@origintrail-official/dkg-agent 10.0.19 → 10.0.21

package/dist/dkg-agent-swm-host.js

@@ -6,12 +6,16 @@
  * the catchup/enable/stats entrypoints. Bodies are a 1:1 move; methods take
  * `this: DKGAgent` so cross-calls resolve against the composed class.
  */
+import { orderVmRecoveryCandidates } from './vm-recovery-candidate-order.js';
 import { createHash } from 'node:crypto';
+import { createSwmHostModeHandler } from './internal/gossip/host-mode-handler.js';
 import { Buffer } from 'node:buffer';
+import { VmRecoveryCoreTransportPreferencePolicy } from './vm-recovery-core-transport-preference.js';
+import { VmRecoveryPassAuthority } from './vm-recovery-pass-authority.js';
 import { performance } from 'node:perf_hooks';
-import { PROTOCOL_GET_CIPHERTEXT_CHUNK, PROTOCOL_SWM_HOST_CATCHUP, contextGraphWorkspaceTopic, contextGraphWorkspaceGraphUri, contextGraphWorkspaceMetaGraphUri, contextGraphDataUri, contextGraphMetaUri, contextGraphLayerUri, MemoryLayer, GOSSIP_TYPE_WORKSPACE_PUBLISH, decodeGossipEnvelope, decodeEncryptedWorkspacePayload, ENCRYPTED_WORKSPACE_ENVELOPE_TYPE, decodeSwmSenderKeyMessage, SWM_SENDER_KEY_MESSAGE_TYPE, SYSTEM_CONTEXT_GRAPHS, createOperationContext, getMetrics, sparqlString, isSafeIri, assertSafeIri, TRUST_LEVEL_PREDICATE, LEGACY_TRUST_LEVEL_PREDICATE, GOSSIP_TYPE_WORKSPACE_PUBLISH_CHUNKED, ciphertextChunkStoreGraph, ciphertextChunkStoreSubject, CIPHERTEXT_CHUNK_PREDICATE, SUBSCRIPTION_SOURCES, } from '@origintrail-official/dkg-core';
-import { GraphManager, isStoreSchedulerBusyError, withDefaultStoreWorkPriority, asChangelogReader, asGraphWriteRevisionSource, tryUpdateWithTouchedGraphs } from '@origintrail-official/dkg-storage';
-import { readMaterializedVersion, shouldApplyMaterialization, withMaterializationLock, isKnowledgeAssetWorkspaceHeadCorruptError, } from '@origintrail-official/dkg-publisher';
+import { PROTOCOL_GET_CIPHERTEXT_CHUNK, PROTOCOL_SWM_HOST_CATCHUP, contextGraphWorkspaceTopic, contextGraphDataUri, contextGraphMetaUri, contextGraphLayerUri, MemoryLayer, GOSSIP_TYPE_WORKSPACE_PUBLISH, decodeGossipEnvelope, decodeEncryptedWorkspacePayload, ENCRYPTED_WORKSPACE_ENVELOPE_TYPE, decodeSwmSenderKeyMessage, SWM_SENDER_KEY_MESSAGE_TYPE, SYSTEM_CONTEXT_GRAPHS, createOperationContext, sparqlString, isSafeIri, assertSafeIri, TRUST_LEVEL_PREDICATE, LEGACY_TRUST_LEVEL_PREDICATE, GOSSIP_TYPE_WORKSPACE_PUBLISH_CHUNKED, ciphertextChunkStoreGraph, ciphertextChunkStoreSubject, CIPHERTEXT_CHUNK_PREDICATE, SUBSCRIPTION_SOURCES, } from '@origintrail-official/dkg-core';
+import { GraphManager, isStoreSchedulerBusyError, withDefaultStoreWorkPriority, tryUpdateWithTouchedGraphs } from '@origintrail-official/dkg-storage';
+import { readMaterializedVersion, shouldApplyMaterialization, withMaterializationLock, isKnowledgeAssetWorkspaceHeadCorruptError, readConfirmedGraphKnowledgeAssetMetadataEnvelope, resolveKnowledgeAssetWorkspaceHead, } from '@origintrail-official/dkg-publisher';
 import { ethers } from 'ethers';
 import { isCoreHostedPublicCgRecorded, resolveCoreHostedPublicCgLocalId, } from './core-hosted-public-cg-record-decision.js';
 import { buildReconciledKnowledgeAssetUal, } from './ka-identity.js';
@@ -24,12 +28,20 @@ import { decodeCiphertextChunkCatchupRequest, encodeCiphertextChunkCatchupReques
 import { orderCatchupPeers } from './p2p/peer-selection.js';
 import { reconcileContextGraph, VmReconcileSchedulingRuntime, } from './chain-reconciler.js';
 import { ContextGraphOnChainIdUnresolvedError, VmReconcileUnavailableError, VmReconcileQueueClosedError, } from './vm-reconcile-service.js';
+import { isUnansweredVmReconcileReadAuthority, VmReconcileReadAuthorityUnansweredError, } from './internal/vm-reconcile-read-authority.js';
 import { createCursorState } from './reconcile-cursor.js';
-import { planVmRecoveryMicrobatch, } from './vm-recovery-microbatch.js';
-import { enrichVmRecoveryFootprints } from './vm-recovery-footprint.js';
+import { resolveVmRecoveryExperimentPolicy } from './vm-recovery-experiment-policy.js';
+import { VmRecoveryTimingObserver } from './vm-recovery-timing-observer.js';
