PR Review Summary

Status: Request Changes

The implementation is the right narrow shield: mailbox routing and receipt carriers are records, not decaying scent, and the exact-head storage witness is green. One evidence-integrity correction remains before this PR can truthfully close #15973.

🪜 Strategic-Fit Decision

• Decision: Request Changes
• Rationale: The code shape and test boundary pass. The close target and the new test comment still assert two facts contradicted by current source; both are small, source-authority corrections rather than a mechanism rewrite.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #15973 current body and comments; #15920 current AC4/AC5 plus the PR's durability-window comment; the exact two-file diff; GraphService.decayGlobalTopology(), PROTECTED_EDGE_TYPES, and getInboundStructuralSupport(); MailboxService's DELIVERED_TO / SENT_TO / SENT_BY consumers; exact-head hosted checks; exact-head GraphService execution.
• Expected Solution Shape: Remove durable mailbox carrier facts from ambient decay without changing the factor, threshold, lock, or designed #15920 archive path. Prove protected survival from SQLite with an unprotected control, while keeping numerical and cache-coherence claims aligned with the source that executes.
• Patch Verdict: Mechanism match, evidence-commentary mismatch. The three edge types join the existing shield and the test proves property-preserving survival plus continued pruning of RELATES_TO. But #15973 still contains the superseded ~10-day horizon and claims RAM necessarily retains pre-decay state even though the current method calls syncCache(); the new spec repeats the latter claim.
• Premise Coherence: The implementation coheres with verify-before-assert and friction→gold. The two stale prose claims conflict with verify-before-assert because their falsifiers are already present in current source.

🕸️ Context & Graph Linking

• Target Issue ID: Resolves #15973
• Related Graph Nodes: #15920, #15825, #15448 / PR #15808, GraphService ambient decay, MailboxService receipt/routing carriers
• Resolution shape: A bounded shield repair that preserves #15920's separate archive-only design and #15825's separate recurrence investigation.

🔬 Depth Floor

Challenge — the patch fixes the mechanism while the authority text still describes the old one.

#15973 correctly amended the configured default to 0.98 and ~80 daily cycles from weight 1.0, yet its #15920 paragraph still says the edge is deleted on a “~10-day countdown” and that a restart witness can be false over “10 days.” Those statements are the superseded 0.85 calculation, not current-source behavior. The measured near-threshold urgency remains: 564 of 2,844 current read-bearing deliveries crossed within two source-default cycles in the read-only copy census.

The second mismatch is sharper. #15973 AC4 says “the cache retains pre-decay state by construction,” and the new GraphService spec repeats that rationale. Current decayGlobalTopology() performs bulk SQL, then explicitly calls this.db.syncCache() to consume the SQLite-triggered invalidation delta before updating the clock. Direct SQLite read-back remains the correct authoritative test—it avoids trusting cache reconciliation—but “retains pre-decay state by construction” is no longer true.

Rhetorical-Drift Audit:

• Mailbox carrier types are durable record/authorization/provenance facts.
• The decay floor below the prune threshold makes unprotected edges a countdown.
• The storage assertion plus RELATES_TO control proves the intended boundary.
• The remaining ~10-day statements match the configured default.
• The cache-retention rationale matches the current syncCache() path.

Findings: One concentrated evidence-integrity correction; no code-mechanism objection.

🧠 Graph Ingestion Notes

• [KB_GAP]: Current Memory Core summaries recovered the #15973 implementation session and archive-decay relationship, but the live issue and source supplied the decisive contradictions.
• [TOOLING_GAP]: N/A.
• [RETROSPECTIVE]: Once a public numerical correction lands, search the whole close target for downstream echoes; correcting the headline paragraph alone left the same disproven constant in the relationship section.

N/A Audits — 📡 🔗 🛂

N/A across listed dimensions: no OpenAPI surface, AiConfig mutation, skill substrate, authorization-policy change, deployment contract, or public application API is changed.

🎯 Close-Target Audit

• Close target identified: #15973.
• #15973 is open, non-epic, and matches the two-file repair.
• AC1–AC4 are represented by the protected set and the red-proved storage/control witness.
• AC5 has a durable #15920 comment recording the post-merge sufficiency rationale and the forced-decay alternative.
• The close target is internally truthful after its own correction: two stale statements remain.

Findings: Correct target, not yet clean enough to close as written.

📑 Contract Completeness Audit

• PR body scopes the shield against #15920's designed archive path.
• Implementation and test stay within GraphService ownership.
• Hosted evidence and local exact-head execution cover the changed surface.
• Ticket and code-comment evidence match current source semantics.

Findings: One prose/evidence boundary is incomplete.

🪜 Evidence Audit

• Exact head bb634435f52240727c36e35e6fef1813b696066c is CLEAN and all hosted checks are green.
• Reviewer exact-head run: GraphService.spec.mjs --workers=1 --retries=0 → 45 passed.
• Storage witness preserves readAt, archivedAt, and weight on DELIVERED_TO, preserves SENT_TO / SENT_BY, and prunes the equal-weight RELATES_TO control.
• Earlier source-exact read-only copy census: 2,844 current read-bearing deliveries before; 2,280 after two default cycles; 564 pruned.
• Commentary matches the current 0.98 default and post-SQL syncCache() call.

Findings: Runtime evidence passes; two public interpretations of that evidence do not.

🧪 Test-Evidence & Location Audit

• Test is in the canonical GraphService unit suite.
• It calls the real decay method against real SQLite storage.
• It self-validates the seeded receipt before decay.
• It reads the consumed authority from storage and includes a live unprotected control.
• Its cache rationale is current-source accurate.

Findings: Test mechanics pass; one explanatory comment needs correction.

📋 Required Actions

To proceed with merging, please address this in one concentrated pass:

• RA-1 — Reconcile the corrected evidence everywhere it is now authoritative.
  • In #15973, replace the remaining “~10-day” / “10-day horizon” statements with the configured-default truth: ~80 daily cycles from weight 1.0, while preserving the measured fact that the near-threshold 564-row cohort crosses within two cycles.
  • In #15973 AC4 and the new GraphService.spec.mjs comment, retire “RAM retains pre-decay state by construction.” State the actual boundary: bulk SQL bypasses Store mutation, then syncCache() reconciles the invalidation delta; direct storage read-back is retained because SQLite is the consumed authority and must not depend on cache-reconciliation correctness.

No new runtime behavior or additional test is requested.

📊 Evaluation Metrics

• [ARCH_ALIGNMENT]: 97 — the shield is the existing sanctioned boundary; no decay-algorithm widening.
• [CONTENT_COMPLETENESS]: 88 — mechanism and dependencies are strong, with two stale authority echoes.
• [EXECUTION_QUALITY]: 96 — exact persisted-state witness and negative control both pass.
• [PRODUCTIVITY]: 94 — a three-entry production delta closes a forward loss route.
• [IMPACT]: 92 — protects routing, authorization, provenance, and per-recipient receipt state.
• [COMPLEXITY]: 34 — small diff on a high-consequence shared graph boundary.
• [EFFORT_PROFILE]: Maintenance — narrow durability shield with one source-truth cleanup.

[review-budget-managed]

• outcome: within-budget
• ordinary-limit: 2
• activation-issue: 15257
• activation-pr: 15307
• activated-at: 2026-07-16T20:54:31Z