Record the threshold section identity rule and register its proof

2118e3345 moved the Virtualization Hosts threshold section off a bare
`type === 'agent'` selection and onto provider-owned nodes, but landed without
the contract delta or a registered verification artifact, so the completion
guard blocked it.

The alerts contract now states the rule the fix depends on. Threshold sections
are keyed by override identity rather than resource type, and a resource that
appears in two sections has two different override keys, so a threshold saved
from the wrong row is written where alerting never reads it. Frontend
primitives records that surfaces classify through the shared
`isPulseAgentPlatformResource` classifier instead of re-deriving the standalone
versus provider-owned distinction from a raw resource type.

`useAlertOverridesState.test.tsx` already carried the right proof and simply
was not on the alerts-frontend-surface accepted list, so it is registered
rather than duplicated elsewhere.

Verified: canonical completion guard passes on the staged set, registry.json
parses.

docs/release-control/v6/internal/subsystems/alerts.md

@@ -61,6 +61,17 @@ own inline boundary. A wearout arm keyed on `> 0` silently exempts the single
 worst reading a disk can publish, which let a spent SSD read critical on the
 Physical Disks surface while raising no alert at all.
 
+Threshold sections are keyed by override identity, not by resource type. The
+Virtualization Hosts section reads and writes overrides on the bare resource id,
+while the Machines section resolves through the agent-derived identity
+candidates. A resource that appears in both sections therefore has two different
+override keys, and a threshold saved from the wrong one is written where
+alerting never reads it, leaving the machine on the global default with nothing
+on screen to explain it. A resource must appear in exactly one threshold section,
+the one whose identity alerting honours. Standalone Pulse-agent machines belong
+to Machines, so the Virtualization Hosts section is fed by provider-owned
+virtualization nodes rather than by every resource of type `agent`.
+
 ## Canonical Files
 
 1. `internal/alerts/specs/types.go`

docs/release-control/v6/internal/subsystems/frontend-primitives.md

@@ -31,6 +31,14 @@ inlining the boundary at each call site. `isPhysicalDiskWearoutReported` mirrors
 helpers gate on it, so a wearout reading cannot be classified one way in a
 status label and another way in the cell beside it.
 
+Feature surfaces classify resources through the shared classifier that already
+owns the distinction rather than re-deriving it from a raw resource type.
+`isPulseAgentPlatformResource` is the single authority for whether a resource is
+a standalone Pulse-agent machine or a provider-owned node, and the standalone
+page, platform navigation, the resource drawer and the alerts threshold sections
+all read it. Selecting by bare `type === 'agent'` collapses that distinction and
+puts the same machine on two surfaces that do not share an identity.
+
 ## Canonical Files
 
 1. `frontend-modern/src/components/shared/`

docs/release-control/v6/internal/subsystems/registry.json

@@ -2256,7 +2256,8 @@
               "frontend-modern/src/features/alerts/__tests__/OverviewTab.timelineerror.test.tsx",
               "frontend-modern/src/features/alerts/__tests__/OverviewTab.total24h.test.tsx",
               "frontend-modern/src/features/alerts/__tests__/ThresholdsTab.test.tsx",
-              "frontend-modern/src/features/alerts/__tests__/useAlertDestinationsTabState.test.tsx",
+              "frontend-modern/src/features/alerts/__tests__/useAlertOverridesState.test.tsx",
+            "frontend-modern/src/features/alerts/__tests__/useAlertDestinationsTabState.test.tsx",
               "frontend-modern/src/features/alerts/AlertDeliveryHealthCard.test.tsx",
               "frontend-modern/src/features/alerts/identity.test.ts",
               "frontend-modern/src/features/alerts/thresholds/__tests__/helpers.test.ts",