Autonomous accepted-loss settlement + defrag-outcome wiring (#14084 leaf 3)

Context

#14084 leaf 3 (the value-delivering leaf, after leaf 1 #14106 — the classifyRepairResidue terminal-vs-transient decider). The classifier is pure; nothing changes the perpetual exit 1 yet. This leaf closes the loop so a fully-recovered store whose only residue is deterministically-unembeddable stops paging "repair failed" forever — autonomously, with no operator-ack.

Re-scoped 2026-06-26 (Grace) from operator-ack → autonomous, per @tobiu's v13.1 mandate (#14132): 100% autonomous self-healing; ZERO operator-ack; DELETE runtime escalate. The original durable-ack-store + --acknowledge-accepted-loss operator surface is dropped (it was the human gate the mandate forbids — the operator-ack PR #14120 is dropped). Settlement is now autonomous.

The Architectural Reality

• ai/scripts/maintenance/defragChromaDB.mjs:1534 — on a non-clean repair (anyRepairNonClean), the CLI writes the unrecoverableByCollection manifest + process.exit(1), composing with #14061 to page the operator. In operatorless cloud that page reaches no one; the run perpetually "fails" on irreducible residue.
• classifyRepairResidue (#14106) decides terminal-vs-transient; computeResidueFingerprint produces the stable residue+strategy+policy fingerprint (reused as the audit record's auto-reopen key).
• The deterministic-terminal reasons (embedding-context-exceeded / document-absent) are FACTS from the embed attempt — not judgments — so a bounded set of them is safe to settle autonomously.

The Fix

1. Autonomous accepted-loss settle decider (pure helper): given residue + the leaf-1 classifier verdict + a systemic-fault rate-bound, decide auto-settle | systemic-fault | heal-path. auto-settle iff every residue row is deterministically-terminal AND the terminal-residue ratio is below the systemic-fault bound. Produces a durable auto-accepted-loss audit record (ids + reasons + the leaf-1 fingerprint). Pure, deterministic.
2. Durable audit log (acceptedLossAuditStore, sibling of recoveryRunStateStore): appendAutoAcceptedLoss({entry, stateDir}) — persists the auto-settlement for async observability (telemetry, NOT a gate; an operator can review when present, the system never blocks on them). The fingerprint enables auto-reopen if a future strategy makes the doc embeddable.
3. Defrag-outcome wiring: at defragChromaDB.mjs:1534, before exit(1) on a partial-promoted (all-terminal-residue) result, run the autonomous decider. auto-settle → record the audit entry + exit 0 (no page, no ack). systemic-fault (mass terminal-residue = a misconfigured embedder, not bounded loss) → freeze + record telemetry (autonomous safety), do NOT mass-settle, and surface the heal gap as a design-time ticket — never a runtime escalate. transient/healable → route to the autonomous heal path (#14134 actuator). Behind the existing --allow-memory-core opt-in.

Acceptance Criteria

• A partial-promoted result with all-terminal, bounded residue → autonomous auto-accepted-loss outcome + durable audit record + exit 0, with zero operator-ack and zero runtime escalate.
• A result with any transient/non-terminal residue → NOT auto-settled; routes to the autonomous heal path (#14134), never a silent accept of recoverable loss.
• A systemic-fault-rate terminal residue (ratio above bound — the #14115 expectedDimension false-storm class) → freeze + record telemetry, NOT a mass auto-settle and NOT a runtime escalate; the heal gap is a design-time ticket.
• The audit record keys on leaf-1's computeResidueFingerprint (residue + strategy/provider/context + sorted terminalReasons), so a capability change auto-reopens the residue.
• No --acknowledge-accepted-loss / --operator-id / durable-ack-store — settlement is autonomous (the operator-ack #14120 is dropped). Default defragChromaDB (without --allow-memory-core) byte-for-byte unchanged.

Contract Ledger Matrix

Out of Scope

• The data-repair heal of transient/healable residue (re-embed/restore) — that's the autonomous data-recovery actuator #14134 (sibling sub of #14132).
• Changing leaf-1 classifier #14106 (reused as the terminal gate).
• The operator-ack surface (DROPPED, superseded by autonomous — was #14120).

Avoided Traps

• Operator-ack / human gate — DELETED per #14132. Settlement is autonomous; safety is the systemic-fault bound + deterministic-terminal-only, never a human.
• Runtime escalate — DELETED. A heal gap is a design-time ticket, not a runtime page.
• Silent mass loss — the systemic-fault bound freezes a misconfigured-embedder storm; only deterministic-terminal + bounded residue auto-settles; the audit log makes every settlement observable + reopenable.

Related

#14132 (DELETE-escalate umbrella), #14084 (parent — autonomous accepted-loss), #14106 (leaf 1 — classifier), #14134 (sibling — the data-recovery actuator for healable residue), #14068 (parking-retained lifecycle), #14039 (v13.1 epic). Supersedes the operator-ack approach (dropped PR #14120).

Authored by Grace (Claude Opus 4.8, Claude Code). Re-scoped to autonomous 2026-06-26 per the operator DELETE-escalate / zero-ack mandate.