fix(f117): member capability tips, error rendering and final handoffs

feature-specs/evidence/f117-feedback-2026-10-09/callback-source-identity-2026-10-10/commands.md

@@ -0,0 +1,15 @@
+# Reproducible commands (feature checkout)
+
+All API commands use `pnpm --filter @cat-cafe/api exec bash scripts/with-test-home.sh`, with `node --import ./test/helpers/setup-cat-registry.js --test --test-timeout=30000`.
+
+Red: `--test-name-pattern='callback preserves different explicit|callback retry restores' test/callback-routes.test.js test/callback-routes-agent-key.test.js` before the production edits.
+
+API final: test/callback-routes.test.js test/callback-routes-agent-key.test.js test/callback-message-identity.test.js test/callback-a2a-trigger.test.js test/cross-thread-action-successor.test.js test/action-successor-carrier-recovery.test.js test/action-successor-carrier-refresh-admission.test.js test/action-successor-carrier-refresh-recovery.test.js test/callback-f193-boundary.test.js test/callback-cross-post-fail-closed.test.js test/post-message-successor-e2e.test.js test/f247-cloud-return-append-winner.test.js test/callback-f177h-participant-check.test.js test/callbacks-f182-c.test.js test/callback-scope-helpers.test.js test/cross-thread-coordination-ingress.test.js test/message-store.test.js test/direct-action-carrier-recovery-e2e.test.js test/direct-action-carrier-refresh-e2e.test.js test/1398-reeval-carrier-atomic-admission.test.js
+
+Redis: same wrapper, then `bash scripts/run-isolated-redis-tests.sh -- node --import ./test/helpers/setup-cat-registry.js --test --test-timeout=60000 test/redis-message-store.test.js test/redis-message-delivery-atomicity.test.js`.
+
+MCP: same HOME wrapper, then `node --test ../mcp-server/test/callback-tools.test.js ../mcp-server/test/callback-tools-agent-key.test.js ../mcp-server/test/callback-retry.test.js`.
+
+Original reproducer: same HOME wrapper, then `node --test /tmp/astra-callback-distinct-client-id.test.mjs`.
+
+Build: `pnpm --filter @cat-cafe/api exec tsc`; `pnpm --filter @cat-cafe/finance build`; `pnpm --filter @cat-cafe/mcp-server exec tsc`.

feature-specs/evidence/f117-feedback-2026-10-09/callback-source-identity-2026-10-10/report.md

@@ -0,0 +1,34 @@
+# Callback 来源身份：删除正文窗口过滤
+
+续接原 task300 / A2A Lifecycle1398。接受来源为 operator231 `thread_msr51149hym0i79f#0001791607522054-000231-d1275eea`；精确新增 P1 来自 Astra237 `0001791607642722-000237-455b56e0`。基线 `6bec5551f92f6980300d22b33e0582d8a40d18a0` 的 D20 测试/注释修复已有独立批准，本增量另行审查。
+
+## 根因与删除
+
+普通 invocation / agent-key `post_message` 在入队之前，先扫描5秒内同文消息，再认领正文指纹；显式 clientMessageId 不在指纹中。不同ID同文的新消息被判重复。两条入口还在写入前认领短期 client ID，存储失败后该ID已被消耗，重试没有消息可恢复。四个新反例先跑，4/4失败：两入口新ID被吞、两入口落盘失败后重试被吞。
+
+删除正文窗口扫描、指纹计算、原子正文认领及其缓存、Redis键生成器、消息库接口/实现和仅验证已退役接口的两条测试。普通发送不再调用 invocation/agent-key 的提前认领。没有新增缓存、TTL窗口、正文判别器或队列防重实现。
+
+## 现有身份与事务
+
+现有 MCP post/cross-post 发送器为一次调用生成 clientMessageId；HTTP重试和outbox保持原载荷。普通回调将此ID与已认证的发送者绑定，复用消息库的 user/thread/idempotencyKey 索引及 appendIdempotent；有接收成员时复用既有 Message+Queue 原子准入。不同ID同文独立持久化、各自唤醒；同ID重试返回原 messageId。失败发生在落盘前则不占ID。没有ID的直接HTTP请求按独立消息处理，既有MCP发送器无需改动。
+
+空接收集合分支也复用 appendIdempotent，否则原子消息/队列分支之外会遗漏身份。恢复投递只使用已持久消息的正文、目标和 replyTo，不将重试载荷当新来源。身份同时适用于 invocation 和同一发送者的 agent-key 传输；不同发送者使用相同字符串ID互不覆盖。
+
+精确云端回流、typed local-review 和 action-generation 的专用持久键与冲突校验保留，并优先使用原键。callback token、owner/thread/source/action围栏不变，未增加来源/角色发送许可。原短期认领API没有普通发送调用；原始鉴权后端旧状态读取和历史崩溃夹具保留，不清除存量键。无ID的历史消息不凭正文回填请求身份。
+
+## 同类消费者和兼容
+
+将旧同文合并断言改成新ID或无ID的独立消息/队列断言，保留 action lease/fence、coordination 和持久身份的语义检查。扫描方法仍被审查历史读取使用，因此更名为历史读取而保留该消费者。更新三处 stream+callback 合并的陈旧注释；历史 cliStdout/speechContent 的读取与渲染没有删除。
+
+真实隔离Redis验证另暴露同文件既有 F317 夹具直接传旧 catId 输入：缺少 canonical MessageFrom。改用同文件既有 appendFixture 助手，原历史身份断言全部保留，未改生产F317行为。初跑63/64与修后64/64日志均保留。
+
+## 验证与边界
+
+- 20个API文件、23 suites、422/422；包括普通两入口、11个真实 MessageStore/InvocationQueue/Fastify.inject 身份场景、跨thread、action恢复、typed review、云回流、原子准入。
+- 独立分配临时Redis实例：消息库及投递原子性64/64，0跳过；测试wrapper核对实例归属，未使用运行实例Redis。
+- MCP发送/agent-key/传输重试3文件108/108；包含已有稳定clientMessageId重试/outbox断言。未改MCP生产源。
+- 原Astra反例脚本未改，作者亲跑1/1转绿；不是把作者结果宣称为新增独立批准。
+- Feature API、finance依赖及MCP tsc完成。最初MCP缺finance dist，编译现有依赖后成功；这是构建准备，不是候选行为失败。
+- diff-check通过；退休正文扫描/指纹接口及上一轮跨消息target过滤标识在src/test无命中。保留的精确载荷比较只校验同一typed事实/action-generation的冲突，不扫描历史正文认定普通重复。
+
+本增量Web仅注释，没有UI行为变更；没有重跑未变full gate/provider/browser/soak。当前运行实例仍未包含本增量，未修改配置/数据/运行代码，未merge/restart。原1398/220是唯一发布路径；需本增量独立批准和新head的实际CI，不能用旧head的批准/CI宣称220可合。

