Own prepared runtime generations

[lynnswap]

Purpose

Prevent stale runtime preparation from publishing after stop, restart, or account transition while preserving the current MCP listener across same-account AppServer replacement.

Changes

• Add Store-owned monotonic runtime generations and inert prepared runtime handles.
• Capture retiring runtime and MCP resources in one state-owned acquisition context before asynchronous work begins.
• Split MCP prepare and activate with exact-generation validation and deterministic stale cleanup.
• Integrate SettingsService cutover begin, commit, cancel, and failure abort without losing deferred writes.
• Carry typed teardown intent through runtime failure and explicit-stop supersession.
• Close Live and Direct request admission before teardown and join auth notification and initial rate-limit work.
• Preserve same-account MCP listener generation and URL while replacing AppServer state.

Testing

• Store lifecycle tests (16 tests)
• Host tests (48 tests)
• swift test --build-system swiftbuild --no-parallel
• Compatibility consumer, API, and MCP golden gates
• ReviewMonitor xcodebuild test
• Two exact-diff reviews, including Codex review with 0 findings

Screenshots

Not applicable.

[chatgpt-codex-connector]

You have reached your Codex usage limits for security reviews. Please try again later.

[lynnswap]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: 3d4bb8d370

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".