fix(acp): route terminal failures to authors or opt-in sibling handlers

[viggo-1]

When a provider rejects a request because its session or usage allowance is exhausted, Buzz should stop retrying the same unavailable provider and emit a signed, thread-bound failure notice. This R4 candidate keeps that narrow terminal-stop behavior and the opt-in addressed routing to an existing attested sibling, while preserving bounded cycle and preflight guards.

The resulting behavior is:

• narrowly classified terminal provider-limit errors leave the futile retry path immediately;
• the default notice remains available when routing preflight is denied or unavailable;
• an explicitly configured sibling can receive one addressed notice after source signature, same-owner attestation, active relay identity, channel membership and visited-chain checks;
• ordinary assistant text, generic transport errors and uncertain writer state do not become terminal provider errors;
• the change does not implement model substitution, a durable queue, a writer fence, automatic native wake, or authority to replay uncertain side effects.

Validation already available on the R4 source includes a passing baseline and restored baseline for failure_routing_tests, plus three guard-removal mutants that fail as expected: source-author attestation, handler attestation and source-channel binding. The mutation receipt records restored production source and the five command outcomes.

The first full R4 CI attempt ended with one mobile failure (2097 passed): settings_profile_header_test.dart, “warms and clears a paused animated-avatar handoff”, expected a cleared handoff but observed one. The named test passed once in isolation; this is currently treated as timing/resource-sensitive evidence, not as a silently ignored pass.

Full just ci passed on the unchanged, clean R4 commit d6a4b53fe6274eaf4fac271cebdc0791c819a5f3 in attempt 2, including 953 ACP tests, 6,488 desktop tests and 2,098 mobile tests. Independent exact-revision review and the offline version-bound gate passed.

Controlled native-app pilots are now complete. One normal read ran through the R4 binary. A separate synthetic terminal-error fixture produced an addressed notice; an already-running, independently authenticated sibling read the original task and published the correct read-only result in the original thread. The first attempt with a stopped sibling did not start it; enabling the existing native Start on launch setting and verifying its process after app restart resolved that prerequisite.

The reserve's normal completion callback produced one unnecessary second notice; the reserve recognized the task as complete and did not repeat it. This is a workflow configuration issue requiring a recovery-specific no-callback rule, not evidence of durable scheduling or exactly-once writes. All synthetic ACP-command overrides were removed. The same hash-bound R4 binary is now running under the official desktop lifecycle on six existing operator-owned instances; both native handler fields were read back from each actual process after restart.

A separate all-unavailable fixture followed the configured five-agent chain and stopped on the visited guard. After removing the fixtures and restarting normal R4, a different included-plan worker resumed the original task from an unchanged checkpoint and published the remaining result in the original root. This demonstrates bounded read-only fallback and explicit resume after restart; it does not implement automatic wake at a later quota reset or prove external-write exactly-once semantics.

[github-actions]

🔐 Codex Security Review

Status: review required for the current range.

The current range is 051c3a270be9c73da9ab06700bcab7d5552fceaa...d6a4b53fe6274eaf4fac271cebdc0791c819a5f3.
A new review must complete for this exact range. When manual authorization
is required, a Block organization member must comment exactly
@buzz-security-review d6a4b53fe6274eaf4fac271cebdc0791c819a5f3 to authorize a new review.
Any previous review applies only to its recorded range.