refactor(mosaic): model destructive reverification as nested statecharts

[alexcarpenter]

Description

Concept PR stacked on #9864. It re-models delete-account reverification as two statecharts that talk to each other, instead of a model + controller + useReverificationWithState hook.

Machine lib (packages/mosaic/src/machine)

• Nested states with dotted value, matches(), and events that bubble to parents.
• #id and .child targets.
• Per-node invoke. A state can invoke a child machine, which appears on snapshot.children; its onDone receives the child's context.
• Named actors are shared with child machines. Adds a stateIn guard.
• childActor(actor, machine) narrows a child to a known machine.

Destructive (destructive.machine.ts)

• closed → open.{confirming, running, failed, verifying.{challenge, retrying}}.
• When the action throws session_reverification_required, the machine enters verifying, which invokes the reverification machine. Once that finishes, it retries the action.
• CLOSE is blocked while running or retrying. Closing during the challenge stops the child.
• A session change during the challenge closes the dialog.

Reverification (reverification.machine.ts, reverification.actors.ts)

• starting → factor.{editing.{ready, preparing.{idle, queued}}, submitting, help} / methods.{list, preparing, help} / unavailable / finishing → verified (final).
• All Clerk calls live in useReverificationActors(). The machine only names them.
• <Reverification actor={...} /> just renders the child actor's snapshot.

Impossible combinations such as "retrying while closed" or "submitting while preparing" are now unrepresentable, rather than guarded against with booleans.

Behavior differences from #9864:

• Only a thrown error triggers reverification.
• unavailable stays on screen until the user dismisses it.
• The swingset Card/Dialog demos are gone.

Bundle cost: the machine lib grows from ~1.6 KB to ~2.8 KB min+gzip. For comparison, XState + @xstate/react is ~14.8 KB.

Not intended to merge as-is. Next up: a typed actor registry and typed transition targets.

Checklist

• pnpm test runs as expected.
• pnpm build runs as expected.
• (If applicable) JSDoc comments have been added or updated for any package exports
• (If applicable) Documentation has been updated

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

[changeset-bot]

🦋 Changeset detected

Latest commit: 8036928

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 0 packages

When changesets are added to this PR, you'll see the packages that this PR includes changesets for and the associated semver types

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
clerk-js-sandbox	Ready	Preview	Sep 30, 2026 2:20am UTC
swingset	Ready	Preview	Sep 30, 2026 2:20am UTC

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

---

_{Comment @coderabbitai help to get the list of available commands.}