fix(routes): reject same-server MCP App resourceUri collisions with AB4829 and sweep orphaned Playground staging files

[ScriptedAlchemy]

Summary

Final-sweep lane B2, items 7 and 8.

7. Route graph — AB4829 for same-server MCP App resourceUri collisions. Two App routes of one generated server declaring the same static config.resourceUri resolved first-wins with no diagnostic (only the AB4812 presence check existed). compileRouteGraph now tracks App routes per generated server by resourceUri and reports AB4829 (error) for every additional claimant, naming both route files and the server; the route stays visible in the IR and validate/inspect fail the way AB4812 does. The same URI on App routes of different servers is not a collision (each generated server registers only its own Apps, per #42 / #418), and servers pinned custom/command/remote are not checked (they ship no Apps).

• docs/diagnostics.md: new AB4829 row (next free code in the AB48xx block; the website diagnostics reference is generated from it).
• docs/entry-conventions.md, website/docs/{en,zh}/guide/authoring/mcp.mdx: the App-route paragraph now names AB4812/AB4829.

8. Native Playground publisher — bounded orphan staging sweep. A publisher that dies before its staging cleanup leaves .<epoch>.stage-<pid>-<nonce> files behind. Entries still hard-linked to their epoch's sidecar are already recovered by the reader (#377/#408); entries that alias nothing (died before link(), lost the EEXIST race, sidecar withdrawn later) were never swept. Each successful #persistSnapshot now runs #sweepAbandonedStaging once over its own catalog directory:

• no recursion; at most 64 pattern-matching entries examined and 16 removed per publish (nativePlaygroundStagingSweepLimits, @internal);
• removes an entry only when it matches this publisher's own naming pattern, belongs to an epoch other than the one being published, its embedded publisher pid has exited (stagingPublisherExited), and lstat reports a regular file with nlink === 1 that does not alias <epoch>.json (#sidecarStillLinked inode check);
• a live winner's linked staging entry, a running publisher's file, guards, directories, symlinks, doubly linked aliases, and foreign look-alike names are kept;
• the sweep is hygiene: any filesystem failure ends it quietly and never changes the publication outcome.

Changeset: .changeset/sweep-resource-uri-collision-stage-sweep.md (agent-bundle patch, mentions AB4829).

Evidence

• packages/agent-bundle/tests/route-graph.test.ts — new test rejects two App routes of one server that declare the same resourceUri with AB4829, but not the same URI across servers: same server → ['AB4829'] with both files and "curator" in the message, sourcePath = second route; three claimants → two AB4829; two servers sharing one URI → no diagnostics; custom server → no diagnostics; validate reports AB4829 and inspect is invalid.
• packages/agent-bundle/tests/native-playground-service.test.ts — three new tests: (a) older-epoch orphan + orphaned guard removed on the next publish, same-epoch orphan left until a later epoch publishes; (b) live winner's hard-linked entry (inode equal to the sidecar, nlink 2), live-pid file, five foreign look-alikes, a directory, a symlink to a file outside the directory, and a link aliasing an outside file are all kept, and the kept older epoch still reads back through the recovery path; (c) 20 orphans → 16 removed on the first publish, the rest on the second; 64 live-pid candidates ahead of an orphan exhaust the examination cap until they are gone.
• Gates in the worktree after pnpm build: pnpm typecheck ✅, pnpm lint ✅ (0/0), pnpm test:projection ✅, pnpm docs:site:build ✅ (language parity ok). pnpm test:unit and pnpm test:route-unit: all tests pass except two 5 s timeouts unrelated to this change under load average ≈ 25 on the shared box (native-claude-contract.test.ts "fails closed when the candidate plugin…" — snapshots the real ~/.claude; route-unit/lifecycle-replay.test.ts — passed on isolated re-run). Both touch neither routes/graph.ts nor the Playground service.

Test plan

• pnpm exec rstest --config rstest.unit.config.ts packages/agent-bundle/tests/route-graph.test.ts (50/50)
• pnpm exec rstest --config rstest.unit.config.ts packages/agent-bundle/tests/native-playground-service.test.ts (42/42)
• pnpm typecheck, pnpm lint, pnpm test:unit, pnpm test:route-unit, pnpm test:projection, pnpm docs:site:build
• CI green

Review status

• chatgpt-codex-connector answered "You have reached your Codex usage limits for code reviews" to both the automatic review and the explicit @codex review request (2026-09-03 16:50Z / 16:51Z). No review threads were opened.
• Last reviewed SHA: none. Unreviewed SHAs: ad29670196e9f154c799eff39406ad87aba1f436, 4891697b41d9b097a7eb0c4c32ca0964b3c2a876 (head).
• Merged on CI green under the sweep-lane quota rule; a follow-up PR will answer any review threads left on this merged PR.

[changeset-bot]

🦋 Changeset detected

Latest commit: 4891697

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[ScriptedAlchemy]

@codex review

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@430

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@430

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@430

commit: 4891697