Duplicate key_hash demotes the unchanged APIKey and swaps caller identity #9

Problem

The gateway rejects a duplicate key_hash and blames the later entry (filesource/mod.rs#L912-L925). Assemble demotes whichever entry the gateway names (assemble.go#L245), even if that entry didn't change.

Reproduce

admin (older, allowed_models: ["*"]) and viewer (newer, [a]) are both served. admin's Secret is set to viewer's key value.

• admin stays Applied with the hash of viewer's key and * access.
• viewer is Rejected, because its fallback carries the same hash.
• Callers holding viewer's key now authenticate as admin, with its access, limits and attribution. admin's real callers get 401.

With identical creation times, name order decides, so "older" is arbitrary for batch applies. A related display_name case: an unchanged newer resource serving a name loses it to an older resource renamed onto that name (oldest wins in render.All), and callers of that name are routed to the other upstream.

Scores

Scores are out of 10. Higher is worse for likelihood and severity. Higher is better for mitigations, detectability, test coverage and cost vs benefit (10 = cheap fix, high value).

Fix

• Add a key_hash pre-pass in Assemble: on a collision, the entry whose current hash equals its served hash wins, and the changed one falls back (its old hash is unique, since the served file was valid). When neither is served, the oldest wins, matching the gateway.
• Optional: the same served-wins rule for display_name in render.All (a policy change; the README documents oldest-wins).

Tests to add

Swap, same creation second, both new.