Gap
escalate/page is being DELETED from the live recovery path (#14132 — @tobiu's full-self-heal directive: operatorless cloud has no human to page; the smoke-detector-not-fire-extinguisher anti-pattern). ADR-0027 already removed escalate from the DATA-recovery path (§2.2 / AC-1 — the STEP_BACK required it; verified by reading it). But the lifecycle/detect world still binds the escalate terminal:
- ADR-0026 (lifecycle actuator): AC-6 "escalate-with-diagnosis — page, never loop" is binding; the §2.5 envelope terminates in
escalate; the reactive controller maps config-drift→escalate; alarm-only = "escalate, never act".
- ADR-0025 (detect): the diagnose-map emits
config-drift→escalate-with-diagnosis (page, do not loop); the envelope terminates in escalate; alarm-only = escalate.
So deleting escalate from RecoveryActuatorService (#14132) contradicts ADR-0026 AC-6 (a binding AC) — this amendment is the #14132 merge co-requisite.
Fix (mirror ADR-0027's pattern — escalate removed, not renamed)
Across ADR-0025 + ADR-0026:
- The un-healable / rate-exhausted terminal → a durable async-record (the heal-ledger), never a blocking page. Alarm-only becomes record-only.
- config-drift → the autonomous lifecycle action (
reconfigure(knownKey) / redeploy, within the anti-thrash envelope); un-resolvable → record.
- Unchanged: never-loop, the anti-thrash envelope, the two-worlds config-lifecycle-only safety (AC-2). Safety moves from the human gate into the envelope — the same move ADR-0027 §2.2 makes for the data world.
- ADR-0025's
data-integrity→escalate line is superseded by ADR-0027 (data-world autonomous heal) — re-point it, don't re-bind escalate.
Scope
- ✅ ADR-0025 (detect) + ADR-0026 (lifecycle actuator).
- ❌ NOT ADR-0027 (already full-self-heal compliant — verified §2.2/AC-1).
Acceptance Criteria
Links
Part of #14132 (the escalate-deletion umbrella; this delivers its "ADR-0025/0026 amended" AC). Authority: @tobiu's full-self-heal directive (operatorless cloud). Sibling: ADR-0027 (data-world, already compliant). Relates: #14183 (runner cutover), #14039 (v13.1 epic).
Authored by Grace (Claude Opus 4.8, Claude Code). Session 090a68e6-1a28-4b20-a5fd-842ebac3e729.
Gap
escalate/pageis being DELETED from the live recovery path (#14132 — @tobiu's full-self-heal directive: operatorless cloud has no human to page; the smoke-detector-not-fire-extinguisher anti-pattern). ADR-0027 already removedescalatefrom the DATA-recovery path (§2.2 / AC-1 — the STEP_BACK required it; verified by reading it). But the lifecycle/detect world still binds the escalate terminal:escalate; the reactive controller mapsconfig-drift→escalate; alarm-only = "escalate, never act".config-drift→escalate-with-diagnosis (page, do not loop); the envelope terminates inescalate; alarm-only = escalate.So deleting
escalatefromRecoveryActuatorService(#14132) contradicts ADR-0026 AC-6 (a binding AC) — this amendment is the #14132 merge co-requisite.Fix (mirror ADR-0027's pattern — escalate removed, not renamed)
Across ADR-0025 + ADR-0026:
reconfigure(knownKey)/ redeploy, within the anti-thrash envelope); un-resolvable → record.data-integrity→escalateline is superseded by ADR-0027 (data-world autonomous heal) — re-point it, don't re-bind escalate.Scope
Acceptance Criteria
config-driftroute, and the alarm-only line amended (escalate→record / autonomous-action); a Status/Decision-Record note added citing the authority.config-drift;data-integrity→ref ADR-0027), envelope terminal, and alarm-only line amended; Status note added.Links
Part of #14132 (the escalate-deletion umbrella; this delivers its "ADR-0025/0026 amended" AC). Authority: @tobiu's full-self-heal directive (operatorless cloud). Sibling: ADR-0027 (data-world, already compliant). Relates: #14183 (runner cutover), #14039 (v13.1 epic).
Authored by Grace (Claude Opus 4.8, Claude Code). Session 090a68e6-1a28-4b20-a5fd-842ebac3e729.