fix(agent): retire cold-joined finalized SWM heads

[branarakic]

User impact

A cold-joining Edge node can receive both a finalized VM copy and the still-retained SWM recovery copy of the same Knowledge Asset. Before this change, the user-facing SWM view could show that finalized asset as if it were still live whenever the receiver had not observed the original finalization transaction envelope.

After this change, once the node independently verifies the exact VM content against the current chain-resolved root, it retires only the matching current SWM head from user queries. The physical SWM copy remains available for recovery, and the node does not invent missing transaction provenance.

This is a bounded correction discovered by the M1 testnet canary. It does not broaden Edge subscriptions, does not activate unselected CGs, and does not weaken VM verification.

Before

sequenceDiagram
    participant Core as Core peer
    participant Edge as Cold Edge node
    participant Chain as Chain
    participant User as User query

    Core->>Edge: Durable VM snapshot
    Core->>Edge: Retained SWM recovery snapshot
    Edge->>Chain: Resolve current KA root
    Chain-->>Edge: Current root
    Edge->>Edge: Verify exact VM content
    Edge->>Edge: Transaction provenance unavailable
    Edge-->>User: VM asset plus stale SWM asset

Loading

After

sequenceDiagram
    participant Core as Core peer
    participant Edge as Cold Edge node
    participant Chain as Chain
    participant Store as Local store
    participant User as User query

    Core->>Edge: Durable VM snapshot
    Core->>Edge: Retained SWM recovery snapshot
    Edge->>Chain: Resolve current KA root
    Chain-->>Edge: Current root
    Edge->>Edge: Verify exact VM content
    Edge->>Store: Mark only matching current SWM head finalized
    Edge->>Edge: Keep provenance state pending
    Edge-->>User: Finalized VM asset only
    Note over Store: SWM recovery quads remain physically stored

Loading

Safety properties

• The VM assertion must verify against the current chain-resolved Merkle root.
• The SWM head is re-read and matched under the existing per-KA write lock before retirement.
• Only the exact matching current SWM head receives the local retirement marker.
• Missing transaction metadata remains pending; no transaction hash or confirmed metadata is synthesized.
• The physical SWM recovery snapshot is retained.

Canary evidence

The initial M1 three-role canary reproduced the defect on the selected public on-demand CG: one exact finalized VM asset was present in both VM and the user-facing SWM view. Logs showed that VM content verification succeeded while transaction provenance remained unavailable. This change turns that exact state into a retired SWM view while preserving the recovery copy and pending provenance state.

Verification

• Agent dependency build chain: passed
• Focused graph finalization tests: 49 passed
• Full Agent unit lane: 165 files, 2238 passed, 5 skipped, 0 failed
• git diff --check: passed

Stack

• Base: feat(agent): resume persisted Edge always-on sync scopes #2032
• Depends on: fix(agent): keep finalized SWM retirement locally authoritative #2031
• This PR is intentionally not merged; the next gate is a repeat of the M1 three-role testnet canary from this exact head.