[yyjeqhc]

MCP response handoff preceded synchronous audit persistence, so a blocked Store Mutex could add seconds after handler_returned with no correlated request-tail evidence. Keep that compatibility boundary in place and record audit/finalizer/adapter completion separately; report known capture loss without blocking tools.

Boundaries and ownership

• MCP retains request received/parsed, dispatch finished, response serialized and existing handler_returned timing. Explicit original identity now reaches audit_finalize and whole request_finalize; lifecycle scope exit adds handler_finished after synchronous cleanup. Cancellation/unwind stays incomplete. These boundaries do not claim client receipt or body-stream EOF.
• ActionAudit owns its correlation, independently of the exited Tokio task-local. Store retains connection wait/hold timing and emits safe INFO evidence at >=100 ms after unlocking, with fixed domain, bounded trace ID and durations. Slow phases are also visible at INFO; fast calls do not add SQL/body capture.
• Queue capacity stays 64 and try_send stays nonblocking. A bounded, try-lock map coalesces losses for <=128 trace IDs and persists gap markers through the existing writer/budget/retention owner. Reader/UI expose an incomplete trace and a known-loss lower bound. Process counters also expose marker loss. Absence of a marker or presence of Handler finish never proves completeness.
• The implementation note describes serialization/compression/I/O congestion and the remaining best-effort boundary. This does not claim a durable trace journal or solve sustained disk throughput by increasing a queue.

Validation on mini (isolated fixtures)

• cargo test -p webcodex trace: 72 passed, including actual successful MCP invocation while the writer is blocked/saturated, 71 dropped events across 8 trace IDs, bounded overflow, cancellation, timeout and Runner disconnect.
• cargo test -p webcodex audit_: 71 passed; final finalization_tests: 2 passed. Real SQLite mutex + channels hold two requests after handoff; both finish durations include the wait, INFO logs and metadata retain distinct IDs, and failed audit persistence does not change successful tool output.
• cargo test -p webcodex-store connection: 11 passed, including nested context/unwind/re-entry and fail-open callback tests.
• cargo test -p webcodex-tool-contracts: 342 passed, 1 pre-existing ignored.
• Trace UI Vitest: 7 passed; TypeScript, generated bundle build and complete check:dist passed. Homebrew Node's zlib produced different PDF gzip bytes; all 183 decompressed assets matched, and official Node 22.23.4 / zlib 1.3.1 passed unchanged PDF artifacts. No unrelated generated PDF changes included.
• Formatting, whitespace and markdown links passed. Existing unused RunnerPollRequest test import warning remains.

Independent main-based PR A. Related B: #1324, C (stacked on B): #1325. No production configuration edits, service restarts, deployment or automatic merge. CI at b9260efc6 passed every selected job: Linux Server/Runner/workspace/tooling, contract, MCP conformance and aggregate gates. Native platform build jobs were skipped by this PR's path matrix. Workflow: https://github.com/yyjeqhc/webcodex/actions/runs/40492656887 .