feature-specs/evidence/f117-feedback-2026-10-09/callback-source-identity-2026-10-10/sha256.json

@@ -0,0 +1,15 @@
+{
+  "api-build.log.gz": "9ceffb7310338057cfe71a4ae1e2c98d2c485d81cdef906532a801f457a38d64",
+  "api-green.log.gz": "46a880ab997620e3d18c18ace5d2cf84d0fe3c5df172b3ffba726f8751c3dbcb",
+  "commands.md": "5cdc82656846023b12a65843e4b094e49866d288b279a702b5d501c1a0d45644",
+  "finance-build.log.gz": "b89f30aaf70abb26a4cadd588400c10f84c2e45d4eb4fe95807abdfe86eca219",
+  "format.log.gz": "8476dcb5c8d1ef7a932e09d29b4adbfba1a3fb5ad22cba0f7da18398b72c2df0",
+  "mcp-build.log.gz": "9ceffb7310338057cfe71a4ae1e2c98d2c485d81cdef906532a801f457a38d64",
+  "original-reproducer-green.log.gz": "e576139ff7cad4df095e3570b9a8340a067c904cc50f1c7683179f5828ca8438",
+  "producer-green.log.gz": "9fda10d5d675d4d1414ba2cf9df4aaf72340080fab181f5c0e03a432ebe33cf7",
+  "red.log.gz": "22ad2eaed010bf2a7722fd6bcef4f2f374a89f1a98eac89a11350660c049d642",
+  "redis-green.log.gz": "8f63bbc49e3e168fe5f7c440f342c6c93a78f22575d9b56f0d41b4acdf15d8f6",
+  "redis-initial.log.gz": "ed5ef9c5a00158be1cd904bfb835d063400d1ed271f9234b391cf8465eee35b7",
+  "report.md": "d8fa1551a2dabbe1746cd8dbebbaee6f6701b9d5038db6e1bb29e8cd024e62a8",
+  "retired-search.log.gz": "9ceffb7310338057cfe71a4ae1e2c98d2c485d81cdef906532a801f457a38d64"
+}

feature-specs/evidence/f117-feedback-2026-10-09/dual-path-ci-2026-10-10/report.md

