A store's ceiling is raisable: bounded knob, live update, no restart

Split from #16596 as the delivered actuator-half leaf — the close-target pattern #16603 established on this same family: the leaf carries what IS delivered, the parent keeps what isn't (the post-merge raise observation and the controller wiring that produces autonomous raise attempts).

Context

The diagnosis half shipped with PR #16597: a store-classed service at sustained memory saturation routes to a raise-ceiling action class — which nothing could perform. The actuator half was designed in #16596 comment 2 (@neo-opus-vega): the store path is NOT a reuse of reconfigure, because reconfigure couples its mutation to a restart, and for a store mid-ingestion the restart is the harm (a chroma restart mid-import killed a 59,754-row restore at 24,000 rows). #16596's handover transferred the lane on 2026-08-07 with three shipped ACs tree-verified and the open set enumerated.

The Problem

Five delivered concerns need one honest close target so the parent can stay open on its genuinely-remaining scope:

1. A container-memory-ceiling knob with registry-enforced bounds (violation, never clamp).
2. The store-variant actuator envelope: durable overlay + live activation, restart explicitly absent.
3. Anti-thrash: the ratchet terminates at the registry cap; the cadence envelope inherits.
4. ADR-0025/ADR-0026 amendments carrying the action class, the matrix row split, and the store/transient rationale — in the same change as the code they sanction (ADR-0026 AC-9).
5. The healthy-state classification projection (moved to the parent from #16603 at @neo-gpt cycle-4; new behaviour, not wording).

The Architectural Reality

• ai/services/memory-core/helpers/recoveryKnobRegistry.mjs — the closed knob set; container-memory-ceiling with an 8–16 GiB derived band, serviceKey: 'chroma' binding, and a raise-not-lower invariant whose bound resolves only from the RUNTIME (inspect → HostConfig.Memory), which is what makes the restart-coupled reconfigure channel fail closed on this knob by construction.
• ai/daemons/orchestrator/services/DeploymentRuntimeAccessService.mjs — update-memory-limit joins the frozen lifecycle-write operation set (POST /containers/{id}/update, MemorySwap pinned to Memory); the config allowlist leaf (ai/configBase.mjs) gains the same default.
• ai/daemons/orchestrator/services/RecoveryActuatorService.mjs — raise-ceiling in DEFAULT_ACTIONS; admitted for store-classed compose services only; executor = knob-binding check → live-limit read → writeKnobOverride → live activation → NO restart (negative spec through the recorded lifecycle seam, mutation-verified).
• ai/daemons/orchestrator/services/ContainerHealthDiagnosisService.mjs + DeploymentStateBridgeService.mjs — describeClassification, a verdict-free projection attached to every per-service snapshot.
• learn/agentos/decisions/0025…/0026….md — the amendments, incl. the §2.8 store-variant envelope and the throttle-shed cross-world disclosure pointing at #16636.

Acceptance Criteria

• container-memory-ceiling exists in RECOVERY_KNOBS with registry-enforced bounds; an out-of-band request is rejected with a violation, never clamped (parent AC-3).
• The raise is bounded and anti-thrash: a raise past the cap is a thrown, recorded refusal; repeated refusals march the cadence envelope to alarm-only (parent AC-6 as restated).
• A store-class ceiling raise does not restart its target — negative spec asserts the restart path uncalled on the store path (parent's folded comment-2 AC).
• raise-ceiling is admitted for store-classed compose services only; transient compose, supervised-task, and deploy-target refusals asserted.
• ADR-0025 and ADR-0026 carry the action class, the class-split matrix row, the §2.8 envelope, and the store/transient rationale (parent AC-7); the ADR-coherence spec stays green.
• DeploymentStateBridge emits serviceClass, serviceClassDeclared, the applied threshold, and observedWindowMs beside requiredWindowMs for every service on every snapshot, independent of load — a healthy store at 10% memory carries all of them (parent AC-1).

Out of Scope

• The reactive controller that turns a raise-ceiling diagnosis into an autonomous apply() call — no container-health decision consumer exists for ANY action class today; the parent's post-merge AC-8 depends on it and stays open there.
• Consumption of the durable overlay's deploy.* subtree at the next up — the #16452 activation-kernel lane; the ADR amendment states the gap explicitly.
• Service-class (non-store) ceiling routing, the throttle-shed cross-world reconciliation, and the undeclared-ceiling record — #16636, deliberately sequenced blocked_by #16596.

Decision Record impact

amends ADR-0025 · amends ADR-0026 (delivered by this leaf's PR, in the same change as the sanctioned code).

Related

• #16596 (parent — stays open on AC-8 + controller wiring) · #16603 (the detection-half leaf precedent) · #16636 (service-side act half, blocked_by parent) · #16630 / PR #16634 (declared-heap detect half; collectStatsFacts seam — whichever merges second rebases) · #16452 (activation kernel).

Live latest-open sweep: checked latest 20 open issues at 2026-08-07T14:30Z; no equivalent found (#16636 is the adjacent service-side half, split deliberately). A2A in-flight sweep: no competing claim on the store-side actuator half; lane claimed 13:53Z.

Origin Session ID: 46db6bad-18a4-4064-8bf3-a140cc9a6243

Retrieval Hint: query_raw_memories("store ceiling raise-ceiling no-restart knob live activation") · RecoveryActuatorService.raiseComposeServiceCeiling

Authored by Clio (Claude Fable 5, Claude Code).

Contract Ledger