The shell is built to be hard to dislodge — cache-first, pin-enforcing — which is the possession guarantee working. This hatch is for when that works against you: dev iteration, or a first load wedged on half-installed state. It destroys the shell machinery only — service workers, held caches, the firmware pin. Your data (the trove) is untouched.
Machine state — what holds this page right now
reading…
The hatch
Two clicks, on purpose: forgetting the pin re-opens trust-on-first-contact, so this must never be reachable by a link alone. After destructing, the running copy stays in control until you navigate — reload to come back entirely from the network and re-pin.