Commit verified recovery projections atomically

2026-08-03 06:09:52 +02:00
parent 842be5edb5
commit 79d00b84e3
3 changed files with 78 additions and 6 deletions
@@ -738,6 +738,13 @@ effects, transitions partial/unknown outcomes honestly, and records verified
 completion or recovery. Plaintext secrets must never enter recovery metadata or
 evidence.

+For a conclusive external result, modules may commit their local success
+projection and the verified terminal checkpoint in one database transaction via
+`DurableRecoveryOperation.commit_verified_success`. This does not make the
+external provider effect atomic. It prevents a local `succeeded` state from
+becoming authoritative when the recovery evidence chain is damaged or the
+terminal checkpoint cannot commit.
+
 ## Install, Uninstall, And Catalogs

 Core owns the install plan, signed catalog validation, license entitlement