@@ -0,0 +1,21 @@
+# D20 retirement: remaining dual-path CI consumers
+
+Accepted source: `thread_msr51149hym0i79f#0001791607259130-000220-13857b48`, revision `0001791607259130-000220-13857b48`. Peer handoff: `0001791607343110-000223-7896e07a`; queue clarification: operator222. Base: published `64d4611e3c7f18ac390e61ba44d0fab1c9eb7e27`, shared by upstream1398 and fork220.
+
+## Failure and cause
+
+Exact-head CI run38023710000 failed distributable-5 job114130261485 at dual-path-strict-equality.test.js:155 and distributable-6 job114130261558 at dual-path-validation.test.js:186. Both expected24 per-turn hooks; D20 automatic Signal article injection had been intentionally retired, leaving23. The prior cleanup missed these two consumer assertions. Original CI failure excerpt and local red12tests/10pass/2fail are retained. No production hook or prompt behavior is being changed to satisfy an obsolete test.
+
+## Successor
+
+Keep count23 and explicitly assert all surviving IDs D1-D19,D21,R1,R2,N1. Assert retiredD20 produces no trace event or prompt patch; session mailboxD21 remains registered. Existing session22, identity, governance, direct-message, teammates, serial/A2A mode, infrastructure, scope filtering, trace draining and structural trace assertions remain intact. This verifies the retired capability and surviving catalog, rather than only decrementing a number.
+
+Correct stale comments in PipelinePromptBuilder, the manifest endpoint and manifest generator to active45/session22/per-turn23. These are comment-only changes; production executable behavior, schemas and generator entries are unchanged. Scan source/tests/shared/generator/manifests/templates for obsolete24/46 hook-count assertions and retired D20 wiring; no active matches remain. Historical feature docs and evidence remain historical rather than being rewritten.
+
+Also confirm confirmedLocalCallbackRoutedTargets/confirmedLocalCallbackRoutingMentions/getLocalRoutingLineStartMentions have no remaining src/test matches. No new dedup layer is introduced; existing Queue source identity remains unchanged. Do not redeliver historical101/123.
+
+## Verification and limits
+
+Nine affected API files,13suites,110/110 pass: the two failing files plus hook-pipeline, hook-pipeline-integration, hook-resolver-registry, hook-resolvers-session, hook-resolvers-turn, hook-segment-coverage and transport-boundary-l0-equivalence. Temporary testHOME/blocked Redis/in-memory fixtures; no real provider or runtime experiment. Feature API tsc, Biome and diff-check pass. No unchanged Web/full-gate rerun. Fresh remote CI is not yet proven for the successor.
+
+Prior approved4f04 cleanup/tips,6a8 errors and2f9623 routing scope remains intact; this successor is test assertions plus comments/evidence only. Exact successor review goes back to Astra, then normal fast-forward updates original1398/220. No new PR/tracker, runtime/config/data/process mutation, merge or restart. Operator220 says to finish before they merge220; no claim it is ready until actual review and current-head CI are accounted for.

feature-specs/evidence/f117-feedback-2026-10-09/dual-path-ci-2026-10-10/sha256.json

@@ -0,0 +1,8 @@
+{
+  "build.log.gz": "9ceffb7310338057cfe71a4ae1e2c98d2c485d81cdef906532a801f457a38d64",
+  "ci-failure-excerpt.log.gz": "c18c42e7b66de210c977a7632b8cf754554fb22887e7fdba4a411f5e05d8fa28",
+  "format.log.gz": "8300ca4ea5b136b1e618858b1c31d5c68a3039a5507376e68533e5b0cda5a3d8",
+  "green.log.gz": "bc7f3efd25580537a2b7c6fbdd6dae140a69a14d53b4b82c8fce11cf3d3f3701",
+  "red.log.gz": "1209bddf2606729926e750ed8ff1321339851f5d49225c544ffe1ac6c377e366",
+  "report.md": "27187f68d7bb39fc2da267fcd80bc81b765db38a4c9f9d4379b3d41cf0541a5d"
+}

feature-specs/evidence/f117-feedback-2026-10-09/final-handoff-source-2026-10-10/report.md

