diff --git a/Repo-docs-RELEASE-DEPENDENCIES.md b/Repo-docs-RELEASE-DEPENDENCIES.md index d0f42f1..4752b4e 100644 --- a/Repo-docs-RELEASE-DEPENDENCIES.md +++ b/Repo-docs-RELEASE-DEPENDENCIES.md @@ -1,4 +1,4 @@ - + > Mirrored from `/mnt/DATA/git/govoplan-core/docs/RELEASE_DEPENDENCIES.md`. > Origin: `repository`. @@ -83,7 +83,9 @@ govoplan-module-installer \ The installer uses a runtime lock, snapshots `pip freeze` plus WebUI `package.json`/`package-lock.json`, writes a run record below `runtime/module-installer/runs`, and marks planned rows as applied only after -all commands succeed. +all commands succeed. When `--migrate` is used with a `sqlite:///` database URL, +the installer also snapshots the SQLite database with SQLite's backup API before +running migrations. Supervised mode treats package command failure, migration failure, restart failure, and health timeout as rollback triggers. It restores the Python/WebUI @@ -92,9 +94,11 @@ saved install plan state so the operator can correct it. The supervisor must run outside the FastAPI server process; the admin UI saves and validates plans but does not mutate packages from an HTTP request. -Package rollback is automatic. Database rollback is not automatic; take a -database backup before running migrations in production and restore that backup -if a migration must be reverted. +Package rollback is automatic. SQLite database rollback is automatic for +installer runs that used `--migrate` and captured a database snapshot. Non-SQLite +production deployments must provide their own managed backup/restore procedure +before running migrations; the current installer blocks automatic migration +backup for unsupported database URLs. Rollback uses the saved run snapshot: @@ -112,7 +116,9 @@ deployment model. Module manifests can declare core compatibility bounds and uninstall guard providers. Preflight blocks incompatible manifest contracts/core versions and lets module-owned guards veto package removal when data, migrations, workers, or -schedulers would make uninstall unsafe. +schedulers would make uninstall unsafe. Modules that own migrations are treated +as non-retirable by default, so package uninstall is blocked unless the manifest +explicitly declares migration retirement support. ## WebUI