[V2 Debt] Upstream ext-apps strict-mode init idempotency closure and pin

[dukefromearth]

Global Program Context

Program hierarchy: #49 -> #50 -> #26.
Milestone: External Blockers.
Ticket state: blocked.

Current Phase and Why This Ticket Exists Now

Phase: Upstream dependency watch + local pin validation.
This ticket exists now to prevent local workaround churn while upstream strict-init fix is unresolved.
Unblock criteria: upstream fix merged and released, local dependency pin updated, required verification gates re-run successfully.

Upstream Dependencies

Blocked by: #50, upstream ext-apps issue/PR release

Downstream Tickets Affected

Blocks: program closure in #49

Cross-Team Impact Map

Teams impacted: team-platform, team-host-web, team-e2e, upstream ext-apps maintainers.

Verification Output Summary

Latest known run (2026-03-08): npm run verify pass; npm run test:integration:real-mcp pass.

Next Action Trigger

Every pickup run (continuous, no date gate)

Summary

Close the upstream dependency gap for strict-mode initialization idempotency in @modelcontextprotocol/ext-apps, then pin this repository to the patched version with local hardening retained as defense-in-depth until pin validation is complete.

Why This Matters

The current V2 hardening in this repo prevents lifecycle truth regressions locally, but we still depend on upstream behavior for strict-mode initialization correctness. If upstream remains unfixed, future upgrades can silently reintroduce duplicate ui/initialize and unknown message ID protocol churn.

Current State

• Local reproducer/tracking doc exists: docs/upstream-ext-apps-strict-init-reproducer.md.
• Local host hardening exists in apps/host-web/src/room-canvas/room-app-instance.tsx.
• Canonical real-MCP suite includes strict duplicate lifecycle assertion from roomd perspective.
• Upstream issue/PR and package pin are still pending.

Scope

In scope:

• Produce reproducible upstream-grade artifact set from this repo.
• Open upstream issue and PR in ext-apps with minimal failing scenario and fix proposal.
• After upstream merge/release, pin dependency in this repo and validate through required gates.
• Update all relevant docs with links, versions, and migration notes.

Out of scope:

• Broad host bridge redesign unrelated to strict-mode init idempotency.
• Non-strict-mode behavior changes.

Detailed Deliverables

1. Upstream reproducer package with:

• exact commands,
• expected/actual behavior,
• log signatures,
• minimal fixture.

2. Upstream issue and PR references captured in this repo:

• add links and status to docs/upstream-ext-apps-strict-init-reproducer.md.

3. Dependency pin update after upstream release:

• pin @modelcontextprotocol/ext-apps to patched version in workspace package manifests and lockfile.

4. Validation report in PR description:

• pre-pin and post-pin real-MCP run results,
• confirmation no lifecycle truth regressions.

Required Implementation Steps

1. Re-run and tighten the reproducer so it is minimal and deterministic.
2. Extract only the essential strict-mode sequence causing churn.
3. Submit upstream issue with reproducible script and artifacts.
4. Submit upstream PR with strict-mode-safe init idempotency fix.
5. Wait for merge/release.
6. Pin this repo to released version.
7. Run required gates and document results.

Acceptance Criteria

• Upstream issue URL and upstream PR URL are linked from docs/upstream-ext-apps-strict-init-reproducer.md.
• Upstream PR is merged and released (or issue is explicitly blocked with owner + ETA).
• This repo is pinned to the patched ext-apps version.
• npm run verify passes.
• npm run test:integration:real-mcp passes.
• No reintroduction of duplicate accepted lifecycle progression per active session in canonical real-MCP test.
• Docs are fully updated with exact version/commit references.

Definition Of Done (Strict)

• All acceptance criteria are met.
• No TODO placeholders remain for this debt unless blocked by external release, and any external block has owner/next action.
• Zero new tech-debt introduced:
  • no new baseline suppressions,
  • no new line-cap suppressions,
  • no unresolved TODO/GOTCHA comments introduced without linked follow-up issue.
• Required CI workflow remains green with artifact capture behavior unchanged.

Verification Commands

npm ci
npm run arch
npm run verify
npm run test:integration:real-mcp

Ownership

• Primary: team-platform
• Secondary: team-host-web, team-e2e

[dukefromearth]

Local actionable work is complete and merged in #36.

What shipped:

• pinned workspace @modelcontextprotocol/ext-apps to exact 1.1.2 to freeze semver drift while upstream fix is unresolved
• added strict lifecycle regression lock: canonical real-MCP host lifecycle test now fails on duplicate host app_initialized evidence for a mounted instance
• added reproducible upstream dependency tracker: docs/upstream-ext-apps-strict-init-reproducer.md

Verification run (2026-03-08):

• npm run verify ✅
• npm run test:integration:real-mcp ✅

External blocker remains (as of 2026-03-08):

• Upstream issue: PostMessageTransport: Race condition with srcdoc iframes — host misses ui/initialize modelcontextprotocol/ext-apps#542 (OPEN)
• Upstream PR: feat: support deferred target in PostMessageTransport for dynamically created iframes modelcontextprotocol/ext-apps#543 (OPEN)

Owner + next action:

• owner: team-platform (this repo) + ext-apps maintainers (upstream)
• next check date: 2026-03-15
• unblock criteria: upstream PR merged + released, then bump/pin to released fixed ext-apps version and rerun required gates

[dukefromearth]

Lifecycle program linkage update:

• Parent program: [Program] Lifecycle Convergence V2: Unified Ontology, Routes, Contracts, and Consumers #37
• External blocker remains valid and unchanged: upstream ext-apps merge/release required before closure work.

Boundary reminder:

• [V2 Debt] Upstream ext-apps strict-mode init idempotency closure and pin #26 tracks upstream dependency closure and pin bump validation only.
• Local route/contract migration work proceeds in [Lifecycle A1] Expand canonical lifecycle contract authority and lock ADR #38-[Lifecycle A6] Remove /evidence compatibility route after deprecation criteria are met #43.