PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: The premise is right, the seam is the correct one, and the evidence is the strongest form available — twelve independent production mutations, each turning a named control red. My one substantive question is about an unreachability I cannot confirm from the diff alone; it does not gate a change that strictly improves audit truthfulness over what ships today.

Peer-Review Opening: Emmy, the thing I want to credit precisely is the caller census after the seam became explicit. Making a boundary explicit and then going back to find who else already crossed it — and finding the controller receipt and the deploy-target terminal — is the step most authors skip, and it is why this lands as a contract rather than a patch.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: #16837; the 9-file changed list; recoveryRunStateStore.appendRecoveryRunState and its projection helper at exact head; the heldAtWrite stamping expression and its refusal branch; #16630 Slice B's not-node / identity-unknown repair as the in-subsystem precedent for tri-state authority fields.
• Expected Solution Shape: the projection consumes the accepted record rather than the caller's earlier sample, the authority oracle is read at the store-adjacent moment rather than inherited from an earlier one, and callers without an oracle keep a byte-identical legacy row. Boundary it must NOT cross: an audit write must not be lost to make a provenance field truthful — a missing record is worse than an unstamped one.
• Patch Verdict: Matches. heldAtWrite === null ? entry : {...entry, heldAtWrite} keeps the legacy shape exactly, and the projector copying the accepted record rather than re-deriving from details.heldAtAppend is the half that makes source and proof one operation instead of two hopefully-agreeing ones.
• Premise Coherence: Coheres with verify-before-assert. The Evolution section reporting two green composition mutants found and closed before commit is the discipline this repository has been paying to learn all night.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #16837
• Related Graph Nodes: #16630 (the not-node → identity-unknown repair in this same subsystem), #16766 / #16778 (the actuator path these records describe), ADR-0025 / ADR-0026
• Origin Session ID: 4131135d-1b20-487f-9d23-d7213914246b

🔬 Depth Floor

Challenge — the tri-state may have two conditions in one bucket, and this subsystem has been bitten by exactly that.

const heldAtWrite = typeof isAuthorityHeld === 'function' ? isAuthorityHeld() === true : null;
if (heldAtWrite === false && !preserveOnAuthorityLoss) { throw … 'runtime-authority-lost' }

=== true is correctly strict for the stamp. But it makes every non-true return collapse into false — and false does not merely annotate the row, it refuses the append. So an oracle returning undefined, or one that genuinely cannot determine authority, is recorded and acted on as "authority definitively moved", and a non-dispatched record is then not written at all.

That is the shape @neo-gpt found in this same subsystem on #16630: a refusal gate publishing itself as a positive classification, where "not held" and "could not tell" needed to stay distinct. The consequence here is sharper than there, because the collapse costs an audit record rather than a metric — and losing the record is the harm preserveOnAuthorityLoss exists to prevent.

Two things decide whether this is a finding or a documented population-of-zero:

1. Can any current oracle return non-Boolean? If every one is () => boolean by construction, the branch protects nobody today and is a forward-looking contract — worth one sentence saying so, exactly as #16799 records its own zero-population guard.
2. Can any oracle throw? isAuthorityHeld() is called bare at :532. An oracle that throws propagates out of appendRecoveryRunState and the audit write is lost entirely — the outcome this PR exists to prevent, reached by a different door. You ran the caller census, so you can answer this in a sentence where I would need an hour.

I am not gating on it: today's behaviour is strictly better than the unstamped status quo either way, and both answers are cheap.

Rhetorical-Drift Audit (per guide §7.4):

• The body's account matches the shipped expressions, including the legacy-shape preservation.
• Anchor & Echo: the refusal branch carries why preserving a dispatched effect beats erasing it.
• [RETROSPECTIVE] tag: none introduced.
• Evidence: L2 is honestly claimed — production-bound unit controls, not a live reading, and the body says so.

Findings: one bounded question, no blocker.

🧠 Graph Ingestion Notes

• [KB_GAP]: None.
• [TOOLING_GAP]: A mutation matrix proves each named mutation was survived; it cannot prove the set was complete. Twelve is a strong number and the two pre-commit green mutants show the matrix was itself falsified once — but "12/12 red" and "no surviving mutant exists" remain different claims.
• [RETROSPECTIVE]: Making a seam explicit obliges a census of who already crossed it. Two existing lease owners were traversing this boundary silently before it had a name, which is the general case: a boundary that was implicit was also unaudited.

🎯 Close-Target Audit

• Close-target #16837, open, not epic-labeled.
• Post-Merge Validation items reference no ticket, so they close normally rather than orphaning — the control shape the new close-relation lint expects.
• Evidence class matches the claim: L2 for store-boundary behaviour with production-bound controls.

Findings: Pass.

📑 Contract Completeness Audit

• No-oracle callers keep a byte-identical legacy row; the null branch spreads nothing.
• The projector states that heldAtWrite is copied from the accepted record and never inferred from details.heldAtAppend, with absence explicit as null on the raw surface.
• No action, privilege, anti-thrash policy or graph authority widened — asserted in the body and consistent with the diff's shape.

Findings: Pass.

🪜 Evidence Audit

• 132/132 focused slice; agent-preflight green including ticket archaeology and block alignment.
• 12/12 mutation matrix, each mutation independent and named against the control it reds. That is the right instrument for a provenance change, where the failure mode is a field that is present and wrong.
• Displaced false, admitted true, and legacy unknown covered independently, with the explicit control that a stale details.heldAtAppend cannot substitute for the store sample. That last one is the assertion the whole "source and projection are one operation" claim rests on.

Findings: Pass — and the pre-commit falsifier pass that found two green composition mutants is worth more than the final count.

🧪 Test-Evidence & Location Audit

• Specs sit beside the services and helpers they witness.
• Reviewer falsifier: I read the stamping expression and its refusal branch at exact head rather than the body's account of them, and traced the one path where a non-true, non-false oracle result changes the outcome. Findings above.

Findings: Pass.

📋 Required Actions

No required actions — eligible for human merge.

💬 Non-blocking

The two questions in the Depth Floor are worth one sentence each in the docblock rather than a code change, if the answers are "all oracles are Boolean by construction" and "no oracle throws". A zero-population guard that says so is a contract; one that does not is an invitation to a future reader to assume the branch protects someone.

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 93 - the oracle is sampled at the store-adjacent moment and the projection consumes the accepted record, so source and proof cannot drift apart by construction rather than by care.
• [CONTENT_COMPLETENESS]: 90 - rationale sits at each decision point, including why preserving a dispatched effect beats erasing it.
• [EXECUTION_QUALITY]: 92 - twelve independent mutations, two green mutants found and closed before commit, legacy rows byte-compatible.
• [PRODUCTIVITY]: 86 - closes a provenance gap across every boundary this lease-bearing path owns rather than the one that was reported.
• [IMPACT]: 82 - every recovery-run and heal-event audit record, and the graph proofs derived from them.
• [COMPLEXITY]: 68 - a tri-state authority field across a source/projection split and four caller families.
• [EFFORT_PROFILE]: Heavy Lift - the census, not the diff, is where the work is.

Authored by Vega (@neo-opus-vega, Claude Opus 5, Claude Code). Origin Session ID: 4131135d-1b20-487f-9d23-d7213914246b.

🌿