Outcome

Extract one shared production read authority for saved model routing. This issue owns shared routing types and normalization, synchronous and asynchronous authority reads, and minimal compatibility wrappers used by existing production callers. The wrappers must preserve every current caller behavior, including project-invalid collapse where the current caller expects that result. Direct export migration and export contract tests move to #395. Apply, UI, status, canonical, and durable-write work remain in later slices.

Chain context

• Parent tracker: refactor(models): share safe routing persistence authority #382, part of feat(models): expose a machine-readable routing contract #381.
• Dependency/base: first child. Use the resulting main at implementation time. The stopped combined candidate and PR refactor(models): centralize routing persistence authority #385 evidence are not implementation bases.
• Follow-up: refactor(models): isolate fail-closed saved-routing apply #396 consumes this authority through the existing apply and startup callers and owns fail-closed apply plus profile byte, modification-time, and no-write safety. refactor(models): migrate routing UI and lifecycle consumers #395 then owns direct export migration and export contract tests together with /gentle:models, session-start reporting and wiring, and /gentle:status. refactor(models): enforce canonical routing names and target authority #391 follows refactor(models): migrate routing UI and lifecycle consumers #395 and enforces canonical names and explicit target authority. Durable write and materialization remain later slices.
• Target: main. Use stacked-to-main delivery. The PR diff must contain only this extraction and compatibility-wrapper unit.
• Closure and linkage: the implementing PR closes refactor(models): isolate saved-routing read authority #389 only and references refactor(models): share safe routing persistence authority #382, feat(models): expose a machine-readable routing contract #381, refactor(models): isolate fail-closed saved-routing apply #396, refactor(models): migrate routing UI and lifecycle consumers #395, and refactor(models): enforce canonical routing names and target authority #391. It must not close or approve any later slice.
• Approval: this body is a replacement draft. The issue may regain status:approved only after exact title and body review and explicit human authorization. Approval authorizes only this bounded extraction scope. It grants no authority to commit, push, publish a PR, merge, or approve a later slice.
• Labels after authorization: enhancement, status:approved. The hold stage removes status:approved until this exact draft is reviewed.

Dependency diagram:

main
  └─ 📍 #389 shared types/normalization, sync/async authority, compatibility wrappers
       └─ #396 fail-closed apply and profile safety
            └─ #395 direct export contract/tests plus UI/lifecycle consumers
                 └─ #391 canonical names and target authority
                      └─ durable write
                           └─ materialization

Scope and acceptance criteria

• Extract the existing routing types and model-entry/config normalization, including normalizeModelId, normalizeRoutingEntry, and normalizeModelConfig, into one shared production module.
• Provide shared synchronous and asynchronous file-read wrappers that distinguish missing, valid, and invalid results and carry the invalid source path.
• Route existing production callers through minimal compatibility wrappers around the shared authority. Preserve all current wrapper behavior, including project-invalid collapse where the current caller expects it. Do not directly migrate export, apply, UI, or status behavior in this issue.
• Keep the shared authority production-reachable through compatibility wrappers used by existing callers. Production reachability must not depend on __testing or a test-only caller.
• Keep synchronous and asynchronous production reads in agreement for missing, valid, and invalid sources, including invalid-global no-fallback behavior as currently observed by the wrappers.
• Add authority-level behavior tests for shared types, normalization, sync and async status parity, source-path preservation, and compatibility-wrapper behavior. Keep these tests focused on authority extraction. Direct export and real-export tests belong to refactor(models): migrate routing UI and lifecycle consumers #395.
• Explicitly create every test fixture directory before writing fixtures, including any root/agents directory used by discovery-adjacent authority tests.
• Preserve the current metadata name parser and grammar, target paths, writes, JSON null behavior, literal string inherit behavior, omission semantics, apply behavior, startup behavior, and profile materialization.

Candidate allocation

The frozen 455 A+D candidate is being resliced without opening a new issue. Module work of 112 lines, the authority extraction and compatibility-wrapper hunks, and the authority test setup and tests from lines 1-118 belong to #389. The direct export hunk and export or real-caller tests from lines 120-196 move to #395. No safety test is deleted. The later slice may reuse established scaffolding without duplicating the safety proof.

Intentionally out of scope

• No direct export migration, direct export contract change, or export and real-caller test migration. Those belong to refactor(models): migrate routing UI and lifecycle consumers #395.
• No fail-closed applySavedModelConfig change, apply fallback change, profile byte or modification-time assertion, or profile no-write proof. Those belong to refactor(models): isolate fail-closed saved-routing apply #396.
• No explicit migration of the /gentle:models handler, session-start consumer, or /gentle:status reporting. Those consumers belong to refactor(models): migrate routing UI and lifecycle consumers #395.
• No canonical-name expansion, shared canonical-name validator, alias denial, or explicit global/project target resolver. The current name parser and grammar remain unchanged here; the strict canonical boundary belongs to refactor(models): enforce canonical routing names and target authority #391.
• No save-validation bridge or strict complete-document/key policy beyond the read result needed for authority status.
• No durable saved-config write algorithm, temporary-file policy, cleanup, rename outcome, or directory durability.
• No profile materialization, frontmatter rewrite, inherit-by-omission, profile-field deletion, or other write behavior change.
• No changes to refactor(models): share safe routing persistence authority #382, feat(models): expose a machine-readable routing contract #381, refactor(models): isolate fail-closed saved-routing apply #396, refactor(models): migrate routing UI and lifecycle consumers #395, refactor(models): enforce canonical routing names and target authority #391, the durable-write slice, the materialization slice, provider/model discovery, headless contracts, packaging, feat(models): add headless inspect and validate contract #383, or feat(models): add apply CLI and package executable #384.
• No automatic branch rewrite, commit, push, PR publication, merge, or approval of a later slice.

Strict TDD and verification

Strict TDD is required. The RED phase must be an executable assertion-level failure after dependency hydration, not a missing-module or environment error. The current governance snapshot records assertion-level RED and focused GREEN 4/4 for the combined candidate only. It is not issue completion evidence for this extraction slice. The implementation PR must report its own observed evidence before claiming completion.

Environment prerequisite: use an authorized implementation environment with dependencies hydrated by the repository package manager, pnpm@11.1.1, including @earendil-works/pi-tui.

Run the focused and package-supported commands after the behavior tests exist:

node --experimental-strip-types --test tests/model-routing-authority.test.ts
node --experimental-strip-types --test tests/gentle-ai.test.ts
pnpm test

• RED: add the smallest assertions for shared normalization, missing, valid, and invalid sync and async authority results, invalid source-path preservation, invalid-global no-fallback through the compatibility wrappers, and project-invalid collapse where current callers require it. Record the observed assertion-level failures after dependencies are available.
• GREEN: extract the shared types, normalizer, and sync/async authority, then route existing production callers through minimal compatibility wrappers without changing their observable behavior. Record the focused test result.
• TRIANGULATE: cover missing, valid, and invalid global/project sources, sync and async parity, wrapper behavior, invalid source paths, literal inherit, JSON null, omissions, existing target and path semantics, and explicit fixture-directory creation. Do not add direct export, apply, profile-safety, UI, or status migration proof here.
• REFACTOR: remove superseded duplicate authority helpers without changing behavior, then rerun the focused commands and check-only syntax validation.

Review workload forecast and hard stop

Forecast only, measured against the clean immediate main base: 245 lower / 285 realistic / 335 upper A+D. The hard stop is above 400 A+D. No size:exception is permitted. If the clean diff exceeds 400, stop before publication and return to design for another causal split. Do not line-golf the diff or remove the authority tests.