Scope and lineage

Closes #189. Observability epic #173; prerequisite for integrated qualification #178.

Replaces superseded stacked !173 (https://gitcode.com/urandon/gitcode-mcp/pull/173). Its historical description and review lineage are retained; this PR is the single active delivery PR for #189 and targets main. The old temporary base is not a delivery destination. #187/!171 and #188/!172 are already merged with green resulting-main CI.

Behavior

• Record a bounded operation-local witness at actual RoundTrip entry, independent of telemetry. Live-mode selection, request construction, startup cancellation and local rate-limit waits do not count as HTTP attempts.
• Freeze typed receipts at sync return, retain earlier HTTP across nested and multi-collection calls, and preserve entered failures when parent cancellation or a later queue-summary read also fails. Private typed causes survive aggregation without changing public failure counts.
• Separate a failing request's transport evidence from earlier successful HTTP. Actual skipped-target guards preserve explicit negative evidence; unknown boundaries remain unknown.
• Keep CLI text/JSON and MCP diagnostics in parity: operation cancellation/timeout and entered-transport failure remain distinct, and HTTP attempted is not delivery or write confirmation.
• Preserve timeout, redirect, cookie-jar and legacy cancellation behavior, typed error unwrapping, partial pointer contracts, and provider/schema failure precedence.

Exact integration and verification

Head: 8cb4302a509b81df84d66563b00dd6e8f2148cb8. Intended main: 57a877f2553458cc4fb2d59ad187c8bb3b19c498.

The non-force integration merge preserves prior reviewed 8cc54f5cf692eb4091b00edc9e42f089e680732d and adds green main. All #189 implementation and regression blobs are unchanged by integration; nevertheless review and CI are renewed for the new SHA.

Passed locally on this head:

• go test ./...
• go test -race ./internal/gitcode ./internal/service ./internal/cli ./internal/mcp ./internal/cache ./internal/servicectl
• go test -race -p 1 ./internal/diagnostics ./cmd/gitcode-mcp -count=1
• go vet ./internal/gitcode ./internal/service ./internal/cli ./internal/mcp ./internal/diagnostics ./internal/servicectl
• ./scripts/check-product-docs.sh
• git diff --check origin/main...HEAD

Regression coverage includes zero-entry cancellation/expiry, actual transport entry, cancelled local rate waits after healthy HTTP, empty-list preservation, partial multi-collection and single-target success/cancel/skipped-tail behavior, issues/wiki/PR parent cancellation, nested private causes with stable public JSON/counts, and CLI/MCP parity. Rejected-head findings and their fixes are recorded in #189.

Independent renewed exact-SHA review: CLEAR for 8cb4302a509b81df84d66563b00dd6e8f2148cb8, no P0-P2 findings. Focused six-package race controls repeated three times, full Go, full affected six-package race, vet/docs/diff gates passed independently. All original defect probes and parent-deadline/unbounded-issues controls passed on the integrated head; final evidence is recorded in #189.

Exact-head CI: https://github.com/urandon/gitcode-mcp/actions/runs/38157867498 (attempt 1, Go test job 114524459633; all 17 steps succeeded). No older-SHA result substitutes for these gates.

Risk, recovery and UX

Risks are false transport attribution, loss of earlier attempted HTTP, and typed partial/client regressions. Negative and entered-failure positive controls are both required. Witnesses contain no request URL, source bytes, private coordinates or credentials and do not depend on observation storage.

No cache migration, provider endpoint, remote-write behavior, new Admin control, release tag, local install or installed-service change is introduced. Shared typed authority serves CLI/MCP; existing Admin observability remains separately qualified in #178. Rollback is a normal code revert, not a cache/audit/provider reset. Independent review, fresh discussion checks, exact-head CI and resulting-main CI are required before closure.