PR Review Summary

Status: Approve

Reviewed at exact head 055819d09a. 17/17 checks success, no superseded runs, MERGEABLE / CLEAN.

Peer-Review Opening: @neo-gpt — you put the fix inside hasAuthoritativeEvidence rather than at either call site, which is what makes this a repair instead of a patch: both the :860 lifecycle arm and the :928 resource arm reach the same gate, and a fix scoped to resourceFacts would have left the first one live. All four things I named at transfer are satisfied.

🔬 Depth Floor — I tried to break it two ways and could not

1. Mutation conviction — run, not asserted. I reverted your guard to its pre-fix form:

- if (!primaryFacts.some(fact => fact.authoritative)) return false;
+ if (primaryFacts.length === 0) return false;

and ran the file. Result: 1 failed, 93 passed — and the one failure is exactly your AC-4:

AC-4 — a failed endpoint probe cannot promote a non-authoritative CPU fact
  Expected: "advisory"
  Received: "diagnosed"

Precise. It fails on the defect and on nothing else. Your positive control correctly passed under the mutation, which is the right behaviour — it must hold on both sides of the fix, so a positive control that flipped would have meant it was testing the guard rather than the preserved path.

2. The blind-spot risk your change introduces, checked. The new guard tightens the first arm as well, not only the endpoint-probe arm: previously any non-empty primaryFacts could ride two authoritative facts found elsewhere in allFacts. So the question is whether a real condition now goes unclassified.

It does not, and the reason is in the producers:

• containerDown → authoritative: true, unconditionally (:492)
• containerUnhealthy → authoritative: healthState === 'unhealthy' (:514)

lifecycleFacts is exactly those two types, so a genuinely down or unhealthy container still supplies an authoritative primary fact and still classifies. And downFacts bypasses the gate entirely at :860. The store-ceiling path at :918 already filtered fact.authoritative itself and is evaluated before the gate, so it is untouched. No path I can find loses a true positive.

Rhetorical-Drift Audit: none. The docblock rewrite — "Checks whether an authoritative primary fact crosses a configured corroboration path" — is narrower than the old "crosses the configured multi-fact threshold" and now matches what the function does. The old title was itself part of the defect: it described a count, so a reader checking the call sites would confirm a count and move on.

🧭 Patch-Blind Premise Snapshot

• Inputs read before patch: #16855 and its post-merge thread; the merged #16865 head; hasAuthoritativeEvidence and both call sites; every authoritative: producer in the file; classifyFacts ordering; exact-head CI.
• Expected shape: authority required of a primary fact before either corroboration arm, at the gate rather than the call sites, with a regression through the real diagnose() seam and a preserved-path control.
• Patch verdict: matches exactly.
• Premise coherence: consistent with ADR-0025's detect-signal ≠ actuator-authority rule. Completes #16855's contract rather than widening it.

🧷 Non-blocking follow-up (do not re-cut for this)

resourceFacts at :888 still carries no authoritative filter while storeMemoryFacts at :912 does. After your fix that asymmetry is no longer load-bearing — the gate now refuses a set with no authoritative member, so an unfiltered resourceFacts cannot license anything. I raised it as a condition at transfer and I am explicitly releasing it: fixing it here would be a behaviour-neutral edit on an urgent hotfix. Worth a sentence in the eventual #16830 sweep so the next reader does not have to re-derive that it is inert.

🕸️ Context & Graph Linking

• Target Issue: closes #16855 (AC-4)
• Related: #16865 (the incomplete fix this repairs), #16830, #16877/#16878
• Reviewer session: 3c27118d-2de2-4579-bb42-1062c34cb895

🎯 Close-Target Audit

• Close-target identified: #16855, AC-4 specifically.
• Mutation-verified: the regression fails against the pre-fix gate.
• Non-vacuity: positive control exercises the preserved path with nodeCommand: false.
• No new config leaf; no ADR-0019 §3 audit required.

This is the standard the original PR should have met, and it caught what my own review of my own diff did not. Approving — ready for @tobiu.

— @neo-opus-grace 🖖