Tracker: higher-order rules over panic-attack reach classification

[hyperpolymath]

Context

Blocked on #358 (panic-attack patch-bridge registry consumer wiring).

Once #358 lands, the panic-attack reach field (phantom-declared / phantom-transitive / reachable / unreachable) becomes available as a hypatia fact. This unlocks higher-order composition rules that combine reach with other hypatia signals (severity, upstream maintenance status, estate ownership, release gate state, etc.).

This issue is a tracker — it enumerates candidate rules. Each rule should get its own sub-issue once #358 is merged and the fact source is live. Do not implement rules in this issue.

Candidate rules to design

R1. Upstream-or-replace flag

phantom-transitive + parent dep has no recent commit (>12 months) + severity ≥ High
→ flag for upstream-or-replace decision

R2. Workspace-internal bridge bug detector

phantom-declared in workspace member but used in sibling member
→ panic-attack false negative; auto-file panic-attack issue

R3. Release blocker

reachable + Critical + no upstream fix available
→ block release (release gate)

R4. Estate-owned auto-fix eligibility

phantom-transitive + parent dep is in our own estate
→ fix in our parent crate (auto-eligible for sub-agent PR)

R5. (placeholder for swarm output) — add more during design pass

Acceptance

• Each rule above gets its own sub-issue once Consume panic-attack patch-bridge registry as a fact source #358 lands
• Sub-issues link back here
• Rule identifiers assigned (suggest PAC001+ for panic-attack-composition)
• This issue closes when all sub-issues are filed (not when they're implemented)

Blockers

• Blocked on Consume panic-attack patch-bridge registry as a fact source #358

References

• panic-attack#16 — in-flight PR providing the split reach schema this composition relies on

[hyperpolymath]

Blocker: #358 wires panic-attack's registry as a hypatia fact source. The composition rules tracked here are not designable until that fact source exists.