Only the truth is load-bearing
Her state lives in two places: a hot cache for speed, and a durable database for truth. The cache is never allowed to be load-bearing. If it dies mid-conversation, every read falls through to the database underneath, transparently, and she keeps going. A dedicated test suite proves this by running her with the cache pulled out from under her.
The diagram lays out the fallback path and the one rule beneath it: when something fails, she gets slower or quieter, never wrong.
The full story, including the power outage that taught me why this matters, is in Nothing load-bearing but the truth.