Preserve MCP startup state under backpressure

[ipo]

Outcome

Restore both halves of one correctness contract: app-server startup status delivery remains lossless under backpressure, and TUI receiver lag does not falsely mark MCP startup completed or cancelled.

Governing evidence

Closed issue #78 and commits 7b4a44da77 and a88dd32bda.

The issue and this evidence define required behavior. Port functional intent onto the current upstream architecture; patch identity is irrelevant.

Non-goals

Do not redesign MCP startup, add unbounded queues, or change ordinary terminal status semantics.

Acceptance criteria and verification

Concurrency/integration tests cover saturated channels, lagged receivers, late subscription/reconnect, eventual terminal delivery, bounded state, and ordinary startup regression behavior. Run the smallest focused just test -p <crate> checks that cover the changed crates under the repository reduced-priority wrapper. Regenerate schemas or snapshots only when this ticket changes them. For a large Rust change run scoped just fix -p <crate>, then just fmt; do not rerun tests after fix/format. Remove disposable build artifacts afterward.

Likely areas

MCP connection manager/startup state, app-server delivery, TUI receiver handling, and focused concurrency tests.

Dependencies

Fully blocked by #81.

Do not begin ticket-owned mutation until every dependency is integrated; their landed contracts are authoritative.

Blocks #104.

Delivery

The accepted result must integrate as exactly one issue-linked commit with subject fix(mcp): preserve startup state under backpressure. Tests, snapshots, generated files, and fixes belong in that commit; adaptation or test-only follow-up commits are not permitted.

Agent routing

agent_level: 5

Agent signature

gpt-5.6-sol@high:01a07441-98af-75c1-9950-8af46deb76de

[ipo]

Implementation started in ticket/103-mcp-backpressure from 1b41e227cd.

[ipo]

IMPLEMENTATION_READY

Commit: c6b1f402923e626f863f1a3540d0af9311760f7f
Branch: ticket/103-mcp-backpressure

Implemented:

• Makes in-process McpServerStatusUpdated delivery lossless and ordered under bounded-channel backpressure.
• Removes synthetic MCP startup settlement from generic TUI lag handling; startup now settles only from real terminal notifications.
• Covers capacity-1 saturation/eventual terminal delivery, lag retention, bounded late/reconnect replay, ordinary terminal behavior, and the visible startup snapshot.

Checks:

• PASS: just test -p codex-app-server --retries 0 saturated_in_process_queue_eventually_delivers_mcp_terminal_status (1 passed).
• PASS: just test -p codex-tui --retries 0 mcp_startup (35 passed).
• PASS: just fix -p codex-app-server.
• PASS: just fix -p codex-tui.
• PASS: just fmt.
• PASS: final git diff --check; exactly one commit above the specified base; disposable target removed.

Caveats:

• The base tree has a stale unrelated Bedrock catalog test that calls models_manager_without_cache with one argument instead of the current two. It blocks compiling the unmodified TUI test binary. For focused validation only, I temporarily supplied the missing overlay argument, ran the 35 MCP tests, then reverted that workaround. No catalog change is included.
• An optional broad app-server run became non-diagnostic under constrained parallel load: 349 tests passed, 19 initialization-deadline failures and 1 timeout occurred before I interrupted it at 369/1433. The ticket-owned saturation test passed both independently and inside that run.

get_agent_signature: gpt-5.6-sol@high:01a0755f-72db-78e0-832f-8c4d5cb872a5

[ipo]

ACCEPT

Audited candidate c6b1f402923e626f863f1a3540d0af9311760f7f against base 1b41e227cdc405448014ab0c3cc9d9e978c0d23d, issue #103, issue #78, and governing commits 7b4a44da77 / a88dd32bda.

• The candidate is exactly one required-subject commit above the assigned base, matches the pushed ticket ref, and has a clean diff/worktree.
• Current architecture check: MCP status notifications now use awaited delivery at the remaining bounded in-process event queue; the preceding outbound queues are already awaited/FIFO, while both local and remote app-server facades drain into ordered unbounded consumer queues. No queue was enlarged or newly made unbounded by this ticket.
• just test -p codex-app-server --retries 0 in_process: 7/7 passed, including capacity-1 saturation with ordered Starting -> Failed eventual terminal delivery.
• just test -p codex-tui --retries 0 mcp_startup: the untouched candidate reaches an inherited, unrelated base-tree E0061 in bedrock_catalog_tests.rs because models_manager_without_cache is called with one argument. In a disposable detached checkout at the exact candidate, adding only the missing /*model_catalog_overlay*/ None test argument yielded 35/35 MCP-focused tests passing. This covered lag retention and the reviewed visible startup snapshot, capacity-1 bounded late/reconnect replay, real Failed/Cancelled warnings, terminal settlement, and ordinary startup/next-round regressions.
• Static inspection confirms Lagged is log/agents-refresh only, all synthetic lag settlement state is removed, MCP terminal replay survives session refresh, and replay storage remains capacity-bounded.
• No pending snapshots were generated. Disposable source/build artifacts were removed; the ticket branch was not edited.

[ipo]

Integrated as 24058e4bea02145b3595954bc27c594e0b549bb5 on patch-stack/rust-v0.153.4.

Verification: independent audit accepted; app-server saturation test passed 1/1; MCP-focused TUI tests passed 35/35; no pending snapshots; integration was an exact one-commit patch-equivalent replay onto the then-current target tip.