Tiles manual slots and "never show" are saved by Zoom's per-session user ID, so they go stale or hit the wrong person in the next meeting #479

Owner, live, 2026-09-11: "CoreVideo Tiles is performing oddly sources that should be eligible are showing as unavailable. I do see video flashing too."

Evidence. The saved DynamicGallery in production-output-preferences.json (mode eligible), compared with the live roster of meeting 97682593786:

• Manual slot 3 = zoom:33556480: NOT IN MEETING, so the panel shows "Unavailable source".
• Manual slot 2 = JohnZoomISO-1: in the meeting, camera off, so not eligible.
• Never-show = zoom:67109888 and zoom:16798720: NOT IN MEETING, both stale.
• Never-show = Jason Bache (camera on): a live guest silently kept off the wall.
• Never-show = OH Metres, slate, PGM, CoreVideo Producer: utility feeds, probably intentional.

Cause. Manual slots and exclusions store zoom:<userId> (StudioViewModel.Tiles.cs AssignTilesSlot / SetTilesExclusion). Zoom user IDs are per meeting session: they are reassigned on every rejoin, and the same integer can be a different person in another meeting (16778240+ are allocated sequentially). A saved Tiles setup therefore:

• points at people who are gone ("Unavailable source"), and
• can exclude or seat the wrong person in a later meeting.

The same concern probably applies to the Show Input roster, which persists participant IDs (slot-write … by=roster-load); audit it with this.

Fix direction:

• Key persisted Tiles choices on a stable identity: Zoom's persistent participant UUID or customer key if the SDK exposes one to the host, otherwise display name.
• Resolve to the session ID at use time.
• Show stale entries plainly ("Jason Bache: not in this meeting"), with a one-click "clear stale entries".
• Never silently apply an exclusion to whoever inherited an ID.

Related, the flashing part of the report: the subscription churn ledger counted 6 re-subscribes in 20 s during the same session (totalChurn 53→59), and one guest reached generation 14. That is the documented active-speaker resolution flip (720p↔1080p tears the renderer down), plus cap evictions. Tracked with #478.