Scope and dependency

Closes #189. Observability epic #173; prerequisite for integrated qualification #178.

This is a stacked review PR against codex/issue-187-deterministic-cli-timeout (!171). It must not be merged into that temporary base or treated as delivered there. Merge #187 first, then retarget/rebase onto the intended green main and repeat exact-SHA review and CI for any changed SHA. #188/!172 is an independent O5 prerequisite. Original issue descriptions remain unchanged; designs and findings are issue comments.

Behavior

• Record one bounded operation-local bit at actual RoundTrip entry, independent of telemetry. Live-mode selection, request construction, startup cancellation and local rate-limit waits do not count.
• Freeze typed receipts at sync return, retaining prior HTTP across nested calls and partial/multi-collection aggregation. Preserve entered failures when the actual parent context is cancelled and a later queue-summary read also fails; private typed causes survive aggregation without inventing public failure counts.
• Keep failing-request transport evidence separate from earlier successful HTTP; actual skipped-target context guards retain explicit negative evidence. Unknown boundaries remain unknown.
• CLI text/JSON and MCP lifecycle/operational diagnostics distinguish operation_cancelled / operation_timeout from entered-transport failure. HTTP attempted remains an independent fact, not delivery or write confirmation.
• Preserve HTTP client timeout, redirect, cookie-jar and legacy cancellation behavior, typed error unwrapping, partial pointer contracts and confirmed provider/schema failure precedence.

Verification

Exact commit: 8cc54f5cf692eb4091b00edc9e42f089e680732d. Stacked base: 8f6a387062944410b9c1acda4a96dfd8c6a7908c.

Passed locally:

• go test -p 1 ./... -count=1
• go test -race -p 1 ./internal/diagnostics ./internal/gitcode ./internal/service ./internal/cli ./internal/mcp ./cmd/gitcode-mcp -count=1
• Focused actual-boundary and mixed-cause controls, three repetitions under race
• Affected go vet -p 1, ./scripts/check-product-docs.sh, git diff --check

Regression evidence covers zero-entry cancellation/expiry, actual transport failures, cancelled local rate waits after healthy HTTP, empty-list preservation, actual multi-collection and single-target-batch success/cancel/skipped-tail behavior, actual parent cancellation at issues/wiki/PR transport entry, nested private causes with stable public JSON/counts and self-cycle controls, mixed provider/schema/unknown causes, public-safe contention projection and CLI/MCP parity. Baseline and rejected-head regression failures are recorded in #189.

Independent review: CLEAR for the full exact SHA; no P0-P2 findings remain. Independent full Go/race/static gates plus actual parent-deadline and unbounded-issues controls passed; final verdict recorded in #189..
Exact-head CI: https://github.com/urandon/gitcode-mcp/actions/runs/38154979277 (attempt 1, Go test job 114515986240; all required steps passed for the exact head SHA)..

Risk, recovery and UX

The principal risks are falsely attributing a local interruption to transport, losing earlier attempted HTTP, or changing typed partial/client behavior. Both negative and entered-failure positive controls are required. Receipts retain no request URL, credentials, source bytes or private coordinate and do not depend on observation storage.

No cache schema migration, provider endpoint, remote-write behavior, new Admin control, release tag, local install or installed-service upgrade is introduced. CLI/MCP use shared typed authority; existing Admin observability is separately qualified by #178, not declared complete by this prerequisite. Rollback is a normal code revert; cache/audit/provider state is not repaired or reset.