Evidence before expansion.

Establish the baseline.

Define the software condition, the authority boundary, the source facts, and the current evidence path. Name the decision owner and agree what success, failure, and an inconclusive result would mean before testing.

Evaluate the existing and composed toolchain fairly. A difference in terminology alone is not a reason to change systems.

Bound the sources and authority.

Choose an explicit source set and interfaces without replacing customer systems or authority. Agree access, disclosure, data handling, and the permitted actions separately. Initial inquiry is not authorization to provide sensitive data or credentials.

Exercise normal and failure states.

Examine missing, stale, conflicting, inapplicable, and divergent conditions as well as the normal path. State what should happen, what must not happen, and what evidence should remain.

Any recovery exercise needs its own scope and authority. Reconstructed history is not continuing permission and does not make a failed execution successful.

Measure, then decide.

Assess the evidence produced and the operational burden of producing, reviewing, and maintaining it. Compare against the baseline and the agreed criteria rather than treating activity as proof of value.

Expand only when the evidence supports doing so. Change or stop when the criteria are not met. An unsupported conclusion remains inconclusive; an adequate existing path remains a legitimate outcome.