Recovery design boundary

The full recovery design record is maintained with the private evidence. This public folder marks the path used by the recovery decision records; it is not a second copy of that record.

Public recovery documentation should describe the contract, the failure mode, and the verification command. Private incident data stays outside this tree.