Cause isolated independently of service timing with the checked-in modernc SQLite driver and database/sql: initialize :memory: on a one-connection pool, commit a marker, begin a cancellable transaction, cancel, wait for automatic rollback to release the connection, then read with a fresh background context. Readback deterministically reports no such table.

database/sql discards a connection on cancellation-driven rollback when the driver lacks both session reset and connection validation hooks. A private :memory: database belongs to that connection; limiting the pool to one does not preserve database lifetime if the connection is replaced. This explains why ordinary concurrent read tests and many local repetitions passed while cancellation could fail in CI.

Design / scope:

• Keep each store in memory and isolated. Assign one process-local unique named in-memory database to an instance; retain a dedicated non-transactional anchor connection for the store lifetime.
• Keep the operational pool constrained to one connection, preserving the existing concurrency contract. A cancelled transaction may discard its worker connection without dropping migrated schema or prior committed progress.
• Close both the operational pool and the retained anchor on store close; clean up all initialization failure paths. No disk-backed substitute, global cache mutation, new schema, driver upgrade, cancellation suppression, or weakened assertion.
• Preserve existing explicit writer leases; #166 is separate.

UX cohort: internal storage-lifetime correction shared by CLI/MCP/daemon/Admin; no new resource, action or configuration/UI work. Public cache identity, source IDs, and read/write authority remain unchanged.

Verification: fail-first deterministic cache regression for cancellation rollback + committed frontier retention/uncommitted rollback; instance isolation and resource cleanup; existing cancellation frontier stress; full offline Go, cache/service and relevant consumers race gates, docs/diff; independent exact-SHA review, PR CI and resulting main CI. Fix #167 in its own issue branch/PR before merging #150.

Prototype of the proposed lifetime boundary passes the same deterministic cancellation experiment: a private named in-memory database plus a retained anchor preserves the single committed marker; the cancelled transaction's marker is rolled back. Replacement worker connections must also receive foreign_keys=ON and busy_timeout=5000 via DSN pragmas, not just initialization-time statements. The probe verified foreign keys remain enabled after replacement. Next: checked-in fail-first regression and implementation in the dedicated #167 branch after the #150 review-correction handoff.

Implemented the isolated in-memory lifetime fix on codex/issue-167-memory-cancellation, based on clean green main 57b2359175b18c0ca08527046c05adf072b06682.

The checked-in deterministic regressions failed first on that base:

• cancelled transaction -> committed frontier readback: no such table: sync_frontiers;
• deliberately discarded worker connection -> committed repository readback: no such table: repos.

After the fix, four lifetime/cancellation/isolation/cleanup tests passed with -count=100; the original TestBulkSyncIssuesBoundedCancelMidway_CancelAfterPage3Progress also passed with -count=100. Tests assert committed state survives, uncommitted changes roll back, different stores remain isolated, replacement workers retain foreign-key enforcement and busy timeout, Close releases anchor/worker pools and is idempotent, and cancelled initialization returns no usable store.

Implementation uses a random per-instance named in-memory DSN, a retained anchor and one operational worker. No driver dependency or schema change; no cancellation suppression or disk-backed replacement. Initialization cleanup is centralized; Close releases resources once. Full Go/vet/race gates are next before commit and independent review.

Clean pushed candidate SHA: e5d295cea47a6758d8054c259021a4625c9e14be, base 57b2359175b18c0ca08527046c05adf072b06682.

Verification passed on the candidate tree:

• Four new lifetime/cancellation tests with -count=100 and the original cancellation frontier service test with -count=100.
• go test -count=1 ./... and go vet ./....
• go test -race -count=1 ./internal/cache ./internal/service ./internal/mcp ./internal/cli ./internal/servicectl ./internal/repositorydocs ./internal/adminhttp, run after normal Go gates completed.
• python3 -m unittest discover -s scripts/release -p 'test_*.py': 31 passed.
• Product documentation and diff whitespace passed.

No Admin source or embedded asset changes, no schema/dependency/config changes, and no live E2E prerequisite needed for this deterministic internal storage fix. Opening a dedicated PR, then independent exact-SHA review and required CI; issue stays open until green main integration.

Independent exact-SHA review is clear: no P0–P2 findings for e5d295cea47a6758d8054c259021a4625c9e14be, base 57b2359175b18c0ca08527046c05adf072b06682.

Reviewer independently checked the authoritative issue/comments, pinned driver/database/sql cancellation semantics, anchor lifetime/isolation, replacement pragmas, initialization and Close cleanup. In-memory lifecycle tests passed with count=100 and under race with count=20; full cache tests, product-docs and whitespace passed. Canonical !148 head/base match and comments are empty. No source edits or remote mutations by the reviewer.

Required CI 37970438825 is the separate final pre-merge gate; it must finish green for the reviewed SHA. After merge, observe exact main CI before closing this issue.

Required CI 37970438825 passed for reviewed SHA e5d295cea47a6758d8054c259021a4625c9e14be (CI / push / issue branch); root and Luna independently read terminal success. Fresh unresolved-discussion check is empty. Merging !148 with an exact-head SHA guard, then waiting for resulting main CI. Issue remains open until integration evidence.

!148 merged with exact reviewed head guard. Provider-confirmed merge/main SHA: 13a7b5d80f489bc2ffcf8e607c8f7cf4ad3aa7b5. Required head CI and independent review were clear; no blocking discussion remained.

Main integration CI is pending. #167 stays open until exact main CI succeeds. The already-open dependent #150 branch will be updated against this merge and reverified; it will not merge before this main gate is green.

Final delivery evidence: !148 merged reviewed head e5d295cea47a6758d8054c259021a4625c9e14be into main commit 13a7b5d80f489bc2ffcf8e607c8f7cf4ad3aa7b5. Independent exact-SHA review: no P0–P2 findings. Head CI succeeded: https://github.com/urandon/gitcode-mcp/actions/runs/37970438825. Resulting-main CI succeeded, confirmed independently by the CI watcher: https://github.com/urandon/gitcode-mcp/actions/runs/37971087008. Deterministic fail-first cancellation/discard tests now pass; repeated cancellation regression, full uncached Go, vet, relevant race packages, release fixtures, docs and whitespace gates passed. #150 contains this fix in integrated candidate 8a51599c726b0a6b2dcdd0707ff9e5409cb985b5. Its separate intermittent migration process readiness failure is being tracked independently; it is not the in-memory schema lifetime regression repaired here.