Pool recovery must not strand stale module references

Replacing a database client in global state and ending the former client can strand stale references held by other bundles or module instances. A recovery path should expose a stable delegating facade or read shared state at call time, prove the replacement healthy before retirement, and test multiple isolated module consumers.

Provider continuity can support a stale-reference amplification hypothesis, but it does not prove the initiating transport stall. A process restart ending the symptom supports client-state involvement without establishing a complete root cause.