Document MCP timeout and cancellation coverage

DESIGN.md

@@ -1203,6 +1203,7 @@ Run after phases 1 to 5 and again before every release, as its own change set.
   **Disposition recorded 2026-10-08:** all 65 Q3 rows have stable IDs and an explicit Release 1 disposition in [the row-by-row ledger](docs/release-1-q3-dispositions.md). Release 1 is published; full workflows deferred to Release 2 retain their release-maintainers owner and 3–5-day target. Partial test evidence is recorded separately and is not represented as a completed smoke. Safety invariants for data loss, unauthorized actions, startup failures, and false success remain release gates. Release notes state the native-platform and accessibility gaps.
   **Q3-60 MCP transcript details (2026-10-08, PR head `6a6514f`).** A headless Avalonia regression verifies that tool, prompt, resource, and resource-template operations share a collapsed natural-language group, expand to correctly named rows, and expose readable untrusted results without raw output envelopes. The focused UI test passed locally; Windows Avalonia UI tests passed 67/67 non-live tests on the exact PR head. Hosted four-RID preview [#37846994789](https://github.com/jay23606/codev/actions/runs/37846994789) passed the packaged Windows prompt/resource/template interaction, including its initially collapsed state and successful expansion; Linux and both macOS package previews also passed. Native macOS/Linux UI readability and interaction remain open.
   **Q3-65 malformed MCP settings recovery (2026-10-08, product head `e9a2e54`).** The MCP settings editor reopens bounded raw JSON after syntax errors and preserves valid JSON containing wrongly typed or invalid server fields instead of silently converting those entries to placeholders. It explains that the source remains unchanged and permits replacement only after a valid save. Case-insensitive duplicate IDs are identified before saving; failed duplicate saves preserve the source, while the user can correct and reload the list. Files above the 1 MiB editing cap open with an explicit warning and an empty replacement; the original remains unchanged until a valid replacement is saved. If a directory occupies the MCP settings path, Codev reports the conflict, names the path, and explains how to move or rename it. Avalonia tests cover malformed syntax, wrongly typed fields, duplicate IDs, oversized files, source preservation, rejected duplicate saves, and reload after repair; a Core regression rejects a directory collision instead of treating the path as missing. The .NET 10 Release Avalonia suite passed 65 tests (12 opt-in live tests skipped); Core passed 1,030 tests (2 opt-in live tests skipped). Exact-head [Windows/Linux/macOS CI](https://github.com/jay23606/codev/actions/runs/37824930302) and [four-target package preview](https://github.com/jay23606/codev/actions/runs/37824930304) passed. Packaged Windows UI Automation verifies malformed JSON, invalid fields, duplicates, oversized files, and the directory-collision guidance with the isolated file path exposed accessibly. Native settings interaction and a true permission-denied read remain unverified.
+  **Q3-64 MCP bounds and cancellation (2026-10-09, current source, .NET 10.0.401).** The focused `Codev.Tests` MCP suite passed 93 tests with one opt-in live test skipped. Coverage includes phase timeouts canceling the underlying operation, preserving caller cancellation, bounded and cancelable HTTP JSON/SSE bodies and stdio frames, stdio process-tree cleanup, and truncation of combined MCP outputs. This is partial portable-test evidence only; the full app's responsiveness and configured startup/catalog/execution/shutdown limits under a live slow-server conversation remain unverified.
   **Q3 local packaged Auto/MCP follow-up (2026-10-08, PR head `ce30d08`, product code `e9a2e54`, Windows 11, .NET 10.0.401).** A fresh self-contained win-x64 build passed the complete packaged UI smoke on its second attempt using an isolated temporary data root and loopback-only mock Ollama/MCP fixtures. The smoke applied an instruction-risk file proposal without review; ran the screenshot-matched destructive command in Auto and then blocked it under an exact Deny without a prompt; denied an MCP tool in Ask without invoking the server; and completed stdio and Streamable HTTP echo calls in Auto without approval. It also covered MCP settings recovery, persisted display/font settings, profile editing, search and sidebar operations, collapsed activity expansion, mode cycling, and native backup dialogs. The first attempt exposed intermittent SendKeys text loss before the Auto/MCP segment; the repeat passed. This gives local packaged UI/executor evidence for R1-Q3-02, 36, 59, and 61, but used a deterministic Ollama mock rather than real inference. Keep those end-to-end rows open for real-model interaction, broader permission cases, SSE/OAuth, and native Mac/Linux checks; no conclusion about general Auto or MCP behavior should be drawn from this single completed mock-backed run.
   **Hosted packaged conversation-find proof (2026-10-09, PR #57 merged as `a4077d7`).** Windows/Linux/macOS CI [passed](https://github.com/jay23606/codev/actions/runs/37981218664), including Avalonia headless UI tests on all three operating systems. The four-target desktop/CLI preview [passed](https://github.com/jay23606/codev/actions/runs/37981218523) for win-x64, linux-x64, osx-arm64, and osx-x64; publication was skipped because the check ran on an unmerged PR head. The merged main commit's Windows/Linux/macOS CI also passed [#37982990888](https://github.com/jay23606/codev/actions/runs/37982990888). Windows UI Automation selected an earlier transcript result and closed/reopened the search panel. Linux Xvfb verified AT-SPI focus and Ctrl+Shift+F routing, activated the earlier prompt, closed search, and found the shortcut in F1. Both macOS window-server targets searched and activated that prompt with Cmd+Shift+F and closed the panel after the multi-action Auto smoke. The Linux keyboard test no longer starts Orca: two earlier runs reported no Orca focus event even though AT-SPI confirmed the search field was focused, so that flaky screen-reader gate was not allowed to block keyboard interaction coverage. Native Linux/macOS input and screen-reader behavior remain unverified; R1-Q3-03 stays open.
   The tag workflow now loads [`docs/release-notes.md`](docs/release-notes.md) as its human-written release body and appends GitHub-generated change notes, so the Auto permission boundary and preview limitations travel with the published assets. Update that file for each release before tagging.

