fit_result_or_limit_error: bound approval_request_id in the oversized-result fallback #1727

Summary

fit_result_or_limit_error (apis/src/openai/responses/mcp_dispatch/mod.rs) guarantees the oversized-result fallback fits MIN_RETAINED_RESULT_BYTES by capping call_id and the tool name at ≤64 bytes via bounded_identity, but it passes approval_request_id through unbounded. The ≤budget guarantee is therefore only enforced by a debug_assert!, which is compiled out in release builds.

Impact

Low — defense in depth, not a live bug. The approval_request_id that reaches this path is the server-issued pending id: a client mcp_approval_response only proceeds if its id matches a server-owned pending approval, so a long/bogus id is rejected before execution and never reaches the fallback. Server-issued ids are short, so the fallback stays within budget in practice. This is about making the retained-byte invariant self-enforcing rather than relying on that external fact.

Proposed fix

Bound the approval id in the fallback the same way call_id/name are bounded — but drop it (None) when it exceeds the cap rather than truncating, since a truncated id breaks approval correlation.

Context

Raised by CodeRabbit on PR #1725: #1725 (comment)