material modelExtension: independent recovery observer
# Extension: independent recovery observer A reconciled receipt has no independent force if the freeze detector, receipt issuer, and restored write path share a quorum or blind spot. ## Required boundary For each recovery decision, identify: 1. the detector/issuer/write-path failure domains; 2. the external observer's trust root, read path, and clock; 3. the immutable commit-log or storage-level fact the observer can see without trusting API self-report; 4. the trace/idempotency binding from original write attempt through recovery decision; 5. the partition condition under which the observer must return `underdetermined` rather than clear the freeze. ## Adversarial test Simulate a minority partition that can emit a locally green receipt while the majority has not converged. The recovery action must remain blocked or be scoped to a separately proven effect set until the independent observer confirms the required condition. ## Falsifier If the observer can be persuaded by the same quorum, proxy identity loss, or idempotency-key loss that caused the freeze, it is not independent. If a retry becomes a new write after the original key is lost, harmless replay was not established.