Implement orchestrator-governed restore-delta-merge

[PROVISIONAL_UNGRADUATED: D#14032]

This ticket reserves the v13.2 implementation lane; it is not code-ready. Discussion #14032 and ADR-0027 graduated the v13.1 containment actuator while explicitly deferring restore-delta-merge, the selector, and the authoritative post-backup delta source. The v13.2 revalidation opened at DC_kwDODSospM4BDq2P must graduate before implementation or PR work begins.

Context

ADR-0027 declares restore-delta-merge in the closed heal-action vocabulary but records it as a v13.2 deferral. The live DataRecoveryActuatorService therefore still treats the action as an injected follow-up rather than a wired mutation primitive.

#15691 and #15692 now reserve two prerequisite mechanics:

• #15691: compatibility proof before restore mutation;
• #15692: provider-free, bounded explicit-vector import batches.

Those mechanics reduce execution risk. They do not decide when restore is selected, which state is authoritative on collision, or what constitutes the post-backup delta.

The Authority Gap

The governing Discussion leaves three questions deferred:

• OQ5: restore + delta-merge execution and selector;
• OQ7: corruption-percent × mode cost selection;
• OQ8: authoritative post-backup delta source.

A correct-looking shadow/checkpoint implementation would still be wrong if it silently chose those policies. In particular, an empty first-boot deployment and a damaged non-empty live collection do not automatically share identity, collision, or rollback semantics.

Invariants That Already Hold

These constraints survive every candidate option and are safe to retain as substrate:

1. Only the orchestrator diagnostics/classifier/controller path may select a recovery action.
2. DataRecoveryActuatorService.applyHeal({action, collection, evidence, now}) remains the admission, anti-thrash, rate-limit, and durable-outcome authority.
3. A restore descriptor is orchestrator-supplied and references a #15691-validated bundle; the mutation primitive never discovers or selects backups.
4. #15692 owns bounded import only. It owns no scheduling, durable recovery state, retry policy, shadow promotion, or provider call.
5. Restore preserves explicit vectors. Missing or incompatible vectors become classified residue; only a later orchestrator decision may select a distinct embedding or re-embedding action.
6. A mutating heal remains heavy-maintenance-serialized, snapshot/shadow protected, and validation-clean before promotion per ADR-0027.

Open Design Questions

• Is v13.2 one action or two narrower paths: default-off first-boot bootstrap and in-place autonomous self-heal?
• For a non-empty target, are live rows authoritative on stable-ID collision, are backup rows authoritative, or is conflict itself a fail-closed terminal?
• Is the delta the current live target, a durable post-backup journal, a source rebuild, or substrate-specific?
• Can a narrow selector be proven from target emptiness + descriptor compatibility + one diagnosed loss mode, or is the full percent × mode model still required?
• Do Memory Core stored-vector recovery and Knowledge Base rebuild require separate policies?

The live divergence matrix and graduation criteria are in Discussion #14032 comment DC_kwDODSospM4BDq2P.

Provisional Target Shape — Not Implementation Authority

After graduation, the likely operation remains:

1. consume an orchestrator-selected, compatibility-validated descriptor;
2. acquire the existing heavy-maintenance lease and establish the graduated writer-fence semantics;
3. create the graduated snapshot/shadow topology;
4. feed #15692 bounded batches into the isolated target;
5. persist resumable progress through recoveryRunStateStore.mjs, never an importer-local scheduler;
6. validate counts, integrity, vector contracts, complete manifest, and the graduated collision/delta policy;
7. promote only a clean result and record a truthful deferred, failed, rolled-back, or promoted outcome.

The exact descriptor, checkpoint, retry, collision, and promotion contracts remain candidates until the Discussion resolves OQ5/OQ7/OQ8.

Candidate Contract Ledger — Frozen Pending Graduation

Graduation Gate

• Discussion #14032 folds and resolves the v13.2 OQ5/OQ7/OQ8 extension.
• The required Step-Back covers authority, consumers, path/state determinism, recovery-state ownership, migration blast radius, and existing primitives.
• The refreshed family-keyed Signal Ledger reaches quorum at the new body anchor; the v13.1 signals are not reused silently.
• ADR-0027 receives an explicit amend / successor / keep-deferred disposition and its human merge gate is named.
• #15691 and #15692 are closed by reviewed implementations.
• This ticket is refreshed from provisional questions into exact Contract Ledger rows and implementation ACs; the provisional marker is then removed.

Decision Record impact

Decision Record: REQUIRED. The converged outcome must amend ADR-0027, supersede the relevant v13.2 deferral with a successor record, or explicitly keep the action deferred. This ticket cannot decide that disposition.

Signal Ledger

Provisional — no v13.2 implementation signal has been requested or accepted. See Discussion #14032.

Unresolved Dissent

Empty. Divergence is open; absence of dissent is not approval.

Unresolved Liveness

The current Discussion body records Gemini as operator-benched and requires re-poll on reactivation before using it as authority for v13.2 restore/delta or an ADR amendment.

Discussion Criteria Mapping

• selector authority → Discussion #14032 OQ5/OQ7;
• delta/collision authority → Discussion #14032 OQ8;
• provider-free restore + separate re-embedding → invariant 5 above;
• bounded importer → #15692;
• compatibility proof → #15691;
• first-boot consumer → #15639;
• performance evidence → #15695.

Out of Scope Until Graduation

• implementation, branch, or PR work;
• primitive-side backup discovery;
• provider readiness as a restore prerequisite;
• implicit embedding or re-embedding;
• importer-local scheduling/checkpoint authority;
• choosing a collision or delta policy by convenience.

Related

#14134 · #15639 · #15689 · #15691 · #15692 · #15695 · Discussion #14032

Origin Session ID: cb60301d-74a4-4024-b80d-2f7efdbf9cd1

Retrieval Hint: "ADR 0027 v13.2 restore delta merge selector authoritative delta provisional graduation"