P2: LRU session eviction at capacity needs a minimum idle age so one client cannot evict others' live sessions (follow-up to #461)

Problem

#461 (PR #463, merged as e46548f) makes register() evict the least-recently-active session with no in-flight request when the store is at maxSessions, regardless of that session's idle age. That removes the 503 storm, but it also means any client that opens sessions quickly can evict other clients' sessions that were active seconds ago: the evicted client's next request fails with an unknown-session error and must re-initialize. Before #461, sessions younger than idleTimeoutMs were never evicted by another registration.

This is a cross-client eviction / availability concern, not a confidentiality one (no data crosses sessions), but on a shared Dev MCP with several concurrent ChatGPT/Codex conversations it lets one noisy caller churn everyone else.

Expected

LRU eviction at capacity should only consider sessions that have been idle for at least a minimum age, e.g. DEVSPACE_MCP_SESSION_LRU_MIN_IDLE_MS (default 60 000 ms, must be ≤ idleTimeoutMs). Sessions younger than that stay protected and the registration is rejected with 503 as before.
canAcceptRegistration() / admitRegistration() must apply the same rule so the pre-check agrees with register().
Optional: when the registering client can be attributed (same ip+userAgent or OAuth subject as an existing session), prefer evicting that client's own idle sessions first.
mcp_session_capacity_rejected should state whether rejection was due to "all sessions in flight" or "no session idle ≥ min age".

Acceptance

Unit test: 256 sessions idle for 10 s + 1 registration → rejected (503), lruEvictions unchanged.
Unit test: 256 sessions idle for 90 s + 1 registration → LRU evicted, no rejection.
Config test: DEVSPACE_MCP_SESSION_LRU_MIN_IDLE_MS parsed, rejects 0/negative/greater than idle timeout.
Dev M5 healthz after deploy shows the new counters; no regression of the P1: MCP session store rejects new sessions with 503 while idle sessions with no in-flight requests remain evictable #461 scenario (abandoned sessions still reclaimed within the min-idle window + idle timeout).

