S3: subagent model routing — the settings surface, suggestions, and the dispatch seam (spec D3)

[aarontrowbridge]

Important

Problem — Every role card carries a model_routing slot (ADR freeze list) that nothing fills; subagent dispatch has no model policy; 'which model just answered me' is archaeology.
Approach — Design-of-record: spec-20260907-011500 (rev 2) — D3 with ALL critic folds. The settings section maps subagent role → model, user-editable, provenance per row (user-set / fleet-locked / tuned / suggested / default — no silent source). Suggestions derive from LIVE API availability (providers with credentials only); the role cards' model_routing slots fill with static prefer-lists that name model CLASSES (workhorse / strongest-reasoner / fast-cheap) — never campaign-tuned assignments (the public/premium boundary holds by construction).

The invariants (the critics' convergent blockers — all bind)

• Zero-config invariant: the DEFAULT tier = inherit-session-model — today's dispatch, byte-identical; suggestions display-only until opt-in
• Uniform credential gate: suggestions AND the tuned overlay are credential-filtered at resolution time; a no-credential tuned model never becomes effective policy (drops to next tier, named reason)
• Failover = walk the candidate chain downward at dispatch time; the resolved model + fallback reason are recorded and surfaced — credential-driven downgrades are ANNOUNCED
• A hand-set model: field on a role card outranks the entire chain (it IS user-set for that card)
• Precedence: user-set > fleet-locked (fleet-spawned sessions/dispatches ONLY — never product-initiated work) > tuned > suggested > default
• Resolution timing: entitlement + overlay at SESSION BIND, re-checked per dispatch; lapse keeps user-set rows + visibly reverts the rest (announced); the tuned table is a snapshot per amicissimo release

Acceptance Criteria (spec S3)

• The settings surface renders per-role mapping + provenance + the drift indicator (user-set diverging from tuned shows drift + reset-to-tuned)
• Suggestions derive from live credentials; credentialed-less providers never appear
• Dispatch honors the effective policy with failover + announced downgrades (unit tests per precedence row)
• Zero-config dispatch is byte-identical to today (the invariant, tested)
• Hand-set model: outranks the chain (tested)