Function persist_oauth_success 

pub(crate) fn persist_oauth_success(
    mstore: &Arc<Store>,
    identity_store: &Arc<Store>,
    broker: &Arc<Broker>,
    _direct_account: bool,
    account_id: &str,
    _into_bundle_id: Option<&str>,
    provider_id: &str,
    dir: Option<&str>,
    session_id: &str,
    email: Option<&str>,
) -> (String, Option<String>)

Shared by all 4 OAuth-success call sites (pipes drain/post-exit, PTY drain/post-exit) — persists the account and builds the (bundle_id, account_id) pair AuthSessionManager::finish_success expects. bundle_id is always empty now: bundle mode (db_identity_bundles binding) was retired in Phase 4c of SPEC_PRESET_TO_BUNDLE_REFACTOR_2026_07_02.md — confirmed unreachable from the frontend (AuthFlowController hardcodes directAccount: true). _direct_account/_into_bundle_id stay as parameters so the wire request shape and the 4 call sites don’t need touching. dir is the account’s own isolation dir, resolved once at spawn time by compute_and_ensure_*_dir in the auth.start handler.

Guards on account_id being non-empty before persisting: auth.start only populates a real account_id when direct_account is true (via compute_and_ensure_account_dir, which always mints/reuses a real id); when direct_account is false (the wire default, still reachable by any caller other than the one production frontend path), account_id is "". Without this guard an empty id would flow into persist_oauth_direct_account’s identity_upsert, whose ON CONFLICT(id) DO UPDATE would silently overwrite/corrupt any prior row that happened to have id="". Reagent P1.