fix: record the validated address on the job row, not the one handed in

backend/windmill-common/src/users.rs

@@ -152,9 +152,9 @@ pub async fn permissioned_as_exists(
 
 /// Drop a cached address so a transactional email change is visible immediately.
 ///
-/// The address is derived at dispatch and feeds the instance-superadmin check and
-/// `email_to_igroup`, so serving a stale one would run jobs with the wrong authorization
-/// for up to the cache TTL.
+/// Not the thing that keeps authorization correct — `fetch_authed_from_permissioned_as`
+/// re-resolves the address before granting anything. This keeps the cache from serving an
+/// address that is merely wrong for the TTL, on reads and on what is shown.
 pub fn invalidate_email_cache(workspace_id: &str, username: &str) {
     EMAIL_CACHE.remove(&(workspace_id.to_string(), username.to_string()));
 }

backend/windmill-queue/src/jobs.rs

@@ -6749,7 +6749,11 @@ async fn push_inner<'c, 'd>(
         language as Option<ScriptLang>,
         same_worker,
         pre_run_error.map(|e| e.to_string()),
-        email,
+        // `job_authed`'s, not the caller's: that one came through
+        // `fetch_authed_from_permissioned_as`, which re-resolves the address from the principal's
+        // live binding. The same statement writes it to `job_perms.email`, and the two columns
+        // naming different accounts is the state this is here to prevent.
+        job_authed.email,
         visible_to_owner,
         flow_innermost_root_job,
         guarded_concurrent_limit,