Many thanks for the review and help with this!
Is it only for SUBSCRIBE or is it required for INVITE as well or UE remembers it from the response to SUBSCRIBE?
This was just for the SUBSCRIBE which the P-CSCF itself originates, in UAC mode (so not the proxied SUBSCRIBE from a UE). I think this could also be routed through the I-CSCF, but I found that 3GPP said to skip that extra "work" (at HSS also) and target directly the same S-CSCF which indicated itself in the "Service-Route" header during registration.
--- Otherwise, for UE originated requests: - The UE also might SUBSCRIBE to the same `reginfo` event at the S-CSCF, but that would be another dialog. And all the initial dialog requests (a.i. first SUBSCRIBE, first INVITE), or standalone ones (a.i. MESSAGE) should also use the Service-Route, including, based on the UE's behavior, also the P-CSCF in the route (some UEs might just force the outbound proxy without a Route, some add a Route and do loose route). - All the subsequent dialog methods from the UE should use the saved Record-Routes for that dialog.
And in case the UE misbehaves, the P-CSCF must enforce all of these routes. (e.g. the `pcscf_force_service_routes()` from `ims_registrar_pcscf` should do it, respectively something similar from `dialog`/`ims_dialog`)