Product capability
Recovery and reconciliation
Preserve evidence. Diagnose uncertainty. Retry deliberately.
The operational problem
A process can stop after changing a native object but before recording its final state. Recovery needs evidence of what actually happened, not a fresh start that destroys that evidence.
Provisioning is a sequence of checks
Create is not verify.
Retry is not reset.
Local reconciliation has a controlled success path and an equally important failure path.
- 01 / VALIDATE
Accept authority
Validate the provider response before local application.
Remote failure: retain prior state - 02 / RECORD
Persist pending
Retain newly authorised state before changing FreePBX.
Evidence survives interruption - 03 / COMPARE
Check ownership
Compare native objects with recorded fingerprints.
Unexpected state: stop - 04 / APPLY + INSPECT
Verify the result
Record provisioned only after complete local verification.
Local failure: retain pending
Recover from evidence. Inspect the actual state, repair the prerequisite and retry deliberately. Never erase signing identity, ownership or provider operation records to force success.
A practical example
A configuration change is interrupted
The module compares actual native state against its recorded original and pending ownership evidence. A recognised, verifiable state can be settled safely. A third, unexpected state stops recovery for review rather than being silently normalised.
PBX recovery
The module can settle verified pending ownership evidence after an interrupted operation when the actual native configuration matches the recorded original or pending state. An unexpected third state fails closed. Successful retry must preserve signing identity and native IDs; it is not permission to take over unrelated objects.
Provider recovery
The BYOT reference locks each service, records step intent, verifies resources and retains outcomes. Inspect the operation, repair the prerequisite and retry with the same authorised identity and a new signed nonce. Never erase replay or key-binding state to obtain success.
Commercial recovery
Unknown carrier allocation or billing outcomes require durable records and explicit operator review. The number-search integration requires production idempotency and duplicate-assignment guards; the in-memory fixtures cannot supply them. A local rollback does not reverse a remote effect.
Local unlink is not teardown
Deactivate removes retained activation authorisation only. Existing calls may still work. It preserves signing identity, endpoint, ownership, routing and PBX configuration and does not cancel billing or revoke upstream authorisation.