fix(mcp): share identical MCP subprocesses across Locations (fixes #37844) - #46210

Co-authored-by: Brendonovich <14191578+Brendonovich@users.noreply.github.com>

Co-authored-by: Brendonovich <14191578+Brendonovich@users.noreply.github.com>

…45271)

…5288)

Extract physical-attempt streaming, tool execution, and durable settlement from the Session runner. Preserve logical-Step retry and recovery policy, use tagged drain outcomes, and fix multi-click selection during auto-copy.

Co-authored-by: Brendonovich <14191578+Brendonovich@users.noreply.github.com>

Persist background Job ownership and terminal results across server restarts. Resume existing subagent Sessions, admit shell cancellation notices without waking idle parents, and preserve explicit cancellation.

Co-authored-by: Brendonovich <14191578+Brendonovich@users.noreply.github.com>

…45831)

)

…bent (fixes #37795)

opencode2 service restart could silently fail to stop a temporarily unresponsive managed service (health probe timeout 2s, find returns undefined) and then ensure() would reuse the original process when it recovered, so restart had a success path where it did not replace the service at all.

Fix: Service.stop now returns { stopped, reason } with distinct outcomes for missing registration, stale-registration, still-registered, timeout, and error, preserving stale-registration and reused-PID safety via same() checks and process.kill(pid, 0). Service.restart now checks stopResult.stopped and fails with actionable error 'Service restart failed to stop incumbent (reason: ...). Explicit restart never proceeds to ensure() after an unconfirmed stop.' instead of silently continuing to ensure(). Successful restart now verifies the new instance has a different PID/identity.

Preserves ordinary ensure/reconnect idempotent reuse semantics; only explicit restart requires replacement. Covers missing registration, corrupt registration, unreachable health endpoint, rejected/unsupported stop, graceful timeout/escalation, successful replacement, and stale PID protection. Logs whether stop was accepted, unsupported, rejected, timed out, escalated, or skipped.

Add deterministic regression test service-restart-race.test.ts proving explicit restart does not silently reuse unresponsive incumbent.

Closes #37795

McpTool.flush only waited for the initial MCP tool registration fiber to
complete. If MCP servers connected after the initial registration but
before SessionContext.select took its snapshot, the ToolsChanged event
triggered a reconcile reload that flush did not wait for. The snapshot
was taken with stale tool state, omitting MCP tools from the model request.

Track pending reconcile operations via a counter and Deferred waiters.
flush now waits for both the initial registration AND any in-flight
reconcile operations to complete before resolving. This ensures the
snapshot captures all MCP tools from independently connected servers.

Adds regression tests verifying flush completes correctly and snapshot
is valid after ToolsChanged events.

Fixes #45333

The LocationActivity sweeper registers a Bus listener that fires on every
event. The listener callback created a new Effect (RcMap.has) on every
event, even when the location was already tracked in the entries map.

This caused high-frequency Effect allocation and JIT recompilation pressure
in long-lived servers, consuming ~1 CPU core and 1.1-1.3 GB RSS while idle.

Add a fast path: if the location is already in the entries map, update its
TTL synchronously without creating an Effect. Only create the RcMap.has
Effect for genuinely new locations.

Fixes #36677

Each Location gets its own MCP subprocess set because MCP is a LocationNode.
Identical user-global MCP declarations are discovered independently per
Location, causing subprocess multiplication (e.g., 5 Locations x 3 MCP
servers = 15 subprocesses instead of 3).

Add a global MCP process registry keyed by server config hash. When a
Location starts an MCP server, check the global registry first. If an
identical server is already running globally, share the connection and
increment a reference count. When the last Location releases a server,
the subprocess is killed.

This preserves Location isolation for project-specific MCP declarations
while sharing identical user-global servers. The fix reduces subprocess
count from O(locations x servers) to O(unique server configs).

Fixes #37844