fix(web): prevent silent opening mutation repeats

[ScriptedAlchemy]

Summary

• Separate bounded mutation execution authority (in-flight, succeeded, failed-unknown) from the 64-entry opening-result cache.
• Keep in-flight calls authoritative under result-cache pressure and never automatically retry succeeded-without-result or failed/unknown mutations.
• Show a persistent host warning and error result directing the user to run the tool explicitly from the App.
• Keep readOnlyHint: true opening tools live on every page load and document the policy in English and Chinese.

Chosen model

Bounded execution tombstones separate from cached results. This preserves the existing automatic opening experience for the first call while removing silent repeat authority; rejecting every automatic mutation opening would be a materially broader behavior break. The execution ledger is capped at 256 and fails closed when full, while results remain independently capped at 64.

Tests

• TDD red: 3 failures reproduced completed-result eviction, in-flight eviction pressure, and failed-after-side-effect retry.
• pnpm build
• pnpm typecheck
• pnpm lint
• pnpm test:unit — 4,148 passed, 6 skipped
• focused web-host/web-launch/MCP-session suite — 73 passed
• pnpm docs:site:build — locale parity and 0 broken links

Deslop

GPT-5.6 Sol, 1 edit — promoted the fail-closed warning from result-only text to an explicit host-visible status so an interactive App cannot hide the safety state.

Self-review

Reviewer: claude-fable-5-1-thinking-high (change-risk-reviewer) over 90b411b0d vs origin/main.

Findings and dispositions:

1. Medium — leased retired sessions could leak execution records into the 256-entry cap. Fixed in 0a26c5979: the route-owned close watcher now remains subscribed until actual session close, and the session test double exercises close notifications. A 257-retirement regression test proves records are reclaimed after the final page lease releases.
2. Low — the execution-cap branch lacked coverage. Fixed: a 257th distinct mutation key is suppressed with the host-visible explicit-run notice and no tool call.
3. Low — #unavailableOpeningCall returned the narrower base type. Fixed: it now returns WebOpeningCall directly.
4. Low residual — a close race can leave at most one failed tombstone for a request already past session lookup. Dismissed: it remains fail-closed, requires a narrow close/request race, and cannot authorize a repeat; the bounded ledger limits impact.

Second review at 0a26c5979: no merge-blocking risks. One low stale-session replacement race was fixed in 8a44043d5 by checking the resolved session id and current map promise before deleting; its regression test proves the replacement remains registered for later retirement. One low dead-session close race was dismissed: it can consume at most one bounded fail-closed slot per narrow rebuild/request race and cannot authorize a repeat.

Final review at 8a44043d5: no concrete merge risks found. The async close guard cannot skip a closed current session or delete a replacement and is safe with epoch adoption and route shutdown. Two low residuals were dismissed: a close-time microtask window can produce one fail-closed 502 without reaching mutation execution, and direct external-close guard coverage is optional because the replacement and 257-retirement tests exercise both identity and cleanup invariants.

Post-main-merge review at 37e6e6e78: no concrete merge risks; the merged main delta is disjoint and all authority, lifecycle, warning, docs, and changeset invariants remain intact. The previously dismissed one-request fail-closed 502 microtask window is unchanged.

Auto-merge remains unarmed until latest-head CI and threads are green.

[changeset-bot]

🦋 Changeset detected

Latest commit: 37e6e6e

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 1 package

Name	Type
agent-bundle	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.
To continue using code reviews, add credits to your account and enable them for code reviews in your settings.

[pkg-pr-new]

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle@646

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/create-agent-bundle@646

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/rsc-markdown-stream@646

npm i https://pkg.pr.new/ScriptedAlchemy/agent-bundle/@agent-bundle/runtime@646

commit: 37e6e6e