upstream: a diagnostics episode follows health, and a peer fault carries its cause

src/web/handlers/apply.zig

@@ -636,9 +636,16 @@ pub const Plan = struct {
                 );
             }
             // A generation no reader held at the swap has no release left to
-            // tear it down, so the publisher does — after the reconciliation,
-            // which reads only the copies taken at prepare.
-            if (self.retired_upstream) |old| old.retire(io);
+            // tear it down, so the publisher does — after the reconciliation
+            // above, which reads only the copies taken at prepare.
+            //
+            // `retireDisplaced`, not `retire`: the teardown of a displaced
+            // generation is also when its `upstream.exchange` episodes are
+            // reconciled, and this path and a reader's release are the two ways
+            // a generation reaches it. The `configuration.load` half above
+            // stays here, because that code is shared with the boot collector
+            // and its rule is scoped.
+            if (self.retired_upstream) |old| self.state.upstreams.?.retireDisplaced(io, old);
         }
 
         self.* = undefined;