A workflow drawing is not a contingency plan until its failure edges still reach valid output and a person can be summoned when automation runs out of road.
Graphlib traverses the declared failure edge from the primary model, then proves that schema normalization and context isolation occur before output. The same graph must preserve a route to human attention when fallback also fails.
Primary fails. Fallback succeeds for the normal recovery proof. Fallback fails independently for the escalation proof. Both routes must exist.
A hit can bypass model spend. A miss must still reach the primary route without becoming a dead end.
Schema normalization protects downstream consumers when a different model takes over the task.
Separation after recovery prevents an outage reroute from bleeding one task’s history into another.