§53.1 Function

RRD-01 names recovery as a constitutional capability. When a guardian block halts a transition, when a derivation falls behind its source, or when a surface contradicts its canonical artifact, the recovery path is the named answer — not an ad hoc one.

§53.2 Surface Binding

RRD-01 binds the recovery subsystem and its operator-facing surfaces. The audit trail is non-optional; a recovery without an audit record is, under this article, not a recovery.

json
{
  "subsystem":      "kiri:system/recovery_repair",
  "apis":           ["/recovery/diagnose", "/recovery/plan", "/recovery/apply", "/recovery/verify"],
  "audit_trail":    "append-only, attached to every step, citable from the memory layer",
  "operator_procs": "named runbooks, versioned, ratified under GPL-01"
}

§53.3 Operator Procedure Discipline

Every recovery procedure is named, versioned, ratified, and addressable. An operator may not invent a procedure mid-incident; they may invoke a ratified one, escalate to draft a new one, or halt. There is no fourth option.

1. §53.3.a
   Diagnose before apply

   No /recovery/apply call is accepted without a preceding /recovery/diagnose record.

2. §53.3.b
   Verify before close

   Every apply is followed by /recovery/verify; an unverified recovery remains open.

3. §53.3.c
   Audit attached

   Each step writes to the audit trail with operator identity, timestamp, and citation of the procedure version.

§53.4 Bounded Scope

RRD-01 does not modify governance, does not alter custody, and does not introduce new APIs beyond the existing recovery surface. It ratifies what is already validated.

§53.5 Final Principle

A civilization that treats recovery as an exception will, in time, treat exception as recovery. RRD-01 forbids the inversion.

“Recovery is a constitutional capability, not an incident.”