The 'a route can be unhealthy before it is unavailable' line is the whole thing, and it is not just an AI-routing problem. I hit the exact same trap on the infra side with a mirrored homelab: the standby node was technically up and passing a naive health check, so nothing failed over, but it was quietly behind and useless the moment I actualy needed it. Same late-fallback shape you describe, just in hardware. What finally fixed it for me was defining health by the outcome I cared about, is the replica caught up and serving, instead of 'did it respond'. Your workflow-outcome framing maps onto that perfectly. Nice clear writeup on the three states too, the half-open part is the one people skip and then wonder why they thrash.