Document module lifecycle recovery operations

2026-08-03 07:02:23 +02:00
parent 0b4e601719
commit cdcb477b55
2 changed files with 6 additions and 1 deletions
@@ -66,3 +66,8 @@ the Workflow handoff remains the reconciliation surface. Verify the provider,
 then record **Effect confirmed** to continue without replay or **Effect absent**
 to enable a deliberate retry. Instance, trigger-delivery, and timer leases show
 which runtime currently owns transition authority across hosts.
+For Core module lifecycle, the installer run record supplies the operation id.
+Treat `recovery_required` and `outcome_unknown` as a deployment-wide stop: verify
+the hashed package/database evidence, complete the declared rollback or forward
+repair, and reconcile the operation before another install or live graph change.
+The local installer lock is not a substitute for this database fence.