docs/avalonia-smoke-checklist.md

@@ -378,7 +378,7 @@ Code + conversation rewind and broader Git review scopes beyond the implemented
 - [ ] `R1-Q3-61` In Ask mode, deny a tool, prompt, and resource read and verify none reaches the server. In Auto, verify each runs without another prompt; add an exact Deny rule and verify it blocks before server invocation. **Partial coverage (.NET 10.0.401, 2026-10-07):** the in-memory MCP protocol/executor regression runs tool, prompt, resource, and template operations in Auto without another prompt, verifies Ask-mode refusal blocks all four before a server handler runs, then verifies exact saved Deny blocks each before invocation. The Avalonia MainWindow test verifies inline Ask approval/run-once for a tool and inline denial for prompts, resources, and resource templates, including persisted operation-specific Deny rules and no call to the server delegate. The native packaged Windows smoke now also verifies a configured stdio tool shows inline Ask denial, persists its exact deny, leaves Ask selected, and never reaches the server; a separate echo call then succeeds in Auto. Packaged prompt/resource/template denial and native macOS/Linux interaction remain open.
 - [ ] `R1-Q3-62` Disable a server, then test an invalid configuration and an unavailable endpoint; verify each outcome is reported under one collapsed activity group, expands to a useful server/status explanation, and exposes no environment values, headers, or credentials. **Partial coverage (.NET SDK 10.0.401, 2026-10-07):** the Core regression exercises a disabled server, malformed HTTP URL, and unavailable loopback HTTP endpoint configured with a unique authorization-header sentinel; it verifies three bounded `mcp_connection` outputs name each server, identify the status, and do not contain the sentinel. The Avalonia regression renders three diagnostics under one initially collapsed **Checked MCP connections** group and verifies expansion exposes the server names and status text. Focused tests passed 21/21 Core and 1/1 Avalonia; complete suites passed 1,029 Core (2 opt-in live skips) and 61 Avalonia (12 opt-in live skips). This is Core plus headless-window evidence; packaged-app interaction with disabled/invalid/unavailable servers and native screen-reader checks remain open.
 - [ ] `R1-Q3-63` Configure a test OAuth server; verify browser sign-in, matching-state callback validation, token reuse after restart, and a new sign-in after **Forget saved OAuth sign-ins**. Confirm tokens and client-registration data are absent from MCP settings, conversation history, and diagnostics.
-- [ ] `R1-Q3-64` Configure short startup, catalog, execution, and shutdown limits; simulate a slow server, cancellation, oversized text/structured results, and slow shutdown. Verify each operation stays within its bound and leaves the rest of Codev responsive.
+- [ ] `R1-Q3-64` Configure short startup, catalog, execution, and shutdown limits; simulate a slow server, cancellation, oversized text/structured results, and slow shutdown. Verify each operation stays within its bound and leaves the rest of Codev responsive. **Partial automated coverage (2026-10-09, .NET 10.0.401):** `Codev.Tests` MCP-filtered suite passed 93 tests (1 opt-in live test skipped). It covers phase timeout canceling its underlying operation, preserving user cancellation, bounded/cancelable HTTP JSON and SSE bodies, bounded/cancelable stdio frames, process-tree cleanup, and combined MCP output truncation. This does not verify the full app's responsiveness or the configured startup/catalog/execution/shutdown limits during a live conversation; native slow-server interaction remains open.
 - [ ] `R1-Q3-65` Save settings, restart, and verify they persist. Then test one malformed server entry, duplicate IDs, and malformed top-level JSON; valid unrelated servers should continue where possible, and unreadable source JSON must be preserved rather than overwritten.
 
 ## Local semantic project search (A9)