Pool recovery must not strand stale module references
Replacing a database client in global state and ending the former client can strand stale references held by other bundles or module instances. A recovery path should expose a stable delegating facade or read shared state at call time, prove the replacement healthy before retirem…