mrhid6andClaude Opus 5
b7221d8111
StartReconciler only fired on its 15-minute ticker, so nothing reconciled until a full interval had passed and restarting admin repaired nothing. Injection failures are most likely around a deploy or a crash, which is exactly when the backstop was asleep -- a paying customer could sit read-only for 15 minutes with the repair already computable. A restart is now also a supported way to force reconciliation. Found by the plan's own Step 8, which assumed this behaviour: verified by tampering with a control-plane blob, confirming the instance went invalid, and watching the boot pass restore it (checked 1, repaired 1). Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>