feat(be): track the default account on first use at an origin

[sea-snake]

Design: #4222. Overview: #4230.

Signing in with an identity's default account at an origin it has never used records nothing — no timestamp, no reference list, no application list. That is the common case, so the canister only knows about accounts a user has explicitly named. Nothing is ever removed either, so applications would accumulate for the life of the canister.

This PR makes first use of the default account a stored fact, and bounds what that costs.

Tracking is one deleted guard

The base PR refuses to store a reference list whose only content is the derived default: absence already says an identity has its default at an origin, so a list repeating that stores nothing. Recording use is what changes that — a timestamp has nowhere else to live.

So tracking is the removal of that refusal from write_account_state, and recording a use is the same read_account / set last_used / write_account every other write goes through. A tracked default is an existing shape, AccountReference { account_number: None, last_used: Some(t) }, so nothing new is stored and a named account still cannot be created from nothing. A default that was given away is not recreated: a tombstone stays a tombstone.

Why tracking, eviction and removal are one PR

They cannot be deployed separately, and this was measured rather than assumed: with tracking alone, one anchor signing in at 2,000 origins creates 2,000 reference lists and 2,000 application lists with no cap and no reclamation. Tracking mints an application list on an operation with no per-anchor cap; eviction is what bounds that and the only thing that makes a reference count fall; removal is dead code without eviction, since a count that never falls never reaches zero. A prefix of the three grows stable memory without bound on an attacker-drivable path.

Eviction

A cap of 500 lists holding nothing but a tracked default, screened by the cheap upper bound stored_account_references - stored_accounts with the scan as the authority. Sign-in evicts rather than failing, in bounded batches — and where the screen fires but the scan finds no candidate, which an identity holding 500 lists that each pair a default with a named account can do, it proceeds having evicted nothing.

Eviction is part of the write. Victims are chosen in validate, against the state the write is about to leave behind — the counters plus this call's deltas, with every origin the write touches excluded — and the removals go in the same batch. It used to hang off a second call made once the first had returned, which made a write that pushed an identity over the cap two atomic units: on the IC an Err from the second commits the first, so a list could go while its sessions stayed.

It takes the whole list and its config list, never leaves an empty list behind, and spares a default while a named account shares its list. The list the caller just wrote is excluded, since every message in a round reads the same time() and would otherwise tie. Non-destructive: it drops a timestamp, and the account returns at the same principal on next use.

Removal

The predicate is the existing StorableApplication.stored_account_references, an accurate live count today because every insert is counted and nothing has ever been removed, so it only needed decrementing — which #4232 made a property of one function. No new field, no migration. Reaching zero removes the application list, and the origin-index entry when it still points at that number.

A removal reads the stored list rather than the normalising one: an absent list must not look prunable, or its counters would be decremented for a list that never existed.

Tests

default_account_tracking_tests (8), tracked_default_eviction_tests (14), application_removal_tests (9). PocketIC drives 500 real sign-ins and asserts an evicted origin returns at the same user_key.

[zeropath-ai]

✅ No security or compliance issues detected. Reviewed everything up to 06d1abe.

Security Overview

• 🔎 Scanned files: 8 changed file(s)
• 🔗 Scan Link: https://zeropath.com/app/repositories/6d3e3b61-710b-4b2b-9c0b-43458b6314b6?scanId=19ad1b2a-9335-4aa1-ac6c-a0c196400f73&codeScanTypes=PrScan&tab=issues

Detected Code Changes

Change Type	Relevant files
Enhancement	► src/internet_identity/src/storage.rs initiate eviction logic for tracked defaults; introduce MAX_EVICTABLE_DEFAULT_ACCOUNTS, watermark, and per-call eviction controls add evictable_after method, and integrate eviction during account reference write processing ► src/internet_identity/src/storage/storable/application.rs extend StorableApplication with stored_tombstones field and accompanying tests for tombstone behavior ► src/internet_identity/src/storage/storable/account_reference.rs add Debug derive to StorableAccountReference ► src/internet_identity/src/storage/storable/account_reference_list.rs add Debug derive to StorableAccountReferenceList ► src/internet_identity/src/storage/tests.rs add test scaffolding for remove_at and held_references helpers ► src/internet_identity/src/storage/account/tests.rs set stored_tombstones default in test fixture
Bug Fix	► None indicated
Configuration changes	► None indicated
Refactor	► src/internet_identity/src/storage.rs adjust return type of account_reference_list_write flow to (Vec, Option) ► src/internet_identity/src/storage/storable/application.rs add stored_tombstones field with CBOR annotation and default ► src/internet_identity/src/storage/storable/account_reference.rs add Debug derive for better test diagnostics
Other	► src/internet_identity/src/account_management.rs update comments to reflect new eviction and default handling semantics

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.