# Degradation and Recovery

> What must remain safe and readable when adaptive, operational, or publication capabilities fail.

A truth machine may lose adaptive capacity without losing or corrupting its
accepted account.

## Durable minimum

**TM-DEC-001 — Last accepted truth.** Failure of an AI Peer, model provider,
reconciliation worker, user interface, live observer, or publication surface
**MUST NOT** alter or erase the last accepted current truth.

**TM-DEC-002 — Completed decisions survive.** Accepted changes, their evidence
references, reviewers, rationale, and resulting states **MUST** remain
recoverable without relying on the session or process that produced them.

**TM-DEC-003 — Partial work is not current.** Interrupted admission,
reconciliation, validation, application, or publication **MUST NOT** expose a
partly advanced coherent state as current.

**TM-DEC-004 — Recoverable uncertainty.** Queued evidence, proposed changes,
failed work, and unknown observations **SHOULD** remain distinguishable and
recoverable after interruption.

**TM-DEC-005 — Declared degraded behavior.** An implementation **MUST** state
which reads, deterministic operations, intake paths, and publication paths
remain available when each material adaptive or external dependency fails.

## AI independence

**TM-DEC-006 — No model safety dependency.** Core correctness and recovery
**MUST NOT** require a particular model, model memory, or conversation history.
If the system uses an AI Peer, the durable workspace must be sufficient for a
capable replacement to inspect the accepted account and its operating rules.

## Recovery evidence

Backups are not self-proving. A consequential implementation should retain
dated evidence that accepted truth, evidence integrity, change ancestry, and
current selection can be restored together. Deployment rollback and truth
rollback are different operations: restoring application code must not
silently reverse accepted domain truth.