+import { noteVmReconcilePassEnd, observeVmRecoveryTiming, vmReconcilePassGapMs, } from './vm-recovery-phase-timing.js';
+import { existingVmRecoveryPreparation, vmRecoveryPreparationFor, } from './vm-recovery-preparation.js';
+import { planVmRecoveryTransport, VmRecoveryTransportPreparation, VM_EXACT_MICROBATCH_LIMITS } from './vm-recovery-transport-plan.js';
+import { EXACT_BATCH_STREAM_PROTOCOL } from './sync/exact-batch-stream-contract.js';
+import { exactBatchStreamUnsupported } from './sync/exact-batch-stream-capability.js';
 import { VmRecoveryProviderPolicy, } from './vm-recovery-provider-policy.js';
-import { encodeExactAssetUals, MAX_EXACT_SYNC_ASSETS, } from './sync/exact-assets.js';
-import { MAX_CONTEXT_GRAPH_ASSET_FETCH_PEERS, ExactAssetFetchLifecycleClosedError, runExactAssetFetch, } from './sync/exact-asset-fetch.js';
+import { MAX_CONTEXT_GRAPH_ASSET_FETCH_PEERS, ExactAssetFetchLifecycleClosedError, ExactAssetVersionBehindError, exactAssetFetchPeerWindow, runExactAssetFetch, } from './sync/exact-asset-fetch.js';
+import { isBoundedOperationTimeoutError, runBoundedOperation } from './bounded-operation.js';
+/** Graph-scoped KA metadata marker; its presence names the metadata graph. */
+const GRAPH_KA_CONTENT_SCOPE_VERSION_PREDICATE = 'http://dkg.io/ontology/contentScopeVersion';
 function rsHealStoreOptions(operation, signal) {
     return {
         priority: 'background',
@@ -73,12 +85,13 @@ function advanceRsHealCursor(cursorMap, cursorKey, bindings, batchSize, maxEntri
         cursorMap.delete(oldest);
     }
 }
-import { canReuseVmReconcilePeerTopology, createVmReconcileCleanMissPeerIds, createVmReconcilePeerTopology, encodeLegacyVmReconcilePeerTopologyKey, isVmReconcilePeerTopology, parseLegacyVmReconcilePeerTopologyKey, parseVmReconcileCleanMissPeerIds, UNREADABLE_VM_RECONCILE_PEER_TOPOLOGY, } from './vm-reconcile-peer-topology.js';
-import { TIMEOUT_SENTINEL, } from './dkg-agent-constants.js';
+import { SYNC_MIN_GRAPH_BUDGET_MS, TIMEOUT_SENTINEL, } from './dkg-agent-constants.js';
 import { chainAuthorityReadBudgetsOf } from './chain-authority-read-budgets.js';
 import { ContextGraphNotFoundError, } from './dkg-agent-types.js';
 import { DKGAgentBase } from './dkg-agent-base.js';
-import { resolveVmReconcilerEnabled } from './sync/backpressure.js';
+import { resolveExactBatchStreamEnabled, resolveVmReconcilerEnabled } from './sync/backpressure.js';
+import { mapWithConcurrencyDrained } from './map-with-concurrency.js';
+import { VM_RECOVERY_SYNC_PRIORITY } from './sync/catchup-policy.js';
 import { finalizedContextGraphSnapshotMismatchV1 } from './internal/context-graph-authority/finalized-context-graph-binding.js';
 import { CONTEXT_GRAPH_AUTHORITY_RPC_SITES as CG_AUTH_RPC_SITES, withOwnedRpcRequestContext, withRpcUsageSite, } from '@origintrail-official/dkg-chain';
 const DEFAULT_HOST_MODE_RECONCILE_BATCH_SIZE = 32;
@@ -105,26 +118,6 @@ function vmReconcileDeploymentMatches(value, expected) {
  * amplify into a per-message `eth_call` (Branimir review #1239 follow-on).
  */
 const HOST_MODE_PUBLISH_POLICY_MAX_CACHE_AGE_MS = 5_000;
-// Exact VM data responses are page-only and capped at 64 rows per page. Keep
-// one recovery microbatch near 64 non-empty pages so a single large graph does
-// not monopolize the global sync admission. This is a soft scheduling/fairness
-// cap, not a wire or correctness limit: an individually larger KA is still
-// admitted alone and remains bounded by the exact executor's hard guards.
-const VM_EXACT_MICROBATCH_PAGE_FAIRNESS_LEAVES = 4096n;
-const VM_EXACT_MICROBATCH_LIMITS = Object.freeze({
-    // Executor capability: the current exact-sync envelope accepts at most ten.
-    maxAssets: MAX_EXACT_SYNC_ASSETS,
-    // Soft recovery-window targets. A single public KA may exceed either; it is
-    // still admitted alone while the exact executor's own hard byte/quad guards
-    // remain authoritative.
-    targetBytes: 24n * 1024n * 1024n,
-    targetLeaves: VM_EXACT_MICROBATCH_PAGE_FAIRNESS_LEAVES,
-    fixedBytesPerAsset: 64n * 1024n,
-    bytesPerLeafOverhead: 128n,
-    byteSizeMultiplierBps: 11500n,
-    // Hard exact-selector cap, evaluated with the executor's real encoder.
