Structure-Preserving Safety Compute Routing for Efficient Reasoning Pipelines Hard Routing Invariants Against Underthinking and Monitor-Skipping

Efficient reasoning systems route inputs across cheap and strong models, short and long reasoning budgets, and optional monitors. We show that this routing control plane can violate safety-critical structure even when output-level safety appears acceptable. We define three safety routing invariants — risk monotonicity, privilege preservation, and monitor coverage — and propose SP-SCR, a structure-preserving router that enforces hard closure rules over a small risk-tag tuple before selecting the cheapest valid route. On a pilot benchmark of 184 abstracted prompts crossed with adversarial transformations (n=2576 records, 14 routers, cross-judge), SP-SCR-Union (rule σ ∪ LLM σ) achieves SCC=1.00, RU=0.00, RMV=0.00, MCV=0.11, PPV=0.17, and 0% cross-judge unsafe outputs at 66% the token cost of a strong-monitored ceiling baseline. A single-LLM safety classifier with comparable route-level coverage carries PPV=1.00 and a 9% unsafe rate, showing that structural privilege preservation is not redundant with output-level scoring. An ablation confirms each closure rule does distinct work: removing the privilege-preservation rule alone jumps PPV from 0.17 to 1.00 and MCV from 0.24 to 0.52. The takeaway, transplanted from structure-preserving sequence models: safety compute must be structurally routed, not merely prompted.