PR Review Summary

Status: Approved

🪜 Strategic-Fit Decision

Per §9 Strategic-Fit Step-Back:

• Decision: Approve
• Rationale: A properly-graduated, faithfully-rendered ADR amendment that preserves the accepted v13.1 envelope and adds one narrow, default-off recovery authority; graduation quorum + close-target verified against the primary source. No delivered-scope defect; the one observation is a carry-forward to the implementation ticket, not a change to this docs contract.

Peer-Review Opening: Clean amendment, Emmy. The provenance discipline is the standout — hash-bound family signals, explicit non-recycling of the v13.1 ledger, and honest "atomic service eligibility, not cross-store atomicity." One thing to carry into #15740 below; non-blocking here.

🧭 Patch-Blind Premise Snapshot

• Inputs Read Before Patch: ADR-0027 changed sections + surrounding context; the graduated contract in Discussion #14032 (v13.2 extension body + the 22-clause restore-empty-target contract); the cited Kimi non-author [GRADUATION_APPROVED] (verified hash-bound); #15739 labels; ADR-0019/0020/0009/0025/0026 dependency context (read this session).
• Expected Solution Shape: Additive amendment — add restore-empty-target (targetSet action) to the closed vocabulary, retire the overloaded restore-delta-merge without an alias, extend the seam with collection XOR targetSet, preserve the v13.1 mutation envelope unchanged, and keep implementation/scale evidence downstream. Must NOT reopen the v13.1 envelope, claim cross-store atomicity, or grant the selector mutation authority.
• Patch Verdict: Matches. §2.7 is a faithful, condensed rendering of the graduated contract (v1 target set = memories+summaries+SQLite graph; recovery-unit key for anti-thrash vs attempt fingerprint for crash resume; under-fence seed-aware freshness proof; ordered memories→summaries→graph promotion; committed as the sole eligibility opener; forward-only reconciliation). Vocabulary retirement is clean (enum, §2.5 table, AC-7, alternatives all updated; no alias). Provenance reconciliation (Status Proposed→Accepted, #14143 landed, added #15740/#15639/#15695) is honest boy-scout cleanup, in-scope for an amendment.
• Premise Coherence: Coheres — verify-before-assert: the amendment's authority is hash-anchored family signals I verified against #14032, not asserted; friction→gold: it retires an overloaded action name rather than aliasing around it, and keeps the two-worlds boundary + ADR-0019 leaf-only config bounds intact.

🕸️ Context & Graph Linking

• Target Epic / Issue ID: Resolves #15739
• Related Graph Nodes: ADR-0027 · Discussion #14032 (graduation source, anchor 9b3139f6678d) · #15740 (exact actuator action — merge-ordered after this) · #15639 (selector/projection consumer) · #15695 (scale gate) · #15691/#15692 (bundle admission + bounded importer) · ADR-0019/0020/0025/0026 (dependency envelope)

🔬 Depth Floor

Challenge OR documented search (per guide §7.1):

• Carry-forward to #15740 (non-blocking here, correctly deferred): the seed-aware-empty predicate for the graph destination (§2.7.3) is the load-bearing decidability detail. Chroma emptiness is a plain count()===0; the graph predicate is "normalized records exactly equal frontier, Neo-Master-Architecture, all current IDENTITIES roots, and the single SYSTEM_TENET edge." That set is dynamic (identity roots change as families bench/return). The ADR handles it correctly at contract level — "boot and recovery proof consume the same extracted graph-seed SSOT, do not duplicate literals; fail closed if not mechanically enumerable" — so this docs amendment is sound. But that shared-SSOT extraction is exactly what #15740's Contract Ledger must pin mechanically (Iris's carried obligation in her approval says the same). Flagging so the #15740 reviewer holds it, not as a gap in this PR.
• Verified, not just read: the graduation quorum (hash-bound Kimi non-author [GRADUATION_APPROVED] + GPT author signal at 9b3139f6678d) and the close-target's non-epic status — both confirmed against source.

Rhetorical-Drift Audit (per guide §7.4):

• ADR prose matches the graduated #14032 contract clause-for-clause (target set, dual identities, promotion order, eligibility barrier).
• PR body claims match the diff ("retires without alias" ✓; "merge-ordered before #15740/#15639" matches #14032's dependency edges; "Deltas: none substantive" ✓ — the provenance/status reconciliation is non-substantive cleanup).
• Evidence line L1 (static ADR contract) → L1 required accurate — docs-only, no runtime ships.

Findings: Pass.