-    maxSelectorBytes: 16 * 1024,
-});
 /**
  * Recovery-target root of an ordinal whose KA the node holds nowhere locally:
  * the sweep queues it without reading the chain root. Exact recovery fetches
@@ -174,6 +167,13 @@ async function raceVmReconcileAbort(work, signal) {
             signal.removeEventListener('abort', onAbort);
     }
 }
+/** `peerIds` started `offset` places in, wrapping. */
+function rotatePeerIds(peerIds, offset) {
+    if (peerIds.length === 0)
+        return [];
+    const start = offset % peerIds.length;
+    return [...peerIds.slice(start), ...peerIds.slice(0, start)];
+}
 /** Track the raw dependency even if an abort race releases its caller first. */
 function trackVmReconcilePhysicalRun(runs, run) {
     runs.add(run);
@@ -312,6 +312,10 @@ export class SwmHostModeMethods extends DKGAgentBase {
      * reserved, or when the node is already subscribed in member mode.
      */
     async reconcileSwmHostModeSubscription(contextGraphId, source = SUBSCRIPTION_SOURCES.RECONCILER) {
+        const session = this.gossipSession;
+        const live = session.live();
+        if (live === null)
+            return;
         if (!this.swmHostModeStore)
             return;
         if (Object.values(SYSTEM_CONTEXT_GRAPHS).includes(contextGraphId))
@@ -347,7 +351,9 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 await this.isCuratedForHostMode(contextGraphId)) {
                 // A manually hosted CG can become curated later. Upgrade the cached
                 // classification so the existing handler starts stripping immediately.
-                this.swmHostModeCurated.set(hostKey, true);
+                if (!session.active || this.gossipSession !== session)
+                    return;
+                session.swmHostModeCurated.set(hostKey, true);
             }
             await this.maybeMarkRegisteredForHostMode(contextGraphId);
             return;
@@ -382,7 +388,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // critically, the host-only-core case where there's no local
         // `_meta` and `isPrivateContextGraph` alone returns false.
         const curated = await this.isCuratedForHostMode(contextGraphId);
-        if (!curated)
+        if (!curated || !session.active || this.gossipSession !== session)
             return;
         // OT-RFC-49 WS-A — the private-ciphertext strip. With `stripCiphertext`
         // ON (default), a core declines ALL host-mode custody for a curated CG:
@@ -502,15 +508,19 @@ export class SwmHostModeMethods extends DKGAgentBase {
      * so the host-mode lifecycle is in one place.
      */
     wireSwmHostModeHandler(contextGraphId, source = SUBSCRIPTION_SOURCES.RECONCILER, curated = true) {
+        const session = this.gossipSession;
+        const live = session.live();
+        if (live === null)
+            return;
         if (!this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId)) {
             const hostKey = this.canonicalSwmHostModeKey(contextGraphId);
-            const hadRuntimeHostState = this.swmHostModeHandlers.has(hostKey)
-                || this.swmHostModeSubscribed.has(hostKey)
-                || this.swmHostModeCurated.has(hostKey);
+            const hadRuntimeHostState = session.swmHostModeHandlers.has(hostKey)
+                || session.swmHostModeSubscribed.has(hostKey)
+                || session.swmHostModeCurated.has(hostKey);
             this.unwireSwmHostModeHandler(contextGraphId);
-            const deletedStaleHandler = this.swmHostModeHandlers.delete(hostKey);
-            const deletedStaleSubscription = this.swmHostModeSubscribed.delete(hostKey);
-            const deletedStaleClassification = this.swmHostModeCurated.delete(hostKey);
+            const deletedStaleHandler = session.swmHostModeHandlers.delete(hostKey);
+            const deletedStaleSubscription = session.swmHostModeSubscribed.delete(hostKey);
+            const deletedStaleClassification = session.swmHostModeCurated.delete(hostKey);
             if (deletedStaleHandler || deletedStaleSubscription || deletedStaleClassification) {
                 // Heal partially restored/stale bookkeeping even when its handler
                 // reference is absent, which makes unwireSwmHostModeHandler a no-op.
@@ -538,7 +548,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // genuine no-op (instead of silently wiring a second handler on
         // the same topic).
         const wireCgId = this.canonicalSwmHostModeKey(contextGraphId);
-        if (this.swmHostModeHandlers.has(wireCgId)) {
+        if (session.swmHostModeHandlers.has(wireCgId)) {
             // Idempotent re-entry — preserve the original source. The first
             // discovery path to wire the handler wins the provenance label;
             // a later path covering the same CG is "also true" but the
@@ -546,44 +556,12 @@ export class SwmHostModeMethods extends DKGAgentBase {
             return;
         }
         const swmTopic = contextGraphWorkspaceTopic(wireCgId);
-        this.swmHostModeSubscribed.set(wireCgId, source);
-        this.swmHostModeCurated.set(wireCgId, curated);
-        this.gossip.subscribe(swmTopic);
-        const handler = (_topic, data, from) => {
-            // Fail closed when the classification is absent. Only an explicitly
-            // non-curated manual subscription retains the public host-mode hatch.
-            if (this.swmHostModeStripCiphertext() &&
-                this.swmHostModeCurated.get(wireCgId) !== false) {
-                this.log.debug(createOperationContext('share'), `Dropping host-mode envelope on cg=${contextGraphId} from=${from}: ` +
-                    `private-ciphertext strip is ON for a curated CG (OT-RFC-49 WS-A)`);
-                return;
-            }
-            // OT-RFC-38 LU-11: peek envelope type and dispatch. Chunked
-            // envelopes (`type='share-write-chunked'`) take the V2 chunk
-            // persistence path; everything else flows through the legacy
-            // host-mode store unchanged. Failed decode falls through to
-            // `ingestSwmHostModeEnvelope` which is also defensive — the
-            // dispatch here is best-effort, not a security boundary.
