Declare recovery against exercised conditions and explicit oracles

Define the service-level indicators and semantic checks relevant to the incident. If users received empty recommendations, verify useful results as well as HTTP status and latency. If a backlog caused delayed jobs, check completion and age rather than only a falling admission rate. Inspect affected cohorts separately so a healthy majority does not hide one broken region, model version, or tenant. Keep the denominator and success definition consistent across the incident and recovery views.

Also verify the restoration mechanism: intended artifact loaded, correct routing, released resources, required redundancy, and normal dependency behavior. A mitigation can mask the symptom by dropping useful work or bypassing a feature, which may be an acceptable degraded state but should be labeled. Recovery communication should distinguish mitigated, restored under tested conditions, and corrective work still pending. That makes the claim actionable without waiting for an unrealistically absolute proof that every future condition is safe.

Under a fixed predeclared sample of independent identically distributed Bernoulli trials with constant failure probability, a zero-failure result supports a calculable one-sided upper confidence bound. It does not estimate every unexercised workload or correct biased selection. Correlated bursts, changing load, missing telemetry, and repeated peeking until a clean run appears invalidate the simple fixed-sample interpretation. State those assumptions alongside the number rather than attaching a confidence label to an arbitrary green dashboard interval.

A confidence bound is a property of a procedure's repeated-sampling coverage under its model, not automatically a posterior probability that this system's true rate lies below the reported value. Nor does a bound on transport errors establish semantic correctness. Pair rate-based evidence with deterministic recurrence fixtures and targeted boundary checks. For rare failures, the required sample can be much larger than intuition suggests, and a production risk decision can also depend on impact and uncertainty outside the chosen model.

Choose conditions that can reveal the original mechanism after immediate traffic settles: new connection creation, cache expiration, delayed jobs, restart, peak-shaped requests, or cancellation after a timeout. A window's duration matters only through the conditions it actually contains. Waiting longer during idle traffic does not exercise a missing high-concurrency path. Record which recurrence tests passed and which conditions remain untested, then assign follow-up verification rather than quietly expanding the meaning of the recovery statement.

The sampling lab makes a clean-run limitation visible. Reset, set both p=0.01 and n=20, predict the exact zero-failure probability, then inspect and Play or Step. Reset and set both p=0.01,n=100 for a separate comparison. Even the latter zero bar is about 0.366 under the synthetic iid model. Playback only highlights outcomes; it is not a monitor or sequential test. Use exact bars for this rare-event question rather than treating the normal approximation or its CDF bound as a guarantee about a single outcome.