Residency diagnosis lacks production-bound mutation controls

Context

PR #16854 repairs the residency diagnosis chain from TextEmbeddingService through VectorService to the operator-visible IngestionService receipt. Exact-source inspection at d28c7d5ca138099f21fc362f26f9bf93f20c1c5c shows the behavior is correct: an unobserved preflight leaves residencyDisposition absent, observed residency followed by loss becomes evicted-mid-batch, and the bounded value reaches summary.errors[].details.

Two requested regression proofs remain absent, however. This successor records those proof obligations without holding merge-safe production code in another repair cycle.

The Problem

Two independent production mutations remain green:

1. Insert a second loaded-model call into the preflight-rejection arm. The focused TextEmbeddingService.retry.spec.mjs suite still passes 36/36 because the never-resident control installs async () => [] but never counts calls.
2. Delete only the conditional residencyDisposition spread from IngestionService.embedChunkGroups. The Vector batch-failure and canonical embed-failure-classification suites still pass 37/37 because the new delivery test stops at VectorService.

The implementation therefore has the intended behavior today, but CI does not own either invariant. A later fresh probe or dropped final carrier can restore the original ambiguity without reddening the named evidence.

The Architectural Reality

• ai/services/memory-core/TextEmbeddingService.mjs owns the residency observation and tri-state classification. The observed-negative preflight is the sole never-resident writer; the post-request arm may add evicted-mid-batch only after an observed-positive preflight.
• ai/services/knowledge-base/VectorService.mjs carries the bounded classification and cause across the total-outage rethrow.
• ai/services/knowledge-base/IngestionService.mjs#embedChunkGroups is the final production writer of the operator-visible error receipt.
• test/playwright/unit/ai/services/memory-core/TextEmbeddingService.retry.spec.mjs owns the exact-one-preflight invariant.
• test/playwright/unit/ai/services/knowledge-base/embedFailureClassification.spec.mjs already exercises the real embedChunkGroups seam and is the natural owner for the final receipt witness.

The mandatory structure-map command was attempted at ticket creation and failed with Cannot create a string longer than 0x1fffffe8 characters; the existing owner files and sibling tests above provide the placement authority. No new file or directory is prescribed.

The Fix

1. Count the installed loaded-model probe in the never-resident control and assert exactly one call.
2. Extend the real embedChunkGroups composition witness so a classified thrown error lands at summary.errors[0].details.residencyDisposition.
3. Add the negative control: an unclassified upstream error must leave that details property absent.
4. Mutation-prove both seams: an inserted second preflight and a removed final receipt carry must each red their named test.

No production behavior change is expected unless a test exposes a previously hidden defect.

Contract Ledger Matrix

Decision Record impact

none — this binds existing repaired behavior and introduces no architectural decision.

Acceptance Criteria

• The never-resident control counts loaded-model probe calls and asserts exactly one.
• Inserting a second loaded-model probe in the production preflight-rejection arm makes that control fail.
• A real embedChunkGroups run carries evicted-mid-batch to summary.errors[0].details.residencyDisposition.
• An upstream error without a disposition leaves summary.errors[0].details.residencyDisposition absent.
• Removing only the final IngestionService carrier makes the production-path witness fail.
• The focused canonical unit specs pass without relying on serial-mode skips as evidence for an unexecuted negative control.

Out of Scope

• Changing residency classification vocabulary or error.code.
• Adding a fresh provider request after failure.
• Changing retry, timeout, model-loading, or ingestion behavior.
• Claiming live-provider or stuck-runner detection; those remain separate runtime-evidence lanes.

Avoided Traps

• Stopping at VectorService. That proves the middle carrier, not the receipt an operator reads.
• Treating a serial skip as a green control. A skipped negative is unmeasured, not preserved.
• Source grep as mutation proof. Current source correctness does not establish that future removal turns CI red.
• Adding a second probe to test probe count. The control observes the existing seam; it must never create the behavior it forbids.

Related

• Follow-up to PR #16854.
• Refs #16852 — source contract and repaired production behavior.
• Refs #14154 — broader residency diagnosis remains intentionally open.

Live latest-open sweep: checked the latest 20 open issues and the latest 30 all-state A2A messages at 2026-08-10T08:23:40.801Z; no equivalent ticket or earlier in-flight claim found.

Origin Session ID: 878f05af-2c4e-4da2-a5c2-9e4af666fcb8

Retrieval Hint: query_raw_memories("PR 16854 residencyDisposition exact one preflight IngestionService receipt mutation")