instar 1.3.676 → 1.3.677

package/dist/core/SpawningTopicsRegistry.d.ts

@@ -0,0 +1,65 @@
+/**
+ * SpawningTopicsRegistry — F7 Piece 1
+ * (docs/specs/verify-after-reachability.md §Piece 1).
+ *
+ * Replaces the closure-local `Set<number>` that `onTopicMessage` used to guard against
+ * double-spawning a topic. The Set was cleared ONLY in the spawn promise's `.finally`,
+ * so a HUNG spawn left the flag set forever → every subsequent inbound for that topic
+ * was silently skipped (the single-machine black-hole F7 surfaces). It carried no
+ * timestamp and no token.
+ *
+ * This component is the SAFE minimum (round-2 review proved any external auto-CLEAR of
+ * the flag relocates the double-spawn race, because the spawn body is non-cancellable):
+ *  - `add(topic)` returns a unique TOKEN and stamps `startedAtMs`.
+ *  - `clear(topic, token)` is TOKEN-GUARDED: it deletes ONLY if the live entry's token
+ *    still matches — so a late `.finally` from a superseded spawn cannot delete a newer
+ *    entry (the ABA fix). The `.finally` on a spawn's own settle remains the SOLE
+ *    clearer; NO timeout and NO sweep clear the flag here.
+ *  - `stuckSinceMs(topic, now)` lets the TopicReachabilityVerifier SURFACE a spawn that
+ *    has been in flight past a threshold (it is never cleared — surfaced, not raced).
+ *
+ * The mechanical auto-recovery of a hung spawn (cancellable spawn) is a tracked
+ * follow-up — see the spec.
+ */
+export interface SpawningEntry {
+    /** Unique per-add token (NOT the topic — the ABA guard). */
+    token: string;
+    /** ms epoch when this spawn entered the registry. */
+    startedAtMs: number;
+}
+export declare class SpawningTopicsRegistry {
+    private readonly map;
+    private readonly now;
+    private seq;
+    constructor(deps?: {
+        now?: () => number;
+    });
+    /**
+     * Mark `topic` as spawning. Returns a unique token the caller passes back to
+     * `clear`. If an entry already exists (a retry that already landed), it is REPLACED
+     * with a fresh token+timestamp — the new spawn supersedes the old, and the old
+     * spawn's later `clear(old token)` becomes a no-op (ABA-safe).
+     */
+    add(topic: number): string;
+    /**
+     * Token-guarded clear. Deletes the entry ONLY if its live token equals `token`.
+     * A late `.finally` from a superseded spawn (whose token no longer matches) is a
+     * no-op, so it can never delete a newer spawn's entry.
+     */
+    clear(topic: number, token: string): void;
+    /** Is `topic` currently marked spawning? (The hot-path double-spawn guard read.) */
+    has(topic: number): boolean;
+    /**
+     * If `topic` has been spawning since longer than now-startedAtMs, return that age in
+     * ms; else undefined. The verifier uses this to detect a wedged spawn. NEVER clears.
+     */
+    stuckSinceMs(topic: number, nowMs?: number): number | undefined;
+    /** Snapshot of currently-spawning topics (for the verifier / status). */
+    entries(): Array<{
+        topic: number;
+        startedAtMs: number;
+    }>;
+    /** Count of in-flight spawns (naturally tiny — one per concurrent spawn). */
+    size(): number;
+}
+//# sourceMappingURL=SpawningTopicsRegistry.d.ts.map

package/dist/core/SpawningTopicsRegistry.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"SpawningTopicsRegistry.d.ts","sourceRoot":"","sources":["../../src/core/SpawningTopicsRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AAEH,MAAM,WAAW,aAAa;IAC5B,4DAA4D;IAC5D,KAAK,EAAE,MAAM,CAAC;IACd,qDAAqD;IACrD,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,qBAAa,sBAAsB;IACjC,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAoC;IACxD,OAAO,CAAC,QAAQ,CAAC,GAAG,CAAe;IACnC,OAAO,CAAC,GAAG,CAAK;gBAEJ,IAAI,GAAE;QAAE,GAAG,CAAC,EAAE,MAAM,MAAM,CAAA;KAAO;IAI7C;;;;;OAKG;IACH,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,MAAM;IAM1B;;;;OAIG;IACH,KAAK,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,IAAI;IAKzC,oFAAoF;IACpF,GAAG,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO;IAI3B;;;OAGG;IACH,YAAY,CAAC,KAAK,EAAE,MAAM,EAAE,KAAK,GAAE,MAAmB,GAAG,MAAM,GAAG,SAAS;IAM3E,yEAAyE;IACzE,OAAO,IAAI,KAAK,CAAC;QAAE,KAAK,EAAE,MAAM,CAAC;QAAC,WAAW,EAAE,MAAM,CAAA;KAAE,CAAC;IAIxD,6EAA6E;IAC7E,IAAI,IAAI,MAAM;CAGf"}

