refactor(telemetry): one expert history for every engine (#700)

[terrizoaguimor]

Closes the format half of #700, approved in
this comment.

.coli_usage had two incompatible writers and two engines that could not produce it at all:
colibri.c wrote sparse text, inkling.c wrote a dense IKU1 binary block, kimi_k3.c and
olmoe.c wrote nothing, and both writers defaulted to the same filename — so a model directory
shared between two engines ended up holding a history the other one refuses.

c/route_trace.h now owns the history format and the ROUTE_TRACE stream with no Model or
Cfg dependency. colibri.c and telemetry.h move onto it; the duplicated writer and
pin_load's duplicated parser are gone.

No new environment variables, and nothing new is printed on a healthy run.

The header records

-1 <n_layers>       <n_experts>
-2 <format_version> <engine_id>
<layer> <expert> <count>

Encoded as triples with a negative layer so that readers built before this change parse
them, discard them, and continue into the data — both are a
while(fscanf(f,"%d %d %u",...)==3) guarded by l>=0. That buys backward compatibility
without a second code path, and it forces three rules. Each is asserted in
tests/test_route_trace.c against a literal copy of the old reader loop, rather than
against my expectations of it:

Rule	What breaks otherwise
Every field numeric	fscanf returns < 3 and the reader silently drops every record after that point
Engine id in the third field	old readers parse the second with %d, and glm_moe_dsa hashes to 3815245270 — above INT_MAX
Exactly three fields, never more	a fourth leaves one value unconsumed, desynchronising an old reader so it fabricates an admitted record from that leftover plus the start of the next line

An empty history stays a zero-byte file: PIN=auto decides usability by file size and falls
back to stats.txt, so a header written into an empty history would quietly cost that fallback.

Refusing a foreign history

A history whose identity does not match is refused by name on every path the engine chooses
for itself — the .coli_usage beside the weights, PIN=auto, and the AUTOPIN seed:

[USAGE] …/.coli_usage: written by kimi_k3, this engine is glm_moe_dsa
        — refusing (pass PIN=<path> to use it anyway)

A path the user typed is honoured, and says so once:

[USAGE] /tmp/foreign.coli_usage: written by kimi_k3, this engine is glm_moe_dsa
        — honouring it because you named it explicitly
          (placement only; expert ids do not transfer between engines)

Trust follows how the path was reached, not what the file contains, which is why pin_load
takes it as an argument — one function serves both kinds of path. Unlike a mismatched weight
container (#529), a mismatched history cannot change what the model computes: pins decide which
bytes are resident, so the worst case is slower, self-inflicted and visible in the hit rate.
Format version and IKU1 geometry are parse correctness rather than attribution and are never
relaxed.

rt_drop_row releases the counter row of a layer that does not route. This is the load
admission rule, not an optimisation — every reader treats a NULL row as "no expert here to
attribute a count to", which is the shape eusage already had, and which the Vulkan
expert-selection path depends on too.

Verification

Measured against the unmodified tree at 292ed4c, not argued:

Check	Result
ROUTE_TRACE dump, before vs after	byte-identical
History data section / [STATS] line	byte-identical
Unmodified binary reading a new-format file	identical [PIN] placement
This build reading a legacy file (no header)	identical placement
Dashboard EMAP line	byte-identical (76x256, 38,924 bytes)
Real GLM-5.2 (78x256, 4,637 records)	same 9,112 selections, same placement
Refactor suite incl. make check, both builds warning-free	20 / 20
tests/test_route_trace	15 cases / 56 assertions
Same test cross-compiled MinGW-w64, run under wine	passes

The Windows run is worth one line: it failed 11 assertions first, because the CRT rename()
fails when the destination exists — the reason compat.h's shim exists in the first place. The
header includes compat.h with that reason inline, so the facility depends on the C library
plus that one shared platform header, and no engine types.

docs/routing-telemetry.md documents the format, why each field sits where it does, the
three-field rule with a worked example of the desynchronisation, and how a new engine adopts it.
Linked from docs/tuning.md beside the learning-cache section.

Not in this PR

kimi_k3.c adoption follows as its own PR now that #676 has landed (five call sites, compiling
clean against the merged file). olmoe.c and teaching inkling.c's reader the text layout come
after that. inkling currently declines a new-format file cleanly, which is correct until then.

🤖 Generated with Claude Code