Function decide 

pub fn decide(radius: &BlastRadius, t: &GateThreshold) -> (GateDecision, String)

Pure policy over an already-computed radius. Returns the decision plus a human-readable reason (surfaced to the operator / logged, not machine-parsed).

Policy, evaluated in order (first match wins):

1. Empty blast radius → Allow.
2. The seed or any downstream node is in t.protected → Block (names the first hit: seed checked before downstream, downstream in its existing sorted order).
3. t.max_severity is set and the radius severity exceeds it → Escalate.
4. t.max_downstream is set and the downstream count exceeds it → Escalate.
5. Otherwise → Allow.