package/dist/core/SpawningTopicsRegistry.js

@@ -0,0 +1,75 @@
+/**
+ * SpawningTopicsRegistry — F7 Piece 1
+ * (docs/specs/verify-after-reachability.md §Piece 1).
+ *
+ * Replaces the closure-local `Set<number>` that `onTopicMessage` used to guard against
+ * double-spawning a topic. The Set was cleared ONLY in the spawn promise's `.finally`,
+ * so a HUNG spawn left the flag set forever → every subsequent inbound for that topic
+ * was silently skipped (the single-machine black-hole F7 surfaces). It carried no
+ * timestamp and no token.
+ *
+ * This component is the SAFE minimum (round-2 review proved any external auto-CLEAR of
+ * the flag relocates the double-spawn race, because the spawn body is non-cancellable):
+ *  - `add(topic)` returns a unique TOKEN and stamps `startedAtMs`.
+ *  - `clear(topic, token)` is TOKEN-GUARDED: it deletes ONLY if the live entry's token
+ *    still matches — so a late `.finally` from a superseded spawn cannot delete a newer
+ *    entry (the ABA fix). The `.finally` on a spawn's own settle remains the SOLE
+ *    clearer; NO timeout and NO sweep clear the flag here.
+ *  - `stuckSinceMs(topic, now)` lets the TopicReachabilityVerifier SURFACE a spawn that
+ *    has been in flight past a threshold (it is never cleared — surfaced, not raced).
+ *
+ * The mechanical auto-recovery of a hung spawn (cancellable spawn) is a tracked
+ * follow-up — see the spec.
+ */
+export class SpawningTopicsRegistry {
+    map = new Map();
+    now;
+    seq = 0;
+    constructor(deps = {}) {
+        this.now = deps.now ?? (() => Date.now());
+    }
+    /**
+     * Mark `topic` as spawning. Returns a unique token the caller passes back to
+     * `clear`. If an entry already exists (a retry that already landed), it is REPLACED
+     * with a fresh token+timestamp — the new spawn supersedes the old, and the old
+     * spawn's later `clear(old token)` becomes a no-op (ABA-safe).
+     */
+    add(topic) {
+        const token = `spawn:${topic}:${this.now().toString(36)}:${(this.seq++).toString(36)}`;
+        this.map.set(topic, { token, startedAtMs: this.now() });
+        return token;
+    }
+    /**
+     * Token-guarded clear. Deletes the entry ONLY if its live token equals `token`.
+     * A late `.finally` from a superseded spawn (whose token no longer matches) is a
+     * no-op, so it can never delete a newer spawn's entry.
+     */
+    clear(topic, token) {
+        const e = this.map.get(topic);
+        if (e && e.token === token)
+            this.map.delete(topic);
+    }
+    /** Is `topic` currently marked spawning? (The hot-path double-spawn guard read.) */
+    has(topic) {
+        return this.map.has(topic);
+    }
+    /**
+     * If `topic` has been spawning since longer than now-startedAtMs, return that age in
+     * ms; else undefined. The verifier uses this to detect a wedged spawn. NEVER clears.
+     */
+    stuckSinceMs(topic, nowMs = this.now()) {
+        const e = this.map.get(topic);
+        if (!e)
+            return undefined;
+        return Math.max(0, nowMs - e.startedAtMs);
+    }
+    /** Snapshot of currently-spawning topics (for the verifier / status). */
+    entries() {
+        return [...this.map.entries()].map(([topic, e]) => ({ topic, startedAtMs: e.startedAtMs }));
+    }
+    /** Count of in-flight spawns (naturally tiny — one per concurrent spawn). */
+    size() {
+        return this.map.size;
+    }
+}
+//# sourceMappingURL=SpawningTopicsRegistry.js.map

package/dist/core/SpawningTopicsRegistry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"SpawningTopicsRegistry.js","sourceRoot":"","sources":["../../src/core/SpawningTopicsRegistry.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;GAsBG;AASH,MAAM,OAAO,sBAAsB;IAChB,GAAG,GAAG,IAAI,GAAG,EAAyB,CAAC;IACvC,GAAG,CAAe;IAC3B,GAAG,GAAG,CAAC,CAAC;IAEhB,YAAY,OAA+B,EAAE;QAC3C,IAAI,CAAC,GAAG,GAAG,IAAI,CAAC,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC;IAC5C,CAAC;IAED;;;;;OAKG;IACH,GAAG,CAAC,KAAa;QACf,MAAM,KAAK,GAAG,SAAS,KAAK,IAAI,IAAI,CAAC,GAAG,EAAE,CAAC,QAAQ,CAAC,EAAE,CAAC,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,CAAC,CAAC,QAAQ,CAAC,EAAE,CAAC,EAAE,CAAC;QACvF,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,EAAE,EAAE,KAAK,EAAE,WAAW,EAAE,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;QACxD,OAAO,KAAK,CAAC;IACf,CAAC;IAED;;;;OAIG;IACH,KAAK,CAAC,KAAa,EAAE,KAAa;QAChC,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,KAAK,KAAK;YAAE,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;IACrD,CAAC;IAED,oFAAoF;IACpF,GAAG,CAAC,KAAa;QACf,OAAO,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;IAC7B,CAAC;IAED;;;OAGG;IACH,YAAY,CAAC,KAAa,EAAE,QAAgB,IAAI,CAAC,GAAG,EAAE;QACpD,MAAM,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAC9B,IAAI,CAAC,CAAC;YAAE,OAAO,SAAS,CAAC;QACzB,OAAO,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,CAAC,WAAW,CAAC,CAAC;IAC5C,CAAC;IAED,yEAAyE;IACzE,OAAO;QACL,OAAO,CAAC,GAAG,IAAI,CAAC,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,KAAK,EAAE,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,EAAE,KAAK,EAAE,WAAW,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,CAAC,CAAC;IAC9F,CAAC;IAED,6EAA6E;IAC7E,IAAI;QACF,OAAO,IAAI,CAAC,GAAG,CAAC,IAAI,CAAC;IACvB,CAAC;CACF"}

