[MathisWellmann]

No description provided.

[github-actions]

Summary

Adds host-driven revision unloading (unload_revision, retain_revisions, Unloaded, tombstoned registry, new error variants, REVISION_UNLOADS metric) plus a thorough integration test. The registry/dedup/handle-pinning mechanics check out (dedup skips tombstones, files delete on last Arc drop, dev-deps and Revision::new/crate_dir() exist), but the active-revision guard has a check-then-act race.

Issues

• symbiont/src/runtime.rs:2146 (major) — unload_revision checks revision == self.active_revision() before taking the write lock, then slot.take()s under it. A concurrent activate_revision(revision) can publish that revision's pointers in the gap, so the unload unmaps and deletes the dylib the dispatch pointers now execute; the next evolvable! call is UB/crash. The documented "active revision is refused" guarantee is not enforced atomically with the unmap. Fix: re-check active inside the write-lock critical section (ideally guard active with the same lock).
• symbiont/src/runtime.rs:2220-2233 (major) — retain_revisions snapshots loaded_revisions() and active lock-free, then unloads one revision at a time; if the active revision changes mid-loop (or a lock poisons), the ? aborts with Err after some dylibs are already unmapped and deleted, and the built unloaded vec is dropped with the error, so the caller cannot learn which ids were actually released. Fix: carry the partially-unloaded ids in the error path (e.g., report_error!-style context or a (Vec<Revision>, Error)), and re-validate active per unload.