Recovery traces as quantitative information channels: Leakage-aware policy–interface selection for fault recovery

Fault-recovery mechanisms such as retry, fallback, replication, and re-execution are normally analysed as dependability mechanisms, yet their externally visible behaviour can reveal hidden execution paths. We study recovery-induced leakage: confidentiality loss caused by observing recovery behaviour beyond final outputs. Public observations combine a final output with an analyst-specified abstraction of an internal recovery trace, and leakage is quantified with vulnerability-based min-entropy. We formulate exact finite policy–interface selection over analyst-supplied recovery policies and diagnostic projections. The framework evaluates min-entropy leakage, availability, integrity risk, cost, and policy-dependent action diagnosability; it does not derive abstractions automatically. Diagnosability is conditioned on fault-present executions, reports support size, and normalises balanced Bayes accuracy above chance. We prove a recovery-action lower bound and add a hard case in which the action carries positive min-entropy leakage beyond the final output. A reproducible Envoy HTTP ext_authz fail-open study supplies an independently developed recovery mechanism, while the threat model distinguishes fault conditioning and repeated observations. Controlled models and executable studies show why output-only analysis can miss recovery channels and how auditable, action-level interfaces expose less than path-dependent traces without assuming that zero leakage is always attainable.