Harden module update compatibility cleanup

docs/MODULE_ARCHITECTURE.md

@@ -489,11 +489,16 @@ does not trust the website by location alone. A catalog must pass the configured
 signature, channel, freshness, and replay rules before a catalog entry can be
 planned. Catalog entries may declare `license_features`; core checks those
 against the configured offline license before adding the entry to the install
-plan.
+plan. Catalog entries may also declare `migration_safety` as `automatic`,
+`requires_review`, `forward_only`, or `destructive`; forward-only and
+destructive entries require explicit operator acknowledgement in the install
+plan before installer preflight allows activation.
 
 Modules should provide:
 
 - pinned backend and WebUI package refs for official catalog entries
+- module dependency metadata for catalog target-state planning
+- migration-safety metadata for catalog update planning
 - compatibility metadata in the module manifest
 - named interface contracts in the manifest and catalog entry when the module
   provides or consumes cross-module APIs
@@ -977,8 +982,15 @@ The package install-plan API records operator intent only:
   also reports catalog validity, channel, signature, trust state, and the
   configured path.
 - `POST /api/v1/admin/system/modules/install-plan/catalog/{module_id}` saves
-  a planned install row from a validated catalog entry. Catalog signature and
-  approved-channel policy are enforced before the row is saved.
+  a planned install or update row from a validated catalog entry. Installed
+  modules are planned as updates. Catalog signature and approved-channel policy
+  are enforced before the row is saved. The saved plan row can also carry a
+  data-safety acknowledgement used by preflight for forward-only or destructive
+  catalog entries.
+- Install-plan preflight returns a structured `target_plan` summary so the
+  admin UI can show current version, target version, package refs,
+  migration-safety level, and acknowledgement state without requiring JSON
+  editing.
 - `POST /api/v1/admin/system/modules/{module_id}/uninstall-plan` saves a
   planned non-destructive uninstall row for an installed module after it has
   been disabled. The Python distribution name is resolved from the installed