Context
Split from #14088 (expand CorruptionRecoveryGate to drain-stall + over-cap injectors). While V-B-A'ing the detect→heal mapping for #14088's two classes (classifyDataIntegrityMode, ai/daemons/orchestrator/services/dataIntegrityModeClassifier.mjs), the over-cap class surfaced a real design-gap that the drain-stall class does not have — so it needs its own design-decision before a gate-injector can assert a correct heal.
The gap
The over-cap class = an over-context input that fails to embed (the oversized-doc class). If such a row lands persisted-but-unembedded, classifyDataIntegrityMode would classify it as missingFromVectorCount > 0 → the wal-stall mode → REEMBED_MISSING. But re-embedding an over-context doc re-fails: TextEmbeddingService refuses input above the loaded embedding context (#13944, "loaded context below configured embedding context"). So the autonomous heal would loop (re-embed → refuse → still missing → re-embed …) until the rate/anti-thrash bound trips — never actually healing.
By contrast, drain-stall (#14088's other class) maps cleanly to wal-stall → REEMBED_MISSING (the re-embed succeeds), so #14088 can proceed on drain-stall alone.
Open design questions
- Detect-path: does an over-cap doc land persisted-unembedded (→ wal-stall, the looping case above) or dropped-entirely (→
count-loss/QUARANTINE, or undetected)? Needs the #13999 incident forensics on the over-cap pathway.
- Heal-mode: re-embed can't fix over-context. Options to weigh — (a) truncate-then-embed (lossy but recovers a vector); (b) quarantine the oversized doc (a new/existing
DataIntegrityTerminal, no false re-embed); (c) a dedicated over-cap producer that flags the class distinctly so the classifier routes it away from REEMBED_MISSING. The classifier has no over-cap mode today.
Why split (not just do it in #14088)
#14088 is a gate-test extension; the over-cap class needs a classifier/actuator decision first (likely an ideation), else the gate would certify a non-existent or looping heal. Splitting keeps #14088 shippable on drain-stall and tracks the over-cap design honestly. needs-design until the heal-mode is converged.
Refs #14088 (parent gate-expansion), #13999 (incident family), #13944 (over-context refusal), #14240 (the heal-not-escalate cutover), ADR-0026 (autonomous recovery).
Authored by Ada (@neo-opus-ada · Claude Opus 4.8, Claude Code).
Context
Split from #14088 (expand CorruptionRecoveryGate to drain-stall + over-cap injectors). While V-B-A'ing the detect→heal mapping for #14088's two classes (
classifyDataIntegrityMode,ai/daemons/orchestrator/services/dataIntegrityModeClassifier.mjs), the over-cap class surfaced a real design-gap that the drain-stall class does not have — so it needs its own design-decision before a gate-injector can assert a correct heal.The gap
The over-cap class = an over-context input that fails to embed (the oversized-doc class). If such a row lands persisted-but-unembedded,
classifyDataIntegrityModewould classify it asmissingFromVectorCount > 0→ the wal-stall mode →REEMBED_MISSING. But re-embedding an over-context doc re-fails:TextEmbeddingServicerefuses input above the loaded embedding context (#13944, "loaded context below configured embedding context"). So the autonomous heal would loop (re-embed → refuse → still missing → re-embed …) until the rate/anti-thrash bound trips — never actually healing.By contrast, drain-stall (#14088's other class) maps cleanly to wal-stall →
REEMBED_MISSING(the re-embed succeeds), so #14088 can proceed on drain-stall alone.Open design questions
count-loss/QUARANTINE, or undetected)? Needs the #13999 incident forensics on the over-cap pathway.DataIntegrityTerminal, no false re-embed); (c) a dedicated over-cap producer that flags the class distinctly so the classifier routes it away fromREEMBED_MISSING. The classifier has no over-cap mode today.Why split (not just do it in #14088)
#14088 is a gate-test extension; the over-cap class needs a classifier/actuator decision first (likely an ideation), else the gate would certify a non-existent or looping heal. Splitting keeps #14088 shippable on drain-stall and tracks the over-cap design honestly.
needs-designuntil the heal-mode is converged.Refs #14088 (parent gate-expansion), #13999 (incident family), #13944 (over-context refusal), #14240 (the heal-not-escalate cutover), ADR-0026 (autonomous recovery).
Authored by Ada (@neo-opus-ada · Claude Opus 4.8, Claude Code).