RFC-64 M1 3/7: bound Core public CG coverage

[branarakic]

M1 stack

This is PR 3 of 7 in the RFC-64 M1 stack.

1. RFC-64 M1 1/2: make Edge CG sync explicitly on-demand #2011 — explicit Edge synchronization lifetime
2. RFC-64 M1 2/7: expose verified VM and SWM convergence #2012 — truthful selected-CG VM/SWM convergence
3. This PR — bounded Core public-CG coverage
4. Adaptive-capacity primitives
5. Role-aware adaptive Core activation and status
6. Bounded operator-only runtime evidence hooks
7. Fail-closed M1 acceptance verifier and real-runtime release launcher

Stack base: codex/rfc64-m1-selected-convergence (PR #2012).

Exact restack coordinates:

• Base: da58c0c70453b32af4f355b00ca2c7a8fdf78fa9
• Head: 235c8071a098782d0aa454ec2eededd95280376b

User and operator impact

Core nodes maintain a separate bounded automatic-coverage set for revealed, chain-verified public Context Graphs. Edge nodes remain selected-only.

• User-selected CGs remain uncapped and higher priority, including after rediscovery.
• Automatic Core work is capped at 8 CGs per peer-sync round by default.
• syncCorePublicBatchSize or DKG_SYNC_CORE_PUBLIC_BATCH_SIZE changes that cap; 0 disables automatic coverage without disabling discovery or live hosting.
• The exact same frozen automatic tail drives durable VM and eligible SWM work during one peer round.
• Automatic entries are restored from durable chain-bound records before peer-sync planning after restart.
• A configured explicit overlay cannot silently overwrite a durable automatic baseline during an ordinary persistence pass; removing the overlay on restart restores automatic admission.
• Store-discovered public CGs cannot leak into the uncapped explicit-selection scope.
• Queued CLI subscribe responses expose canonical includeSharedMemory while preserving deprecated includeWorkspace compatibility.
• /api/status exposes configured batch size, tracked coverage, active planning lanes, and bounded last-plan counters.

Hash-only unresolved registrations, private CGs, and public CGs explicitly unsubscribed on that Core remain outside automatic coverage. coreHosted remains ACK-derived and is not repurposed.

Before

sequenceDiagram
    participant Chain
    participant Store as Durable subscription store
    participant Core
    participant Scope as Explicit sync scope
    participant Peer

    Chain->>Core: Discover a public CG
    Core->>Store: Persist registration state
    Note over Core: Automatic scheduler state is memory-only
    Note over Core,Store: Core restarts
    Peer->>Core: Start peer-sync round
    Core->>Scope: Read explicit selections
    Scope-->>Core: Selected CGs only
    Note over Core: Public coverage can be omitted or enter an uncapped path

Loading

After

sequenceDiagram
    participant Chain
    participant Store as Durable subscription store
    participant Core
    participant Scheduler as Core coverage scheduler
    participant Peer

    Chain->>Core: Confirm registered public CG
    Core->>Scheduler: Reconcile automatic coverage
    Core->>Store: Persist chain-bound eligibility

    Note over Core,Store: Core restarts
    Core->>Store: Rehydrate durable CG records
    Core->>Scheduler: Restore verified automatic coverage

    Peer->>Core: Start peer-sync round
    Core->>Scheduler: Plan one bounded automatic tail
    Scheduler-->>Core: Explicit selections plus automatic batch
    Core->>Peer: Pull durable VM using frozen round scope
    Core->>Peer: Pull eligible SWM using the same automatic tail
    Note over Core,Scheduler: New explicit selections remain live and uncapped

Loading

Scheduling and safety

• Chain discovery, durable rehydration, and unsubscribe are tested against the same explicit-versus-automatic admission invariants. Their remaining mutation and classification helpers are not yet a single canonical boundary.
• Priority configuration determines initial ordering.
• Each peer has an independent cursor; a stable peer order cannot pin it to one batch.
• Rotation uses a stride coprime to coverage size, so every tracked CG eventually becomes first even when work fails fast.
• Peer cursor state survives short reconnects and is pruned with stale/rejected peer state.
• Authoritative chain access policy—not local ontology/store inference—controls automatic-public eligibility.
• The round scope has one owner: explicit selections remain live while only the automatic tail is frozen for VM and SWM parity.
• A regression with more eligible CGs than the batch proves only the bounded automatic tail plus explicit selections is scheduled.

