Record Core lifecycle recovery adoption

2026-08-03 07:02:34 +02:00
parent d4bf07b446
commit 5e449b0983
3 changed files with 30 additions and 5 deletions
@@ -67,6 +67,16 @@ cannot be retried until evidence confirms either that the effect occurred or is
 absent. Linked Dataflow uncertainty blocks the Workflow without duplicating
 Dataflow's recovery authority.

+Core module lifecycle is adopted at four boundaries. Installer recovery is
+prepared before snapshots so a full database restore preserves the attempted
+operation. Pre-migration package changes use compensation, migrated changes use
+forward recovery, destructive retirement requires a hashed and restore-checked
+snapshot, and live graph changes restore the prior registry when no migration
+ran. A deployment-wide database fence serializes these effects; any unresolved
+predecessor blocks a differently keyed retry until explicit reconciliation.
+Supervised installs become successful only after restart and health evidence is
+recorded.
+
 ## Operator Contract

 Ops lists non-terminal and manual-intervention operations. Operators must verify