-            let envelopeType;
-            try {
-                const peek = decodeGossipEnvelope(data);
-                envelopeType = peek?.type;
-            }
-            catch { /* drop into legacy path */ }
-            if (envelopeType === GOSSIP_TYPE_WORKSPACE_PUBLISH_CHUNKED) {
-                this.ingestSwmCiphertextChunkEnvelope(contextGraphId, data, from).catch((err) => {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    this.log.warn(createOperationContext('system'), `LU-11: chunked SWM ingest failed for "${contextGraphId}": ${msg}`);
-                });
-                return;
-            }
-            this.ingestSwmHostModeEnvelope(contextGraphId, data, from).catch((err) => {
-                const msg = err instanceof Error ? err.message : String(err);
-                this.log.warn(createOperationContext('system'), `Host-mode SWM ingest failed for "${contextGraphId}": ${msg}`);
-            });
-        };
-        this.swmHostModeHandlers.set(wireCgId, handler);
-        this.gossip.onMessage(swmTopic, handler);
+        session.swmHostModeSubscribed.set(wireCgId, source);
+        session.swmHostModeCurated.set(wireCgId, curated);
+        live.manager.subscribe(swmTopic);
+        const handler = createSwmHostModeHandler(this, this.log, session, contextGraphId, wireCgId);
+        session.swmHostModeHandlers.set(wireCgId, handler);
+        live.manager.onMessage(swmTopic, handler);
         // B3: persist the host-mode designation so a restart re-engages
         // this handler before the chain-event poller catches up.
         // Codex PR #620 R2: chain wire/unwire writes through a per-CG
@@ -1622,7 +1600,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         }
         if (!authOk) {
             try {
-                const allowedPeers = await this.getContextGraphAllowedPeers(req.contextGraphId);
+                const allowedPeers = await this.resolveSwmAllowedPeersForCurrentAuthority(req.contextGraphId);
                 if (allowedPeers !== null) {
                     anyAuthorityFound = true;
                     if (allowedPeers.includes(fromPeerId))
@@ -1931,6 +1909,20 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 `${transition.previous?.onChainId}->${newOnChainId}; reset reconcile watermark + cursor to 0`);
         }
     }
+    /**
+     * Inverse of {@link bindSubscriptionOnChainId}: drop a local CG's on-chain
+     * id together with every piece of reconcile progress made against it. The
+     * persisted watermark and the in-memory cursor count ordinals of the graph
+     * that id named, so neither may survive the id. The canonical setter
+     * persists the unbound row.
+     */
+    unbindSubscriptionOnChainId(localCgId) {
+        const sub = this.subscribedContextGraphs.get(localCgId);
+        if (sub === undefined)
+            return;
+        this.forceClearVmReconcileStateForContextGraph(localCgId);
+        this.setContextGraphSubscription(localCgId, { ...sub, onChainId: undefined, lastReconciledOrdinal: 0 });
+    }
     /**
      * Install a reverse-derived VM candidate without promoting it to the shared
      * authoritative `onChainId` field. The candidate is process-local and every
@@ -2370,7 +2362,9 @@ export class SwmHostModeMethods extends DKGAgentBase {
             return null;
         if (resolved.provenance !== 'reverse-name-hash') {
             try {
-                await this.persistContextGraphSubscriptionStrict(localCgId, { ...sub, onChainId: resolved.onChainId }, undefined, isSubscriptionCurrent);
+                // An on-demand subscription binds in memory only; durable rows are
+                // saved before the binding becomes visible.
+                await this.persistContextGraphSyncStateStrict(localCgId, { ...sub, onChainId: resolved.onChainId }, 'on-chain id binding', isSubscriptionCurrent);
             }
             catch {
                 return null;
@@ -2464,6 +2458,534 @@ export class SwmHostModeMethods extends DKGAgentBase {
         }
         return localCgId;
     }
+    /**
+     * #2858 — body of the live `KnowledgeAssetUpdated` nudge.
+     *
+     * An update keeps the KA id and moves its latest root. The ordinal sweep
+     * never revisits a settled ordinal, and a node whose only copy is a
+     * confirmed VM copy (a member of a catalog graph, a core outside the update's
+     * ACK set) has no other lane that brings the new version. This decides from
+     * local state alone, with no chain read, for every VM-reconcile target graph
+     * that holds a confirmed copy of the KA; a queued target gets a reconcile
+     * pass, whose refresh worker reads the chain and fetches the current version
+     * ({@link startVmRefreshWorker}).
+     *
+     * - A copy at another root is queued for a refresh.
+     * - A copy already at the event's root is skipped when it reflects the
+     *   update: the event's own transaction confirmed it (the publisher), or it
+     *   was materialized from a chain view at or after the event's block (a
+     *   replayed event). Otherwise it may be an older version with the same
+     *   content, so a version check is queued.
+     * - When the workspace already stages a newer version than the confirmed
+     *   copy (the publisher mid-update, a core holding the update's ACK copy, a
+     *   member that recovered its curator's shared memory), the target waits
+     *   `VM_REFRESH_STAGED_GRACE_MS` for the lane that staged it; on a member no
+     *   lane promotes it, and the refresh does.