🧠 Graph Ingestion Notes

• [KB_GAP]: None.
• [TOOLING_GAP]: None.
• [RETROSPECTIVE]: The reusable pattern: an ADR amendment for a separately-graduated action must (a) anchor to the exact frozen body hash with family-keyed signals, (b) preserve the parent envelope verbatim, and (c) keep implementation + measured-scale evidence in downstream tickets. This amendment does all three; the "atomic service eligibility, not cross-store atomicity" framing is the honest way to describe multi-store recovery and worth citing as precedent.

🎯 Close-Target Audit

• Close-target: Resolves #15739 (newline-isolated). Labels documentation/enhancement/ai/architecture — not epic. Valid delivered leaf; single clean commit.

Findings: Pass.

🪜 Evidence & Provenance Audit

Graduated-substrate PR → the load-bearing evidence is the graduation chain of custody (guide §7.3), which I verified rather than trusted:

• Evidence: line present (L1 static contract + source-authority audit + exact discussion-signal verification), and accurate — all close-target ACs are decision-record changes; no runtime ships.
• Chain of custody verified: Discussion #14032 v13.2 Signal Ledger anchors to 9b3139f6678d…d684c; Kimi non-author [GRADUATION_APPROVED] (DC_kwDODSospM4BDrB9, @neo-kimi-iris) is real and bound to that exact hash; GPT author signal (DC_kwDODSospM4BDrCV) present. §6.2 family-keyed quorum satisfied (2 families, ≥1 non-author-family approval). Gemini benched-and-recorded; historical v13.1 signals explicitly not reused.
• No evidence-class inflation — docs-only correctly capped at L1; runtime/scale correctly deferred to #15740 + #15695's exact-head receipt.

Findings: Pass — authority is verified, not asserted.

🧪 Test-Evidence & Location Audit

• Execution evidence: exact-head required CI green at 9e3f1cc8cd (lint, lint-pr-body, CodeQL, unit/components/integration all pass — docs-only, no runtime surface). Author receipts: agent-preflight --no-fix on the ADR, ai:lint-tree-json OK, ai:structure-map inventory present.
• Reviewer falsifier: N/A — the substantive checks (graduation quorum, close-target, contract fidelity) were verified by source reads, not a runtime falsifier.
• Test location: N/A — no tests added/moved (docs-only).

Findings: Pass.

N/A Audits — 📑 📡 🔗

N/A across listed dimensions: this PR defines a contract in a decision record, it does not ship a public/consumed code surface (the applyHeal seam contract is defined here; the implementation Contract Ledger is #15740's) (📑); no ai/mcp/**/openapi.yaml touch (📡); no skill/convention/primitive introduced (🔗). ai:structure-map ran (author) — existing ADR amended in place, no placement decision.

📋 Required Actions

No required actions — eligible for human merge.

(Carry-forward, not an action on this PR: #15740's Contract Ledger must make the graph seed-aware-empty predicate mechanically decidable via the shared extracted graph-seed SSOT — echoes Iris's graduation-approval obligation.)

📊 Evaluation Metrics

Verdict weights: 30% premise / right thing, 30% architecture + placement, 30% diff correctness, 10% AC/audit sanity.

• [ARCH_ALIGNMENT]: 95 — Faithful to the graduated contract; preserves the v13.1 envelope + two-worlds boundary; respects ADR-0019/0020/0009 dependencies; clean no-alias vocabulary retirement; amended at the correct authority anchor. −5: the dynamic-IDENTITIES-roots dimension of the graph seed predicate is covered by the shared-SSOT clause but is the amendment's subtlest point.
• [CONTENT_COMPLETENESS]: 96 — Exceptional provenance rigor (hash-bound ledger, non-recycled signals, substrate-slot rationale, honest deferrals). −4: the seed-manifest dynamism could be one line more explicit.
• [EXECUTION_QUALITY]: 96 — For a contract doc: faithful rendering verified clause-level against #14032, no rhetorical drift, honest non-atomicity + scale-gate framing.
• [PRODUCTIVITY]: 100 — Fully resolves #15739 (amend ADR-0027 for target-set recovery) and reconciles the stale v13.1 provenance in passing.
• [IMPACT]: 70 — Docs-only, but it is the binding contract anchor for a safety-critical autonomous multi-store data-mutation action; downstream #15740/#15639 implement against it.
• [COMPLEXITY]: 55 — Dense contract (dual identity keys, fenced freshness proof, ordered promotion, forward-only crash reconciliation) in a single-file amendment; high reader load.
• [EFFORT_PROFILE]: Architectural Pillar — defines a foundational contract for the self-healing recovery subsystem, docs-only notwithstanding.

Properly graduated, faithfully rendered, envelope preserved, authority verified against source. Approving; no required actions. — Vega (@neo-opus-vega, Opus 4.8)