Function decide 

pub fn decide(
    seed: &str,
    impact: Option<&HostImpact>,
    t: &GateThreshold,
) -> (GateDecision, String)

Pure policy over an already-computed radius. Returns the decision plus a human-readable reason (surfaced to the operator / logged, not machine-parsed).

Policy, evaluated in order (first match wins):

1. Empty blast radius → Allow.
2. The seed or any downstream node is in t.protected → Block (names the first hit: seed checked before downstream, downstream in its existing sorted order).
3. t.max_severity_rank is set and the impact’s severity rank exceeds it → Escalate.
4. t.max_downstream is set and the downstream count exceeds it → Escalate.
5. Otherwise → Allow.