+     *
+     * The event's root is only a trigger: an older or superseded event is
+     * settled by the worker's chain read, never materialized. Every no-op is
+     * logged at debug. A store read that fails, or a full target set, throws, so
+     * the event lane holds the event and dispatches it again after its failure
+     * backoff instead of losing it.
+     *
+     * Returns the refresh targets newly queued.
+     */
+    async handleKAUpdatedNudge(kaId, merkleRoot, ctx, options = {}) {
+        const { signal } = options;
+        const blockNumber = options.blockNumber !== undefined
+            && Number.isSafeInteger(options.blockNumber)
+            && options.blockNumber >= 0
+            ? options.blockNumber
+            : undefined;
+        const eventTxHash = typeof options.txHash === 'string' && options.txHash.length > 0
+            ? options.txHash.toLowerCase()
+            : undefined;
+        const logIndex = options.logIndex !== undefined
+            && Number.isSafeInteger(options.logIndex)
+            && options.logIndex >= 0
+            ? options.logIndex
+            : undefined;
+        const blockHash = typeof options.blockHash === 'string' && options.blockHash.length > 0
+            ? options.blockHash.toLowerCase()
+            : undefined;
+        signal?.throwIfAborted();
+        const lifecycleGeneration = this.vmReconcileLifecycleGeneration;
+        const lifecycleSignal = this.vmReconcileLifecycleController?.signal;
+        const isLifecycleCurrent = () => !this.vmReconcileRotationClosed
+            && !signal?.aborted
+            && !lifecycleSignal?.aborted
+            && this.vmReconcileLifecycleGeneration === lifecycleGeneration;
+        if (!isLifecycleCurrent() || kaId <= 0n || merkleRoot.length !== 32)
+            return [];
+        this.expireVmRefreshTargets(ctx);
+        const update = `update${blockNumber === undefined ? '' : ` at block ${blockNumber}`}`;
+        let ual;
+        let holders;
+        try {
+            const storageAddr = this.chain.getDKGKnowledgeAssetsAddress
+                ? await this.chain.getDKGKnowledgeAssetsAddress()
+                : undefined;
+            if (!storageAddr)
+                return [];
+            ual = buildReconciledKnowledgeAssetUal(this.chain.chainId, storageAddr, kaId);
+            holders = await this.localGraphsDescribingKnowledgeAsset(ual);
+        }
+        catch (err) {
+            throw new Error(`VM refresh: could not read which local graphs hold KA ${kaId} for its ${update}: `
+                + `${err instanceof Error ? err.message : String(err)}`, { cause: err });
+        }
+        const eventRoot = ethers.hexlify(merkleRoot).toLowerCase();
+        const queued = [];
+        if (holders.length === 0) {
+            this.log.debug(ctx, `VM refresh: no local graph holds ${ual}; nothing to refresh`);
+        }
+        for (const localCgId of holders) {
+            if (!isLifecycleCurrent())
+                break;
+            if (!this.isVmReconcileTargetSelected(localCgId)) {
+                this.log.debug(ctx, `VM refresh: "${localCgId}" holds ${ual} but is not a VM reconcile target; not queued`);
+                continue;
+            }
+            let local;
+            let coversUpdate = false;
+            try {
+                local = await this.readVmRefreshLocalState(localCgId, ual);
+                if (local.kind === 'confirmed' && local.merkleRoot === eventRoot) {
+                    coversUpdate = await this.vmRefreshCopyCoversUpdate(localCgId, ual, local.transactionHash, eventTxHash, blockNumber, blockHash);
+                }
+            }
+            catch (err) {
+                throw new Error(`VM refresh: could not read the copy of ${ual} in "${localCgId}" for its ${update}: `
+                    + `${err instanceof Error ? err.message : String(err)}`, { cause: err });
+            }
+            if (local.kind !== 'confirmed') {
+                this.log.debug(ctx, `VM refresh: ${ual} in "${localCgId}" not queued: no confirmed copy`);
+                continue;
+            }
+            const sameRoot = local.merkleRoot === eventRoot;
+            if (coversUpdate) {
+                this.log.debug(ctx, `VM refresh: ${ual} in "${localCgId}" not queued: the copy holds this update`);
+                continue;
+            }
+            if (!isLifecycleCurrent())
+                break;
+            const target = {
+                localCgId,
+                ual,
+                kaId,
+                merkleRoot: eventRoot,
+                ...(blockNumber === undefined ? {} : { blockNumber }),
+                ...(logIndex === undefined ? {} : { logIndex }),
+                ...(blockHash === undefined ? {} : { blockHash }),
+                ...(eventTxHash === undefined ? {} : { txHash: eventTxHash }),
+                ...(sameRoot ? { checkVersion: true } : {}),
+            };
+            const delayMs = local.staged ? DKGAgentBase.VM_REFRESH_STAGED_GRACE_MS : 0;
+            // A replayed event (a lane re-scan) leaves the held target and its
+            // backoff alone.
