unblock startup model loading

Unblock Startup Model Loading

Date: 2026-07-15
Tracking: Issue #39, sub-issues #40, #41, and #43

Problem

The model picker can remain on its built-in fallback entries after the Codex Worker reaches Ready and the account is confirmed as signed in. Runtime diagnostics stop after the account status is received and do not show a model discovery request.

Evidence

• The installed Codex CLI responds to model/list and returns the current model catalog.
• The extension initializes the picker with fallback entries before connecting.
• Ready-state initialization previously awaited Remote UI account synchronization before starting model discovery.
• Account synchronization raises multiple cross-process property and command notifications. A delayed subscriber can therefore prevent the model request from starting.
• The extension-to-Worker model RPC previously had no outer timeout or boundary diagnostics.

Implementation Plan

1. Move startup model discovery before Remote UI account synchronization.
2. Preserve the existing in-place model collection merge and selection-stability behavior.
3. Catch UI update exceptions consistently for inline and Dispatcher-based execution.
4. Add a bounded timeout around the extension-to-Worker model discovery RPC.
5. Add start, completion, cancellation, timeout, and failure diagnostics at the extension, Worker RPC, and app-server request boundaries.
6. Add a regression test that blocks account command notifications and verifies that model discovery and selection finish first.
7. Run the focused model tests, all UI and Core tests, and a warning-free solution build.

Acceptance Criteria

• Startup model discovery begins after account status is available without waiting for account UI notification completion.
• The model picker replaces fallback entries when the app-server returns a catalog.
• A delayed account UI subscriber does not prevent model discovery or model selection.
• Model discovery cannot wait indefinitely at the extension-to-Worker boundary.
• Diagnostics identify the boundary at which model discovery starts, completes, times out, is canceled, or fails.
• Existing fallback behavior remains intact when discovery fails.
• The solution builds with zero warnings and zero errors, and all relevant tests pass.

Out of Scope

• A broader redesign of tool-window initialization around ControlLoadedAsync.
• Making every ready-state refresh independent if an unrelated Remote UI notification blocks forever.
• Changing the model picker binding or the selection-stability implementation from PR #37.