Measure restore-empty-target staging and promotion at 5k/20k

Context

The original fresh-host investigation is measured in the phase receipt: ordinary restore preserved explicit vectors, made zero embedding-provider calls, and did not reproduce a provider-dependent hang. The first material boundary was whole-file vector retention plus store transport; 20,000-row runs reached 1.23–1.33 GiB importer RSS before counting Chroma.

That evidence unblocked #15691 and #15692. Both fixes are now merged: bundle/row admission completes before mutation, and stored-vector import streams in bounded batches.

Discussion #14032 subsequently graduated the narrower restore-empty-target contract at body SHA-256 9b3139f6678dca536407e3d5f0d426df83f9a28d281781a7e404a2cb692d684c. The remaining scale gate is no longer the manual importer: #15740 must stage, validate, promote, and revalidate one run-owned Memory Core target set containing memories Chroma, summaries Chroma, and the SQLite graph. #15740 is blocked from merge until this ticket supplies that evidence.

The Problem

#15692 bounds each vector-import batch, but it does not price the complete recovery unit:

• two isolated Chroma staging targets;
• a run-owned SQLite graph staging target;
• pre-promotion validation of all three targets;
• ordered memories → summaries → graph promotion;
• post-promotion target-set validation and cleanup/containment overhead;
• Node, Chroma, SQLite, temporary-disk, and total wall-time cost.

The prior single-import receipt cannot be reused as proof for this wider action. Conversely, a mock-only benchmark cannot prove the exact #15740 implementation is cloud-safe.

Investigation Contract

Build the disposable measurement harness now, then run its final evidence pass against the exact #15740 implementation head before that PR may merge.

1. Use fresh, run-owned destinations and disposable bundle/store roots only. No live Memory Core data may be opened or mutated.
2. Measure two explicit fixture profiles:
   • 5k-target-set: 5,000 stored-vector rows in memories and 5,000 in summaries;
   • 20k-target-set: 20,000 stored-vector rows in memories and 20,000 in summaries.
3. Include a deterministic graph fixture in both profiles and report its exact node/edge counts and serialized bytes. Do not imply a one-to-one relationship between vector and graph rows.
4. Execute and time the exact action phases separately: admission, stage memories, stage summaries, stage graph, validate all staged targets, promote memories, promote summaries, promote graph, revalidate production, and terminal settlement.
5. Record peak Node heap/RSS, Chroma RSS, SQLite/process RSS where separable, temporary-disk high-water mark, first/last progress receipt, per-phase row counts, and observed maximum vector batch size.
6. Trace provider entrypoints and prove zero embedding or re-embedding calls. Provider state is not a benchmark axis for the final action because it is not a dependency.
7. Exercise one interrupted pre-promotion control and one post-first-promotion reconciliation control. These controls measure retained staging/disk/memory cost; #15740 owns correctness of the state machine.
8. Repeat the final measurement on the exact #15740 PR head. Synthetic or seam-only runs remain controls and cannot satisfy the merge gate.

Acceptance Criteria

• A disposable harness measures the complete memories + summaries + graph target set without touching live data
• The 5k profile contains 5,000 explicit-vector rows per Chroma destination and reports exact graph cardinality/bytes
• The 20k profile contains 20,000 explicit-vector rows per Chroma destination and reports exact graph cardinality/bytes
• Admission, each staging phase, staged validation, each ordered promotion, production revalidation, and settlement have separate timings and progress receipts
• Peak Node/Chroma/SQLite RSS, Node heap, temporary-disk high-water mark, row counts, and maximum observed vector batch size are reported
• Provider tracing proves zero embedding and re-embedding calls
• Pre-promotion interruption and post-first-promotion reconciliation controls report retained-resource cost
• The final receipt names the exact #15740 implementation head; mock-only evidence is explicitly non-authoritative
• Any unsafe scaling or unbounded phase is routed to its owning fix before #15740 merge; no provider gate is introduced from correlation

No arbitrary wall-time or RSS pass threshold is invented here. The merge decision must use the measured 5k→20k scaling curve, the bounded-batch witness, and the declared cloud deployment envelope rather than a threshold without provenance.

Decision Record Impact

None. This ticket measures the restore-empty-target contract graduated by Discussion #14032 and governed by the #15739 ADR-0027 amendment. It cannot change action authority.

Authority Boundary

• The orchestrator classifier remains the only selector of restore-empty-target.
• DataRecoveryActuatorService / #15740 owns persistent recovery mutation.
• This ticket owns disposable measurement only.
• Stored-vector restore is provider-free.
• Embedding and eventual re-embedding remain separately classified and Orchestrator-driven.

Out of Scope

• Implementing or widening the #15740 action contract
• Implementing the #15639 bootstrap selector
• restore-shadow-fill, generic count-loss promotion, or journal replay
• Knowledge Base restore
• Production mutation
• Adding an embedding-provider preflight

Avoided Traps

• Reusing the old importer receipt — it omits graph staging and ordered target-set promotion.
• Mock-only green benchmark — useful as a control, not exact-head merge evidence.
• Node-only memory accounting — hides Chroma, SQLite, and temporary-disk cost.
• One end-to-end stopwatch — cannot locate a scale cliff or retained-resource phase.
• Provider-state matrix — the final action has no provider dependency; trace zero calls instead.
• Invented performance threshold — report the scaling curve and deployment envelope before choosing a bound.

Dependencies And Routing

• #15740 may implement while this measurement lane is open, but its PR may not merge until the exact-head receipt lands here.
• #15739 remains the ADR merge-order gate for #15740.
• #15639 consumes the admitted action only after #15739 and #15740 settle.

Related

• Discussion #14032
• #15639
• #15691
• #15692
• #15739
• #15740

Origin Session ID: cb60301d-74a4-4024-b80d-2f7efdbf9cd1

Retrieval Hint: "restore-empty-target 5000 20000 memories summaries graph staging promotion peak memory"