Q token mark QUADPublic Accountability

Degrade without pretending

Continuity And Handoff

Continuity means every surface keeps its own public promise when another surface, endpoint, feed, provider, or release path is late, stale, refused, or offline.

A fallback is not a stronger claim. A recovery label is not proof of repair. A handoff is not destination admission.

Continuity Contract

Each surface keeps a smaller promise when dependencies are missing. It does not borrow authority from another chain.

SurfaceMinimum public promiseWhen a dependency is stale
CoreBlocks, validators, metadata, custody labels, audit/export posture, and Core-owned refusal or quarantine state.Keep local state visible and downgrade Infra proof-memory, Bridge native-acquisition, Liquid fast-lane, and outside-provider claims.
InfraBIGHT-priced work, upload, verification, retrieval, receipts, proof, repair, reissue, challenge, and provider/service labels where public.Continue local service lanes where accepted and label cross-chain imports or exports as pending, stale, refused, or not yet public.
BridgePassage intent, source-pool labels, host evidence, route posture, receipt, refund, refusal, and destination-handoff labels.Record local route state, pause stronger passage/admission claims, and avoid claiming destination acceptance until the destination proves it.
LiquidMotion posture, position labels, risk posture, wrapper labels, settlement-request state, endpoint contracts, and market-closed labels where public.Block Core-worth and Bridge-dependent claims; keep only locally admissible motion and downgrade final-settlement language.
Main websiteIdentity, orientation, docs, status labels, summaries, sitemap, assistant guide, and route map.Mark current state as unverifiable, point to owning surfaces, and keep the static reader path useful.

When A Surface Degrades

Public pages should move through a small, readable sequence.

The static recovery drill contract is available at data/recovery-drills.json. It defines trigger, expected public state, recovery action class, terminal receipt requirement, and what recovery must not imply.

1. Detect

Name the owner, stale feed, missing route, delayed receipt, or unavailable dependency.

2. Label

Use plain state: stale, degraded, paused, refused, unavailable, quarantined, recovery, restored, or cannot verify.

3. Downgrade

Shrink the public claim to what the owning evidence still proves.

4. Route

Send readers to the owner surface, receipt, proof route, status page, or support playbook.

5. Recover

Publish restored state only when the owning surface has a public reason to say so.

Release And Rollback Labels

Release language should tell readers how strong the public artifact is without becoming a deployment secret.

The static release provenance contract is available at data/release-provenance.json. It explains release artifact classes, required checks, handoff labels, and the local-package boundary.

Candidate

A source or artifact is under review and should not be treated as the public surface.

Staged

The artifact is prepared for release, but publication or route ownership is not yet proved.

Promoted

The artifact has become the current public release for its surface.

Superseded

A newer artifact or route now owns the public claim.

Rolled back

The surface returned to an earlier artifact or route because the newer one should not carry the claim.

Restored

The owning surface is back inside its public contract after degraded or recovery state.

Retired

The route, artifact, or public claim is no longer current and should not be quoted as active.

Cannot verify

The current artifact, route, or owner state cannot be confirmed from public evidence.

Owner changed

The route now belongs to a different surface or support path. The old owner must not keep implying authority.

Continuity Packet Shape

The public shape is enough to keep meaning intact. Private rebuild details stay out of the page.

FieldPublic meaningBoundary
SurfaceCore, Infra, Bridge, Liquid, main website, or external support rail.Does not merge authority across surfaces.
Minimum promiseThe smallest public commitment the surface should still keep in degraded mode.Does not imply full production availability.
Required public routesStatus, proof, receipt, summary, sitemap, endpoint contract, or owner page.Does not publish private endpoints or private account paths.
Last public artifactRelease hash, manifest, dated receipt, or public version label where available.A hash proves the artifact, not live chain state.
Degraded behaviorWhat continues, waits, refuses, queues, downgrades, or becomes unavailable.Does not reveal sensitive recovery steps.
Must not claimThe strongest claims that must stay closed until the owning surface proves them.No sale, reward, allocation, custody, admission, liquidity, or launch inference.
Next proofThe next public receipt, route, status, or artifact needed to strengthen the claim.Private memory is not enough.

Downgrade Matrix

When one surface is stale or offline, the others should keep their own jobs and make the smaller claim.

If Core is staleInfra can continue accepted work, Bridge pauses Core-admission claims, Liquid blocks Core-worth claims, and the website routes to last known Core evidence. If Infra is staleCore spools audit/export posture locally, Bridge keeps local route receipts, Liquid queues export posture, and public receipt-memory claims downgrade. If Bridge is staleCore stops native-acquisition assumptions, Infra continues normal proof lanes, Liquid refuses Bridge-dependent ingress, and passage claims close or downgrade. If Liquid is staleCore and Infra continue without fast-lane claims, Bridge cannot claim Liquid handoff completion, and motion/market language downgrades. If website feed is staleThe static route map, summary, assistant guide, sitemap, and owning subdomains remain the public orientation path. If providers are staleAffected lanes pause, retry, refuse, or degrade by owner law; provider dashboards do not become source truth.

Retention Continuity

Continuity is not only uptime. It is also preserving the right public evidence when a payload, route, dataset, or support lane expires, prunes, tombstones, or moves to cold retention.

Receipts survive where useful

Receipt metadata can remain public after payload access ends, but the page must say what access no longer exists.

Tombstones are evidence

A tombstone should show ended, moved, expired, unavailable, or terminal state without publishing private payloads or private review material.

Restore needs a route

Restore or reissue should name owner, original receipt, new receipt where applicable, quote where applicable, service class, and unchanged boundary.

Use the contract

data/retention-policy.json defines retained public fields, prunable fields, tombstone behavior, restore/reissue behavior, and consumer behavior.

Public Handoff Rules

  • A handoff must name source surface, destination surface, proof class, and current state.
  • Bridge handoff does not force destination admission.
  • Infra storage does not make stored material true for another chain.
  • Liquid motion does not become Core worth without Core-owned evidence.
  • The main website can route readers, but it cannot inherit chain authority.

Not Published Here

  • Keys, seed phrases, private endpoint configuration, private provider accounts, or private payment paths.
  • Private recovery timing, private topology, sensitive contacts, or unpublished access routes.
  • Private evaluation mechanics, sensitive security detail, or bypass steps.
  • Claims of immutable operations, governance handoff, or autonomous payment before public proof exists.
  • Any route that turns degraded state into a sale, allocation, reward, redemption, or custody claim.