Refs #461, #463

🤖 Generated with Claude Code

Authority: RESEARCH_OBSERVATION_ONLY / NO_ENGINEERING_AUTHORITY

Hybrid replication capture receipt

{
  "body_gzip_base64": "H4sIAAAAAAACA41VzW7bRhC+6ymmziESIkqULdmxWxRwZSEwEP/Aso0CRSGuyKG4NbnL7C4tOw9QINceeu0lfTE/QR+hM7uU5aYtkBvB2Z35Zr7vm/3umyiC89mPN/PF9OJqtpjdnp7Mzqezxc356e3saj47AluI3cn+Ubx/sPd2Mh7t5bujyTIXk9EE44PsAHfj5e7BMj4Yx+M4HR1OxjGO3wrMDwXG8W6a7Y3GiOkhRNH3nc6rV3Bp9LLEir7H+yPoXl4Bfez1oUKzwgyEBRzvT8Zv8x5U4g4tJAZX0jo03V4CeC9TB65AKFFYFxlMUbnyMRKpk/cIFq2VWsFaugKUBqmivJSrwoHBDw1aB+sClU9gnTYI0oJwkFTiYR6u2qRPZ1fCZCX9AJ3TYTrRJn5tQVIAxAoHcM0Bg5W+J5icchLv+bRVH5aNA+lAlFZTa0JRGfUIaSkJbsioa6S/bV4LHxqZ3pV0RKi2S00pTXvFvt6e9LfXSOCfm061yqjCSh95HP4+DTPcJcwKH7YTyIUsbZgQ1WrUndJrFW0mh8ZoQ4EMqsbypUgq6aQo5Udq+QfMeWrMXX+L6FE3akVYCZmChAd0LSvUjTuzSUCq8J7iG1zLRyoQ2gvkGuEo0aDTuS6IEOYEUqOtjdqB+YuMbgjinuCLpSylo2FplaJRfaLa8R2tcpnRBYZLYa0QuqSCTLg2IW4n3gskUVLBIjeE6wTv4Wx6GWZjGbIofY3GGIYxpcm/u7weTnWGDxygE9ZDt0x2ic76mkpLy0yWJRNYNIYpRfPIMSwtDrwTZg818jg6nQjeX91smyR6U1GLlFuwhW7KjLKWvltL7ZkvpFAI0sASSdZemjnT54I/qLWK6KuaihXbBxysBpCczG7nl8fkcup1MZ/N56cX5wtCsDg7PV+cnrynwDyBboa5aEoH+zHEcQyV7QdJLBGePn3+kufeAOb/qYdgHyceoTba+Y69vFioL9ln2g3+Eg54BthOtA+WXnMDmlJC5jhOU6zd1YuLvBeGkIiskv/67wGLuqbpec+Lioo2NCWyJf+oSd9pgekdzccgtrZ4uXK47kXN+UR5tN0emxNSrTauZufSbIRzRpKyqIuur5fIOnmTNBbN8YrOJUAEXRw3LLFmyf1yk+z6B8rI+Vp6SaAEL9/4hiN+ls+uJtsGyp/1kEtjnZ9UldaL9vdiI6bFZrzJRlZEi0NuqvUih/36JERZg+A07JCKtwWkgrBPd7iLHfLWZm94IE+f/mTBsdh2gsgDXYJsyjK/oVUCjpbQEdCj8iLtRrijGCy8gdE/lfH0629baXRJFjSapDTNrHUMbZlGpSQ2ekEGX1Pm8H/LPBsRM94q25lw3invl1Wb+SttVAtjOVdIZCEeKnpdeG8PSXE0/tYmHpsLduJafhdNoEBRuuIjiJxPZliX2i+FdXhxFK5pLTSKgvbbgJeyBkb80xV2NVh6JoWRGrpiSeajRZRtx0KqI47pKS0F1Q/mk0HmRGbkka0l3VrTzF7i7BHHV5jb9j3gh7zT+euPz7/DO1S0PJ+d/NO0FE2GwIvz527hXG2PhsPU/xykumo/o5Tivc7f5tgXZJYIAAA=",
  "capture_sha256": "e8a0672ebe844bcaf295b5204949c804c179d2d4e36228b8f086d9107b9dcfda",
  "captured_at": "2026-10-09T01:32:22Z",
  "contract_sha256": "2807f55f071b8cb563802085dbbf5c5656c1917efe30bdc3e6550a66281d23cb",
  "created_at": "2026-10-09T01:29:23Z",
  "default_branch": "main",
  "issue_number": 467,
  "issue_updated_at": "2026-10-09T01:29:55Z",
  "pre_implementation_revision": "e46548f5660b0198be6e3bfc735b282f5a64685d",
  "repository": "James3014/devspace",
  "schema": "nexus.hybrid_replication.capture.v1",
  "source_event_id": "actions:37870014847:1",
  "title": "P2: LRU session eviction at capacity needs a minimum idle age so one client cannot evict others' live sessions (follow-up to #461)"
}

