feat(keyviz): address PR #822 round-1 (Gemini HIGH ×2 + Codex P2 + Gemini MEDIUM)

Three review items, four bot comments (two duplicates):

- Gemini HIGH (line 650) + Gemini HIGH (line 679) + Codex P2
  (line 654) — all the same regression: addWrite called
  updateFallbackState(value) without passing the contributor's
  (group, term), so resolveWrite's fallback path always
  returned (0, 0) for the identity slot even when a
  known-term source supplied the winning max value
  (e.g. known=100 + legacy=50 returned RaftGroupIDs=[0]).
  This regressed the PR-3b per-cell identity contract for
  mixed-version cells. Fixed: updateFallbackState now takes
  (value, group, term) and stamps lastGroup/lastTerm when
  value >= fallbackMax (last-touched tie-break matching
  addRead). When the known-term contributor wins, its
  identity propagates to the merged cell as expected;
  when the legacy contributor wins, identity correctly
  resets to (0, 0) (TestMergeKeyVizMatrices...OnUnknownTerm
  pins this case).

- Gemini MEDIUM (line 780) — hasConflict loop over
  termConflict was wasteful. recordTermContribution only
  ever stores `true` (entries are never reset), so
  `len(c.termConflict) > 0` is equivalent and clearer.

Caller audit (per loop instruction, updateFallbackState
signature change is a semantic shift on its parameter
list):

- updateFallbackState: internal helper, only caller is
  addWrite (same file, updated). No external consumer.
- hasConflict: behavior unchanged (length check is a pure
  optimization of the previous loop), no caller impact.

New test:
TestMergeKeyVizMatricesFallbackPreservesKnownTermWinnerIdentity
mirrors the existing fallback test but flips who wins —
modern (100, group=7, term=42) + legacy (50, no arrays) →
fallback returns value=100 with identity=(7, 42). The prior
PR-3c diff would have emitted (0, 0) and silently dropped
the modern source's per-cell identity in mixed-version
clusters.

Author: bootjp

internal/admin/keyviz_fanout.go

@@ -647,7 +647,7 @@ func (c *cellMergeAcc) addWrite(value, group, term uint64) {
 	if value == 0 {
 		return
 	}
-	c.updateFallbackState(value)
+	c.updateFallbackState(value, group, term)
 	// LeaderTerm == 0 (or group == 0) means "term not tracked" —
 	// the documented sentinel from a legacy peer or a publisher
 	// that has not yet fired. We CANNOT safely sum across an
@@ -664,10 +664,19 @@ func (c *cellMergeAcc) addWrite(value, group, term uint64) {
 // updateFallbackState advances the fallback-max accounting that
 // applies when hasUnknownTerm is set at resolve time. Maintained for
 // every non-zero contribution so a cell that later flips into the
-// fallback path has the correct running max + disagreement signal.
-func (c *cellMergeAcc) updateFallbackState(value uint64) {
-	if value > c.fallbackMax {
+// fallback path has the correct running max + disagreement signal
+// AND the identity of the contributor that supplied the max value.
+// Tie-break is last-touched (matching addRead) so a cell with two
+// equal contributions keeps the most recently processed identity.
+// Without the identity tracking, a cell with one known-term source
+// + one unknown-term source would always fall back to (0, 0) even
+// when the known-term source supplied the winning max (Gemini HIGH
+// + Codex P2 on PR #822).
+func (c *cellMergeAcc) updateFallbackState(value, group, term uint64) {
+	if value >= c.fallbackMax {
 		c.fallbackMax = value
+		c.lastGroup = group
+		c.lastTerm = term
 	}
 	if c.fallbackSeenNonZeroValue == 0 {
 		c.fallbackSeenNonZeroValue = value
@@ -767,17 +776,15 @@ func (c *cellMergeAcc) resolveWrite() (value, group, term uint64) {
 
 // hasConflict returns true when any (group, term) at this cell saw
 // disagreement, or — under the fallback path — when ≥2 distinct
-// non-zero values were reported.
+// non-zero values were reported. recordTermContribution only ever
+// stores `true` in termConflict (entries are never reset), so a
+// length check is equivalent to scanning the map (Gemini MEDIUM
+// on PR #822).
 func (c *cellMergeAcc) hasConflict() bool {
 	if c.hasUnknownTerm {
 		return c.fallbackNonZeroDistinct
 	}
-	for k := range c.termConflict {
-		if c.termConflict[k] {
-			return true
-		}
-	}
-	return false
+	return len(c.termConflict) > 0
 }
 
 // unionColumns returns the sorted union of column timestamps across

internal/admin/keyviz_fanout_test.go

@@ -236,6 +236,46 @@ func TestMergeKeyVizMatricesGroupTermFallbackOnUnknownTerm(t *testing.T) {
 	require.True(t, merged.Rows[0].Conflict, "fallback path raises conflict when ≥2 distinct non-zero values were seen")
 }
 
+// TestMergeKeyVizMatricesFallbackPreservesKnownTermWinnerIdentity
+// pins the Gemini HIGH / Codex P2 fix on PR #822: when the
+// fallback path is triggered by an unknown-term contribution but
+// the KNOWN-term source supplies the winning max value, the
+// merged identity must reflect that known-term contributor —
+// NOT fall back to (0, 0). Mirror image of
+// TestMergeKeyVizMatricesGroupTermFallbackOnUnknownTerm where the
+// legacy peer wins; this test pins the case the prior PR-3c diff
+// regressed (identity was always 0 under fallback regardless of
+// who won).
+func TestMergeKeyVizMatricesFallbackPreservesKnownTermWinnerIdentity(t *testing.T) {
+	t.Parallel()
+	col := []int64{1_700_000_000_000}
+	// Modern source wins with 100.
+	modern := KeyVizMatrix{
+		ColumnUnixMs: col,
+		Series:       keyVizSeriesWrites,
+		Rows: []KeyVizRow{
+			{BucketID: "route:9", Values: []uint64{100}, RaftGroupIDs: []uint64{7}, LeaderTerms: []uint64{42}},
+		},
+	}
+	// Legacy peer reports 50 with no arrays — triggers fallback but
+	// loses the max.
+	legacy := KeyVizMatrix{
+		ColumnUnixMs: col,
+		Series:       keyVizSeriesWrites,
+		Rows: []KeyVizRow{
+			{BucketID: "route:9", Values: []uint64{50}},
+		},
+	}
+	merged := mergeKeyVizMatrices([]KeyVizMatrix{modern, legacy}, keyVizSeriesWrites)
+	require.Len(t, merged.Rows, 1)
+	require.Equal(t, []uint64{100}, merged.Rows[0].Values, "fallback max-merge keeps the larger value")
+	require.Equal(t, []uint64{7}, merged.Rows[0].RaftGroupIDs,
+		"identity must reflect the known-term contributor that supplied the winning max — not (0, 0)")
+	require.Equal(t, []uint64{42}, merged.Rows[0].LeaderTerms,
+		"same: known-term contributor's term wins because its value won the fallback max")
+	require.True(t, merged.Rows[0].Conflict, "100 != 50 disagreement raises the conflict flag under fallback")
+}
+
 // TestMergeKeyVizMatricesPerCellIdentityMatchesValueOwner pins the
 // Gemini MEDIUM fix: when maxMerge picks a value from one source,
 // the identity at that cell must come from the SAME source — not