot.account_id is now part of that hash, matching isolation already in place for usage_history, threshold toasts, and post-SBS-1057 predictive pace.

Related issue

Fixes SBS-1079 (incomplete SBS-1057).

Affected areas

• Tray panel
• Settings UI
• Config file / settings persistence
• CLI
• Provider-specific behavior
• Other: capacity-event observer + enforcement tracker scope keys

Validation

Hosted CI is the main frontend and Rust gate (Windows for Rust jobs).

• New tests fail without the account_id field (same hash codex:f9a966f77f51ccff, false SurpriseReset 85%→10%, false unavailable on Weekly) and pass with it
• Local cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml — 620 passed
• Local cargo test --manifest-path rust/Cargo.toml — passed
• Local cargo fmt --all --check — passed
• Local frontend CI steps: node --test worker.test.mjs, version-sync check, pnpm test, pnpm build — passed
• GitHub CI on this PR — all checks green, including Frontend, Rust / shared, Rust / desktop, Rust aggregator, CodeQL
• powershell.exe ... scripts\local-check.ps1 — Windows-only; not run here (covered by hosted Rust jobs)

UI / tray proof

• Not applicable

Notes for reviewers

The new tests are the regression: two Codex seats with the same email, org, and source but different directory account_ids. Without this change they collide.

Ambient seats (account_id empty) still hash with an empty fifth field, so persisted baselines for those seats re-key once after upgrade (first live read is a fresh baseline, same as a new scope). Directory seats that were colliding get distinct keys immediately.

Do not merge.

  

Note

Include directory account_id in observation_scope and enforcement scope

• Adds trimmed, non-empty account_id to the scope hash in capacity_events.rs and to the enforcement identity scope in enforcement.rs
• Prevents directory seats sharing the same provider, source, email, and organization from inheriting each other's capacity-event baselines or expected-window enforcement state
• Whitespace-only or empty account_id values are treated as absent, preserving prior behavior for snapshots without an account ID
• Adds test fixtures and scenarios verifying distinct account IDs produce distinct scopes and that reset confirmations do not cross-contaminate between seats
• Risk: any out-of-tree code relying on scope hashes being stable without account_id will see different hashes for the same snapshot; in-tree readers in capacity_events.rs and enforcement.rs are updated

^{Macroscope summarized f5c57ac.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ceiling	f5c57ac	Commit Preview URL Branch Preview URL	Aug 23 2026, 10:27 PM