package/dist/monitoring/TopicReachabilityVerifier.d.ts

@@ -0,0 +1,92 @@
+/**
+ * TopicReachabilityVerifier — F7 Piece 2 (PURE SIGNAL)
+ * (docs/specs/verify-after-reachability.md §Piece 2).
+ *
+ * After a destructive session/routing mutation (a `sessionReaped(terminal)` or an
+ * ownership release/transfer), it verifies the affected topic is still inbound-reachable
+ * and SURFACES a genuine orphan as ONE NORMAL-priority attention item. It mutates
+ * NOTHING — no clear, spawn, kill, transfer, or re-place. It is a smoke alarm.
+ *
+ * Honesty guard: the dominant single-machine path already self-heals (the next inbound
+ * auto-spawns), so a topic that simply has no session now but WILL spawn on the next
+ * message is REACHABLE, not orphaned — the verifier must not scream on every idle kill.
+ * Only the specific defeats of the self-heal (stuck-spawn, at-capacity, released-no-
+ * placement, stalled inbound-queue) are orphans.
+ *
+ * This module is the DECISION CORE (deterministic, tick-driven, injected deps). The
+ * server wires the triggers (events) + the live `probe` (reads session/placement state)
+ * + the attention sink; this class owns grace/coalescing/pressure/suppression/dedup.
+ */
+export type OrphanReason = 'stuck-spawn' | 'at-capacity' | 'released-no-placement' | 'inbound-queue-stalled' | 'partition-suspected';
+export type Reachability = {
+    reachable: true;
+} | {
+    reachable: false;
+    reason: OrphanReason;
+};
+export interface AttentionSurface {
+    /** A single attention item (NORMAL priority, stable sourceContext, deduped by key). */
+    key: string;
+    topics: number[];
+    reason: string;
+    rolledUp: boolean;
+}
+export interface VerifierDeps {
+    /** Live reachability classification for a topic (reads local session/placement state). */
+    probe: (topic: number) => Reachability;
+    /** Raise one NORMAL attention item. */
+    surface: (item: AttentionSurface) => void;
+    /** True ⇒ skip per-topic verify churn (mass-reap is the pressure; don't amplify). */
+    pressureCritical: () => boolean;
+    /** True ⇒ an operator emergency-stop / halt is active; suppress surfacing. */
+    emergencyStopActive: () => boolean;
+    now: () => number;
+    /** Verify delay after a mutation (default 30s; > normal respawn so a healthy bounce isn't flagged). */
+    graceMs?: number;
+    /** Orphan count in a flush past which a single rolled-up item is emitted (default 10). */
+    burstThreshold?: number;
+    /** Per-topic minimum re-surface interval, exponential floor (default 1h). */
+    resurfaceFloorMs?: number;
+    /** Hard cap on pending verifies (overflow counted). */
+    maxPendingVerifies?: number;
+}
+export declare class TopicReachabilityVerifier {
+    private readonly d;
+    /** topic → earliest time the verify is due (now + grace at record time). Coalesced. */
+    private readonly pending;
+    /** Topics whose verify was SKIPPED under pressure / SUPPRESSED under halt — re-swept on clear. */
+    private readonly deferredWindow;
+    private readonly dedup;
+    private _overflow;
+    private _orphansSurfaced;
+    private _verifiedReachable;
+    private _lastTickAt;
+    constructor(deps: VerifierDeps);
+    /** A destructive mutation hit `topic` — schedule a coalesced post-grace verify. */
+    recordMutation(topic: number): void;
+    /**
+     * Process verifies whose grace has elapsed. Pure-signal: classifies + surfaces.
+     * Returns a report (for the status route + tests).
+     */
+    tick(): {
+        surfaced: number;
+        reachable: number;
+        skipped: number;
+        overflow: number;
+        pending: number;
+    };
+    private surfaceOrphans;
+    /** Backoff gate: re-surface only past an exponentially-widening floor, regardless of re-arm. */
+    private shouldSurface;
+    private bumpDedup;
+    private markReachable;
+    status(): {
+        pending: number;
+        deferred: number;
+        orphansSurfaced: number;
+        verifiedReachable: number;
+        overflow: number;
+        lastTickAt: number;
+    };
+}
+//# sourceMappingURL=TopicReachabilityVerifier.d.ts.map

