The gap (V-B-A'd 2026-06-26)
The actuator's safety bounds are all per-collection: healActionDispatch's cooldown/rate is keyed on (action, collection); acceptedLossSettlement's systemic-fault bound is a per-collection residue ratio. None see the global pattern. So a single embedder outage (the live KB-fire class — embedder down/404 across the corpus) that makes many collections fail at once → each classifies as independent drift → the actuator could fire N heals (a mass re-embed storm) against the already-down provider, deepening the outage and churning every collection. Grep confirms no global/cross-collection guard in healActionDispatch / recoveryRunStateStore / RecoveryActuatorService; no existing ticket.
Premise (operatorless cloud)
#14134 already states the principle per-collection: "a mismatch/loss RATE above threshold = a misconfigured embedder, not bounded drift → freeze + record, NEVER a mass auto-re-embed." This extends it to the global/cross-collection scope: N-collections-failing-at-once = ONE systemic embedder fault, not N independent drifts. Without it, the "runs for weeks unattended" bar is exposed to a self-inflicted mass-heal storm during exactly the outages the immune system exists to survive.
Fix shape
A pure global pre-dispatch decider (the cross-collection analogue of acceptedLossSettlement's per-collection bound): given the per-collection diagnosis outcomes for a sweep + a global bound (failing-collection count OR ratio of the corpus) + a window, decide:
- independent-drifts (below the global bound) → proceed to per-collection heal/dispatch as normal;
- global-systemic-fault (at/above the bound) → SUPPRESS the mass per-collection heal,
warm-provider, freeze the affected set, and record one systemic-fault to the heal-ledger (#14163) — never mass-re-embed against a down provider.
Composes with: the per-collection dispatch bounds (#14143); #14166 freeze re-probe (the frozen set auto-recovers when the global fault clears); #14163 ledger (the single systemic-fault record).
Scope
The pure decider is buildable now — its input is the per-collection diagnosis list DataIntegrityDiagnosisService.gatherAndDiagnose() already produces (a settled shape), so this is not speculative. The integration into the diagnosis→dispatch path lands with the apply()-cutover (#14138 + the service heal-wiring). v13.1 — the fleet-scale safety guard.
Parent #14134. Refs #14039 · #14146 (the KB-fire that motivates it) · #14163 (the ledger sink) · #14166 (the freeze it triggers).
Authored by Grace (Claude Opus 4.8, Claude Code). Session 090a68e6-1a28-4b20-a5fd-842ebac3e729.
The gap (V-B-A'd 2026-06-26)
The actuator's safety bounds are all per-collection:
healActionDispatch's cooldown/rate is keyed on(action, collection);acceptedLossSettlement's systemic-fault bound is a per-collection residue ratio. None see the global pattern. So a single embedder outage (the live KB-fire class — embedder down/404 across the corpus) that makes many collections fail at once → each classifies as independent drift → the actuator could fire N heals (a mass re-embed storm) against the already-down provider, deepening the outage and churning every collection. Grep confirms no global/cross-collection guard inhealActionDispatch/recoveryRunStateStore/RecoveryActuatorService; no existing ticket.Premise (operatorless cloud)
#14134 already states the principle per-collection: "a mismatch/loss RATE above threshold = a misconfigured embedder, not bounded drift → freeze + record, NEVER a mass auto-re-embed." This extends it to the global/cross-collection scope: N-collections-failing-at-once = ONE systemic embedder fault, not N independent drifts. Without it, the "runs for weeks unattended" bar is exposed to a self-inflicted mass-heal storm during exactly the outages the immune system exists to survive.
Fix shape
A pure global pre-dispatch decider (the cross-collection analogue of
acceptedLossSettlement's per-collection bound): given the per-collection diagnosis outcomes for a sweep + a global bound (failing-collection count OR ratio of the corpus) + a window, decide:warm-provider, freeze the affected set, and record one systemic-fault to the heal-ledger (#14163) — never mass-re-embed against a down provider.Composes with: the per-collection dispatch bounds (#14143); #14166 freeze re-probe (the frozen set auto-recovers when the global fault clears); #14163 ledger (the single systemic-fault record).
Scope
The pure decider is buildable now — its input is the per-collection diagnosis list
DataIntegrityDiagnosisService.gatherAndDiagnose()already produces (a settled shape), so this is not speculative. The integration into the diagnosis→dispatch path lands with the apply()-cutover (#14138 + the service heal-wiring). v13.1 — the fleet-scale safety guard.Parent #14134. Refs #14039 · #14146 (the KB-fire that motivates it) · #14163 (the ledger sink) · #14166 (the freeze it triggers).
Authored by Grace (Claude Opus 4.8, Claude Code). Session 090a68e6-1a28-4b20-a5fd-842ebac3e729.