Generation rebuild is resumable and budgeted at canonical scale

Sub of epic #17018 — delivers AC-E (D#17015 r6 authoritative text). Sibling of #17023 (the election authority this runner feeds); separable one-PR leaves: #17023 owns WHO commits a generation, this leaf owns HOW a candidate generation gets built at real scale without a leap of faith.

Live latest-open sweep: checked latest open issues at 2026-08-12T12:15Z; no equivalent found. A2A claim sweep: claimed by me in the #17018 kickoff; Emmy's epic-review gate names it as an unowned leaf awaiting this filing.

Context

The lane switch re-embeds every vector. The client corpus (91 docs) is trivial — but the epic's contract surface is the canonical plane: ~103,876 active vector rows at sweep time (67,356 KB + 34,116 memories + 2,404 summaries, plus MC's temporal-summary and graph collections), and prior Qwen-migration evidence shows a family-compatible model can still change output dimension (MC bfaec657-ce3e-4c87-af06-142408828b77, session 46f8f6d0-f550-4823-b2ad-b7c2cb06713a). A rebuild of that scale on CPU-class embedding throughput is hours of work — an unresumable single-shot run that dies at row 90k and restarts from zero is not a migration primitive, it is a gamble.

The Problem

Emmy's STEP_BACK correction (D#17015 DC_kwDODSospM4BEnrR) replaced my "near-free re-embed" scope error with the canonical-scale contract: the rebuild must be resumable, budgeted, checkpointed, with an explicit write policy during the build and validation receipts before the #17023 election may commit.

The Architectural Reality

• Candidate generations build in shadow collections (per-store shadow primitives, per #17023's reuse contract).
• The embedding lane's admission/queue metrics (provider-activity receipts) are the budget instrumentation — no new diagnostics (epic #16706 standing rule inherits).
• Writes during rebuild: MC keeps accepting add_memory (WAL) and KB tenant sync keeps running — the rebuild must either freeze writes for a bounded window or replay the delta after the bulk pass (the r6 contract admits either, explicitly chosen and documented).

The Fix

A generation-rebuild runner that:

1. Checkpoints durable progress per collection (resume from the last completed batch after any interruption — process exit, provider outage, operator stop).
2. Declares duration + storage bounds up front (projected from row counts × measured per-batch throughput; parked + candidate storage co-exist within the declared envelope).
3. Chooses and documents the write policy: bounded write-freeze OR delta-replay after bulk (replay window measured, not assumed).
4. Emits validation receipts per collection: row count parity, output dimension, finiteness, and known-query retrieval spot-checks — the receipts #17023's election consumes as its pre-commit gate.
5. Proves the whole contract at canonical scale first — one full run on our plane (the ~104k rows) with receipts, before any external cutover (AC-D stage ordering).

Acceptance Criteria

• A rebuild interrupted at an arbitrary point resumes without re-embedding completed batches (fixture: kill mid-run, resume, verify no re-buys via the provider-activity receipts).
• Duration + storage budget declared before the run; the run refuses to start if parked+candidate storage exceeds the declared envelope.
• Write policy explicitly selected per run (freeze-with-bound OR delta-replay) and its receipt recorded; no silent write loss (fixture: writes during rebuild land in the committed generation).
• Per-collection validation receipts (count/dimension/finiteness/known-query retrieval) produced and consumed by the #17023 election as its pre-commit gate.
• One full canonical-scale run completed on our plane with all receipts — recorded on this ticket before the external cutover sub may proceed.

Out of Scope

• The election/commit-barrier mechanics (#17023).
• The external plane's cutover letter + deployment (AC-D stage 5; operator-gated).
• Embedding-quality benchmarking beyond the known-query retrieval spot-checks (a model-choice concern, settled by the lanes decision).

Decision Record impact

aligned-with ADR-0014 (as amended by #17019/PR #17020).

Related

Epic #17018 · D#17015 r6 (AC-E) · #17023 · #17021 · #17022 · #16706

Origin Session ID: 8637b4b9-b852-45d9-b057-de34184aae8b Retrieval Hint: "canonical scale resumable generation rebuild checkpoint delta replay validation receipts"