package/dist/monitoring/TopicReachabilityVerifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"TopicReachabilityVerifier.d.ts","sourceRoot":"","sources":["../../src/monitoring/TopicReachabilityVerifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,MAAM,MAAM,YAAY,GACpB,aAAa,GACb,aAAa,GACb,uBAAuB,GACvB,uBAAuB,GACvB,qBAAqB,CAAC;AAE1B,MAAM,MAAM,YAAY,GAAG;IAAE,SAAS,EAAE,IAAI,CAAA;CAAE,GAAG;IAAE,SAAS,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,YAAY,CAAA;CAAE,CAAC;AAE5F,MAAM,WAAW,gBAAgB;IAC/B,uFAAuF;IACvF,GAAG,EAAE,MAAM,CAAC;IACZ,MAAM,EAAE,MAAM,EAAE,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,OAAO,CAAC;CACnB;AAED,MAAM,WAAW,YAAY;IAC3B,0FAA0F;IAC1F,KAAK,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,YAAY,CAAC;IACvC,uCAAuC;IACvC,OAAO,EAAE,CAAC,IAAI,EAAE,gBAAgB,KAAK,IAAI,CAAC;IAC1C,qFAAqF;IACrF,gBAAgB,EAAE,MAAM,OAAO,CAAC;IAChC,8EAA8E;IAC9E,mBAAmB,EAAE,MAAM,OAAO,CAAC;IACnC,GAAG,EAAE,MAAM,MAAM,CAAC;IAClB,uGAAuG;IACvG,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,0FAA0F;IAC1F,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,uDAAuD;IACvD,kBAAkB,CAAC,EAAE,MAAM,CAAC;CAC7B;AAgBD,qBAAa,yBAAyB;IACpC,OAAO,CAAC,QAAQ,CAAC,CAAC,CAC6E;IAC/F,uFAAuF;IACvF,OAAO,CAAC,QAAQ,CAAC,OAAO,CAA6B;IACrD,kGAAkG;IAClG,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAqB;IACpD,OAAO,CAAC,QAAQ,CAAC,KAAK,CAAiC;IACvD,OAAO,CAAC,SAAS,CAAK;IACtB,OAAO,CAAC,gBAAgB,CAAK;IAC7B,OAAO,CAAC,kBAAkB,CAAK;IAC/B,OAAO,CAAC,WAAW,CAAK;gBAEZ,IAAI,EAAE,YAAY;IAU9B,mFAAmF;IACnF,cAAc,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI;IAYnC;;;OAGG;IACH,IAAI,IAAI;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,SAAS,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE;IAgDnG,OAAO,CAAC,cAAc;IAqCtB,gGAAgG;IAChG,OAAO,CAAC,aAAa;IAOrB,OAAO,CAAC,SAAS;IAQjB,OAAO,CAAC,aAAa;IAQrB,MAAM,IAAI;QAAE,OAAO,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,eAAe,EAAE,MAAM,CAAC;QAAC,iBAAiB,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,CAAA;KAAE;CAU1I"}

package/dist/monitoring/TopicReachabilityVerifier.js

@@ -0,0 +1,173 @@
+/**
+ * TopicReachabilityVerifier — F7 Piece 2 (PURE SIGNAL)
+ * (docs/specs/verify-after-reachability.md §Piece 2).
+ *
+ * After a destructive session/routing mutation (a `sessionReaped(terminal)` or an
+ * ownership release/transfer), it verifies the affected topic is still inbound-reachable
+ * and SURFACES a genuine orphan as ONE NORMAL-priority attention item. It mutates
+ * NOTHING — no clear, spawn, kill, transfer, or re-place. It is a smoke alarm.
+ *
+ * Honesty guard: the dominant single-machine path already self-heals (the next inbound
+ * auto-spawns), so a topic that simply has no session now but WILL spawn on the next
+ * message is REACHABLE, not orphaned — the verifier must not scream on every idle kill.
+ * Only the specific defeats of the self-heal (stuck-spawn, at-capacity, released-no-
+ * placement, stalled inbound-queue) are orphans.
+ *
+ * This module is the DECISION CORE (deterministic, tick-driven, injected deps). The
+ * server wires the triggers (events) + the live `probe` (reads session/placement state)
+ * + the attention sink; this class owns grace/coalescing/pressure/suppression/dedup.
+ */
+const DEFAULT_GRACE_MS = 30_000;
+const DEFAULT_BURST = 10;
+const DEFAULT_RESURFACE_FLOOR_MS = 3_600_000;
+const DEFAULT_MAX_PENDING = 500;
+export class TopicReachabilityVerifier {
+    d;
+    /** topic → earliest time the verify is due (now + grace at record time). Coalesced. */
+    pending = new Map();
+    /** Topics whose verify was SKIPPED under pressure / SUPPRESSED under halt — re-swept on clear. */
+    deferredWindow = new Set();
+    dedup = new Map();
+    _overflow = 0;
+    _orphansSurfaced = 0;
+    _verifiedReachable = 0;
+    _lastTickAt = 0;
+    constructor(deps) {
+        this.d = {
+            ...deps,
+            graceMs: deps.graceMs ?? DEFAULT_GRACE_MS,
+            burstThreshold: deps.burstThreshold ?? DEFAULT_BURST,
+            resurfaceFloorMs: deps.resurfaceFloorMs ?? DEFAULT_RESURFACE_FLOOR_MS,
+            maxPendingVerifies: deps.maxPendingVerifies ?? DEFAULT_MAX_PENDING,
+        };
+    }
+    /** A destructive mutation hit `topic` — schedule a coalesced post-grace verify. */
+    recordMutation(topic) {
+        const due = this.d.now() + this.d.graceMs;
+        if (!this.pending.has(topic)) {
+            if (this.pending.size >= this.d.maxPendingVerifies) {
+                this._overflow++;
+                return;
+            }
+            this.pending.set(topic, due);
+        }
+        // coalesced: an existing pending verify keeps its (earlier) due time.
+    }
+    /**
