Files
turnstone/tests
Patrick Buckley 53f11454ad fix(mcp): review round 3 — cap static catalogs, atomic removal, unify the list_changed protocol twins
- Static resource/prompt catalogs are now size-capped at connect
  discovery AND on every refresh (mirrors the pool twins and the static
  tools path): a misbehaving server's push ran uncapped through the new
  spawned refresh path and could balloon the shared node's merged
  catalogs on every notification.
- remove_server_sync mutates NOTHING outside the per-name lock: the
  up-front config pop meant a removal cancelled while parked (behind
  the push-refresh runners that now share this lock) left a
  half-removed server — config gone, session and published catalogs
  alive, no driver able to reconnect or cleanly re-remove. A timed-out
  removal is now honestly retryable.
- _refresh_all's DISCONNECTED branch busy-skips too (parking inside
  _ensure_static_connected burned the pass's 30s budget on one
  mid-reconnect server), and a busy-skip on either branch ARMS the
  health-tick retry — an operator-requested refresh can no longer be
  silently dropped with output indistinguishable from 'no changes'.
- reconnect_sync drops the session before queueing on the lock (FORCE
  semantics already rebuilt live sessions): parked push runners bail
  at their session gate instead of serializing up to one 30s list call
  per kind ahead of the operator's recovery action. Residual: one
  mid-list holder can still precede the 45s attempt; a timed-out
  reconnect is honest and retryable.
- _refresh_server's supersede check gains the session arm: a spawned
  retry/post-reconnect pass racing an eviction skipped instead of
  manufacturing a false 'not connected' error pill (and a re-arm loop)
  for a self-healing condition.
- The list_changed protocol twins are UNIFIED (Closes #842): the
  admission half (_admit_list_changed) and the runner half
  (_run_list_changed_refresh) each exist once as plain parametrized
  methods — values and small closures, no factory layer (mcp v2 drops
  the factory pattern; the two thin message_handler closures remain
  only as SDK-v1 bindings). The one true asymmetry — coalesce-marker
  ownership on the superseded path — is a documented boolean: pool
  markers are only ever cleared by their runner; static markers are
  cleared by remove_server_sync, so a present marker belongs to the
  re-added generation. Both runners keep their names and signatures;
  the notification suites pass unchanged.
- Cleanups: per-kind staleness rechecks stripped from the static
  refreshers (unreachable under the lock discipline — the MUST-hold-
  lock contract is documented instead); _run_hl (5th run-on-loop copy)
  replaced at 44 call sites; _poll_until centralizes the live-test
  wait loops; docs no longer describe the periodic refresh tier
  removed in eb2a119d.

Refs #839
2026-07-14 11:39:25 -07:00
..