Authority: RESEARCH_OBSERVATION_ONLY / NO_ENGINEERING_AUTHORITY

{
  "body_gzip_base64": "H4sIAAAAAAACA41VzW7bRhC+6ymmziESIkqULdmxWxRwZSEwEP/Aso0CRSGuyKG4NbnL7C4tOw9QINceeu0lfTE/QR+hM7uU5aYtkBvB2Z35Zr7vm/3umyiC89mPN/PF9OJqtpjdnp7Mzqezxc356e3saj47AluI3cn+Ubx/sPd2Mh7t5bujyTIXk9EE44PsAHfj5e7BMj4Yx+M4HR1OxjGO3wrMDwXG8W6a7Y3GiOkhRNH3nc6rV3Bp9LLEir7H+yPoXl4Bfez1oUKzwgyEBRzvT8Zv8x5U4g4tJAZX0jo03V4CeC9TB65AKFFYFxlMUbnyMRKpk/cIFq2VWsFaugKUBqmivJSrwoHBDw1aB+sClU9gnTYI0oJwkFTiYR6u2qRPZ1fCZCX9AJ3TYTrRJn5tQVIAxAoHcM0Bg5W+J5icchLv+bRVH5aNA+lAlFZTa0JRGfUIaSkJbsioa6S/bV4LHxqZ3pV0RKi2S00pTXvFvt6e9LfXSOCfm061yqjCSh95HP4+DTPcJcwKH7YTyIUsbZgQ1WrUndJrFW0mh8ZoQ4EMqsbypUgq6aQo5Udq+QfMeWrMXX+L6FE3akVYCZmChAd0LSvUjTuzSUCq8J7iG1zLRyoQ2gvkGuEo0aDTuS6IEOYEUqOtjdqB+YuMbgjinuCLpSylo2FplaJRfaLa8R2tcpnRBYZLYa0QuqSCTLg2IW4n3gskUVLBIjeE6wTv4Wx6GWZjGbIofY3GGIYxpcm/u7weTnWGDxygE9ZDt0x2ic76mkpLy0yWJRNYNIYpRfPIMSwtDrwTZg818jg6nQjeX91smyR6U1GLlFuwhW7KjLKWvltL7ZkvpFAI0sASSdZemjnT54I/qLWK6KuaihXbBxysBpCczG7nl8fkcup1MZ/N56cX5wtCsDg7PV+cnrynwDyBboa5aEoH+zHEcQyV7QdJLBGePn3+kufeAOb/qYdgHyceoTba+Y69vFioL9ln2g3+Eg54BthOtA+WXnMDmlJC5jhOU6zd1YuLvBeGkIiskv/67wGLuqbpec+Lioo2NCWyJf+oSd9pgekdzccgtrZ4uXK47kXN+UR5tN0emxNSrTauZufSbIRzRpKyqIuur5fIOnmTNBbN8YrOJUAEXRw3LLFmyf1yk+z6B8rI+Vp6SaAEL9/4hiN+ls+uJtsGyp/1kEtjnZ9UldaL9vdiI6bFZrzJRlZEi0NuqvUih/36JERZg+A07JCKtwWkgrBPd7iLHfLWZm94IE+f/mTBsdh2gsgDXYJsyjK/oVUCjpbQEdCj8iLtRrijGCy8gdE/lfH0629baXRJFjSapDTNrHUMbZlGpSQ2ekEGX1Pm8H/LPBsRM94q25lw3invl1Wb+SttVAtjOVdIZCEeKnpdeG8PSXE0/tYmHpsLduJafhdNoEBRuuIjiJxPZliX2i+FdXhxFK5pLTSKgvbbgJeyBkb80xV2NVh6JoWRGrpiSeajRZRtx0KqI47pKS0F1Q/mk0HmRGbkka0l3VrTzF7i7BHHV5jb9j3gh7zT+euPz7/DO1S0PJ+d/NO0FE2GwIvz527hXG2PhsPU/xykumo/o5Tivc7f5tgXZJYIAAA=",
  "delta_sha256": "0b13bb8e46da01e33e7aea2a14e0d1321561a9d58e9d40f27816043a181929c1",
  "edited_at": "2026-10-09T01:35:39Z",
  "issue_updated_at": "2026-10-09T01:29:55Z",
  "original_capture_sha256": "e8a0672ebe844bcaf295b5204949c804c179d2d4e36228b8f086d9107b9dcfda",
  "schema": "nexus.hybrid_replication.contract_delta.v1",
  "source_event_id": "actions:37870058278:1",
  "task_key": "James3014/devspace#467",
  "title": "P2: LRU session eviction at capacity needs a minimum idle age so one client cannot evict others' live sessions (follow-up to #461)"
}

fix(mcp-sessions): require a minimum idle age before LRU eviction at …

Navigation Menu

Repository navigation

P2: LRU session eviction at capacity needs a minimum idle age so one client cannot evict others' live sessions (follow-up to #461) #467

Problem

Expected

Acceptance

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

P2: LRU session eviction at capacity needs a minimum idle age so one client cannot evict others' live sessions (follow-up to #461) #467

Description

Problem

Expected

Acceptance

Activity

github-actions commented on Oct 9, 2026

github-actions commented on Oct 9, 2026

Metadata

Metadata

Assignees

Labels

Projects

Milestone

Relationships

Development

Issue actions