+     * Process verifies whose grace has elapsed. Pure-signal: classifies + surfaces.
+     * Returns a report (for the status route + tests).
+     */
+    tick() {
+        const now = this.d.now();
+        this._lastTickAt = now;
+        const due = [];
+        for (const [topic, dueAt] of this.pending) {
+            if (dueAt <= now)
+                due.push(topic);
+        }
+        const halt = this.d.emergencyStopActive();
+        const pressure = this.d.pressureCritical();
+        let skipped = 0;
+        const orphans = [];
+        for (const topic of due) {
+            this.pending.delete(topic);
+            // Under halt or critical pressure we do NOT churn per-topic — defer to re-sweep.
+            if (halt || pressure) {
+                this.deferredWindow.add(topic);
+                skipped++;
+                continue;
+            }
+            const r = this.d.probe(topic);
+            if (r.reachable) {
+                this._verifiedReachable++;
+                this.markReachable(topic); // re-arm dedup
+            }
+            else {
+                orphans.push({ topic, reason: r.reason });
+            }
+        }
+        // A window just cleared (no halt + no pressure) → re-sweep deferred topics once.
+        if (!halt && !pressure && this.deferredWindow.size > 0) {
+            for (const topic of [...this.deferredWindow]) {
+                this.deferredWindow.delete(topic);
+                const r = this.d.probe(topic);
+                if (r.reachable) {
+                    this._verifiedReachable++;
+                    this.markReachable(topic);
+                }
+                else {
+                    orphans.push({ topic, reason: r.reason });
+                }
+            }
+        }
+        const surfaced = this.surfaceOrphans(orphans, now, pressure);
+        return { surfaced, reachable: this._verifiedReachable, skipped, overflow: this._overflow, pending: this.pending.size };
+    }
+    surfaceOrphans(orphans, now, pressure) {
+        if (orphans.length === 0)
+            return 0;
+        // Burst roll-up: a mass-orphan (or partition) → ONE rolled-up item, never N.
+        if (orphans.length >= this.d.burstThreshold || pressure) {
+            const topics = orphans.map((o) => o.topic);
+            this.d.surface({
+                key: 'topic-reachability:burst',
+                topics,
+                reason: `${topics.length} topics may be unreachable`,
+                rolledUp: true,
+            });
+            for (const o of orphans)
+                this.bumpDedup(o.topic, now);
+            this._orphansSurfaced += 1;
+            return 1;
+        }
+        // Per-topic with backoff (a single flapper cannot mint per cycle).
+        let count = 0;
+        for (const o of orphans) {
+            if (this.shouldSurface(o.topic, now)) {
+                this.d.surface({
+                    key: `topic-reachability:${o.topic}`,
+                    topics: [o.topic],
+                    reason: `topic ${o.topic} may be unreachable (${o.reason})`,
+                    rolledUp: false,
+                });
+                this.bumpDedup(o.topic, now);
+                this._orphansSurfaced++;
+                count++;
+            }
+        }
+        return count;
+    }
+    /** Backoff gate: re-surface only past an exponentially-widening floor, regardless of re-arm. */
+    shouldSurface(topic, now) {
+        const s = this.dedup.get(topic);
+        if (!s || s.armed)
+            return true; // first time, or re-armed by a verified-reachable obs
+        const wait = this.d.resurfaceFloorMs * Math.pow(2, Math.max(0, s.surfaceCount - 1));
+        return now - s.lastSurfacedMs >= wait;
+    }
+    bumpDedup(topic, now) {
+        const s = this.dedup.get(topic) ?? { lastSurfacedMs: 0, surfaceCount: 0, armed: true };
+        s.lastSurfacedMs = now;
+        s.surfaceCount = s.armed ? 1 : s.surfaceCount + 1;
+        s.armed = false;
+        this.dedup.set(topic, s);
+    }
+    markReachable(topic) {
+        const s = this.dedup.get(topic);
+        if (s) {
+            s.armed = true; // a genuine re-orphan after heal may surface again (not suppressed forever)
+            s.surfaceCount = 0;
+        }
+    }
+    status() {
+        return {
+            pending: this.pending.size,
+            deferred: this.deferredWindow.size,
+            orphansSurfaced: this._orphansSurfaced,
+            verifiedReachable: this._verifiedReachable,
+            overflow: this._overflow,
+            lastTickAt: this._lastTickAt,
+        };
+    }
+}
+//# sourceMappingURL=TopicReachabilityVerifier.js.map

