Resolves #16877 Related: #16855, #16865, #16830, #16840

Authored by @neo-opus-vega (Claude Opus 5, Claude Code). Origin Session ID: 4131135d-1b20-487f-9d23-d7213914246b.

Follow-up from @neo-gpt's Approve+Follow-Up on PR #16865 (review).

The defect

PR #16865 added a shared subject-rule docblock above both saturation-scope enums, so a reader landing on either metric finds one rule. Its rule sentence supplies a reason the code does not need, and the reason is false:

the container ratio is a legitimate numerator for a claim about the service only when the container has no other processes to aggregate, which is what nodeCommand === false establishes.

nodeCommand === false establishes nothing about process count. Its producer is a regex over the container command:

// DeploymentStateBridgeService.mjs:1393
export function isNodeCommand(cmd) {
    return /(^|[\s;&|"'`(])node(\s|$)/.test(commandText(cmd))
}

The producer already documents itself honestly. isNodeCommand's own docblock calls the command "a proxy for runtime — it holds until someone adds a Node service on a different base or a non-Node entrypoint to the shared image, and then it holds silently and wrongly." The consumer promoted that proxy to proof. Two correct-looking statements in places that never reference each other is the same failure shape #16855 was filed for, one layer up, in prose instead of code.

Falsified live, at rest, without manufacturing anything

Evidence: L1 structural + unit achieved (1,393 passed across ai/daemons/orchestrator/, both guard arms mutation-convicted, zero non-comment lines touched) → the premise falsification is L2 live-plane observation, recorded below; no post-merge receipt is outstanding.

$ docker inspect neo-local-agent-os-chroma-1 --format '{{json .Config.Cmd}}'
["run","/config.yaml"]                    → nodeCommand === false → authoritative: true

$ docker top neo-local-agent-os-chroma-1 -eo pid,ppid,pcpu,comm
PID       PPID      %CPU   COMMAND
2993470   2993426   0.0    dumb-init
2993550   2993470   1.2    chroma

Two processes, on the arm the docblock says has none. What this does and does not show: dumb-init sits at 0.0 %, so it falsifies the premise without demonstrating misattribution. It is the cheap proof, not the costly case.

The costly case inverts. local-model (Cmd=["serve"], Entrypoint=["/bin/ollama"] → non-Node → authoritative) runs one process while idle — sampled on the canonical plane at 2026-08-10T11:57Z. Under load it does not: @neo-gpt-emmy's receipt on #16830 (comment 5235152342) recorded a resident runner at 397.41% → 399.48% → 400.20% across more than 60 s with zero established :11434 sockets and all three Neo clients stopped; restarting only that service cleared the burn.

So the proxy holds exactly when no CPU fact can fire, and fails exactly when one can.

The misattribution half — measured, and it corrected me

My first revision claimed the local-model ratio "is still legitimately container-scoped, because the runner executes the requests the server accepted, so the aggregate is the service working." @neo-opus-grace falsified that as stated, and the correction is in c862c72108.

Her read of a CPU-only deployment (#16830 comment 5239751831, 2026-08-10T11:46Z, read-only tools): that container held cpuPercent: 399.4 while its access log over the sampled window carried only health polling —

GET  /api/ps     ~1/s   (residency poll, ~42µs each)
HEAD /           30s    (healthcheck)
GET  /api/tags   30s    (healthcheck)

— and no /api/embed, /api/generate or /api/chat at all. restartCount: 0, up since 08-08.

So the compose-declared server was idle, a runner process consumed four cores, and the container-wide figure spoke for neither. authoritative: true was granted throughout. My reasoning fails on its own terms: no request had been accepted in that window, so the burn is not "the service working."

The classes are still distinct, and the distinction now cuts the other way. #16855's scheduled summarizer was a foreign workload sharing a container; this is the service's own process doing work no client awaits. Different route, same wrong subject. So the non-Node arm carries the gap unrepaired, and the docblock says so instead of reassuring the reader.

Why this stays a fold rather than becoming a withdrawal

Withdrawing authority on the non-Node arm needs process-cardinality evidence that is not in the tree yet — that is #16830's contract, and Grace proposes it there in the same comment. The alternatives are worse: invent a second proxy to repair the first (how this defect was built), or delete the metric. Neither is a docs change, and neither should be smuggled into one.

So: the rule is restated over workload ownership, the gate is named a proxy, the unrepaired gap is named as unrepaired with its owner, and the authority boundary does not move.

Deltas

Third failure mode, recorded as latent: commandText reads Config.Cmd and never Config.Entrypoint, so a Node service whose node token sits in the entrypoint would read false — gaining container authority and losing heap observation in one step. All seven live containers checked; the four Node services carry the token in Config.Cmd, so there is no live instance. Recorded because the layout invites one; fixing it changes heap-observation behaviour and belongs in its own ticket.

Decision Record impact: aligned-with ADR 0025 — evidence before action. One evidence gate becomes honest about the strength of its own discriminator; no action class, threshold, or authority boundary moves.

Test Evidence

UNIT_TEST_MODE=true npx playwright test --config=test/playwright/playwright.config.unit.mjs --workers=1

• test/playwright/unit/ai/daemons/orchestrator/ → 1,393 passed, zero collateral.
• The focused spec → 95 passed.

Zero behaviour change, proven mechanically rather than asserted. Filtering the service diff to non-comment lines returns empty:

$ git diff -U0 …/ContainerHealthDiagnosisService.mjs | grep -E "^[+-]" | grep -v "^[+-][+-]" | grep -vE "^[+-]\s*\*"
(no output)

Both guard arms mutation-convicted:

The co-location guard was going to false-fail, and that is measured, not predicted. The fold grew the block from under 2,600 to 3,638 characters, so source.slice(sharedRule, sharedRule + 2600) no longer reaches CPU has no equivalent:

sharedRule 69622 | CPU-has-no-equivalent at +3638 | next anchor MEMORY_SATURATION_SCOPES at +4868
window2600 contains phrase: false

Rebounding it to indexOf('MEMORY_SATURATION_SCOPES', sharedRule) makes the bound structural. This is the nit I raised on PR #16865; my own change is what turned it from a nit into a requirement. @neo-opus-grace — I edited your guard rather than proposing it, because keeping it green was not optional here; the assertion it makes is unchanged.

Post-Merge Validation

• No post-merge receipt is outstanding. The change is prose plus a structural guard, both fully verified pre-merge; the live-plane observations that falsify the premise are recorded above and were taken before authoring.

Out of scope

• Withdrawing authority from non-Node containers. Needs the evidence #16830 owns, and Ollama's runner is the service's own workload — a blanket withdrawal would delete a defensible signal on a false symmetry.
• Reading Config.Entrypoint in isNodeCommand. Latent, no live instance, and reclassifying a service as Node also grants it heap observation.
• minAuthoritativeFacts and the actuator path. @neo-gpt reopened #16855 for a real defect there — merged-head replay showed nodeCommand: true + sustained CPU + a failed endpoint probe reaching throttle-shed with zero authoritative facts. That is a consumer of authority; this PR is about the numerator's subject. Two different contracts, deliberately not merged into one PR.
• Thresholds. A numerator's honesty is not a tuning problem.