+            const offered = this.vmRefreshQueue.offer(target, delayMs);
+            if (offered === 'held') {
+                this.log.debug(ctx, `VM refresh: ${ual} in "${localCgId}" already has this or a newer update queued`);
+                continue;
+            }
+            if (offered === 'full') {
+                throw new Error(`VM refresh: ${this.vmRefreshQueue.size} targets are held, the most allowed, so the `
+                    + `${update} of ${ual} in "${localCgId}" waits for some to settle`);
+            }
+            queued.push(target);
+            if (sameRoot) {
+                this.log.debug(ctx, `VM refresh: ${ual} in "${localCgId}" holds its update's root; version check queued`);
+            }
+            else if (local.staged) {
+                this.log.info(ctx, `VM refresh: ${ual} in "${localCgId}" does not hold its update's root and stages a newer `
+                    + `version; refresh queued in ${Math.round(delayMs / 1000)}s unless that version is promoted first`);
+            }
+            else {
+                this.log.info(ctx, `VM refresh: ${ual} in "${localCgId}" does not hold its update's root; refresh queued`);
+            }
+            // A delayed target is not due yet: the graph's next reconcile pass
+            // starts the worker.
+            if (delayMs === 0 && this.vmReconcileScheduling && isLifecycleCurrent()) {
+                this.vmReconcileScheduling.triggerLive(localCgId);
+            }
+        }
+        return queued;
+    }
+    /**
+     * #2858 — whether a copy at an update's root already reflects that update:
+     * the update's own transaction confirmed it, or it was materialized from a
+     * chain view at or after the update's block, which already held the update.
+     * Neither fact proves fork lineage when the event carries a block hash,
+     * because the same transaction can be included on a replacement fork.
+     */
+    async vmRefreshCopyCoversUpdate(localCgId, ual, copyTxHash, eventTxHash, eventBlock, eventBlockHash) {
+        if (eventBlockHash !== undefined)
+            return false;
+        if (eventTxHash !== undefined && copyTxHash === eventTxHash)
+            return true;
+        if (eventBlock === undefined)
+            return false;
+        const materialized = await readMaterializedVersion(this.store, contextGraphMetaUri(localCgId), ual, { source: 'agent.vmRefresh.materializedVersion', priority: 'background' });
+        return materialized !== null && materialized.blockNumber >= eventBlock;
+    }
+    /** #2858 — give up the refresh targets held past `VM_REFRESH_MAX_AGE_MS`, with a warning each. */
+    expireVmRefreshTargets(ctx) {
+        // Narrow test agents built without the base constructor have no queue.
+        const queue = this.vmRefreshQueue;
+        if (queue === undefined)
+            return;
+        for (const given of queue.expire()) {
+            this.log.warn(ctx, `VM refresh: gave up on ${given.ual} in "${given.localCgId}" after `
+                + `${Math.round(given.heldMs / 60_000)} min and ${given.failures} failed attempt(s) `
+                + `(${queue.givenUpTotal} given up so far); its copy waits for the KA's next update `
+                + 'or an asset fetch');
+        }
+    }
+    /**
+     * #2858 — highest block the update event lane may persist as scanned: just
+     * below the oldest held target's event, so a restart replays that event and
+     * its target is recorded again. Targets held past their maximum age are
+     * given up first, so one that never settles cannot hold the cursor for good.
+     */
+    vmRefreshPersistCeiling() {
+        this.expireVmRefreshTargets(createOperationContext('system'));
+        const oldest = this.vmRefreshQueue?.oldestBlockNumber();
+        return oldest === undefined ? undefined : oldest - 1;
+    }
+    /** #2858 — the refresh lane's state, for `/api/status`. */
+    getVmRefreshStatus() {
+        const queue = this.vmRefreshQueue;
+        const oldest = queue?.oldestBlockNumber();
+        return {
+            heldTargets: queue?.size ?? 0,
+            persistCeiling: oldest === undefined ? null : oldest - 1,
+            givenUpTotal: queue?.givenUpTotal ?? 0,
+            refusedTotal: queue?.refusedTotal ?? 0,
+        };
+    }
+    /**
+     * Local graphs whose root metadata graph describes this graph-scoped KA.
+     * One subject-bound read; the caller filters them to reconcile targets.
+     */
+    async localGraphsDescribingKnowledgeAsset(ual) {
+        const result = await this.store.query(`SELECT DISTINCT ?g WHERE { GRAPH ?g { <${assertSafeIri(ual)}> `
+            + `<${GRAPH_KA_CONTENT_SCOPE_VERSION_PREDICATE}> ?version } }`, { source: 'agent.vmRefresh.holders', priority: 'background' });
+        if (result.type !== 'bindings')
+            return [];
+        const prefix = 'did:dkg:context-graph:';
+        const suffix = '/_meta';
+        const holders = new Set();
+        for (const row of result.bindings) {
+            const graph = row['g'];
+            if (typeof graph !== 'string' || !graph.startsWith(prefix) || !graph.endsWith(suffix)) {
+                continue;
+            }
+            const localCgId = graph.slice(prefix.length, graph.length - suffix.length);
+            if (localCgId.length > 0 && contextGraphMetaUri(localCgId) === graph)
+                holders.add(localCgId);
+        }
+        return [...holders];
+    }
+    /**
+     * What the refresh lane decides on for one KA in one graph: the root and
+     * assertion version the confirmed graph-scoped copy recorded, the
+     * transaction that confirmed it when it is receipt-backed, and whether the
+     * workspace stages a newer version than that copy. A staged version only
+     * delays the refresh (see `VM_REFRESH_STAGED_GRACE_MS`). A head at the
+     * confirmed version or older stages nothing newer; a corrupt one is read
+     * past by the exact fetch.
