Recipient configuration should only narrow runtime eligibility
Treat a remotely configured recipient allowlist as an intersection with authoritative runtime eligibility, never as a replacement for it. A listed user must still have the required role, active membership, and active availability; then apply the existing load-balancing order. Re-…