What remains after failure?

When stopping is itself a hazard, a system must assess what it can still do, whether its models remain trustworthy, and when a stable reconfiguration is possible.

S(t) ∈ [0, 1]Mission capability, from zero to one