fix(F117): restore cross-thread delivery and Codex read receipts

docs/architecture/ownership/cells/routing-context.md

@@ -1,8 +1,8 @@
 ---
 cell_id: routing-context
 title: Live Routing Context
-summary: 在决策时组合 F208 applied capability revision、owner 条件偏好与带 freshness 的 cat/provider/provable-pool availability，并向 Workspace Team、invocation cognition 与 dispatch preflight 提供可解释 projection；不拥有 capability 更新、成员/runtime 配置、quota collection、provider telemetry、identity/session 或 dispatch execution。
-description: F293 路由决策组合边界：持久 signal、版本化 preference、applied capability revision、Team/ledger read model、动态 cognition 与发送前 preflight；不接管 Workspace host、事实采集、画像更新或 dispatch。
+summary: 在决策时组合 F208 applied capability revision、owner 条件偏好与带 freshness 的 cat/provider/provable-pool availability，并向 Workspace Team 与显式查询提供可解释 projection；普通消息不消费 availability 预检或提示；不拥有 capability 更新、成员/runtime 配置、quota collection、provider telemetry、identity/session 或 dispatch execution。
+description: F293 路由决策组合边界：持久 signal、版本化 preference、applied capability revision、Team/ledger read model、显式路由查询；普通消息执行不接可用性闸、动态提示或终态回写；不接管 Workspace host、事实采集、画像更新或 dispatch。
 description_source: model
 description_author: codex-sol
 description_generated_by: codex-sol@gpt-5.6-sol
@@ -50,14 +50,13 @@ boundaries:
     - owner-scoped immutable routing signal events and active projection semantics
     - versioned owner routing preferences with provenance
     - candidate explanation, alternatives and allowed/warned/rejected preflight decisions
-    - sparse per-invocation cognition projection and shared F284 Team-mode/ledger/contextual routing view model
+    - explicit routing projections and shared F284 Team-mode/ledger/contextual routing view model
     - translation of canonical typed observations into immutable routing assertions and causal recoveries
     - routing signal owner-revision coherence and immutable timeline cache invalidation
   consumes:
     - F208 applied capability revisions and relevant evidence-backed signals
     - F051 canonical quota refresh evidence only when stable pool identity is present; route impact still requires a provable binding
     - F153 typed provider/runtime health observations with explicit subject authority
-    - canonical durable dispatch terminals paired with the exact actual-send preflight decision
     - runtime catalog cat/provider bindings and thread-local routing overrides
   does_not_own:
     - capability dossier prose, proposal/apply lifecycle or model benchmark truth
@@ -68,7 +67,7 @@ boundaries:
     - TurnExecution terminal ownership, failure text classification beyond the closed stable routing classes, or delivery outcome mutation
     - Workspace host/chrome, current-thread Now surface or background focus navigation
     - silent target selection or opaque routing scores
-last_reviewed: 2026-09-02
+last_reviewed: 2026-10-10
 ---
 
 # Live Routing Context
@@ -77,12 +76,12 @@ F293 owns the decision-time composition layer between canonical source facts and
 
 Signals and global preferences are owner-scoped. They are not partitioned by project path because provider health and quota scarcity do not become healthy in another repository. The resolver intersects that truth with the current runtime catalog and candidate set.
 
-The native L0 remains a stable, cached identity/governance surface. Dynamic routing exceptions are injected through a per-invocation cognition projection adjacent to the ADR-038 staging path, then independently re-read at the actual dispatch boundary.
+The native L0 remains a stable, cached identity/governance surface. Per operator direction in F117/#1398 (2026-10-10, messages 051/054 in `thread_msr51149hym0i79f`), ordinary serial/parallel replies, callbacks, Append and failure returns no longer consult availability preflight or inject routing advice. Requested targets enter the existing delivery lifecycle; actual client results produce the normal success/failure response. Invocation terminals no longer publish global member availability. Team views, explicit routing queries and persisted ledgers remain independent of message execution.
 
-Automatic source adapters do not own their input facts. They validate and translate only canonical F051 refreshes, explicitly scoped F153 observations and persisted TurnExecution terminals through `AutomaticRoutingSignalService`. They cannot append the event store directly, import another domain store, derive scope from hidden account identity or instantiate another resolver. The architecture guard ratchets those seams mechanically.
+Automatic source adapters do not own their input facts. They validate and translate only canonical F051 refreshes, explicitly scoped F153 observations through `AutomaticRoutingSignalService`. They cannot append the event store directly, import another domain store, derive scope from hidden account identity or instantiate another resolver. The architecture guard ratchets those seams mechanically.
 
