fix: deduplicateAccounts fixpoint loop and identity property tests - #579

Summary

• A new fast-check property suite for the account identity-matching layer found a real bug on its 11th generated pool: deduplicateAccounts was not idempotent — one pass could return a list still containing two records for the same account. This PR fixes the implementation and lands the suite that caught it.

What Changed

The bug (lib/storage.ts): deduplicateAccountsByIdentity made a single pass, and a newest-wins merge in one matching tier can install an account that duplicates an earlier survivor through a different tier. Minimal reproduction (now a deterministic test):

1. {accountId: acc-1, refreshToken: rt-1} (no email) is kept.
2. {email: [email protected], refreshToken: rt-2} (no accountId) is kept.
3. {accountId: acc-1, email: [email protected], refreshToken: rt-1} arrives — the email tier matches record 2 first and replaces that slot.

The result keeps both record 1 and record 3, which are the same account by accountId + refresh token; a second pass would have merged them. The fix: re-run the dedup pass until the length stabilizes. Every merge strictly shrinks the array, so the loop terminates after at most accounts.length passes; the kept entry is still the most-recently-used one, exactly as the function's contract documents.

The suite (test/property/account-identity.property.test.ts, 9 tests):

• normalizeEmailKey: idempotence, case/whitespace insensitivity, undefined on blank input
• findMatchingAccountIndex: the matched account is invariant under pool permutation (pools generated with strictly distinct lastUsed so newest-wins has a unique answer); candidate email respelling never changes the result; any match shares at least one identity facet with the candidate; candidates with all-foreign facets never match; email-only candidates are vetoed when the email maps to multiple accountIds
• deduplicateAccounts: output is a subset of input (object identity — dedup never synthesizes), idempotence, and a deterministic replay of the discovered counterexample

Validation

• npm run typecheck
• npx eslint lib/storage.ts test/property/account-identity.property.test.ts --max-warnings=0
• npm test -- test/property/account-identity.property.test.ts — 9/9
• Targeted suites for every consumer of the matching/dedup path (storage, storage-async, import-export, account-pool, account-port, rotation-integration, refresh-guardian, runtime-auth-facade, codex-manager-login-workspace-512): only the 23 known environment failures in storage.test.ts, name-diffed exactly against docs/audits/evidence/test-baseline-2026-06-10.txt
• Full-suite canary: 60 failures = the 58-name environment baseline + the 2 beta.2 version-drift names that fix: sync plugin manifest and docs portal to v2.3.0-beta.2 #577 fixes on main (this branch is based on main without it); zero failures attributable to this change

Docs and Governance Checklist

• No user-visible command/setting/path surface changed; behavior change is strictly "dedup now actually removes all duplicates", matching the existing doc comment ("Removes duplicate accounts, keeping the most recently used entry")

Risk and Rollback

• Risk level: low-moderate — deduplicateAccounts runs on the storage load path, so the fix can merge account records that previously (incorrectly) survived as duplicates. The kept record is always the most-recently-used of the merged set, which is the documented contract; pools without the multi-tier corner are byte-identical to before (the first pass is unchanged, and a length-stable pass is a pure copy).
• Rollback plan: revert the commit; the property suite's idempotence assertion and the deterministic replay will fail again, flagging the regression.

Additional Notes

• Companion to the property suites in test: property-check the unsupported-model fallback invariants #574/test: property-check write-queue serialization and clamp invariants #575; same conventions (plain fc.assert, explicit vitest imports, small identity alphabets so generated pools actually collide on facets).

https://claude.ai/code/session_01XNtnkLbBiXZxfQQYLMpucB

Generated by Claude Code

note: greptile review for oc-chatgpt-multi-auth. cite files like lib/foo.ts:123. confirm regression tests + windows concurrency/token redaction coverage.

Greptile Summary

fixes deduplicateAccountsByIdentity so it re-runs until the output length stabilises, addressing a real idempotence failure where a newest-wins email-tier merge could leave an earlier survivor still matching a second record through a different tier. the property suite that caught the bug is also landed, including a new deterministic 3-shrinking-pass test that pins the full convergence chain.

• lib/storage.ts: split the inner loop into deduplicateAccountsByIdentityPass (readonly T[]), wrapped by a new deduplicateAccountsByIdentity that loops until next.length === current.length; the length check is a sound fixpoint condition because every merge reduces the count by exactly one, so length-stable ↔ zero merges ↔ content-stable.
• test/property/account-identity.property.test.ts: 9 fast-check/deterministic tests for normalizeEmailKey, findMatchingAccountIndex, and deduplicateAccounts, including explicit replay of the discovered counterexample and a new 3-pass convergence pin.

Confidence Score: 5/5

the change is safe to merge; the fixpoint loop is a pure in-memory operation on small arrays, the termination argument is airtight, and pools without the multi-tier corner case are byte-identical to the previous output.

the fix is narrowly scoped to deduplicateAccountsByIdentity and does not touch storage I/O, token handling, or any concurrent path. the length-stable fixpoint condition is provably correct, the property suite fully exercises the affected code paths, and the deterministic regression pins the exact counterexample.

no files require special attention; both changed files are clean.

Important Files Changed

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A["deduplicateAccounts(accounts: T[])"] --> B["deduplicateAccountsByIdentity(accounts)"]
    B --> C["current = deduplicateAccountsByIdentityPass(accounts)"]
    C --> D{"next = deduplicateAccountsByIdentityPass(current)\nnext.length === current.length?"}
    D -- "yes (fixpoint reached)" --> E["return next"]
    D -- "no (merged ≥1 account)" --> F["current = next"]
    F --> D
    G["deduplicateAccountsByIdentityPass(accounts: readonly T[])"] --> H["for each account"]
    H --> I{"findMatchingAccountIndex\nin deduplicated?"}
    I -- "no" --> J["push account"]
    I -- "yes" --> K["deduplicated[i] = selectNewestAccount(existing, account)"]
    J --> H
    K --> H

_{Reviews (2): Last reviewed commit: "test: pin three-pass dedup convergence c..." | Re-trigger Greptile}