Before activation
Record the selected package/version/strategy and manifest digest, current configuration/policy references, actual artifact or remote contract identity, host compatibility and missing prerequisites. Confirm the chosen credential owner and account, role intent and current grant. For a frontend, additionally establish principal admission, conversation mapping, allowed output, current audience and durable inbox/egress. For a device, use its domain-owned validation and safety contract.Observe readiness at the owner
Inspect the intended runtime identity and resolved operations, then invoke the selected operation under its policy. Check the same binding after any supported restoration or spawn path. For a frontend, send a message from an admitted identity and confirm that the permitted reply reaches the selected destination.Health projection
Include observation time and failure scope. A healthy process can coexist with pending or uncertain delivery.
Recovery procedure
1
Find the canonical operation
Use the actual owner’s exact operation/output key and authorized scope. Preserve the original payload association and last known receipt.
2
Observe before retrying
Determine whether admission, provider entry, acknowledgment or reconciliation committed. A missing client response does not prove rollback.
3
Apply the domain recovery contract
Reconcile an uncertain write. Recover an existing delivery. Revalidate a restored runtime binding. Replace an expired auth challenge only when that ceremony allows it.
4
Report the remaining fact
Separate known failure, pending owner action and unknown external outcome. State which independent work can continue.