 The resolver caches only immutable owner timelines under `RedisRoutingSignalEventStore.getOwnerRevision()`. A newly appended event increments the shared revision atomically; replay does not. Every resolve still re-runs time-sensitive reduction, so cache reuse never freezes expiry or derived availability.
 
-`unavailable` may reject only when subject scope and active validity are proven. Advisory states never silently reroute. Resolver/store failure returns warned fail-open and an audit event so routing context cannot become a dispatch availability single point of failure.
+Explicit routing queries can explain `unavailable` only when subject scope and active validity are proven. These projections do not reject, delay or warn during ordinary delivery, and cannot silently change its requested target. Already persisted signal events remain readable; this retirement does not erase historical data.
 
 The user-facing Team surface is a canonical F284 Workspace mode, not a sibling host or an expansion of the current-thread Now surface. Background routing changes update the shared read model and needs-you Activity only; explicit user navigation is required to open Team list or detail.

feature-specs/evidence/f117-feedback-2026-10-09/ci-followup-2026-10-10/report.md

@@ -0,0 +1,16 @@
+# F117 CI follow-up: ordinary delivery ignores legacy availability
+
+Observed public head: `52cb79817066d458555d67d81e7132545434dd26`.
+Failure source: [distributable-6 job](https://github.com/zts212653/clowder-ai/actions/runs/38017850925/job/114112452232), run `38017850925`.
+
+The lane has one failing test in `routing-human-recovery.test.js`: its old journey expected a failed provider invocation to publish global unavailability, reject later cross-thread requests, and require an owner recovery attempt. The aggregate `Test (Public)` consequently failed. This test was omitted from the earlier targeted author and independent checks; their passing counts did not cover this journey.
+
+The implementation already matches operator 017/051/054. Keep production code unchanged. Rewrite this existing journey to assert each requested thread executes, reports its real error, never queries legacy availability or publishes global member state, and never creates an availability rejection receipt. Seed one durable legacy signal to prove it stays readable without controlling ordinary sends. After provider recovery, only explicit new requests execute; failed work is not replayed. Other explicit recovery-service tests remain intact.
+
+Local original test: 8/9, exit 1, same `allowed` versus `rejected` assertion as CI. Corrected test: 9/9, exit 0. Related three-file check: see `f117-ci-followup-related-green.log.gz` for the exact total and all named cases. Biome check and git diff check passed.
+
+No production source, runtime config, persistent user data, running process, or workflow change. The earlier Opus approval remains bound to `709caf89`; it is not a verdict on this new test-only commit. Independent validation for this external CI correction is the fresh published-head CI. No merge or runtime restart is authorized by this record.
+
+Architecture cell: routing-context ordinary-delivery consumer retirement.
+Map delta: none; existing regression now asserts the retired consumer stays disconnected.
+Why: preserve the operator-approved delivery contract instead of restoring a global suppression layer to satisfy an obsolete expectation.

feature-specs/evidence/f117-feedback-2026-10-09/ci-followup-2026-10-10/sha256.json

@@ -0,0 +1,17 @@
+[
+  {
+    "file": "f117-routing-human-recovery-red.log.gz",
+    "sha256": "8114c464c535103cc1b8c842461035fcf5dc78eebf14f7356bd7ace3e9d5173d",
+    "uncompressedSha256": "bd5068de54ca338fb2a92634c4b3a9a2617b54c6f3761f06982137910a7b47b8"
+  },
+  {
+    "file": "f117-routing-human-recovery-green.log.gz",
+    "sha256": "605623cccdc9910eaece723b3bc64ad7b3ece4486c1ae3c032c65fd053331e86",
+    "uncompressedSha256": "b45b72008e64e91f211145816192cb6007c71ec6f655ecb2a84c9f1131d65f62"
+  },
+  {
+    "file": "f117-ci-followup-related-green.log.gz",
+    "sha256": "84cad6ba4a9006320aed6c852566b98b0d06d845f9838162c05f78c1c00769f0",
+    "uncompressedSha256": "4b1ab60926ccffa0e524139ce2bfa0f4ffeca2753ce4ace53142b5148ee0d0b0"
+  }
+]