refactor(models): migrate routing UI and lifecycle consumers

[decode2]

Outcome

Own the direct saved-routing export migration and export contract tests, then migrate the existing UI and lifecycle consumers to the shared production authority. This unit wires /gentle:models, session-start reporting and wiring, and /gentle:status to the authority delivered by #389 and the fail-closed apply contract delivered by #396. It preserves the existing parser, target paths, writes, profile materialization, JSON null behavior, literal string inherit behavior, and omission semantics.

Chain context

• Parent tracker: refactor(models): share safe routing persistence authority #382, part of feat(models): expose a machine-readable routing contract #381.
• Dependency/base: refactor(models): isolate saved-routing read authority #389 and refactor(models): isolate fail-closed saved-routing apply #396 must merge to main first. Use the resulting main as the implementation base and revalidate that base before starting work. The stopped combined candidate and PR refactor(models): centralize routing persistence authority #385 evidence are not implementation bases.
• Predecessors: refactor(models): isolate saved-routing read authority #389 delivers shared types and normalization, synchronous and asynchronous read authority, and minimal compatibility wrappers used by existing production callers. It does not directly migrate export, apply, UI, or status behavior. refactor(models): isolate fail-closed saved-routing apply #396 delivers fail-closed apply behavior and the profile byte, modification-time, and no-write safety proof. This issue consumes those contracts and does not duplicate their read, fallback, apply, or profile-safety logic.
• Follow-up: refactor(models): enforce canonical routing names and target authority #391 enforces strict canonical routing names and explicit target authority after refactor(models): isolate saved-routing read authority #389, refactor(models): isolate fail-closed saved-routing apply #396, and this consumer and export migration merge to main. Durable write and materialization remain later slices.
• Target: main. Use stacked-to-main delivery. The PR diff must contain only the direct export and UI/lifecycle consumer unit.
• Closure and linkage: the implementing PR must close only refactor(models): migrate routing UI and lifecycle consumers #395 and reference refactor(models): isolate saved-routing read authority #389, refactor(models): isolate fail-closed saved-routing apply #396, refactor(models): enforce canonical routing names and target authority #391, refactor(models): share safe routing persistence authority #382, and feat(models): expose a machine-readable routing contract #381. It must not close or approve refactor(models): isolate saved-routing read authority #389, refactor(models): isolate fail-closed saved-routing apply #396, refactor(models): enforce canonical routing names and target authority #391, refactor(models): share safe routing persistence authority #382, or the later durable-write and materialization slices.
• Initial labels: enhancement, status:approved.
• Approval and dependency: this issue remains approved, but implementation is dependency-blocked until refactor(models): isolate saved-routing read authority #389 and refactor(models): isolate fail-closed saved-routing apply #396 merge and the resulting main base is revalidated. Approval grants no authority to commit, push, publish a PR, merge, or approve a later slice.

Dependency diagram:

main
  └─ #389 shared types/normalization, sync/async authority, compatibility wrappers
       └─ #396 fail-closed apply and profile safety
            └─ 📍 #395 direct export contract/tests plus UI/lifecycle consumers
                 └─ #391 canonical names and target authority
                      └─ durable write
                           └─ materialization

Scope and acceptance criteria

• Migrate the real exportSavedModelConfig caller to consume the shared status-carrying authority from refactor(models): isolate saved-routing read authority #389 rather than reimplementing read, fallback, or invalid-source handling.
• Preserve the exact export contract: a missing source produces an empty agent map, a valid source produces normalized export, and an invalid source fails before the export file is created. Invalid global input remains invalid and does not fall back to a project source.
• Add behavior-level export and real-caller tests for missing, valid, invalid, invalid-source no-file-creation, invalid-global no-fallback, normalization, and source status propagation. The direct export hunk and export or real-caller tests from lines 120-196 of the frozen candidate belong here.
• Migrate the /gentle:models handler to consume the shared status-carrying saved-routing authority rather than reimplementing read, fallback, or invalid-source handling.
• Migrate session startup to the shared authority through the existing production call path, preserving current startup behavior for missing and valid sources and carrying invalid-source status without downgrading it to an empty configuration.
• Migrate /gentle:status reporting to the shared authority, preserving the existing status contract while exposing the authority's invalid-source result and source path where the current contract requires it.
• Keep the real export, UI, and lifecycle callers production-reachable. Exercise the direct export caller, /gentle:models, session startup, and /gentle:status paths, not a test-only export or fake caller.
• Preserve the refactor(models): isolate fail-closed saved-routing apply #396 apply-safety contract: invalid apply remains fail closed, does not fall back to an empty configuration, and leaves profile bytes, modification time, and write-attempt state unchanged. Missing and valid apply behavior remains unchanged.
• Preserve the current metadata name parser and grammar, target and path semantics, writes, profile materialization, JSON null behavior, literal string inherit behavior, and omission semantics.
• Explicitly create every test fixture directory before writing fixtures, including any root/agents directory used by discovery-adjacent tests.

