feat: harden multi-host runtime coordination

docs/STATE_AND_RECOVERY_CONTRACT.md

@@ -52,6 +52,13 @@ software version, module-composition hash, queues, start time, and heartbeat.
 The registration identity includes a process incarnation so a stale process
 cannot update a replacement's row.
 
+Worker metadata also records the orchestrator pool and declared concurrency.
+Every Celery prefork child disposes the SQLAlchemy pool inherited from its
+parent and creates a process-local pool before handling work. Deployment
+rendering must therefore budget one database pool for the worker parent and
+each child. Ops compares active queue ownership, software versions, and the
+order-independent module-composition hash with the graph loaded by the API.
+
 Drain is durable operator intent:
 
 - an API enters not-ready state after observing drain;