fix: a fallback whose first identity is being saved is still admitted
Found by the 2.2.0 release PR's CI. A request could skip a fallback account whose identity was being saved for the first time and return the main account's error instead: the request had captured the account's binding before the identity existed, and authorization then found the same row with the identity set (or caught a partly written state/config pair) and refused it as row-ineligible. 2 of 40 runs of the affected test on main, 0 of 40 on v2.1.2; the change in cause-keyed refresh joining (#414) stopped serve requests from waiting on that publication.
- A serve request that finds its row mid-write (same credential epoch) waits once for that writer with the existing torn-row barrier and budget, then rereads; still torn returns the existing retryable account error.
- If the row now carries the first identity and the store, row and credential epoch still match, the request adopts that identity. Admission still requires its normal permission and exact proof; custody, quota, refresh-error and rejected-token exclusions are unchanged.
Red-first Core regressions for both windows; mutation rows serve-adopts-concurrent-first-identity and serve-joins-concurrent-first-identity-write CAUGHT. After the fix: 0 status-400 misses in 40 + 40 Linux runs. No changelog line: the bug isn't in any release.
Summary by cubic
Fixes a race that let a serve request skip a fallback account whose first identity was being saved, returning the main provider's 400 instead.
- In-flight first-identity writes on the same credential epoch are now joined via the existing torn-row barrier and budget before the row is judged ineligible.
- A request adopting a newly published first identity only proceeds if store, row, and credential epoch still match; admission permissions, proof checks, and all existing exclusions (custody, quota, refresh-error, rejected-token) are unchanged.
- Added two mutation controls with red-first regressions, plus tests covering adoption, torn-write join, transient-error branding, and preserved admission exclusions.
- Not in a release, so no changelog line.