Fleet review (glm)

Lens: requirements + adversarial. The diff fixes the #384 blocking finding at its named location: recordedDriftAssets checks content drift (!owned || ownerHash != slot.SHA256) before ModeDrift, so a combined content+mode drift reports ActorGuidanceContentDrift with ModeDrift as the independent flag, and mode-only drift still reports ActorGuidanceModeDrift — mirroring the conflict-stage invariant. The combined evidence-stage case is pinned by a table case asserting cause, both modes, and ModeDrift=true; mode-only and content-only cases are pinned unchanged. The refusal record is detached (defensive copy verified by mutation test), a successful preflight carries no refusal, and refusals write nothing (tree-compared). Early evidence refusals on invalid units degrade to zero named assets rather than panicking or inventing paths. No blocking findings.

No findings.

Verdict: ready to merge

Post-merge QA (glm)

Lens: requirements + adversarial. The diff fixes the #384 blocking finding at its named location: recordedDriftAssets checks content drift (!owned || ownerHash != slot.SHA256) before ModeDrift, so a combined content+mode drift reports ActorGuidanceContentDrift with ModeDrift as the independent flag, and mode-only drift still reports ActorGuidanceModeDrift — mirroring the conflict-stage invariant. The combined evidence-stage case is pinned by a table case asserting cause, both modes, and ModeDrift=true; mode-only and content-only cases are pinned unchanged. The refusal record is detached (defensive copy verified by mutation test), a successful preflight carries no refusal, and refusals write nothing (tree-compared). Early evidence refusals on invalid units degrade to zero named assets rather than panicking or inventing paths. No blocking findings.

No findings.

Verdict: clean

Post-merge QA (deepseek)

Lens: evidence + test design. The merged code implements the #384 acceptance criterion at the right level: recordedDriftAssets now evaluates content drift first (!owned || ownerHash != slot.SHA256) and keeps mode drift as the independent ModeDrift flag, with mode drift as the cause only when it is the sole drift, and TestPreflightActorGuidanceRefusalNamesCause adds the combined content+mode case plus the case where a conflicting skill also carries mode drift. The criterion's scenario (bytes appended by an external editor, mode 0640) is therefore reproduced as a package test, and the Refusal() record is detached (Assets() returns a copy) with the zero value meaning 'not refused'. Two evidence gaps: the documented no-recorded-ledger branch has no test that names it, and the early-return refusals reuse recordedDriftAssets even when the refusal is about the runtime matrix rather than the files. No blocking defect: I traced the refusal paths and the two cause values exhaustively, and none reports a wrong cause for the merged inputs.

Suggestion (1)

• Runtime-matrix refusals now carry file drift that is not the reason for the refusal (internal/installcoord/actor_guidance.go:212): Every early return now calls recordedDriftAssets(unit), including the runtime-matrix branch (err != nil || !matrix.HasCompatible), which refuses because the local runtime is incompatible or disabled, not because a guidance file drifted. After the CLI half (feat(cli): name failing assets and drift cause on actor_guidance_unverified refusals #436) lands, that refusal prints asset=... cause=content_drift action=conflict lines for every drifted file next to a reason token about the runtime, so an operator fixing the runtime first sees file conflicts that were not the reason for the refusal. Either scope assets to the evidence stage or accept and document that the lines are informational, so a later reader does not treat them as the blocker.

Question (1)

• The no-recorded-ledger branch is documented but not exercised by name (internal/installcoord/actor_guidance.go:285): recordedDriftAssets documents that "without any recorded ledger nothing can be verified as owned, so every present candidate asset is reported", a widening of the refusal compared with a ledger-present run. No test in the merged actor_guidance_test.go mentions a prior state or a nil ledger, so the behaviour that decides whether every present asset is named in that case is asserted only implicitly. Condition worth pinning: a unit whose observation has no prior state and whose plan has N assets, one refused preflight, expected refusal assets = the N present assets, all with cause content drift and an empty RelativePath never occurring.

Verdict: clean