Follow-up: reconcile advisory routing with exact-route provenance after #348

[justin808]

Problem

PR #348 merged a useful requested-versus-observed routing contract and the #400 routine-coordinator policy, but the resulting portable policy contains two incompatible launch rules:

• docs/agent-workflows-model-routing.md lines 10-16 say route preferences are advisory, an unavailable/different/inherited/UNKNOWN route never alone blocks launch, and the closest route or runtime default should continue.
• Lines 359-361 and 396-398 say the same unavailable/different/inherited/UNKNOWN exact route must stop before editing with MODEL_ROUTE_MISMATCH.

The contract test pins both statements, so green validation preserves rather than detects the contradiction. An agent can reasonably either continue or stop the same lane depending on which section it reads.

This also leaves two associated release-facing inconsistencies:

• the ten-batch promotion paragraph calls Add replay-safe batch and worker usage telemetry receipts #398 an execution-provenance receipt dependency, but Add replay-safe batch and worker usage telemetry receipts #398 owns usage/cost receipts; Follow-up: versioned execution-provenance receipt schema and validator (#151 AC1) #333 owns execution provenance and Follow-up: replay fixtures and evaluation runner for measured route recommendations (#151 AC6-AC8) #335 owns the evaluation runner;
• CHANGELOG.md still describes unconditional Sol/xhigh multi-lane coordination while the merged Default routine PR-batch coordinators below Sol/xhigh and require measured escalation #400 policy uses balanced/high for routine coordination.

Direction

Choose and encode one portable rule:

• advisory routing remains the default, so a route mismatch is recorded honestly and excluded from route-measurement evidence but does not by itself stop otherwise valid work; or
• a genuinely binding exact-route experiment is a separately explicit mode with its own authority/capability preconditions, rather than being inferred merely because a prompt names a tuple.

Preserve requested-versus-observed separation, authorized-fallback provenance, no silent coordinator-pair inheritance, and explicit user-selected overrides. Do not weaken independent review, scope, security, evidence, or authority gates.

Update the measured-promotion prerequisites to require #398 usage receipts together with #333 execution-provenance receipts and the #335 evaluation runner. Align the Unreleased changelog with the resulting policy.

Acceptance criteria

• One unambiguous launch rule governs unavailable, different, inherited, and UNKNOWN routes.
• A focused contract test rejects simultaneous advisory-continue and unconditional route-only stop semantics.
• A mismatched or unobserved route cannot be presented as the requested route or included as measured route evidence.
• Binding exact-route behavior, if retained, requires an explicit mode and authority/capability contract.
• The ten-batch promotion dependency names Add replay-safe batch and worker usage telemetry receipts #398, Follow-up: versioned execution-provenance receipt schema and validator (#151 AC1) #333, and Follow-up: replay fixtures and evaluation runner for measured route recommendations (#151 AC6-AC8) #335 according to their actual responsibilities.
• CHANGELOG.md no longer states the superseded unconditional Sol/xhigh coordinator default.
• Focused routing tests and bin/validate pass.

Process Gap Disposition

• Mechanism target: checklist+replay
• Motivating miss: PR Enforce requested-versus-observed model route provenance #348 merged mutually incompatible routing launch rules while the contract test pinned both as individually required prose.
• Replay evidence or park reason: replay the merged 84b027a guide and assert that advisory fallback cannot coexist with unconditional route-only launch blocking without an explicit binding-mode discriminator.
• Non-goal: another broad prose-only routing instruction without a conflict-detecting contract test.

Audit ledger: not applicable (non-release audit).

Refs #348, #400, #398, #333, #335.

[justin808]

we want:

advisory routing remains the default, so a route mismatch is recorded honestly and excluded from route-measurement evidence but does not by itself stop otherwise valid work; or