+     */
+    async readVmRefreshLocalState(localCgId, ual) {
+        const read = await readConfirmedGraphKnowledgeAssetMetadataEnvelope(this.store, {
+            contextGraphId: localCgId,
+            ual,
+        });
+        if (read.state !== 'confirmed')
+            return { kind: 'none' };
+        let staged = false;
+        try {
+            const head = await resolveKnowledgeAssetWorkspaceHead({
+                store: this.store,
+                graphManager: new GraphManager(this.store),
+                contextGraphId: localCgId,
+                kaUal: ual,
+                ...(read.envelope.subGraphName ? { subGraphName: read.envelope.subGraphName } : {}),
+            });
+            staged = head !== undefined
+                && BigInt(head.assertionVersion) > BigInt(read.envelope.assertionVersion);
+        }
+        catch (err) {
+            if (!isKnowledgeAssetWorkspaceHeadCorruptError(err))
+                throw err;
+        }
+        const transactionHash = read.envelope.transactionHash?.trim().toLowerCase();
+        return {
+            kind: 'confirmed',
+            merkleRoot: ethers.hexlify(read.envelope.merkleRoot).toLowerCase(),
+            assertionVersion: BigInt(read.envelope.assertionVersion),
+            ...(transactionHash ? { transactionHash } : {}),
+            staged,
+        };
+    }
+    /**
+     * #2858 — start this graph's refresh worker when it has due targets and
+     * none is running. The worker runs beside the reconcile pass that starts
+     * it, in the background RPC class and store lane, so the pass never waits
+     * on a peer for a refresh. At most `VM_REFRESH_MAX_WORKERS` run at once; a
+     * graph left waiting starts on its next pass or when a running worker ends.
+     * Returns the graph's running worker, if any.
+     */
+    startVmRefreshWorker(localCgId, onChainId, isTargetCurrent, signal) {
+        // Narrow test agents built without the base constructor have neither.
+        const queue = this.vmRefreshQueue;
+        const workers = this.vmRefreshWorkers;
+        if (queue === undefined || workers === undefined)
+            return undefined;
+        const running = workers.get(localCgId);
+        if (running !== undefined)
+            return running;
+        if (signal?.aborted || !isTargetCurrent() || !queue.hasDue(localCgId))
+            return undefined;
+        if (workers.size >= DKGAgentBase.VM_REFRESH_MAX_WORKERS) {
+            this.log.debug(createOperationContext('system'), `VM refresh for "${localCgId}" waits for a free worker`);
+            return undefined;
+        }
+        const worker = withOwnedRpcRequestContext({ requestClass: 'background', ...(signal ? { signal } : {}) }, () => withDefaultStoreWorkPriority('background', () => this.runVmRefreshesForCg(localCgId, onChainId, isTargetCurrent, signal))).catch((err) => {
+            this.log.warn(createOperationContext('system'), `VM refresh worker for "${localCgId}" stopped: `
+                + `${err instanceof Error ? err.message : String(err)}`);
+        }).finally(() => {
+            if (workers.get(localCgId) === worker)
+                workers.delete(localCgId);
+            if (signal?.aborted || this.vmReconcileRotationClosed)
+                return;
+            // Hand the freed slot on: this graph past its per-run bound, or a graph
+            // that found every slot taken. Their passes start the workers.
+            let free = DKGAgentBase.VM_REFRESH_MAX_WORKERS - workers.size;
+            for (const dueCgId of queue.dueContextGraphIds()) {
+                if (free <= 0)
+                    break;
+                if (workers.has(dueCgId))
+                    continue;
+                if (!this.isVmReconcileTargetSelected(dueCgId)) {
+                    // The graph left VM reconciliation; no pass will work its targets.
+                    queue.clearContextGraph(dueCgId);
+                    continue;
+                }
+                void this.vmReconcileScheduling?.triggerLive(dueCgId);
+                free -= 1;
+            }
+        });
+        workers.set(localCgId, worker);
+        trackVmReconcilePhysicalRun(this.vmReconcilePhysicalRuns, worker);
+        return worker;
+    }
+    /**
+     * Work off up to `VM_REFRESH_MAX_PER_PASS` of this graph's due refresh
+     * targets. Each attempt is bounded by `VM_REFRESH_ATTEMPT_TIMEOUT_MS` and
+     * its peer steps by `VM_REFRESH_PEER_STEP_TIMEOUT_MS`, and every outcome is
+     * settled and logged: an attempt that fails, times out or finds no holder
+     * backs off and asks the next peer window when it is due again. A closing
+     * lifecycle or a replaced reconcile target keeps the target for the next
+     * worker. Never throws.
+     */
+    async runVmRefreshesForCg(localCgId, onChainId, isTargetCurrent, signal) {
+        // Narrow test agents built without the base constructor have no queue.
