[Bug]: transient-hold resolver and pool-wide recovery limiter are not wired into production dispatch #4701

Summary

The 2.56.0 tree added and documented a transient half-open resolver plus a process-wide recovery ratio limiter in #4626, but the production request path does not call the new dispatch APIs.

Current exact refs checked:

• dev: cc182a40526a1d87cf5b4b7949fdc6979e70747f
• released main / v2.56.0: includes feat(routing): bound recovery with a half-open probe lease and honour Retry-After in full (#4546) #4626 through the promoted 386303af1 product tree

Current behavior

A source search outside src/routing/probe-lease.ts finds no production caller of:

• resolveHeldAccountDispatch
• sharedPoolBackpressure
• createPoolBackpressureLimiter
• recordInitialSend
• tryPermitRetryDispatch
• tryPermitProbeDispatch

Only direct unit tests call the resolver and limiter. Existing production imports of this module are for the older Codex quota-probe lease functions (tryAcquireCodexQuotaProbeLease, ownsProbeLease, and related settlement helpers). Those do not connect the new transient-hold resolver or the pool-wide initial/recovery send ratio.

Consequently, the new unit tests prove the isolated primitives, but a burst of separate requests still has no shared limiter at the initial-send and retry/probe dispatch boundaries. The structure contract currently says the limiter is active, which overstates runtime behavior.

Expected behavior

Production account selection should consume resolveHeldAccountDispatch for a bound transiently held account, preserving its working detour while permitting only one half-open probe. Every physical first send should call the shared limiter's recordInitialSend; every retry and transient probe should obtain a recovery permit before dispatch.

A refusal must return a future retry time rather than busy-looping, must not consume the request-local send budget, and must not discard the remembered detour.

Required regression coverage

1. Two concurrent requests bound to the same held account produce one probe and one detour/withheld result through the real request boundary.
2. Many requests share one process-wide recovery ratio; separate request objects cannot each obtain a private allowance.
3. A refused recovery dispatch performs no provider fetch and returns a bounded future retry signal.
4. Success/failure/expiry settlement cannot overwrite a newer affinity generation.
5. Existing quota-probe behavior remains unchanged.

Scope note

This is not a claim that every probe lease is unused. The existing quota-probe lease is wired. The gap is specifically the transient-hold resolver and pool-wide recovery limiter introduced in #4626.

@lidge-jun This was reported by the post-promotion exact-tree review on #4694 and is present in the released 2.56.0 tree. I recommend treating the runtime wiring and the inaccurate active-contract wording as a 2.57 follow-up, not patching the release branch directly.