Candidate allocation and test reuse

The frozen 455 A+D candidate is being redistributed without opening a new issue. The authority extraction, compatibility-wrapper work, module work of 112 lines, and authority test setup and tests from lines 1-118 remain in #389. The direct export hunk and export or real-caller tests from lines 120-196 move to #395. No safety test is deleted. This issue may reuse established scaffolding from the candidate, but it must not duplicate the #396 profile safety proof.

Intentionally out of scope

• No shared types, normalization, synchronous or asynchronous read-authority extraction, or compatibility-wrapper behavior change. Those belong to refactor(models): isolate saved-routing read authority #389.
• No fail-closed apply behavior or profile byte, modification-time, and no-write safety change. Those belong to refactor(models): isolate fail-closed saved-routing apply #396.
• No canonical-name expansion, strict canonical-name validation, explicit alias denial, or other target-authority changes from refactor(models): enforce canonical routing names and target authority #391.
• No durable saved-config write algorithm, temporary-file policy, cleanup, rename outcome, or directory durability.
• No profile materialization, frontmatter rewrite, inherit-by-omission, profile-field deletion, or unrelated profile-field preservation change.
• No parser or grammar change, target or path change, write behavior change, JSON null change, literal string inherit change, or omission-semantics change.
• No changes to refactor(models): share safe routing persistence authority #382, feat(models): expose a machine-readable routing contract #381, refactor(models): isolate saved-routing read authority #389, refactor(models): isolate fail-closed saved-routing apply #396, refactor(models): enforce canonical routing names and target authority #391, the durable-write slice, the materialization slice, provider/model discovery beyond these consumers, headless contracts, packaging, feat(models): add headless inspect and validate contract #383, or feat(models): add apply CLI and package executable #384.
• No automatic branch rewrite, commit, push, PR publication, merge, or approval of a later slice.

Strict TDD and verification

Strict TDD is required. The RED phase must be an executable assertion-level failure after dependency hydration, not a missing-module or environment error. The current governance snapshot records assertion-level RED and focused GREEN 4/4 for the combined candidate only. It is not issue completion evidence for this export and consumer slice. The implementation PR must report its own observed evidence before claiming completion.

Environment prerequisite: use an authorized implementation environment with dependencies hydrated by the repository package manager, pnpm@11.1.1, including @earendil-works/pi-tui.

Run the focused and package-supported commands after the behavior tests exist:

node --experimental-strip-types --test tests/model-routing-authority.test.ts
node --experimental-strip-types --test tests/gentle-ai.test.ts
pnpm test

• RED: add the smallest assertions showing that the real export caller, /gentle:models, session startup, and /gentle:status use the shared authority and preserve missing, valid, and invalid status and source-path information. Record the observed assertion-level failures after dependencies are available.
• GREEN: route direct export and the three real consumers through the shared authority with the minimum wiring change. Preserve the exact export contract, the refactor(models): isolate fail-closed saved-routing apply #396 apply-safety contract, and all existing parser, target, write, materialization, null, inherit, and omission behavior. Record the focused test result.
• TRIANGULATE: cover missing, valid, and invalid global/project sources, sync and async parity, the real export caller, /gentle:models, session startup, and /gentle:status, invalid-source no-fallback, invalid-source no-file-creation, source-path reporting, explicit fixture-directory creation, and the existing target and path semantics. Reuse the refactor(models): isolate fail-closed saved-routing apply #396 safety proof without duplicating it.
• REFACTOR: remove superseded consumer-specific read or fallback helpers without changing behavior, then rerun the focused commands and check-only syntax validation.

Review workload forecast and hard stop

Forecast only, measured against the clean immediate main base after #389 and #396 merge: 170 lower / 250 realistic / 365 upper A+D. The hard stop is above 400 A+D. No size:exception is permitted. If the clean diff exceeds 400, stop before publication and return to design for another causal split. Do not line-golf the diff or remove the tests that establish the export contract and consumer wiring.