package/dist/monitoring/TopicReachabilityVerifier.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"TopicReachabilityVerifier.js","sourceRoot":"","sources":["../../src/monitoring/TopicReachabilityVerifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAgDH,MAAM,gBAAgB,GAAG,MAAM,CAAC;AAChC,MAAM,aAAa,GAAG,EAAE,CAAC;AACzB,MAAM,0BAA0B,GAAG,SAAS,CAAC;AAC7C,MAAM,mBAAmB,GAAG,GAAG,CAAC;AAEhC,MAAM,OAAO,yBAAyB;IACnB,CAAC,CAC6E;IAC/F,uFAAuF;IACtE,OAAO,GAAG,IAAI,GAAG,EAAkB,CAAC;IACrD,kGAAkG;IACjF,cAAc,GAAG,IAAI,GAAG,EAAU,CAAC;IACnC,KAAK,GAAG,IAAI,GAAG,EAAsB,CAAC;IAC/C,SAAS,GAAG,CAAC,CAAC;IACd,gBAAgB,GAAG,CAAC,CAAC;IACrB,kBAAkB,GAAG,CAAC,CAAC;IACvB,WAAW,GAAG,CAAC,CAAC;IAExB,YAAY,IAAkB;QAC5B,IAAI,CAAC,CAAC,GAAG;YACP,GAAG,IAAI;YACP,OAAO,EAAE,IAAI,CAAC,OAAO,IAAI,gBAAgB;YACzC,cAAc,EAAE,IAAI,CAAC,cAAc,IAAI,aAAa;YACpD,gBAAgB,EAAE,IAAI,CAAC,gBAAgB,IAAI,0BAA0B;YACrE,kBAAkB,EAAE,IAAI,CAAC,kBAAkB,IAAI,mBAAmB;SACnE,CAAC;IACJ,CAAC;IAED,mFAAmF;IACnF,cAAc,CAAC,KAAa;QAC1B,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;QAC1C,IAAI,CAAC,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,CAAC,EAAE,CAAC;YAC7B,IAAI,IAAI,CAAC,OAAO,CAAC,IAAI,IAAI,IAAI,CAAC,CAAC,CAAC,kBAAkB,EAAE,CAAC;gBACnD,IAAI,CAAC,SAAS,EAAE,CAAC;gBACjB,OAAO;YACT,CAAC;YACD,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;QAC/B,CAAC;QACD,sEAAsE;IACxE,CAAC;IAED;;;OAGG;IACH,IAAI;QACF,MAAM,GAAG,GAAG,IAAI,CAAC,CAAC,CAAC,GAAG,EAAE,CAAC;QACzB,IAAI,CAAC,WAAW,GAAG,GAAG,CAAC;QACvB,MAAM,GAAG,GAAa,EAAE,CAAC;QACzB,KAAK,MAAM,CAAC,KAAK,EAAE,KAAK,CAAC,IAAI,IAAI,CAAC,OAAO,EAAE,CAAC;YAC1C,IAAI,KAAK,IAAI,GAAG;gBAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;QACpC,CAAC;QAED,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,mBAAmB,EAAE,CAAC;QAC1C,MAAM,QAAQ,GAAG,IAAI,CAAC,CAAC,CAAC,gBAAgB,EAAE,CAAC;QAC3C,IAAI,OAAO,GAAG,CAAC,CAAC;QAChB,MAAM,OAAO,GAAmD,EAAE,CAAC;QAEnE,KAAK,MAAM,KAAK,IAAI,GAAG,EAAE,CAAC;YACxB,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;YAC3B,iFAAiF;YACjF,IAAI,IAAI,IAAI,QAAQ,EAAE,CAAC;gBACrB,IAAI,CAAC,cAAc,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;gBAC/B,OAAO,EAAE,CAAC;gBACV,SAAS;YACX,CAAC;YACD,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;YAC9B,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;gBAChB,IAAI,CAAC,kBAAkB,EAAE,CAAC;gBAC1B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC,CAAC,eAAe;YAC5C,CAAC;iBAAM,CAAC;gBACN,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;YAC5C,CAAC;QACH,CAAC;QAED,iFAAiF;QACjF,IAAI,CAAC,IAAI,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,cAAc,CAAC,IAAI,GAAG,CAAC,EAAE,CAAC;YACvD,KAAK,MAAM,KAAK,IAAI,CAAC,GAAG,IAAI,CAAC,cAAc,CAAC,EAAE,CAAC;gBAC7C,IAAI,CAAC,cAAc,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;gBAClC,MAAM,CAAC,GAAG,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC;gBAC9B,IAAI,CAAC,CAAC,SAAS,EAAE,CAAC;oBAChB,IAAI,CAAC,kBAAkB,EAAE,CAAC;oBAC1B,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,CAAC;gBAC5B,CAAC;qBAAM,CAAC;oBACN,OAAO,CAAC,IAAI,CAAC,EAAE,KAAK,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC;gBAC5C,CAAC;YACH,CAAC;QACH,CAAC;QAED,MAAM,QAAQ,GAAG,IAAI,CAAC,cAAc,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;QAC7D,OAAO,EAAE,QAAQ,EAAE,SAAS,EAAE,IAAI,CAAC,kBAAkB,EAAE,OAAO,EAAE,QAAQ,EAAE,IAAI,CAAC,SAAS,EAAE,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC;IACzH,CAAC;IAEO,cAAc,CACpB,OAAuD,EACvD,GAAW,EACX,QAAiB;QAEjB,IAAI,OAAO,CAAC,MAAM,KAAK,CAAC;YAAE,OAAO,CAAC,CAAC;QACnC,6EAA6E;QAC7E,IAAI,OAAO,CAAC,MAAM,IAAI,IAAI,CAAC,CAAC,CAAC,cAAc,IAAI,QAAQ,EAAE,CAAC;YACxD,MAAM,MAAM,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC;YAC3C,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;gBACb,GAAG,EAAE,0BAA0B;gBAC/B,MAAM;gBACN,MAAM,EAAE,GAAG,MAAM,CAAC,MAAM,4BAA4B;gBACpD,QAAQ,EAAE,IAAI;aACf,CAAC,CAAC;YACH,KAAK,MAAM,CAAC,IAAI,OAAO;gBAAE,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;YACtD,IAAI,CAAC,gBAAgB,IAAI,CAAC,CAAC;YAC3B,OAAO,CAAC,CAAC;QACX,CAAC;QACD,mEAAmE;QACnE,IAAI,KAAK,GAAG,CAAC,CAAC;QACd,KAAK,MAAM,CAAC,IAAI,OAAO,EAAE,CAAC;YACxB,IAAI,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,EAAE,CAAC;gBACrC,IAAI,CAAC,CAAC,CAAC,OAAO,CAAC;oBACb,GAAG,EAAE,sBAAsB,CAAC,CAAC,KAAK,EAAE;oBACpC,MAAM,EAAE,CAAC,CAAC,CAAC,KAAK,CAAC;oBACjB,MAAM,EAAE,SAAS,CAAC,CAAC,KAAK,wBAAwB,CAAC,CAAC,MAAM,GAAG;oBAC3D,QAAQ,EAAE,KAAK;iBAChB,CAAC,CAAC;gBACH,IAAI,CAAC,SAAS,CAAC,CAAC,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;gBAC7B,IAAI,CAAC,gBAAgB,EAAE,CAAC;gBACxB,KAAK,EAAE,CAAC;YACV,CAAC;QACH,CAAC;QACD,OAAO,KAAK,CAAC;IACf,CAAC;IAED,gGAAgG;IACxF,aAAa,CAAC,KAAa,EAAE,GAAW;QAC9C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,CAAC,IAAI,CAAC,CAAC,KAAK;YAAE,OAAO,IAAI,CAAC,CAAC,sDAAsD;QACtF,MAAM,IAAI,GAAG,IAAI,CAAC,CAAC,CAAC,gBAAgB,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,CAAC;QACpF,OAAO,GAAG,GAAG,CAAC,CAAC,cAAc,IAAI,IAAI,CAAC;IACxC,CAAC;IAEO,SAAS,CAAC,KAAa,EAAE,GAAW;QAC1C,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,IAAI,EAAE,cAAc,EAAE,CAAC,EAAE,YAAY,EAAE,CAAC,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC;QACvF,CAAC,CAAC,cAAc,GAAG,GAAG,CAAC;QACvB,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QAClD,CAAC,CAAC,KAAK,GAAG,KAAK,CAAC;QAChB,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,EAAE,CAAC,CAAC,CAAC;IAC3B,CAAC;IAEO,aAAa,CAAC,KAAa;QACjC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,KAAK,CAAC,CAAC;QAChC,IAAI,CAAC,EAAE,CAAC;YACN,CAAC,CAAC,KAAK,GAAG,IAAI,CAAC,CAAC,4EAA4E;YAC5F,CAAC,CAAC,YAAY,GAAG,CAAC,CAAC;QACrB,CAAC;IACH,CAAC;IAED,MAAM;QACJ,OAAO;YACL,OAAO,EAAE,IAAI,CAAC,OAAO,CAAC,IAAI;YAC1B,QAAQ,EAAE,IAAI,CAAC,cAAc,CAAC,IAAI;YAClC,eAAe,EAAE,IAAI,CAAC,gBAAgB;YACtC,iBAAiB,EAAE,IAAI,CAAC,kBAAkB;YAC1C,QAAQ,EAAE,IAAI,CAAC,SAAS;YACxB,UAAU,EAAE,IAAI,CAAC,WAAW;SAC7B,CAAC;IACJ,CAAC;CACF"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "instar",
-  "version": "1.3.676",
+  "version": "1.3.677",
   "description": "Coherence infrastructure for self-evolving AI agents — on the Claude Code or Codex subscription you already have.",
   "type": "module",
   "main": "dist/index.js",

