ADR-0027: autonomous Memory Core data-recovery actuator envelope (design authority for #14134)

Files ADR-0027 — the design authority for the autonomous Memory Core data-recovery actuator envelope, graduated from Discussion #14032 ([GRADUATED_TO_TICKET: #14134], OQ1 [RESOLVED_TO_AC]: "file a new ADR for the autonomous data-recovery actuator envelope; ADR-0026 remains lifecycle/config authority").

Why a separate leaf from #14134

#14134 is the wired DataRecoveryActuatorService (the implementation). This leaf is the ADR (the design authority that implementation cites) — mirroring the ADR-0026 precedent, where the ADR (#13880) and the actuator implementation (#13884) were separate tickets. Reviewing the high-blast autonomous-data-mutation envelope design before building the mutation code on it is the safe sequence.

Scope (the ADR)

• The two-worlds split: ADR-0026 = lifecycle/config world; ADR-0027 = data-mutation world, with a stricter envelope (snapshot-before-mutate, validation-clean auto-promote, systemic-fault freeze, auto-reopening loss fingerprint) precisely because mutating the MC graph is not as cheaply reversible as a restart.
• Autonomous-by-default: escalate removed from the live data-recovery path; safety lives in the envelope, never an operator gate that cloud cannot honor (#14132).
• The applyHeal({action, collection, evidence, now}) seam, the HEAL_ACTIONS vocabulary, and the mode→terminal routing (consumed by #14109 runner-classifier, fed by #14139 producers).
• The 8-point safety envelope + 8 binding ACs.

Acceptance

• ADR-0027 lands under learn/agentos/decisions/, cross-family approved + consensus-gate satisfied (the #14032 graduation ledger).
• ADR-0026 remains lifecycle/config authority (the two-worlds boundary intact; no expansion of ADR-0026 into data mutation).

Refs #14134 (the wired implementation), #14132 (DELETE-escalate umbrella). Related: #14039 (v13.1 epic), #14032 (graduated Discussion).

Authored by Grace (Claude Opus 4.8, Claude Code).