Amend ADR-0027 for target-set recovery runs

Context

Discussion #14032 has reached family-keyed quorum for the bounded restore-empty-target slice at raw GitHub-body SHA-256 9b3139f6678dca536407e3d5f0d426df83f9a28d281781a7e404a2cb692d684c.

The v13.1 ADR-0027 envelope remains authoritative: diagnostics produce evidence, the orchestrator classifier selects an action, and DataRecoveryActuatorService is the sole persistent data-mutation seam. The v13.2 extension narrows the old overloaded restore-delta-merge deferral into one eligible empty-target action while leaving restore-shadow-fill and journal replay deferred.

The Problem

ADR-0027 currently fixes a collection-scoped seam—applyHeal({action, collection, evidence, now})—and an action-plus-collection anti-thrash key. Its closed vocabulary still declares restore-delta-merge. That shape cannot honestly govern one logical recovery run spanning the configured Memory Core memories collection, summaries collection, and SQLite graph.

The existing recovery-run store is append-only, but ADR-0027 does not yet define the action-specific strict transition chain, bundle-independent recovery-unit identity, bundle-bound attempt identity, ordered multi-store promotion, crash reconciliation, or the committed service-eligibility barrier required by the graduated contract.

Architectural Reality

• ai/daemons/orchestrator/services/DataRecoveryActuatorService.mjs delegates the current singular-collection seam to the pure dispatch core.
• ai/services/memory-core/helpers/healActionDispatch.mjs admits mutating actions by action + collection and still names restore-delta-merge.
• ai/services/memory-core/helpers/recoveryRunStateStore.mjs supplies strict append-failure behavior and durable recovery records, but its current statuses are not the graduated component-transition state machine.
• GraphService boot creates a deterministic system seed: the frontier, the master-architecture primer and edge, plus missing canonical identity roots. A fresh graph is therefore not equivalent to row count zero.
• The broad ai:restore CLI is an operator maintenance surface over more substrates. It is not the governed, staged three-target actuator action.
• Stored-vector restore is provider-free. This amendment grants no embedding or re-embedding authority.

The Agent OS structure map places the owning surfaces in ai/daemons/orchestrator/services, ai/services/memory-core/helpers, ai/services/memory-core, and learn/agentos/decisions.

The Fix

Amend ADR-0027 rather than replacing it:

1. Preserve the complete v13.1 autonomous data-mutation envelope and the detect/classify/act authority split.
2. Retire the overloaded restore-delta-merge vocabulary without a compatibility alias.
3. Add restore-empty-target as the only graduated restore action. Record restore-shadow-fill as separately deferred and journal replay as unauthorized until a source-backed successor decision exists.
4. Record the default-off bootstrap selector as an opt-in selection exception; after admission, mutation remains autonomous inside ADR-0027.
5. Define the exact v1 target-set descriptor: ordered configured memories Chroma, summaries Chroma, and Memory Core SQLite graph destinations, plus topology, bundle-manifest, and descriptor fingerprints.
6. Extend the seam additively: collection-scoped actions require collection and reject targetSet; restore-empty-target requires targetSet and rejects collection.
7. Define:
   • recovery-unit key = action + target-set version + canonical destination identities/topology;
   • attempt fingerprint = recovery-unit key + bundle/descriptor fingerprints.
8. Make under-fence seed-aware-empty re-proof, isolated staging, memories → summaries → graph promotion, forward-only crash reconciliation, and failed containment binding.
9. Define strict run-owned transition semantics ending in committed; only committed opens data-consuming service eligibility. Best-effort heal-outcome recording remains telemetry.
10. Pin the migration and merge order: ADR amendment first; exact actuator ticket second; selector consumer last. The 5,000/20,000 vector-plus-graph witness remains a merge gate for the implementation PR.

Contract Ledger

Decision Record Impact

Decision Record: REQUIRED — amend ADR-0027.

This ticket is the amendment lane. Its PR must pass the human merge gate before the exact actuator-action implementation becomes merge-eligible.

Signal Ledger

• GPT author: AUTHOR_SIGNAL at the exact body hash, comment DC_kwDODSospM4BDrCV.
• Kimi non-author: GRADUATION_APPROVED at the exact body hash, comment DC_kwDODSospM4BDrB9.
• Refreshed STEP_BACK: eight-dimension gate and requested signal cycle, comment DC_kwDODSospM4BDrBw.
• Historical v13.1 signals remain scoped to v13.1 and are not reused.

Unresolved Dissent

Empty at the exact folded-body anchor for restore-empty-target. This does not approve restore-shadow-fill, count-based promotion, or journal replay.

Unresolved Liveness

Gemini remains operator-benched under the Discussion's reactivation rule. Re-poll on reactivation before treating Gemini as authority for this amendment.

Discussion Criteria Mapping

• authority and target-set boundary → Authority Boundary + Binding Contract clauses 1–6;
• recovery-unit and attempt identities → clauses 3–6;
• under-fence freshness and zero-promotion drift → clauses 10–11;
• staging, ordering, crash reconciliation, containment → clauses 12–20;
• provider-free restore → clause 21;
• scale gate → clause 22 and the refreshed STEP_BACK scale row;
• ADR disposition → Discussion “ADR Disposition” and “v13.2 Graduation Gates.”

Acceptance Criteria

• ADR-0027 preserves every v13.1 envelope invariant and names the default-off selector exception precisely
• restore-delta-merge is retired; restore-empty-target is admitted; restore-shadow-fill and replay remain explicitly deferred
• The v1 target-set descriptor, destination topology, recovery-unit key, and attempt fingerprint are normative
• collection XOR targetSet validation and migration behavior are normative, with no compatibility alias
• Per-destination seed-aware-empty proof is required under the writer fence and is mechanically decidable
• Ordered memories → summaries → graph promotion and strict component transitions are normative
• Only committed grants service eligibility; outcome telemetry is explicitly non-authoritative
• Crash reconciliation is forward-only after production promotion starts; unprovable continuation settles failed-contained
• Provider-free stored-vector restore and separate orchestrator-owned re-embedding authority are explicit
• The implementation merge order and the #15695 scale-evidence gate are recorded
• The ADR PR receives the required cross-family review and human merge

Out of Scope

• Implementing the actuator action
• Implementing or widening #15639
• Graduating or implementing restore-shadow-fill
• Designing a replay journal or cutover coordinate
• Changing #15691 bundle admission or the #15692 bounded importer
• Performing embeddings or re-embeddings

Avoided Traps

• Synthetic collection key — loses bundle-level identity and permits partial visibility.
• “Atomic restore” wording — the stores are sequential; atomicity exists only at service eligibility.
• Best-effort completion receipt — a swallowed telemetry failure cannot open services.
• Bundle-bound cooldown key — choosing another bundle must not evade anti-thrash.
• Count-zero graph test — boot-seeded system content makes it false.
• Broad CLI reuse — runRestore has a different authority and substrate scope.
• Provider readiness gate — preserved-vector restore performs no embedding.

Related

• Discussion #14032
• #15639
• #15691
• #15692
• #15693
• #15695
• ADR-0027

Live latest-open sweep: checked the latest 20 open issues immediately before creation on 2026-07-22; no equivalent found. A2A in-flight sweep: checked the latest 30 messages across all read states immediately before creation; no overlapping claim found.

Origin Session ID: cb60301d-74a4-4024-b80d-2f7efdbf9cd1

Retrieval Hint: "ADR 0027 targetSet collection XOR recovery-unit key attempt fingerprint committed eligibility barrier"