[code-yeongyu]

Fixes #4304
Part of code-yeongyu/oh-my-openagent#10304

Problem

A prompt cache lives on the account that served the session. When every attempt of a turn failed (A rate-limited, then B rate-limited, stalled or failed), the failed attempt on B published B's retry checkpoint as the session's binding, although B had never served the session. The binding is what the next request prefers (preferredAccount) and what the seat-change flag compares against (lineageSeat). So:

• Once A recovered, the next request went to B and wrote the whole conversation to B's cold cache. A, which held the session's cache, was skipped.
• When B was still blocked and the next request went back to A, A read its cache, but the continuity line said fork / account_changed with seatChanged: true (Retry log marks a seat change when returning to the cache-holding account #4304).

Change

• session-turn-attempt.ts: createSessionTurnAttempt takes servedLineage, the session's binding from before the attempt. Once the attempt's process is gone (a failure, a discard, or an abort that closed it), an unanswered attempt on an account other than the one that binding names re-publishes that binding instead of its own retry checkpoint. If Claude Code rejected a fork boundary during the attempt, that boundary is dropped from the binding first, as [Bug]: #1472 still causes repeated full-history replay and stale UUID resume fallback #1958 already does for the attempt's own lineage.
• Unchanged: an attempt on the serving account records its own checkpoint. A process kept after a clean interrupt also keeps its own checkpoint, because it holds the turn and its live entry keeps serving; publishing another lineage there would make a later reattach resume a lineage that is not the live one.
• session-stream.ts: createResidentAttempt reads the binding after restored-binding admission and passes it on.

Account selection does not change. It already prefers the binding's account, and with the binding now kept on the serving account, that account is preferred as soon as it can serve, before any cold account. A real move is still labelled account_changed with seatChanged: true, and the new account keeps the session after the old one recovers.

Test authoring gate:

1. Contract: after a turn whose attempts all went unanswered, the next request goes to the account that last served the session as soon as it is healthy. It sends that account exactly the prompt it was already sent, so it reads that account's cache, and it is logged as a same-seat timeout_retry. A move while that account stays down is still logged as a seat change, and the new account then keeps the session.
2. Regressions that fail it: writing a non-serving account's checkpoint over the serving lineage; preferring or comparing against the last account attempted instead of the last one that served; restoring a lineage with a boundary Claude Code rejected; restoring the served lineage while a kept process still holds the turn.
3. Why existing coverage misses it: the senpi#1432 tests cover a failover whose second account succeeds. No test failed on every account and then checked where the next request went or how it was labelled.
4. Seams: the real Claude Code binary runs against a loopback Messages endpoint that tells accounts apart by their OAuth token and records every request. The managed lanes strip ANTHROPIC_BASE_URL, so the test adds it at the SDK boundary. A fake clock (overrideAuthLaneBoundary({ now })) expires the rate-limit blocks. Claude Code is spawned through spawnClaudeCodeProcess, so cleanup waits for each process to exit before removing its directory. The kept-process case drives the real session pump with a scripted query, because the shipped Claude Code closes the process when a stalled attempt is interrupted (see Evidence).

Evidence

• RED on unmodified main (44eccff) with the new tests: 4 failed, 4 passed.
  • Both accounts recover: the retry goes to B (A:200, A:429, B:429, B:200), a cold write on an account that never served the session.
  • B still limited: the retry on A is logged fork / account_changed, seatChanged: true.
  • B stalled and the turn was aborted: the retry goes to B (B:200).
  • [Bug]: #1472 still causes repeated full-history replay and stale UUID resume fallback #1958 case: the restored binding names account-b.
  • The A-stays-down case and the 3 existing [Bug]: #1472 still causes repeated full-history replay and stale UUID resume fallback #1958 cases pass on main.
• GREEN on this change: the 5 cache-holder cases and the 4 [Bug]: #1472 still causes repeated full-history replay and stale UUID resume fallback #1958 cases pass (9/9).
• Mutations, each applied alone and reverted:
  • Without dropping the rejected boundary from the restored lineage: the [Bug]: #1472 still causes repeated full-history replay and stale UUID resume fallback #1958 case fails (the dead boundary stays as lastAssistantUuid).
  • Without the kept-process check: the kept-process case fails (the binding moves to A's lineage while B's process holds the turn).
  • The shipped Claude Code 2.1.306 does not keep the process of an interrupted stalled attempt: with the kept-process check removed, the stall case still passes. That is why the kept case is pinned with a scripted query.
• Gated push at bf5318ed8f: bun run check exited 0. The 64 test files that drive the resident session path passed under CI=1 (64 files, 404 tests), and the conflict-marker check exited 0.