Task 16. The pipeline-reliability suite lands: cursor resume across an AppView restart, replay-exactly-once across a rewind (rows, never the counters), rev-gate no-resurrection staged through the dead-letter queue (a rewind replays create AND delete, so the DLQ is the only way to make the violation observable), dead-letter capture with redrive recovery via the redriver's boot-time pass — a production code path, no test knob — and two-feed overlap on genuinely fresh feed keys with connector-name assertions. Stack manipulation runs over a file-based control channel: five argument-free verbs, no Docker socket, project-scoped with a watcher pidfile, absent from production images; a TestMain topology guard refuses stacks a violent death left in two-feed shape. tests/integration is dissolved — all 38 files relocated, absorbed, or deleted with proven vacuity, the malformed-scoped-identifier carry list discharged and strengthened — and the contract manifest now runs with -allow-pending=false, probed in both directions. error_recovery's fake resilience tests die; the signup rebuild makes the rate-limit boundary exact. Defect #10 filed (hostedBy DID verification is untestable; the consumer lacks only a client-injection option it already has the field for). Full panel reviewed (Codex + harness + inventory): 11 fixes. make ci green: 3497 tests, 0 skips. Net −1,984 LOC for the phase's final act. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>