feat(oracle): pin follow-up tasks to the owning worker (session→worker affinity)

backend/src/db.rs

@@ -1643,6 +1643,21 @@ pub async fn ensure_indexes(db: &Database) -> Result<(), mongodb::error::Error>
                 .build(),
         )
         .await?;
+    // Session→worker affinity: the FIFO claim filters queued tasks by
+    // `required_worker_label` (null for fresh, the owning account for
+    // follow-ups) before sorting by `created_at`.
+    oracle_tasks
+        .create_index(
+            IndexModel::builder()
+                .keys(doc! {
+                    "pool_id": 1,
+                    "status": 1,
+                    "required_worker_label": 1,
+                    "created_at": 1,
+                })
+                .build(),
+        )
+        .await?;
     oracle_tasks
         .create_index(
             IndexModel::builder()

backend/src/handlers/oracle_tasks.rs

@@ -501,6 +501,7 @@ mod tests {
             pdf_name: Some("a.pdf".to_string()),
             conversation_id: Some("conv_1".to_string()),
             is_followup: false,
+            required_worker_label: None,
             client_ref: None,
             status: OracleTaskStatus::Queued,
             phase: None,

backend/src/models/oracle_session.rs

@@ -32,6 +32,22 @@ pub struct OracleSession {
     /// Browser-side conversation URL pinned by the worker after turn 1.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub chatgpt_url: Option<String>,
+    /// Worker label of the account that created this conversation, stamped
+    /// on the first result. Follow-ups copy it onto their task as
+    /// `required_worker_label` so multi-turn lands back on the owning
+    /// account in a multi-account pool. `None` for legacy/unstamped
+    /// sessions (unpinned, today's behavior).
+    ///
+    /// Affinity keys on the worker *label*, so correctness rests on the
+    /// operational invariant that one stable label maps to one ChatGPT
+    /// account. Two tabs of the same account under different labels are
+    /// treated as different accounts (over-pinning — harmless beyond lost
+    /// load-balancing); two different accounts sharing a label would
+    /// reintroduce the misroute this pinning prevents. Worker label
+    /// assignment lives in the CDP/userscript clients, which already mint a
+    /// stable per-tab label (`?nyx=N` → `tab_N`).
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub owner_worker_label: Option<String>,
     pub turn_count: u64,
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub last_task_id: Option<String>,
@@ -62,6 +78,7 @@ mod tests {
             api_key_id: Some(uuid::Uuid::new_v4().to_string()),
             tag: Some("bedc-deep".to_string()),
             chatgpt_url: Some("https://chatgpt.com/c/abc".to_string()),
+            owner_worker_label: Some("tab_1".to_string()),
             turn_count: 3,
             last_task_id: Some("task-3".to_string()),
             closed_at: None,
@@ -90,6 +107,7 @@ mod tests {
             api_key_id: None,
             tag: None,
             chatgpt_url: None,
+            owner_worker_label: None,
             turn_count: 0,
             last_task_id: None,
             closed_at: Some(Utc::now()),
@@ -111,6 +129,7 @@ mod tests {
             api_key_id: None,
             tag: None,
             chatgpt_url: None,
+            owner_worker_label: None,
             turn_count: 0,
             last_task_id: None,
             closed_at: None,

backend/src/models/oracle_task.rs

@@ -84,6 +84,12 @@ pub struct OracleTask {
     /// True when this task continues an existing conversation.
     #[serde(default)]
     pub is_followup: bool,
+    /// When set, only the worker with this label may claim the task.
+    /// Copied from the owning session for follow-ups so multi-turn lands
+    /// back on the account that created the conversation in a
+    /// multi-account pool. `None` = fresh task, claimable by any worker.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub required_worker_label: Option<String>,
     /// Optional submitter-scoped idempotency key.
     #[serde(default, skip_serializing_if = "Option::is_none")]
     pub client_ref: Option<String>,
@@ -152,6 +158,7 @@ mod tests {
             pdf_name: None,
             conversation_id: None,
             is_followup: false,
+            required_worker_label: None,
             client_ref: None,
             status: OracleTaskStatus::Queued,
             phase: None,