## Why
Concurrent Codex processes can otherwise refresh the same rotating token, and a
cancelled or partially persisted refresh can leave durable and in-memory MCP
credentials out of sync.
## What changed
- Serialize each credential's read-refresh-write transaction across processes,
reread the authoritative store after locking, and adopt credentials refreshed
by another process.
- Keep refresh persistence running after caller cancellation, bound lock and
provider waits independently, and preserve omitted refresh tokens and scopes.
- Fail MCP startup and operations when refresh or persistence fails instead of
continuing with stale credentials, while requiring reauthorization for
missing, unusable, or rejected refresh tokens.
- Exclude OAuth refresh time from the MCP initialization timeout.
## Testing
Add coverage for lock contention, concurrent refreshes, rejected and missing
credentials, storage failures, caller cancellation, and provider timeouts.
GitOrigin-RevId: 4d29b879bec646d2ceb922b526dc793b1a1f5423
6962a2ecae