package/src/data/builtin-manifest.json

@@ -1,8 +1,8 @@
 {
   "$schema": "./builtin-manifest.schema.json",
   "schemaVersion": 1,
-  "generatedAt": "2026-06-26T13:09:14.108Z",
-  "instarVersion": "1.3.676",
+  "generatedAt": "2026-06-26T13:12:48.410Z",
+  "instarVersion": "1.3.677",
   "entryCount": 202,
   "entries": {
     "hook:session-start": {

package/upgrades/{1.3.676.md → 1.3.677.md}

@@ -15,6 +15,16 @@ background chatter. The total cap is NEVER raised — only *who gets which slot*
 Ships dark on the fleet / live on a development agent (dev-agent gate); byte-identical
 to today when off.
 
+Lands postmortem fix F7 (Blast-Radius / Verify-After), dark on the fleet / live on a dev
+agent. Two parts: (1) the live inbound spawn-guard is now a token-tagged
+`SpawningTopicsRegistry` — a hung session start no longer silently wedges a topic forever
+(ABA-safe; the `.finally` stays the sole clearer, no risky auto-clear). (2) a pure-signal
+`TopicReachabilityVerifier`: after a session is killed/reaped, it checks (after a grace
+window) that the conversation can still receive your next message, and if a genuine
+orphan (e.g. a wedged start-up) it surfaces ONE calm NORMAL heads-up. It mutates nothing —
+never kills, spawns, or clears. The probe is conservative + fail-safe (uncertain ⇒
+treated as reachable), so it never cries wolf on a normal idle kill.
+
 ## What to Tell Your User
 
 When the machine is busy, your reply's safety check now jumps to a reserved slot instead
@@ -22,6 +32,13 @@ of waiting behind background work — fewer slow/held replies under load. The cr
 protection is exactly as strong as before. Most setups see no change (it's off on the
 fleet for now).
 
+If I ever shut down a conversation's session and it genuinely can't be reached again
+(e.g. a start-up that hung), you now get one calm "this conversation may be unreachable"
+heads-up instead of your messages silently vanishing. Most of the time you see nothing,
+because most kills self-heal on your next message. It only watches — it never tries to
+auto-fix the stuck state (that proved too risky); the mechanical repair stays a tracked
+follow-up. Off on the fleet for now.
+
 ## Summary of New Capabilities
 
 - `attribution.lane:'interactive'` requests reserved headroom — honored ONLY for an
@@ -32,6 +49,13 @@ fleet for now).
 - `/spawn-limiter` reports per-lane live counts + the reservation config.
 - Off (the fleet default) ⇒ byte-identical to the all-or-nothing cap (no `lane` written).
 
