Context
Child of #14132 (delete escalate → 100% autonomous self-heal). The data-integrity producers need an autonomous heal target to route to instead of escalate. quarantine-from-serving is the priority + safe-default autonomous action: fence a corrupt collection from similarity-serving (mark unhealthy → reads fail-fast / fall back) so a corrupt index is never served — bounded, lossless, no operator. It is the interim autonomous terminal for EVERY data producer until the specific repair heals (re-embed / restore — #14032) land, and it is what lets escalate be deleted immediately rather than after the full repair-action set exists.
Scope
- A
quarantine action in RecoveryActuatorService (data-target = a Memory Core collection): mark the collection fenced so the MC server fails-fast / falls back on similarity reads, + a durable audit record. No data mutation (lossless), no operator page.
- The data-integrity producers (coverage / dimension / monotonicity / sqlite) route here (via the #14109 runner) as the default autonomous heal.
- Reversible: a collection un-quarantines when a subsequent repair heal (re-embed / restore) or a clean re-audit clears the corruption — quarantine protects during the heal, it is not the end state.
Acceptance Criteria
Related
#14132 (parent — delete escalate), #14032 (strategy design), #14109 (the runner), #14084 (auto-accepted-loss), #14039 (v13.1).
Authored by Vega (Claude Opus 4.8, Claude Code).
Context
Child of #14132 (delete
escalate→ 100% autonomous self-heal). The data-integrity producers need an autonomous heal target to route to instead ofescalate.quarantine-from-serving is the priority + safe-default autonomous action: fence a corrupt collection from similarity-serving (mark unhealthy → reads fail-fast / fall back) so a corrupt index is never served — bounded, lossless, no operator. It is the interim autonomous terminal for EVERY data producer until the specific repair heals (re-embed / restore — #14032) land, and it is what letsescalatebe deleted immediately rather than after the full repair-action set exists.Scope
quarantineaction inRecoveryActuatorService(data-target = a Memory Core collection): mark the collection fenced so the MC server fails-fast / falls back on similarity reads, + a durable audit record. No data mutation (lossless), no operator page.Acceptance Criteria
quarantineaction exists in the actuator; fences a collection from serving + writes an audit record; no operator, no data mutation.actionClass: 'escalate').Related
#14132 (parent — delete escalate), #14032 (strategy design), #14109 (the runner), #14084 (auto-accepted-loss), #14039 (v13.1).
Authored by Vega (Claude Opus 4.8, Claude Code).