diff --git a/DEBT-DESIGN.md b/DEBT-DESIGN.md
index 6c4f1c9..0585ba2 100644
--- a/DEBT-DESIGN.md
+++ b/DEBT-DESIGN.md
@@ -441,3 +441,41 @@ That is the intended behavior. An event must not silently change meaning
 because normalization code changed. Repairing historical signatures is an
 explicit migration or reclassification event, never a different projection
 result from the same log.
+
+## What counts as a manual intervention
+
+An intervention is an operator action required to recover, repair, unblock or
+correct behaviour that should otherwise have proceeded autonomously. The
+ledger measures what the system costs to keep running, so routine operation
+does not belong in it.
+
+Counts:
+
+```text
+transaction_cleanup
+forced_release
+state_repair
+manual_requeue          when recovery failed and a human had to requeue
+manual_phase_recovery
+worker_restart          only when restarting is itself the repair
+```
+
+Does not count:
+
+```text
+deploy restart
+planned upgrade
+configuration rollout
+normal shutdown and start
+deliberate burn-in setup
+```
+
+The distinction is policy rather than schema. `worker_restart` is the one kind
+that spans both sides, and it stays a single kind until someone actually
+misuses it; a field added before the confusion exists is a guess about how it
+will be misread.
+
+The first live consequence: the deploy restart of `79d2053` was not recorded,
+and `manual_intervention` stayed in the gap list afterwards. That is the
+correct result. Orchestra can record the evidence and this history contains
+none, which is an honest gap rather than synthetic evidence.