v2-platform: 09 hot-swap lifecycle prototype — in-flight requests, teardown, ESM disposal

Parent

#274 (v2 platform services spec)

What to build

A runnable hot-swap lifecycle prototype that answers wayfinder ticket 10 before the OTA runtime is implemented: a two-plugin host where one remote is swapped mid-traffic, repeatedly. The prototype must answer, with measurements: what happens to in-flight requests (drain vs shadow-flip), whether plugin scope teardown is clean or leaks (DB pools, intervals, subscriptions), whether a partial swap (only remotes whose URLs changed) avoids connection doubling, what must be explicitly dropped for old ESM graphs to become collectible, and whether rollback can re-import cached last-good URLs safely. Candidate design to test: shadow-flip with partial swap. Lives on a prototype branch per repo convention; the answer folds into the OTA runtime ticket.

Acceptance criteria

• A swap of one remote mid-traffic loses zero in-flight requests (or the prototype proves which strategy guarantees it)
• Repeated swaps (10+) show no leaked DB connections, handlers, or retained old module graphs (measured, not asserted)
• Partial swap (only changed URLs re-imported) is validated against full-graph swap
• Rollback to last-good config recovers a deliberately broken swap
• A written findings doc records the chosen lifecycle strategy with the measurements behind it

Blocked by

• None (can start immediately — parallel frontier ticket).

Start by reading parent #274 and the repository's prototype-branch convention; no source file or test entry point is named. Build the two-plugin host described here, then measure repeated swaps, partial versus full graph swaps, rollback, and cleanup, recording the lifecycle choice and findings in a document.