Include directory account_id in observation_scope (SBS-1079)

[tsouth89]

Summary

observation_scope (shared by capacity-event observation and enforcement tracking) hashed only provider|source|email|org. Codex directory seats that share a login email — personal + Team — therefore shared one baseline. A drop on the Team seat looked like a confirmed surprise reset of the personal seat, and a missing core window on one seat was flagged unavailable on the other.

Directory snapshot.account_id is now part of that hash, matching isolation already in place for usage_history, threshold toasts, and post-SBS-1057 predictive pace.

Related issue

Fixes SBS-1079 (incomplete SBS-1057).

Affected areas

• Tray panel
• Settings UI
• Config file / settings persistence
• CLI
• Provider-specific behavior
• Other: capacity-event observer + enforcement tracker scope keys

Validation

Hosted CI is the main frontend and Rust gate (Windows for Rust jobs).

• New tests fail without the account_id field (same hash codex:f9a966f77f51ccff, false SurpriseReset 85%→10%, false unavailable on Weekly) and pass with it
• Local cargo test --manifest-path apps/desktop-tauri/src-tauri/Cargo.toml — 620 passed
• Local cargo test --manifest-path rust/Cargo.toml — passed
• Local cargo fmt --all --check — passed
• Local frontend CI steps: node --test worker.test.mjs, version-sync check, pnpm test, pnpm build — passed
• GitHub CI on this PR — all checks green, including Frontend, Rust / shared, Rust / desktop, Rust aggregator, CodeQL
• powershell.exe ... scripts\local-check.ps1 — Windows-only; not run here (covered by hosted Rust jobs)

UI / tray proof

• Not applicable

Notes for reviewers

The new tests are the regression: two Codex seats with the same email, org, and source but different directory account_ids. Without this change they collide.

Ambient seats (account_id empty) still hash with an empty fifth field, so persisted baselines for those seats re-key once after upgrade (first live read is a fresh baseline, same as a new scope). Directory seats that were colliding get distinct keys immediately.

Do not merge.

  

Note

Include directory account_id in observation_scope scoping key

• Appends account_id as a fifth field to the raw string used for hashing in observation_scope, changing the format from provider_id|source_label|email|organization to provider_id|source_label|email|organization|account_id.
• Prevents capacity events from cross-confirming resets and enforcement tracking from false 'unavailable' flags across directory seats sharing an email and organization.
• Updates module documentation in enforcement.rs to include account_id in the tracking scope.
• Risk: The returned scope string changes for all inputs due to the added fifth field, even when account_id is empty. Check observation_scope in capacity_events.rs.

^{Macroscope summarized f5c57ac.}

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[cloudflare-workers-and-pages]

Deploying with    Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status	Name	Latest Commit	Preview URL	Updated (UTC)
✅ Deployment successful! View logs	ceiling	f5c57ac	Commit Preview URL Branch Preview URL	Aug 23 2026, 10:27 PM