Feat
- observability: record why each OAuth token is rejected, and for whom
- observability: record MCP client fleet and tool-delivery semantics
Fix
- observability: record a management grant only once the allowlist clears
- observability: remove unreachable return left by the chain refactor
- observability: record a fallback chain as one rejection, not one per stage
- observability: drop the duplicate log I added in round 7
- observability: record valid only once an AccessToken exists
- observability: record a token validation once, at acceptance
- observability: classify JWKS fetch failures as network_error
- observability: keep the verified client_id on allowlist rejections
- observability: record the last silent rejection path (opaque, no validator)
- observability: derive rejection result from reason; close remaining gaps
- observability: remove test-order coupling and falsy-value accessor bug
- observability: bound the cardinality of caller-chosen metric labels