[Epic 3] Safe lifecycle, transactions, checkpoints & recovery

[aquitaine]

Epic: Safe lifecycle, transactions, checkpoints & recovery

The headline, recovery-critical capability. No §9.2 invariant may be weakened without an accepted RFC.

Milestone: M0 → M2 · PRD: LIF-001…LIF-022, DIA-006…DIA-010, §9

Scope

• Lifecycle + transaction state machines and SafetyEngine preflight/safe-surface (DisplayDomain, TopologyCore).
• Serialized TopologyCoordinator: checkpoint → apply → verify → commit/rollback; success only after observed postconditions (LIF-002/005/007/008, D-010).
• ExperimentalLifecycleProvider spike on certified Apple Silicon (LIF-003/004); public/private API boundary memo (Q-002).
• RecoveryService: Reconnect All from menu bar + global hotkey + CLI (LIF-009/010).
• Standalone rescue utility reading the checkpoint format independently (LIF-011, DIA-010, D-004).
• Restore-on-unclean-exit + safe-mode startup (LIF-013, DIA-006); wake reconciliation once per generation (LIF-014).
• Black Out + monitor power as distinct, honest states (LIF-018/019); persistent policy guards (LIF-015).

Acceptance

• Full fault suite (kill/hang/corrupt at every stage) recovers a usable safe surface 100% (NFR-004); zero wrong-target destructive actions.