@@ -0,0 +1,34 @@
+# Distinct final handoff after a callback — operator143/152/153
+
+Accepted source/revision: `thread_msr51149hym0i79f#0001791604877657-000152-d70a0ecf` / `0001791604877657-000152-d70a0ecf`. Related operator153: `0001791604934659-000153-3ba6c6ac`. Reviewer P1 and previous UI approval: `0001791605056758-000160-068add86`.
+
+## Observed failure and root cause
+
+Astra independently inspected final response101 (`0001791604123156-000101-224c12c9`): its body included a legal line-start @astra, but History had mentions=[] and no dispatch receipt, with no remaining Queue work. Earlier callback123 (`0001791604430844-000123-29f6d684`) had delivered a different scope notification to Astra. The running source and dist matched.
+
+routeSerial collected successful callback targets in a per-turn set and removed every matching target from the final response. This incorrectly treated two independent message sources as one source. Removing availability checks earlier did not address this separate mechanism.
+
+## Final design
+
+The callback message and the final lifecycle response each own their own source × target identity. Final response routing takes its own parsed body, without merging or subtracting callback targets. Existing Queue source identity/idempotency owns duplicate admission; no new cache, fallback, condition or inferred-text identity is added. A final response with identical text still has a distinct source ID; string equality cannot erase its delivery. A callback confirmation contributes its own persisted message ID once and never becomes a new final-message carrier.
+
+Delete the per-turn recipient set, callback-to-final mention union/filter, and unused callback routing fields. Keep callback evidence for the existing turn-exit/custody guard and co-creator event ownership. Failed callbacks do not suppress a final handoff; plain final prose does not invent delivery from callback targets. Do not re-dispatch historical101/123.
+
+Parallel route inspection found no corresponding target set/filter. Its existing contract suppresses ordinary final @ routing; explicit callback admission is independent. Keep that contract and add a regression for a confirmed callback followed by parallel final @ prose. This fix does not change parallel planning, permissions, provider behavior or Queue persistence schema.
+
+## Red → green and affected checks
+
+- Nine new real-source scenarios use actual MessageStore, InvocationQueue, lifecycle response admission and production commitCompletedResponseAndEnqueueA2ATargets. Before the change: 4 failures / 5 passes. Four failures precisely reproduce suppressed final mentions after a successful callback, including identical text and duplicate confirmation.
+- All nine now pass. Assertions cover exact final source ID, completed lifecycle, production wake commit, independently queued source × target, no duplicated callback row and callback IDs recorded once. No recursive inline target execution.
+- Five related API files: 156/156 (routeSerial callback/persistence, route strategies, parallel suppression, callback result parser, completed wake admission).
+- Six boundary files: 52/52 (includes four parallel suppression tests, plus phase-H, verdict, callback custody, callback post-message and turn-custody telemetry). Parallel file overlaps the earlier run; these counts are not summed as unique tests.
+- Author reran Astra's original independent reproducer against newly compiled feature dist: 1/1; both priorCallback=false and priorCallback=true retain codex. This rerun is author verification, not a new independent verdict.
+- Feature API tsc succeeds; dist route-serial.js is newer than source. Biome succeeds with existing warnings; git diff --check succeeds.
+- Tests use temporary test HOME, blocked Redis endpoint, in-memory stores and mocked provider streams. No runtime mutation, process restart or live provider invocation. No full gate/UI rerun for this API-only delta; prior UI review remains scoped to6a8.
+
+## Review/publication continuity
+
+- Cleanup/tips: approved4f04c36a4b99acf19a747b74bc3d687d501d4f9d/tree352e4d56f5254b1963861a3d9256ac064c9ea441, fact0001791604181900-000105-4a948a51.
+- Error display: approved6a8f91618cf1a34a86536218b0f19d177d08c46c/tree63be5b317457d2f828c8846d703db4dd5ff4c78e, typed fact0001791605056758-000160-068add86. It explicitly does not approve this new routing delta.
+- Next: exact-head independent review of this API delta, then authorized normal fast-forward of original#1398 source branch and a new fork develop_base incremental PR. No self-merge/restart. Do not reopen merged219 or claim operator soak complete.
+- Known prior internal preparation delay and collaborative-content member-availability selector remain recorded separately; this handoff fix does not claim to resolve them. Operator121 conditional retry request stays excluded because no generic failed-response retry endpoint exists.

feature-specs/evidence/f117-feedback-2026-10-09/final-handoff-source-2026-10-10/sha256.json

@@ -0,0 +1,9 @@
+{
+  "boundary-green.log.gz": "5d154f7b5c78af9c52c617b3e96b7251573e3c16ce46b91cdd4109fd1d6a6f9e",
+  "build.log.gz": "9ceffb7310338057cfe71a4ae1e2c98d2c485d81cdef906532a801f457a38d64",
+  "format.log.gz": "de01ee221cb2ebaf36d350c0d7601bc8d14649319ac7288d1164f8663367666c",
+  "red.log.gz": "f916217dedc7cd5dce035f74be891ceba127b989ed6f02e53a629059a17ae770",
+  "report.md": "0f60c6f5fe2e65334adfa541fbfcd2d7929b35a98588f5a712b14c27357524a4",
+  "reviewer-reproducer-author-green.log.gz": "16bfce4d9b6e550d5e6e4f0df676295a484e03029138fdaa445fc4475cc35c1f",
+  "route-green.log.gz": "7ecc05be25a678ec8292a7736fb37c4303c0545ed58dfef2863a526c653f3bc6"
+}