fix(proxy): retire stale HTTP bridge pending sessions

[DZsolt01]

Summary

Fixes HTTP bridge sessions that can get stuck with stale pending work after an upstream websocket closes before response.completed. Failed precreated replay now terminally fails pending requests, releases the response-create gate, retires the stale bridge session, and removes local/durable ownership so later same-session requests can recover on a fresh bridge instead of looping on proxy_overloaded.

Type of change

• fix: — bug fix (no behavior change beyond the bug)
• feat: — new user-facing feature or capability
• refactor: — internal refactor (no behavior change, no API change)
• docs: — documentation only
• chore: / ci: / build: — tooling, CI, packaging
• Breaking change (also append ! after the type, e.g. feat!: or include BREAKING CHANGE: footer)

Linked issue: Not linked

OpenSpec

• This PR includes / updates an OpenSpec change
• Not applicable — bug fix that matches the existing spec
• Not applicable — docs / CI / chore only
• This PR touches a codex-faithful path (image pipeline, request/response shape, SSE framing, OAuth flow) and preserves upstream-equivalent behavior

Change directory: openspec/changes/bound-http-bridge-startup-waits/

Changes

• Retire stale HTTP bridge sessions when precreated replay fails after upstream close or timeout.
• Clear pending request state, release response_create_gate, release durable bridge ownership, and close the stale upstream websocket.
• Add response-create gate timeout diagnostics for bridge key hash, pending/queued counts, gate availability, pending request ids, and ages.
• Add regression coverage for failed replay, stale cleanup, request-log failure during terminal cleanup, and timeout diagnostics.

Test plan

.\.venv\Scripts\python.exe -m pytest tests\unit\test_proxy_utils.py tests\unit\test_http_bridge_cancel_drain.py tests\unit\test_proxy_http_bridge.py -q
# 502 passed

.\.venv\Scripts\python.exe -m ruff check app\modules\proxy\service.py tests\unit\test_proxy_http_bridge.py
# All checks passed!

Linked issue:

Fixes #857

Screenshots / output (optional)

Local codex exec review --uncommitted --full-auto --ephemeral completed and reported no actionable findings.

Checklist

• Title is in Conventional Commits format (<type>(<scope>)?: <subject>).
• Linked the related issue / discussion above.
• Added or updated tests covering the change.
• Ran uv run pre-commit run local-ci --hook-stage manual --all-files or the relevant make <target> subset locally.
• If touching specs: openspec validate --specs passes and /opsx:verify is clean.
• CHANGELOG is not edited by hand (release-please handles it).

[Soju06]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Hooray!

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Soju06]

Blocking race found in the stale-session retirement path.

_submit_http_bridge_request() only checks session.closed before it queues/waits. A concurrent request can already be waiting on the same response_create_gate when the reader handles an upstream close/timeout. The reader then fails the old pending request and releases the gate (app/modules/proxy/service.py:6930-6978), and only then retires/unregisters/closes the session via _retire_stale_pending_http_bridge_session() (app/modules/proxy/service.py:6864-6899). There is no post-gate/post-lock check before the waiter appends and sends (app/modules/proxy/service.py:6567-6603).

I reproduced this locally against the PR head: start a second _submit_http_bridge_request() while the old request owns the gate, then have _relay_http_bridge_upstream_messages() process a close with failed precreated replay. Result: the second submit still calls send_text and leaves pending=['new'] on session.closed=True with the session no longer registered in _http_bridge_sessions (send_text_calls=1, registered=False, new_gate_acquired=True). This can orphan a new same-session request on a closed/unregistered bridge and reintroduce leaked gate/admission/pending state.

Please make retirement/admission mutually exclusive: mark the session closing/retiring before releasing the old request gate, and/or re-check session.closed plus current registry ownership after acquiring the gate and before appending/sending. Add a regression test for the concurrent waiter case.

[DZsolt01]

Addressed the stale HTTP bridge admission/retirement race follow-ups.

• Require bridged submit/prewarm paths to still own the registered session before reconnecting or sending.
• Serialize post-admission validation, enqueue, and upstream send with per-session lifecycle locking, while keeping
  slow I/O off the global bridge registry lock.
• Retire reader-crashed bridge sessions from local reuse, close upstream resources, and make duplicate retirement
  cleanup idempotent.
• Fixed prewarm cleanup so it does not decrement visible request queue counts.

[Komzpa]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 6e919204f3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Komzpa]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: b525a31522

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Komzpa]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4594934488

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Komzpa]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. Bravo.

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".