[High] Path() is not round-trippable, but ADR-012 markets it as the parseable "stable URL form."

Dashboard = accelerator + "-" + os joins two free-form fields with -, and CriteriaAcceleratorRTXPro6000 = "rtx-pro-6000" (criteria.go:121) already contains hyphens. So eks/rtx-pro-6000-ubuntu/training has no positional split point — a consumer cannot recover (rtx-pro-6000, ubuntu) vs (rtx, pro-6000-ubuntu). ADR §"Stable URL form" says RQ1 deep-links to and TG4a's presence endpoint checks this string.

Not a blocker for this PR — nothing parses Path() yet; deep-links/presence checks only need it stable+equal, not decomposable. Recommend: track on the first parsing consumer (RQ1 #1283 / TG4a #1284) — ship an explicit ParseCoordinate, or keep consumers on the struct fields rather than string-splitting. Add an ADR note that Path() is a stable opaque identity, not a decomposable key, until then.

Documented (820eef3). Added an ADR note under "Stable URL form": `Path()` is a stable opaque identity, not a decomposable key — `rtx-pro-6000` already carries the join char, so consumers compare/deep-link the string but address dimensions via the `Coordinate` struct fields, never by splitting. An explicit `ParseCoordinate` (with a "values must not contain the active delimiter" invariant) is deferred to the first parsing consumer (RQ1 #1283 / TG4a #1284).

[High] No charset guard → a / in a value silently breaks the segment count.

requireConcrete rejects only empty/"any". Registry values admitted via --data are merely lowercased/trimmed (no charset validation), so a service value like acme/ncp yields acme/ncp/h100-ubuntu/training — a 4-segment path that any positional / split mis-parses. That is exactly the "ambiguous placement / silent fusion" the ADR claims to prevent.

This one is cheap and self-contained — reasonable to fold into this PR: reject values containing / (and arguably - in the joined fields), failing closed with ErrCodeInvalidRequest naming the dimension, plus a negative test.

[Low, same spot] value == CriteriaAnyValue compares to the literal "any" without trim/lowercase, so "ANY"/" any " from a hand-built (unnormalized) Criteria would pass as concrete. Only reachable if a caller bypasses the resolve path — either normalize here or document that CoordinateFor assumes resolved input.

Folded in (820eef3). `requireConcrete` now routes through a new `rejectPathSeparator`, so service/accelerator/os/intent and platform fail closed with `ErrCodeInvalidRequest` naming the dimension when a value contains `/`. Added negative cases (`service contains slash`, `platform contains slash`). On the [Low]: left as-is — the function documents its input as already-resolved `Criteria`, and normalizing `"any"`/case here would duplicate the resolve path; the resolved-input assumption is stated in the doc comment.

[High] The registry-union test never actually exercises the registry-driven fail-closed path.

concreteValues() strips "any", but NewCriteriaRegistry() is empty and the static Get*Types() lists never contain "any" — so the filter removes a token that is never present, and no wildcard ever reaches CoordinateFor through this test. If concreteValues were removed or a --data registry ever surfaced "any", this test would still pass.

Fail-closed is covered by the literal cases in TestCoordinateFor (nil + each dimension any), so this is dead-code/clarity rather than a true coverage hole. Recommend: either feed an explicit "any"/empty into the loop and assert it fails closed, or drop the dead filter with a comment pointing at the literal cases that own that coverage.

Fixed (820eef3). Added an explicit assertion that a wildcard service fails closed through the registry-driven path, plus a comment noting `concreteValues` is defensive against a `--data`-seeded registry surfacing `"any"` and that the literal per-dimension cases in `TestCoordinateFor` own the rest of that coverage.

[Medium] tab = intent-platform round-trips only by the unenforced accident that intents are hyphen-free.

Splitting training-kubeflow back to (training, kubeflow) works only because today's intents (training, inference) contain no -. A future/--data intent like fine-tuning would make fine-tuning-kubeflow un-splittable. Same delimiter family as the Path() issue above — the structural-parsing fix covers it. Recommend: add an explicit ADR invariant: "dimension values must not contain the active delimiter."

Covered by the same opaque-identity note (820eef3): the ADR now states values may contain `-` (`rtx-pro-6000`, a future `fine-tuning` intent), so the tab is not `-`-decomposable, and the delimiter invariant is deferred to `ParseCoordinate`. Only `/` is enforced now, since it is the one char that changes the segment count.

[Medium] The 7-key started.json schema is declared as a binding contract but is prose-only — nothing enforces it.

"TG2 emits exactly these; TG3 reads exactly these" reads as a frozen ABI, yet no Go constant/struct/test pins the key names, order, or count. A typo or reorder on either side drifts silently — the same anti-drift failure the ADR's Problem section warns against, now in the half of the contract that isn't code. Deferring the emitter to TG2 (#1267) is fine, but reword to: "specified here, enforced by TG2," rather than implying it is pinned in code.

Reworded (820eef3): "specified here and enforced by TG2 (#1267)" — and added that no Go constant pins the names today, so TG2 must lock the key names/order/count in a shared constant + round-trip test when it lands, rather than relying on the prose.

[Low] Missing ## Status section. 7 of 8 prior ADRs (002–005, 007–009) open with a ## Status. Add ## Status: Accepted (or Proposed) so consumers importing this contract know whether the mapping is ratified.

Added `## Status: Accepted` (820eef3).

[Low] No format-lock golden test independent of the fixtures. The canonical string is only asserted via the table's want fields; a refactor that changes the delimiter in both Path() and these want strings stays green while breaking the five downstream consumers that hardcode <group>/<dashboard>/<tab>. Consider one standalone Path() == "eks/h100-ubuntu/training-kubeflow" assertion explicitly framed as "this exact string must never change."

Added `TestCoordinatePathFormatLock` (820eef3) — a standalone assertion that `Path()` equals `eks/h100-ubuntu/training-kubeflow`, framed as a frozen contract string that must fail even if the table want-strings change in lockstep.

[Low] Negative cases assert the error code but not that the message names the offending dimension — which both the code comment and ADR explicitly promise ("naming the offending dimension"). A refactor dropping the dim name from the message (e.g. a generic "dimension must be concrete") still passes. Add a substring assertion on the dimension name in one negative case.

Added `TestCoordinateForErrorNamesDimension` (820eef3) — asserts the failure message contains `accelerator` for an `any`-accelerator input.

[Nitpick] Durable ADR embeds transient issue-lifecycle state ("#1272 stays open until that user-facing page lands"). Once #1272 closes, the ADR still asserts it's open. Keep the design record timeless and let the issue tracker own lifecycle — consistent with the repo's "don't reference transient state in durable artifacts" guidance.

Reworded (820eef3) to drop the issue-lifecycle state — the deferred page is now described as "authored alongside that work rather than here," leaving #1272 lifecycle to the tracker.