# ADR-0041: Authoritative versus rebuildable recovery state

## Status

Accepted in M15 on 2026-08-27.

## Decision

Classify every persisted state source as `AUTHORITATIVE`, `REBUILDABLE`, `EPHEMERAL`, `EXTERNAL` or
`SECRET` in a versioned `RecoveryPolicyRevision`, and enforce the classification in the contract:
authoritative state may not declare a manifest-only or absent backup and must state an RPO,
ephemeral state may not claim a payload backup, external state must be marked as a dependency,
secret state must name a secret recovery class, and only rebuildable state may be rehydrated.

Partition the database itself along the same line. Fingerprinted history is compared across a
restore; `CURRENT_TRUTH_TABLES` — NVML telemetry, GPU leases, residency, inventory runs, storage
volume states — is cleared during reconciliation and re-measured by a running control plane. A test
asserts the two sets together cover the whole schema.

## Consequences

Recovery cost is proportional to what is genuinely irreplaceable: a 5 MB encrypted control-plane
dump protects the provenance, lifecycle, migration, approval and audit truth, while 8.1 GB of model
weights are protected by exact-revision manifests instead of being copied.

A restored control plane cannot present a stale GPU lease or a dead NVML reading as present-day
fact, and the `READY` gate refuses to pass while any current-truth row survives. External projects
are recorded as dependencies rather than silently claimed as backed up.

The cost is that a new milestone must classify every table it adds. The invariant test makes that a
build failure rather than a silent recovery gap.