Follow-up: Automatically fall back when a worker model route cannot be bound

[justin808]

The model-routing recovery policy currently requires an unavailable worker route to stop and re-plan, but it does not define how the coordinator should discover dispatcher capabilities or automatically select an authorized stronger fallback. This caused batch awfa-20260709-1753-docs-adoption to remain blocked after its requested Terra / Extra High replacement could not be bound through the available subagent API, even though a Sol fallback was acceptable once the operator was asked.

Incident evidence:

• The batch needed a corrective implementation worker for issue Follow-up: Fix seam-init forwarding edge cases after PR #107 #112 after PR Add one-command consumer seam initialization #107 merged with two known forwarding defects.
• The dispatcher exposed worker creation but no model/effort binding or verification field.
• The batch instruction prohibited an unbound worker, so the coordinator correctly preserved the claim and stopped.
• Goal-mode blocker auditing then repeated until the goal was marked blocked.
• Work resumed only after the operator explicitly authorized Sol / Extra High fallback.

Desired behavior:

• Represent routing intent as a required route plus an explicit ordered fallback chain, distinguishing hard prohibitions from preferences.
• At preflight, discover whether the active dispatcher can bind and attest the requested model/effort pair.
• If the requested pair is unavailable, automatically select the first operator/repository-authorized fallback and record requested route, actual route, reason, and authority in coordination state.
• If no fallback is authorized, ask one focused question immediately and persist a restart-safe decision request rather than repeating unchanged blocker audits.
• Preserve claim, branch, worktree, file-touch map, and sanitized replacement handoff across the switch.
• Never silently inherit the coordinator route or weaken an explicitly hard routing restriction.
• Add contract fixtures for: requested route available; requested route unavailable with authorized stronger fallback; unavailable with no authorized fallback; and dispatcher unable to attest its selected route.
• Ensure Goal-mode completion/blocking behavior resumes automatically after an authorized fallback is selected.

Process Gap Disposition:

• Mechanism target: schema plus dispatcher-capability preflight and replayable contract tests.
• Motivating miss: awfa-20260709-1753-docs-adoption, issue Follow-up: Fix seam-init forwarding edge cases after PR #107 #112 corrective lane.
• Replay evidence: simulate a dispatcher without model/effort parameters, configure Terra/xhigh -> Sol/xhigh, and prove the lane transfers once without overlapping workers or user intervention.
• Non-goal: prose that merely tells coordinators to ignore unavailable route bindings or silently substitute arbitrary models.

Related implementation history:

• PR Add model routing to PR batch planning #106 introduced model routing.
• PR Fix model-routing recovery edge cases #109 addressed recovery edge cases but retained stop-and-re-plan behavior for unavailable routes.

[justin808]

Second verified reproduction: batch ac-a-coord-cinder in shakacode/agent-coordination while closing PRs #54 and #55.

Observed behavior:

• The batch explicitly requested routed subagents: gpt-5.6-sol/high for PR Follow-up: Make priority review dispositions replayable in merge closeout #54 and gpt-5.6-terra/high for PR Follow-up: Require durable QA Evidence for batch closeout #55.
• Both requested routes were supported by Codex worktree tasks.
• The available in-process subagent interface could not select or attest model/effort, so the coordinator stopped before registration and dispatch.
• Goal-mode blocker auditing repeated the unchanged condition for three turns and marked the goal blocked.
• Work resumed only after the operator separately authorized user-owned Codex worktree tasks. The requested models did not change; only the dispatch mechanism changed.
• Once dispatched through the model-selectable mechanism, both lanes completed, independent QA passed, both PRs merged, and linked issue Follow-up: Flag PRs that merge before selected checks finish #53 closed.

This adds a distinct case to the existing model-fallback scope: dispatcher-mechanism fallback with the exact requested route preserved.

Proposed acceptance criteria:

1. Preflight distinguishes:
   • requested model/effort unavailable;
   • selected dispatcher unable to bind or attest it;
   • another supported dispatcher able to preserve the exact route.
2. Generated Codex goal prompts explicitly declare whether route-bound Codex worktree tasks are authorized as a dispatcher fallback.
3. When that authority is present, switch dispatch mechanisms automatically and record requested route, actual route, dispatcher, reason, and authority.
4. When authority is absent, ask one focused question during the first preflight turn and persist a restart-safe decision request; do not repeat unchanged blocker audits until Goal mode becomes blocked.
5. Add a replay fixture for Sol/high + Terra/high, an in-process dispatcher without model selection, and a Codex worktree-task dispatcher supporting both. Prove both lanes launch once, with no overlapping workers or route substitution.

Process Gap Disposition:

• Mechanism target: schema plus dispatcher-capability preflight and replayable contract tests.
• Motivating miss: ac-a-coord-cinder, PRs Follow-up: Make priority review dispositions replayable in merge closeout #54/Follow-up: Require durable QA Evidence for batch closeout #55.
• Replay evidence: the exact dispatcher capability matrix above; expected result is an automatic mechanism switch when authorized, otherwise one immediate decision request.
• Non-goal: treating every generic “use subagents” request as permission to create arbitrary user-owned tasks, or silently substituting a different model/effort route.