Implement orchestrator-owned restore-empty-target action

Context

Discussion #14032 has graduated only the exact restore-empty-target slice at raw GitHub-body SHA-256 9b3139f6678dca536407e3d5f0d426df83f9a28d281781a7e404a2cb692d684c.

The action restores one fresh Memory Core recovery unit—configured memories Chroma, summaries Chroma, and SQLite graph—from one admitted bundle. Knowledge Base rebuilds from source. Stored vectors remain provider-free, and every embedding or re-embedding decision stays separately orchestrator-driven.

#15739 owns the required ADR-0027 amendment. #15693 remains provisional for the different, still-deferred restore-shadow-fill action.

The Problem

No current actuator action can execute this contract:

• DataRecoveryActuatorService.applyHeal and healActionDispatch accept one collection;
• the closed vocabulary still contains the rejected overloaded restore-delta-merge;
• the broad runRestore CLI mutates a larger substrate set sequentially and has no run-owned staging, component transition ledger, or committed-only eligibility barrier;
• a freshly initialized SQLite graph already contains deterministic system seeds, so a naive count === 0 test either blocks all legitimate fresh boots or invites an unsafe loose predicate;
• best-effort heal-outcome telemetry cannot prove completion.

Without an exact action ticket, #15639 can accidentally become a second mutation controller or route into #15693's unresolved in-place repair semantics.

Architectural Reality

• The orchestrator classifier is the sole action selector; bootstrap contributes typed evidence only.
• DataRecoveryActuatorService is the sole persistent recovery-mutation seam.
• #15691 owns full provider-free bundle/row admission before mutation.
• #15692 supplies the landed bounded 250-row Memory Core stored-vector importer.
• recoveryRunStateStore.mjs supplies a fail-loud append precedent, but not yet this action's strict component state machine.
• GraphService creates the canonical fresh graph seed from:
  • fixed global nodes frontier and Neo-Master-Architecture;
  • the fixed frontier -[SYSTEM_TENET]-> Neo-Master-Architecture edge;
  • every canonical root in ai/graph/identityRoots.mjs::IDENTITIES. Schema tables are not data. Any additional node/edge or a non-canonical seed fingerprint means the graph is not fresh.
• The Agent OS structure map places the implementation owners in ai/daemons/orchestrator/services, ai/services/memory-core/helpers, ai/services/memory-core, ai/graph, and the matching unit/integration suites.

The Fix

Implement the orchestrator-owned restore-empty-target action after #15739 lands:

1. Replace the overloaded action vocabulary without a compatibility alias. Add a typed fresh-empty classifier route; bootstrap never selects the terminal itself.
2. Add the action-specific targetSet request and reject collection; retain collection and reject targetSet for collection-scoped actions.
3. Canonicalize a versioned v1 target-set descriptor containing the ordered destination identities, destination-topology fingerprint, bundle-manifest fingerprint, and #15691 descriptor fingerprint.
4. Derive:
   • recovery-unit key from action + target-set version + destination identities/topology;
   • attempt fingerprint by adding the bundle/descriptor fingerprints.
5. Acquire one heavy-maintenance lease/writer fence before the action-time proof.
6. Re-read every destination and require the exact seed-aware-empty predicates below. Any drift strict-settles deferred-target-not-empty with zero promotion.
7. Restore all three targets into run-owned isolated destinations, using #15692 for memories/summaries and the canonical graph importer for graph staging.
8. Validate every staged target against the admitted bundle and target-set descriptor before production promotion begins.
9. Persist strict transitions and promote memories → summaries → graph. Graph is last because it projects identities and relationships over the vector stores.
10. Revalidate the complete production target set, then strict-append committed. Only that terminal opens data-consuming service eligibility.
11. On restart, reconcile and resume the same attempt fingerprint. After production promotion begins, continue forward or settle failed-contained; never claim rollback of independently observed live state.
12. Project a bounded receipt for observability. recordHealOutcome may mirror it, but never grants completion authority.

Mechanical Seed-Aware-Empty Predicate

The graph seed manifest/fingerprint must be computed by the same canonical helper consumed by boot and recovery proof, not duplicated literals. If a future boot seed cannot be enumerated by that helper, recovery fails closed until a versioned pre-user-mutation seed marker is designed; it must not loosen the predicate.

Contract Ledger

Decision Record Impact

BLOCKED_BY #15739. The implementation must conform to the merged ADR-0027 amendment. This ticket creates no second decision record and is not merge-eligible while the amendment is only proposed.

