Release v0.1.16

docs/STATE_AND_RECOVERY_CONTRACT.md

@@ -93,10 +93,17 @@ Alembic, and post-migration tasks. The lock is session-scoped and therefore
 released if the migration process dies.
 
 Runtime roles run `govoplan_core.commands.wait_for_database`. It waits until
-the database has exactly the configured Core/module Alembic heads and never
-upgrades schema. This permits a migration Job and runtime Deployments to be
+the database has exactly the configured, dependency-resolved Core/module
+Alembic heads and never upgrades schema. Cross-module `depends_on` revisions
+therefore do not leave runtime roles waiting for a branch marker Alembic has
+correctly consumed. This permits a migration Job and runtime Deployments to be
 submitted together while keeping startup fail-closed.
 
+Runtime coordination records the installed `govoplan-core` distribution
+version for API, worker and scheduler roles. FastAPI/OpenAPI metadata versions
+are presentation metadata and must not be used as deployable software identity;
+mixing the two would create a false version-skew readiness failure.
+
 ## Recovery Ledger
 
 `govoplan_core.core.recovery` provides a durable operation and evidence