PR #19413: provider-scoped MCP credentials
Reviewed local revision: 8119388ab0
Linux / Node 24; isolated in-memory SQLite; no user credentials or state.

Before: same HTTP scenario with main manager/storage modules fails when original A client calls after opening B: HTTP 401, expected 200.
After: 16/16 HTTP observations pass using production ProviderSessionManager, McpProviderSessions, McpSessionRegistry, MCP HTTP transport/auth middleware and tool-access guards.

Provider adapters are test fixtures. Active-run ownership is supplied by a controlled ThreadManagement fixture; the actual actsAsCaller guard runs unchanged. No authenticated Claude/Codex model turns or client UI switching were exercised.
The terminal-detach flag used by archive/delete revokes both provider tokens. Archive/delete command dispatch itself is not part of this live harness.

A initial: HTTP 200; read_identity; codex
A owns active run: HTTP 200; write_identity; codex
A original client after B opened: HTTP 200; read_identity; codex
B original client: HTTP 200; read_identity; codex-other
A cannot mutate B run: HTTP 200; write_identity; parent_not_active tool error (expected)
B owns active run: HTTP 200; write_identity; codex-other
A reused client after switch back: HTTP 200; read_identity; codex
A owns active run again: HTTP 200; write_identity; codex
B still reads after switch back: HTTP 200; read_identity; codex-other
B cannot mutate A run: HTTP 200; write_identity; parent_not_active tool error (expected)
B closed: HTTP 401; read_identity; codex-other
A survives B close: HTTP 200; read_identity; codex
B reissued: HTTP 200; read_identity; codex-other
A survives B reissue: HTTP 200; read_identity; codex
terminal detach clears A: HTTP 401; read_identity; codex
terminal detach clears B: HTTP 401; read_identity; codex-other

No screenshots: backend credential behavior has no visual change. macOS, Windows, iOS, Android and Electron desktop not verified.
Public artifact deliberately omits authorization headers, secrets, session identifiers and private data.