Refactor VM exact-recovery policy behind a focused state owner

[Jurij89]

Summary

PR #2053 adds bounded exact-recovery peer rotation, clean-absence proof, no-progress damping, curator-first ranking, and lifecycle invalidation. The behavior is covered, but its mutable policy is still split across the large SWM host orchestrator, durable-sync lifecycle wrappers, and the generic ordinal recovery target.

Extract that policy behind a focused owner in a follow-up with no intended runtime behavior change.

Scope

• Move exact-recovery slot key/fingerprint construction, capped roster reconciliation, peer cursor selection, clean-absence evidence, no-progress backoff, LRU capacity, and context/shutdown cleanup behind a small policy API.
• Keep network discovery, dialing, admission, transfer, chain authentication, and materialization in the host orchestrator.
• Make contradictory batch identity unrepresentable: keep graph identity at the recovery-batch boundary and expose only the target fields the pure ordinal reconciler owns.
• Collapse parallel public/detailed durable-sync wrappers onto one internal execution path plus projection at the public boundary.
• Move the focused rotation-policy cases out of the already broad host integration test into a dedicated unit suite while retaining a small set of end-to-end host tests.

Required invariants

• Only a complete, fresh clean-absent result from every member of the current canonical roster is absence proof.
• incomplete, thrown, or found-but-still-pending outcomes never earn absence credit, but a fully attempted no-progress roster remains completion-anchored and exponentially damped.
• Roster removal/replacement, target fingerprint change, unsubscribe, on-chain rebind, and shutdown invalidate stale evidence and make late continuations inert.
• Authoritative curators rank ahead of fallback/hint and ordinary peers before the bounded cap.
• State remains bounded, overflow stays fail-open, and completed backoff records remain fairly evictable.
• Existing public sync return types and physical single-flight identity do not change.

Acceptance criteria

• A focused policy module owns every rotation-state mutation and can be tested without constructing a full DKGAgent.
• The host path asks the policy for work and reports outcomes back; it does not mutate policy records directly.
• The pure chain reconciler no longer carries duplicated agent-local graph identity on each target.
• One canonical internal durable-sync path produces detailed exact disposition; public methods only project it.
• All PR fix(agent): relieve repeated sync pressure #2053 rotation, stale lifecycle, capacity, curator, and exact-fetch regressions continue to pass unchanged in behavior.
• No new timers, queues, RPC calls, discovery walks, or persistent state are introduced.

Related

• Follow-up to fix(agent): relieve repeated sync pressure #2053
• Parent pressure issue: Reconnect-triggered background sync amplification can starve foreground catch-up #2052