Non-goals

• Edge nodes do not sync all public CGs; they remain on-demand or explicitly always-on.
• This PR does not adapt concurrency or batch breadth to host pressure; that is split across PRs 4 and 5.
• This PR does not change catalog selection, transport, or authorization policy.

Validation

• Agent dependency closure plus Agent build, type tests, and package-root test: pass.
• Conflict-sensitive Core scheduler, discovery/restart, and peer-round suite: 83/83 pass.
• Affected CLI API-client compatibility suite: 86/86 pass; CLI build and compile-only public API fixture pass.
• Eight-commit git range-diff: 8/8 commits preserved; 6 are exactly patch-equivalent and two have only the expected canonical subscribe request-key/test-context delta from PR RFC-64 M1 2/7: expose verified VM and SWM convergence #2012.
• git diff --check: pass.
• Live GitHub review and CI status remain the merge-readiness source of truth.

Review focus

1. Edge remains selected-only.
2. Core automatic work stays separate from uncapped explicit selection.
3. Restart restoration occurs before planning from chain-bound durable evidence.
4. VM and SWM consume the same bounded automatic tail.
5. Rotation preserves eventual coverage without widening one round.

[otReviewAgent]

Operational Notice: Review Agent could not complete this review.

Business logic reviewer failed: retry_exhausted

[otReviewAgent]

🟡 Issue: Centralize sync-admission ownership instead of carrying hidden parallel state

What's wrong
The PR turns sync admission into a state machine, but the implementation spreads that state across the subscription map, mutable config, the coverage scheduler, and a hidden override map. That makes the invariant hard to audit: every future subscription mutation has to know whether it must update live admission, durable admission, config scope, scheduler membership, and persistence. This is exactly the kind of cross-cutting state that should have one canonical owner.

Example
A configured explicit overlay over a persisted automatic-public row now depends on multiple coordinated side effects: rehydration stores the durable override, persistence reads that external map, subscribe/unsubscribe/delete remember to clear it, and reconciliation mutates both config scope and scheduler registration.

Suggested direction
Model admission as a single explicit state, for example { liveAdmission, durableAdmission } on the normalized subscription or behind a small ContextGraphSyncAdmissionManager. Then make subscription/discovery/rehydration call transition methods and let persistence consume that state directly, deleting the external override map and scattered cleanup requirements.

For Agents
Look at contextGraphSubscriptionDurableAdmissionOverrides, reconcileContextGraphSyncAdmission, setContextGraphSubscription, persistContextGraphSubscription*, subscribeToContextGraph, unsubscribeFromContextGraph, and the rehydration block. Preserve the live-vs-durable overlay behavior, but make a single admission-state owner or typed model drive live state, scheduler registration, config scope, and durable projection. Existing overlay and rehydration tests should still pass.

[otReviewAgent]

🟡 Issue: Split this boundary test before letting it sprawl past 1k lines

What's wrong
This PR pushes a test file from comfortably under 1k lines to well over it. The added cases are not just small assertions; they introduce several different concerns and repeat heavyweight setup. Even though this is test code, it becomes part of the codebase architecture: future reviewers now have to scan one large mixed suite to understand public coverage, discovery, rehydration, migration, and overlay behavior.

Example
The added scenarios cover bounded public coverage, explicit public rediscovery, chain access-policy classification, restart rehydration, legacy migration, configured overlays, and failure continuation in one already broad boundary file.

Suggested direction
Decompose the new coverage into focused files and shared local fixtures instead of extending this catch-all boundary suite. The production change is already concept-heavy; keeping the tests modular will make future admission-policy changes much easier to review.

For Agents
Split the new scenarios into focused specs such as context-graph-public-coverage.test.ts and context-graph-subscription-rehydration.test.ts. Extract small helpers for mock subscription stores, public/private chain rows, and started agents. Preserve the existing assertions; the proof is that the moved tests still run unchanged in behavior.