fix: surface list-fetch failures instead of swallowing them

A list load that failed — a transport error, or a result the SDK's era
codec rejects as invalid — reported nothing. The connect-time refresh is
fired with no caller to await it (`void this.refresh()`), so its rejection
became an unhandled rejection: the header said "Connected", the panel
rendered an empty list indistinguishable from a server that has none, and
the failed exchange showed in the Protocol panel as a clean success.

Two surfaces now tell the truth:

- ManagedListState records the failure as observable state (`getError` +
  an `errorChange` event) and still re-throws, so App's auth-recovery
  wrapper keeps working. The four `useManaged*` hooks expose it via a
  shared `useManagedListError`, and the Tools/Prompts/Resources sidebars
  render a `ListLoadError` alert with the reason and a Retry.
- A response the client refused is attributed back to its Protocol entry
  (`markResponseRejected` → `responseRejected` → `MessageEntry.clientError`),
  which now renders an Error status and a "Rejected by the Inspector"
  alert rather than the green resultType badge alone. The SDK gives no
  request id with a decode failure, so the id is recovered by correlation;
  see the comment on `markResponseRejected` for why that is exact.

Also stops `listAllTools` from dropping a failing excluded-tools walk on
the floor — it stays non-fatal but is logged.

Closes #1953

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01SW1p8E2uiyyLx4RKwrwSrt

clients/web/src/components/groups/ProtocolEntry/ProtocolEntry.test.tsx

@@ -711,3 +711,57 @@ describe("ProtocolEntry — modern vocabulary", () => {
     });
   });
 });
+
+// A response the server answered successfully but the CLIENT then refused —
+// e.g. the SDK's era codec rejecting a 2026-07-28 list result missing
+// `ttlMs`/`cacheScope`. The wire frame is a valid JSON-RPC result, so before
+// #1953 this rendered as a clean success.
+describe("ProtocolEntry — client-rejected response", () => {
+  const REASON = "Invalid result for tools/list: ttlMs required";
+
+  const rejectedEntry: MessageEntry = {
+    id: "rej-1",
+    timestamp: new Date("2026-07-28T10:00:00Z"),
+    direction: "request",
+    origin: "client",
+    message: { jsonrpc: "2.0", id: 9, method: "tools/list", params: {} },
+    response: {
+      jsonrpc: "2.0",
+      id: 9,
+      result: { resultType: "complete", tools: [] },
+    },
+    clientError: REASON,
+  };
+
+  it("renders Error rather than a success status", () => {
+    renderWithMantine(<ProtocolEntry {...baseProps} entry={rejectedEntry} />);
+    expect(screen.getByText("Error")).toBeInTheDocument();
+    expect(screen.queryByText("OK")).not.toBeInTheDocument();
+  });
+
+  it("shows the Error badge even though a resultType badge is present", () => {
+    // The resultType normally suppresses the status badge (a modern success
+    // says "complete"). A rejected result must not hide behind it — the wire
+    // said complete, the client disagreed, and both are worth seeing.
+    renderWithMantine(<ProtocolEntry {...baseProps} entry={rejectedEntry} />);
+    expect(screen.getByText("complete")).toBeInTheDocument();
+    expect(screen.getByText("Error")).toBeInTheDocument();
+  });
+
+  it("names the Inspector as the rejecter and gives the reason when expanded", () => {
+    renderWithMantine(
+      <ProtocolEntry {...baseProps} entry={rejectedEntry} isListExpanded />,
+    );
+    expect(screen.getByText("Rejected by the Inspector")).toBeInTheDocument();
+    expect(screen.getByText(REASON)).toBeInTheDocument();
+  });
+
+  it("shows no rejection alert on an ordinary success", () => {
+    renderWithMantine(
+      <ProtocolEntry {...baseProps} entry={successEntry} isListExpanded />,
+    );
+    expect(
+      screen.queryByText("Rejected by the Inspector"),
+    ).not.toBeInTheDocument();
+  });
+});

clients/web/src/components/groups/ProtocolEntry/ProtocolEntry.tsx

@@ -135,6 +135,16 @@ const SpecErrorAlert = Alert.withProps({
   icon: <RiErrorWarningLine />,
 });
 
+// The client rejected an otherwise well-formed response (#1953). Distinct from
+// SpecErrorAlert: nothing is wrong with the server's JSON-RPC frame — the
+// Inspector's own decoding refused the result — so the title says who rejected it.
+const ClientErrorAlert = Alert.withProps({
+  variant: "light",
+  color: "red",
+  icon: <RiErrorWarningLine />,
+  title: "Rejected by the Inspector",
+});
+
 // Link (button-styled) that jumps to the correlated HTTP entry in the Network tab.
 const RevealLink = Anchor.withProps({
   component: "button",
@@ -213,6 +223,9 @@ function extractStatus(
   if (entry.direction !== "request") return "none";
   if (!entry.response) return "pending";
   if ("error" in entry.response) return "error";
+  // The server answered with a valid result the CLIENT then refused (#1953).
+  // The call failed, so the entry must not read as a success.
+  if (entry.clientError) return "error";
   return "success";
 }
 
@@ -330,11 +343,12 @@ export function ProtocolEntry({
   // Suppress the redundant green "OK" when a `resultType` badge already conveys
   // the outcome (a modern success is `complete`/`input required`); errors and
   // pending have no `resultType`, so their status badge still shows.
-  const statusBadge = status !== "none" && !resultType && (
-    <Badge color={statusColor(status)} variant="status">
-      {statusLabel(status)}
-    </Badge>
-  );
+  const statusBadge = status !== "none" &&
+    (!resultType || entry.clientError) && (
+      <Badge color={statusColor(status)} variant="status">
+        {statusLabel(status)}
+      </Badge>
+    );
   const subscriptionBadge = subscriptionId && (
     <SubscriptionCluster>
       <SubscriptionLabel>sub</SubscriptionLabel>
@@ -431,6 +445,11 @@ export function ProtocolEntry({
         <Collapse in={isExpanded}>
           <Stack gap="sm">
             <Divider />
+            {entry.clientError && (
+              <ClientErrorAlert>
+                <Text size="xs">{entry.clientError}</Text>
+              </ClientErrorAlert>
+            )}
             {specError && (
               <McpSpecErrorAlert
                 error={specError}