fix: harden release checks for grouped routes

docs/CODEX_EXECUTION_LOG.md

@@ -7587,7 +7587,8 @@ Open:
 ## Local validation
 
 - `bash scripts/run_readiness_check.sh` passed end to end.
-- Full backend suite passed: `506` tests.
+- Full backend suite passed: `508` tests after the final coverage, manifest
+  provenance and framework-contract regression additions.
 - API contract audit passed with `81` implemented routes and the two documented
   non-envelope endpoints.
 - Alembic reports one head: `202606120900`.
@@ -7599,3 +7600,46 @@ Open:
 - Deploy Sprint 184 to Tower, rerun QA for the persisted Mol-center analysis
   run and verify both persisted coverage evidence and Detection Lab rendering
   against live PostGIS before making any model-training decision.
+
+## Tower and live Mol evidence
+
+- Pushed commit `948e50b` and rebuilt the all-in-one runtime at
+  `http://192.168.10.150:1202`. PostGIS `3.6`, required schema/indexes,
+  database collation, Alembic head `202606120900`, frontend proxy, API proxy
+  and icon checks passed.
+- Reused persisted analysis run `97c204cc-bc75-4139-aab5-25397dd0d87e`,
+  raster `e9a292e2-57d2-4a85-9df6-32580ba6ea98` and GRB reference dataset
+  `bfc83882-2acc-470d-baec-ee828b4428f8`; no duplicate inference or fake data
+  was produced.
+- The persisted EPSG:31370 tile manifest contained one inference tile. All 36
+  detections were evaluated; one was clipped at the tile boundary. Of 374
+  persisted reference footprints, 304 intersected coverage, 70 were excluded
+  outside coverage and 34 were clipped at the boundary.
+- Quality check `a25290ed-14ea-4c84-aff7-20672f568b1c` persisted 19 strict
+  footprint-IoU matches, 17 false positives and 285 false negatives. Its six
+  canonical Metric rows contain precision `0.527778`, recall `0.0625`, F1
+  `0.111765`, mean IoU `0.599302` and the two error counts.
+- The diagnostic-only reference-envelope pass found 33 matches and identifies
+  14 possible box-to-footprint matching artifacts. Those values are persisted
+  only in findings and do not alter canonical Metric rows.
+- Internal-browser validation reran the comparison from Detection Lab and
+  displayed `304 of 374 reference features evaluated`, coverage exclusions,
+  boundary clipping and the explicitly labelled diagnostic. The deployed page
+  produced no console warnings or errors for the live Tower URL.
+- A later clean framework resolution exposed FastAPI `0.139.0`'s grouped
+  top-level router representation: `app.routes` contains 17 groups while the
+  canonical OpenAPI schema still contains all 81 operations. Updated the API
+  contract audit to read the OpenAPI path map and added a regression guard so
+  clean framework installations cannot produce a false 81-route drift report.
+- Starlette `1.3.1` also deprecates the existing `httpx` TestClient path in
+  favor of `httpx2`. Kept Starlette on the still-supported
+  `>=0.46.0,<1.0.0` line until that test-client migration receives a dedicated
+  compatibility pass; the release gate consequently remains warning-free.
+
+## Decision
+
+- Sprint 184 is operationally complete. Coverage bias is now explicit and the
+  observed 14-match geometry gap confirms that model quality must not be judged
+  from envelope diagnostics. The next safe model step is an evidence-led
+  footprint-label/matching review, followed by a fresh bounded Mol multi-zone
+  benchmark before any activation or retraining decision.