fix(server): block V2 replacements until session cleanup completes

[shivamhwp]

V2 reports a provider session as stopped after a 30-second cleanup timeout, even when its scope is still closing. Removing the live entry also lets a replacement open before cleanup finishes.

Keep the pending release until cleanup completes. Timeouts return an error and record error status instead of stopped. Close and detach retries wait for the same cleanup. New sessions and new thread attachments covered by pending cleanup stay blocked; a thread already attached to another live session can keep reusing it. Failed cleanup keeps the replacement block until the environment restarts.

Targets the Orchestration V2 branch in #2829, rebased onto 3ed8c4d. The conflict resolution preserves the base's workspace-folder validation alongside the cleanup locks. This does not change shared-session detach policy or solve the separate shared-Codex-process account handoff problem. Related #8580 and #9211 change V1 switching, not this V2 release path.

The live-session reuse review finding is fixed in 87d7bcf. Two new regression cases reproduce the prior rejection and cover pending cleanup, timeout, late success, and permanent cleanup failure. All 76 focused tests across 11 files passed, with one optional fixture-recording test skipped. Server typecheck and targeted lint/formatting passed. The earlier rebased head passed 363 tests across 20 files, including provider adapters, replay, restart recovery, and independent lifecycle probes.

CI repeatedly failed or timed out fetching Ubuntu packages over HTTP, including on fresh-runner retries. A separate commit, b0ccd56, changes the runner's Ubuntu package downloads to HTTPS without changing package sources or test commands. Full CI passed on this head: https://github.com/pingdotgg/t3code/actions/runs/33936834660.

Cursor Bugbot, Macroscope correctness, and Effect Service Conventions pass on b0ccd56. All review threads are resolved. Macroscope requires human approval because of the production lifecycle and credential-handling scope.

Screenshots

Before: no warning while cleanup is still running.

After: the PR shows the cleanup timeout and blocks replacement sessions.

Recovery: the warning clears automatically after cleanup succeeds.

Captured in a real Chromium client connected to an isolated local server and the real Codex provider. Both the V2 base and PR head used a temporary five-second idle timer and a 120-second cleanup delay. The production 30-second cleanup timeout was unchanged.

• Before, V2 base 3ed8c4df: the session was marked stopped after the timeout, with no warning while cleanup was still running.
• After, PR head b0ccd56f: the session stayed in error and the app showed that replacement sessions were blocked until cleanup completed.
• Recovery: cleanup finished, the stored error cleared, and the warning disappeared without dismissal or a page reload.

Temporary test hooks were removed after capture and are not included in this PR. Original PNGs and the captured session-state evidence are retained with the test artifacts.

Full test report.

Implemented and tested by GPT-6 using Codex in T3 Code for shivamhwp.

---

Note

High Risk
Changes core provider session lifecycle, MCP credential revocation timing, and open/close concurrency in Orchestration V2; failed or slow cleanup can block replacements until restart.

Overview
Orchestration V2 no longer treats a hung provider session close as successfully stopped. ProviderSessionManagerV2 keeps a releasing record after removing a session from the live map, runs scope cleanup on a background fiber, and waits up to 30 seconds; on timeout callers get a release error, projections move to error, and cleanup keeps running.

While that release is pending, open fails with ProviderSessionOpenError for the same session id or for threads tied to the releasing session (already-attached live sessions on other ids can still be reused). close/detach join the in-flight cleanup instead of starting parallel teardown; MCP credential revocation is deferred until after scope close, with guards for reservations and live holders.

CI apt steps on Blacksmith runners now rewrite mirror URLs from HTTP to HTTPS before apt-get update. Provider-switching docs describe the new cleanup and blocking rules.

^{Reviewed by Cursor Bugbot for commit b0ccd56. Bugbot is set up for automated code reviews on this repo. Configure here.}

Note

Block V2 provider session replacements until cleanup completes

• Adds a releasing registry in layerWithOptions that retains removed session entries, their thread IDs, and a completion Deferred until cleanup finishes, keyed by provider session and thread.
• Reworks releaseEntry in ProviderSessionManager.ts into an uninterruptible coordinator: it removes the live entry, starts cleanup under thread and provider-session locks, waits up to 30 seconds, records a timeout error if cleanup is still running, and keeps the entry blocked on failure.
• open now rejects replacement sessions and new thread attachments while a related cleanup is pending, but still returns an already-attached live session for the same thread.
• detach requests targeting a session in releasing now wait on the existing cleanup instead of starting a competing release, optionally revoking the thread credential first.
• Adds documentation in provider-switching-and-context.md covering the timeout, blocking rules, and failed-cleanup persistence.
• Risk: cleanup entries that fail remain permanently blocked in the releasing registry; releaseEntry revokes credentials only when no live session or reservation holds the same credential — verify the isProviderSessionReleaseError classifier and credential-revocation guard do not skip a still-attached session.

^{Macroscope summarized b0ccd56.}

[shivamhwp]

Note: GPT-6 on behalf of shivam (@shivamhwp).

The first CI run found failures in unchanged V2-base files: Check reports formatting in seven files, Test Server 1 expects 58 migrations but the base registers 59, and Release Smoke fails on an unused expo-notifications@57.0.15 patch. None of those files are changed by this PR. Keeping those fixes separate from session cleanup.

The review fixes are in d68d735. All 34 focused session-manager and turn-start tests pass locally, along with targeted lint and server typecheck. Waiting for the new CI and review results.

[cursor]

Stale Bugbot comment from a previous run.

[macroscopeapp]

Approvability

Verdict: Not approved

Macroscope's review found this PR not approvable — The production session manager now coordinates asynchronous cleanup, blocks replacements and thread attachments during cleanup, changes persisted session error states, and alters MCP credential revocation timing. These cross-cutting lifecycle and credential-handling changes have substantial runtime impact beyond the accompanying tests, CI adjustment, and documentation.

^{You can add or adjust custom eligibility rules. Learn more.}

[shivamhwp]

Note: GPT-6 on behalf of shivam (@shivamhwp).

Latest head bf93d87 passes Bugbot and Macroscope correctness. All reported review threads are resolved. Locally, 58 focused tests across six session-manager consumer test files pass, as do targeted lint and server typecheck.

CI remains blocked outside this change: seven unchanged files fail formatting, the migration test expects 58 entries instead of the registered 59, and Release Smoke rejects the unused Expo notifications patch. Earlier Test Server 3 logs also show stale replay expectations for the runtime-info prompt suffix. I reproduced the migration failure, the seven formatting failures, and the tool_call_read_only/cursor replay mismatch locally. The relevant adapter, migration, fixture, and release files match the V2 base.

Leaving these base fixes out of the cleanup PR pending maintainer direction. Nothing has been merged.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit bc10499. Configure here.}