Signal Ledger

• GPT author: AUTHOR_SIGNAL at the exact body hash, comment DC_kwDODSospM4BDrCV.
• Kimi non-author: GRADUATION_APPROVED at the exact body hash, comment DC_kwDODSospM4BDrB9.
• Refreshed STEP_BACK: signal-cycle gate and measured-evidence owner, comment DC_kwDODSospM4BDrBw.

Unresolved Dissent

Empty for restore-empty-target at the folded-body anchor. The approval explicitly excludes restore-shadow-fill, count-based promotion, and replay.

Unresolved Liveness

Gemini remains operator-benched under the Discussion's reactivation rule. Re-poll on reactivation before using a Gemini signal as authority for an action-contract change.

Discussion Criteria Mapping

• exact action and target-set split → “Action And Ticket Split”;
• request, identities, fence, staging, ordering, eligibility, crash and retry → Binding Contract clauses 1–20;
• provider-free import → clause 21;
• measured merge gate → clause 22;
• graph seed decidability → Kimi carried-forward ticket obligation in DC_kwDODSospM4BDrB9;
• implementation order → v13.2 Graduation Gates.

Acceptance Criteria

• The classifier alone maps typed fresh-empty bootstrap evidence to restore-empty-target
• restore-empty-target requires targetSet and rejects collection; collection actions do the inverse
• No restore-delta-merge compatibility alias survives in classifier, dispatcher, receipts, tests, docs, or #15639
• Recovery-unit key and attempt fingerprint are canonical, versioned, and covered by collision/idempotency tests
• Memories and summaries require exact zero counts under the writer fence
• Graph freshness uses one boot/recovery seed-manifest SSOT and rejects an extra node, extra edge, missing seed, altered seed record, altered system edge, and topology mismatch
• Under-fence drift settles deferred-target-not-empty with zero production promotion
• #15691 admission completes before staging and #15692 batches remain bounded and provider-free
• All staging targets validate before the first production promotion
• Strict states cover admitted → fenced → staged → promoted:memories → promoted:summaries → promoted:graph → validated → committed plus deferred, interrupted, and failed-contained paths
• Transition-write failure at every boundary leaves eligibility closed
• Crash tests at every component boundary resume the same attempt idempotently
• After production promotion begins, reconciliation completes forward or settles failed-contained; it never overwrites independently observed live state
• Only committed opens data-consuming service eligibility; best-effort telemetry cannot do so
• Provider tracing proves zero embedding and re-embedding calls
• #15695 records 5,000/20,000 vector-plus-graph staging/promotion timing and peak memory before this PR may merge
• #15639 consumes the admitted action only and contains no importer call or restore child spawn
• Unit and disposable-store integration coverage passes under the repository's custom Playwright harness

Out of Scope

• Bundle/row compatibility work owned by #15691
• Bounded vector importer mechanics already supplied by #15692
• The selector/projection implementation owned by #15639
• restore-shadow-fill and #15693
• Generic count-loss promotion
• Journal replay or a synthetic cutover coordinate
• Knowledge Base restore
• Concepts, trajectories, sent-to-cull archive, or temporal summaries
• Embedding or re-embedding

Avoided Traps

• Direct runRestore reuse — wrong authority, target scope, staging, and settlement.
• Per-collection heals — permit partially restored service visibility and destroy bundle-level identity.
• Graph row-count zero — canonical boot seeds make it false.
• Loose “only system rows” test — extra or altered seed-looking state is still non-fresh.
• Best-effort completion — telemetry failure cannot be confused with a committed run.
• Rollback after promotion starts — cannot safely overwrite independently observed live state.
• Bundle-keyed anti-thrash — a different bundle must not bypass cooldown.
• Provider preflight — stored-vector restore performs no embedding.
• Selector-owned mutation — #15639 remains request/projection only.

Dependencies

Blocked by #15739, #15691, and #15695. #15692 is available.

Related

• Discussion #14032
• #15639
• #15691
• #15692
• #15693
• #15695
• #15739
• ADR-0027

Live latest-open sweep: checked the latest 20 open issues immediately before creation on 2026-07-22; only the intended ADR blocker #15739 matched this design space. A2A in-flight sweep: checked the latest 30 messages across all read states immediately before creation; no overlapping action claim found.

Origin Session ID: cb60301d-74a4-4024-b80d-2f7efdbf9cd1

Retrieval Hint: "restore-empty-target memories summaries graph seed-aware empty committed eligibility targetSet"