+- A hung session start-up can no longer permanently jam a conversation's inbound path
+  (token-tagged spawn guard; ABA-safe).
+- After a destructive session/routing op, a dev agent verifies the topic is still
+  reachable and surfaces a genuine orphan as ONE NORMAL attention item (deduped,
+  flap-backoff-capped, burst-rolled-up, pressure/emergency-stop aware with a re-sweep).
+- Visible in `/guards` (registered). Dark on the fleet (dev-agent gate). Mutates nothing.
+
 ## Evidence
 
 - `hostSpawnSemaphore-priority.test.ts` (10): symmetric reserve, OOM floor unconditional,
@@ -43,3 +67,12 @@ fleet for now).
   fork-bomb burst-invariant test still green). `tsc --noEmit` clean.
 - Side-effects: `upgrades/side-effects/spawn-cap-interactive-priority.md`.
 - Spec (converged + approved): `docs/specs/spawn-cap-interactive-priority.md`.
+
+- `spawningTopicsRegistry.test.ts` (5): ABA token-guard; `.finally` sole clearer (no
+  timeout/sweep); stuck-age seam.
+- `topicReachabilityVerifier.test.ts` (8): grace; reachable-honesty (no false orphan on a
+  topic that self-heals); orphan→one NORMAL item; pressure/halt skip + re-sweep; flap
+  backoff; burst roll-up; coalescing.
+- `tsc --noEmit` clean.
+- Side-effects: `upgrades/side-effects/verify-after-reachability.md`.
+- Spec (converged + approved): `docs/specs/verify-after-reachability.md`.

package/upgrades/side-effects/verify-after-reachability.md

@@ -0,0 +1,65 @@
+# Side-Effects Review — Verify-After Topic Reachability (F7 — core components)
+
+**Version / slug:** `verify-after-reachability`
+**Date:** `2026-06-26`
+**Author:** `Echo (instar-dev agent)`
+**Tier:** 2 (converged + approved spec: `docs/specs/verify-after-reachability.md`)
+**Scope:** the two pure components (first commit) PLUS the server wiring (this commit):
+Piece 1 (`spawningTopics` closure→`SpawningTopicsRegistry` refactor of the live inbound
+path, token-guarded at all 4 callsites) and Piece 2 (the verifier constructed dev-gated,
+triggered by `sessionReaped`, a conservative fail-safe probe, a 15s tick, NORMAL
+attention surfacing, and `guardRegistry` registration). The probe is deliberately
+CONSERVATIVE: a live session ⇒ reachable; a topic stuck-spawning past `stuckSpawnMs` ⇒
+orphan; ANYTHING ELSE ⇒ reachable (the next inbound self-heals) — so it never
+false-orphans an idle kill. The multi-machine released-no-placement + at-capacity orphan
+cases (placement reads) and a dedicated `/topic-reachability` route are a tracked
+follow-up; their absence means LESS coverage, never a false orphan (the probe fails safe
+to reachable). <!-- tracked: topic-28744 F7-followup multimachine-probe-and-route -->
+
+## What this commit adds
+
+- `SpawningTopicsRegistry` (src/core) — token-tagged replacement for the closure-local
+  `spawningTopics` Set: `add` returns a token, `clear` is token-guarded (the ABA fix so a
+  late `.finally` from a superseded spawn cannot delete a newer entry), `stuckSinceMs`
+  exposes in-flight age for the verifier. NO timeout, NO sweep — the `.finally` remains
+  the sole clearer (round-2 proved any external clear relocates the double-spawn race).
+- `TopicReachabilityVerifier` (src/monitoring) — the PURE-SIGNAL decision core: grace +
+  per-topic coalescing, the reachable-honesty guard (a topic that will self-heal on next
+  inbound is REACHABLE, not orphaned), NORMAL-priority surfacing with per-topic
+  exponential backoff (flap cap), burst roll-up, pressure-skip + emergency-stop-suppress
+  WITH a re-sweep on clear (no never-surfaced orphan). It MUTATES NOTHING.
+
+Neither component is wired into the running server yet (no runtime surface), so this
+commit is inert at runtime — pure library code under test.
+
+## The 8 questions (for the components as committed)
+
+1. **Over-block** — N/A. The verifier blocks nothing; it surfaces a signal. The registry
+   only guards double-spawn (existing behavior), now ABA-safe.
+2. **Under-block** — N/A.
+3. **Level-of-abstraction fit** — Correct. Pure decision logic separated from the server
+   wiring + live-state probe (the spec's design).
+4. **Signal vs authority** — The verifier is a pure signal (zero mutation). The registry's
+   only authority is the EXISTING token-guarded clear (no new clearer). Complies.
+5. **Interactions** — None at runtime (unwired). The registry, once wired, replaces the
+   closure Set; the token guard makes its clear idempotent/ABA-safe.
+6. **External surfaces** — None yet (unwired). The future wiring adds a NORMAL attention
+   item + a `/topic-reachability` status route + a `/guards` entry.
+7. **Multi-machine** — The verifier's released-no-placement detection (future probe) is
+   machine-local (reads the local placement snapshot, freshness-gated); machine-local BY
+   DESIGN. The components themselves hold no cross-machine state.
+8. **Rollback cost** — Trivial. Delete two new files + their tests; nothing references
+   them at runtime yet.
+
+## Tests
+
+- `spawningTopicsRegistry.test.ts` (5): the ABA token-guard, `.finally` is the sole
+  clearer (no timeout/sweep), `stuckSinceMs`, entries snapshot.
+- `topicReachabilityVerifier.test.ts` (8): grace; reachable-honesty (no false orphan);
+  orphan→one NORMAL item; pressure-skip+re-sweep; halt-suppress+re-sweep; flap backoff;
+  burst roll-up; coalescing.
+- `tsc --noEmit` clean.
+
+## Rollback
+
+Delete the two component files + tests. No runtime reference.