GovOPlaN/govoplan-core
2
0
Fork 0
Code Issues 4 Pull Requests Actions Packages Projects Releases Wiki Activity

Commit atomic domain and recovery state together

Browse Source
This commit is contained in:
zemion
2026-08-03 05:43:39 +02:00
parent 7e59a7f2b3
commit 842be5edb5
3 changed files with 189 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/DURABLE_RECOVERY_OPERATIONS.md
+8
View File
@@ -27,6 +27,14 @@ provider result codes. They must never contain credentials or resolved secrets.
Ops is the platform surface for unresolved operation status; owning modules must
provide the reconciliation action and business-level explanation.
Database-only operations must use the durable handle's atomic terminal methods
when their module rows and final recovery checkpoint belong to one invariant.
Those methods stage the terminal checkpoint and lease release in the caller's
SQLAlchemy transaction, then commit the domain rows and recovery evidence
together. A failed commit rolls both back and leaves the previously durable
`running` record available for stale-fence handling; modules must not commit
their domain state first and close an `atomic` recovery record afterwards.
An owning module may reconcile an `outcome_unknown` provider effect through the
claimed durable handle's `resolve_unknown` method. External evidence that the
effect occurred records verified success. Evidence that it did not occur moves