- hoover: #comp registry + expanded-content cache now per render
container; committing one root no longer unmounts/remounts
components owned by another root (infinite load loop on pages
whose load() re-mutates reactive state)
- auth_model: refresh timer scheduled from the token's remaining
exp claim (unverified decode, mirrors lib/auth.py); falls back to
the configured TTL for non-JWT/malformed/already-expired tokens
- docs: hoover.md documents both behaviors
- tests: exp-claim TTL cases in test-auth-model.js; new
test-render-lifecycle.js regression suite
