docs: correct Discord durability boundary

docs/DEVELOPER-GUIDE/architecture/channel-protocol.md

@@ -32,7 +32,7 @@ The migration from `docs/_old_structure/architecture/channel-protocol.md` is a d
 The current source boundaries also distinguish two identities:
 
 1. A channel route carries a configuration-owned logical agent and response destination.
-2. The gateway chooses the durable session, provider, model, and runtime session internally.
+2. The gateway chooses provider, model, and runtime session internally. Durable-session enrollment is separate and is not proven by the external channel route alone.
 
 A route is therefore not a claim that a channel adapter owns or exposes a harness, provider, model, process, or native runtime-session identity.
 
@@ -152,15 +152,21 @@ The gateway exposes the `/chat` Socket.IO namespace. A Discord connection authen
 
 This path is intentionally described as compatibility: the gateway receives a signed Discord envelope and reconstructs chat input; it does not currently receive a complete `ChannelIngressDto` from the host registry.
 
+### Persistence and durability boundary
+
+The Discord `conversationId` is an external route string such as `<logical-agent-id>:discord:<channel-or-thread-id>`. Persisted conversations and messages use UUID conversation IDs. No current route-mapping layer was found that resolves the external route to a generated UUID before ordinary Discord writes. The gateway catches persistence/binding failures and may continue dispatch, so live output does not prove durable history or restart/resume continuity.
+
+The focused cross-surface integration test explicitly pre-enrolls a durable session before exercising control flow. It does not prove that a fresh ordinary Discord message creates durable conversation/message rows. Current architecture claims are therefore limited to authenticated routing and live delivery. Durable Discord continuity requires a route-to-UUID mapping, observable persistence failures, ordinary-ingress enrollment where required, and a fresh-database restart test.
+
 ### Thread and conversation behavior
 
-| Inbound case                                    | Current route and side effect                                                                                           |
-| ----------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------- |
-| Authorized untagged message in a parent channel | Uses the parent channel as the response target; no thread is created.                                                   |
-| Authorized bot mention in a parent channel      | Creates a public thread, or reuses the thread already attached to that message, and routes the response to that thread. |
-| Authorized follow-up in an existing thread      | Authorizes against the configured parent channel and keeps the existing thread; it does not create a nested thread.     |
-| `/approve` or `/stop <approval>`                | Uses the current parent/thread durable session and does not create a new topic.                                         |
-| Requested thread creation fails                 | Does not dispatch the message, because the requested response target cannot be honored.                                 |
+| Inbound case                                    | Current route and side effect                                                                                                   |
+| ----------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- |
+| Authorized untagged message in a parent channel | Uses the parent channel as the response target; no thread is created.                                                           |
+| Authorized bot mention in a parent channel      | Creates a public thread, or reuses the thread already attached to that message, and routes the response to that thread.         |
+| Authorized follow-up in an existing thread      | Authorizes against the configured parent channel and keeps the existing thread; it does not create a nested thread.             |
+| `/approve` or `/stop <approval>`                | Uses the current parent/thread route and requires an already enrolled durable session; ordinary chat does not prove enrollment. |
+| Requested thread creation fails                 | Does not dispatch the message, because the requested response target cannot be honored.                                         |
 
 ### Discord egress and health
 
@@ -265,7 +271,7 @@ Discord evidence:
 - [`apps/gateway/src/chat/chat.gateway.ts`](../../../apps/gateway/src/chat/chat.gateway.ts) — `/chat` namespace, service/session authentication, signed-envelope reconstruction, trusted binding selection, and raw stream egress.
 - [`apps/gateway/src/chat/chat.gateway-auth.ts`](../../../apps/gateway/src/chat/chat.gateway-auth.ts) — Discord service-token and BetterAuth session validation.
 - [`apps/gateway/src/plugin/discord-ingress.security.spec.ts`](../../../apps/gateway/src/plugin/discord-ingress.security.spec.ts) — signature, allowlist, replay, binding, attachment, approval, stop, and logical-agent checks.
-- [`apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts`](../../../apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts) — focused Discord-to-durable-session integration.
+- [`apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts`](../../../apps/gateway/src/__tests__/integration/tess-cross-surface.integration.test.ts) — focused control-flow test with explicit durable-session pre-enrollment; not ordinary persistence evidence.
 
 Hosting and compatibility evidence: