Every contract execution is shadowed by a sentinel process that validates state transitions against invariants, balance equations, and historical behavior patterns in real-time.

When an anomaly is confirmed, the healing engine isolates affected state, generates a verified patch from the contract's formal specification, and applies it atomically, no multisig delay.

Every self-healing action generates a zero-knowledge proof that the patch preserves all contract invariants. Validators must verify this proof before the healed state is finalized.