+        const queue = this.vmRefreshQueue;
+        if (queue === undefined)
+            return;
+        const due = queue.due(localCgId, DKGAgentBase.VM_REFRESH_MAX_PER_PASS);
+        if (due.length === 0)
+            return;
+        const ctx = createOperationContext('system');
+        const stopped = (target) => {
+            if (!signal?.aborted && isTargetCurrent())
+                return false;
+            this.log.debug(ctx, `VM refresh of ${target.ual} in "${localCgId}" deferred: its reconcile target closed`);
+            return true;
+        };
+        for (const target of due) {
+            if (stopped(target))
+                return;
+            let attempt;
+            let failed = false;
+            try {
+                attempt = await runBoundedOperation((attemptSignal) => this.refreshConfirmedVmCopy(target, onChainId, isTargetCurrent, attemptSignal), {
+                    timeoutMs: DKGAgentBase.VM_REFRESH_ATTEMPT_TIMEOUT_MS,
+                    label: `VM refresh of ${target.ual}`,
+                    ...(signal ? { signal } : {}),
+                });
+            }
+            catch (err) {
+                if (stopped(target))
+                    return;
+                failed = true;
+                attempt = {
+                    outcome: 'retry',
+                    detail: isBoundedOperationTimeoutError(err)
+                        ? err.message
+                        : `failed: ${err instanceof Error ? err.message : String(err)}`,
+                };
+            }
+            if (stopped(target))
+                return;
+            const retryAt = queue.settle(target, attempt.outcome);
+            const subject = `${target.ual} in "${localCgId}"`;
+            if (attempt.outcome === 'refreshed') {
+                this.log.info(ctx, `VM refresh: ${subject} now holds the current version (${attempt.detail})`);
+            }
+            else if (attempt.outcome === 'retry') {
+                const retry = retryAt === undefined
+                    ? 'retrying on a later pass'
+                    : `retrying in ${Math.max(0, Math.round((retryAt - Date.now()) / 1000))}s`;
+                const message = `VM refresh of ${subject} did not complete (${attempt.detail}); ${retry}`;
+                if (failed)
+                    this.log.warn(ctx, message);
+                else
+                    this.log.info(ctx, message);
+            }
+            else {
+                this.log.debug(ctx, `VM refresh of ${subject} settled as ${attempt.outcome}: ${attempt.detail}`);
+            }
+        }
+    }
+    /**
+     * One refresh attempt: settle from local state when the copy already holds
+     * the event's root, otherwise read the chain's current root. A copy at that
+     * root is current (the event was older or superseded — nothing is rolled
+     * back); a different one is fetched as the exact current version, which
+     * replaces the older assertion in place. `signal` is the attempt's own: it
+     * stops the fetch at the attempt deadline.
+     */
+    async refreshConfirmedVmCopy(target, onChainId, isTargetCurrent, signal) {
+        const local = await this.readVmRefreshLocalState(target.localCgId, target.ual);
+        if (local.kind === 'none') {
+            return { outcome: 'not-applicable', detail: 'no confirmed copy is held any more' };
+        }
+        // A version still staged here was not promoted by the lane that staged it
+        // (or nothing on this node promotes it). The exact fetch below verifies it
+        // against the chain like any other copy, and a staged version newer than
+        // the chain's stays in the workspace: the fetch writes only Verifiable
+        // Memory.
+        // A copy at the update's root is current, unless the nudge found it
+        // there already: then only the chain's version can tell (a repeated root).
+        if (!target.checkVersion && local.merkleRoot === target.merkleRoot) {
+            return { outcome: 'current', detail: 'the copy holds the update root' };
+        }
+        if (typeof this.chain.getLatestMerkleRoot !== 'function') {
+            return { outcome: 'not-applicable', detail: 'the chain adapter reads no latest root' };
+        }
+        let chainRoot = ethers.hexlify(await this.chain.getLatestMerkleRoot(target.kaId, { signal })).toLowerCase();
+        if (!isTargetCurrent())
+            throw new VmReconcileQueueClosedError();
+        let chainVersion;
+        if (chainRoot === local.merkleRoot) {
+            // An older or superseded event, a read that has not seen the update yet
+            // (a lagging endpoint, a confirmation depth above one), or an update
+            // that repeated the copy's root. Settle only on a coherent view at or
+            // after the update's block, by version as well as root.
+            const confirmed = await this.confirmVmRefreshCurrentAtEventBlock(target, local, isTargetCurrent, signal);
+            if (confirmed.kind === 'settled')
+                return confirmed.attempt;
+            // The pinned view names a newer version: fetch it.
+            chainRoot = confirmed.chainRoot;
+            chainVersion = confirmed.rootCount;
+        }
+        let result;
+        try {
+            result = await this.runExactAssetFetchForContextGraph(target.localCgId, [target.ual], {
+                isCurrent: () => isTargetCurrent() && !signal?.aborted,
+                ...(signal ? { signal } : {}),
+                expectedOnChainId: onChainId,
+                maxPeers: DKGAgentBase.VM_RECONCILE_EXACT_PEER_MAX,
+                // Each retry asks the next window of candidates, so a holder outside
+                // the first few peers is still reached.
+                peerWindowIndex: target.failures,
+                // An update keeps the UAL. Its old responder session can outlive the
+                // previous version, so every refresh attempt needs a new snapshot.
+                forceFreshExactSession: true,
+                // A candidate that cannot be reached (after a restart, the curator
+                // is often not connected yet) yields to the next one.
+                peerStepTimeoutMs: DKGAgentBase.VM_REFRESH_PEER_STEP_TIMEOUT_MS,
+                // Evidence that has not seen the update would settle on the old version.
+                ...((target.proofBlockNumber ?? target.blockNumber) === undefined
+                    ? {} : { minVersionBlock: target.proofBlockNumber ?? target.blockNumber }),
+            });
+        }
+        catch (err) {
+            // This adapter cannot prove an exact version at all. Anything else,
+            // including a conflict such as a version snapshot the endpoints did
+            // not agree on, is retried after backoff.
+            if (err instanceof VmReconcileUnavailableError) {
+                return { outcome: 'not-applicable', detail: 'this adapter cannot prove an exact version' };
+            }
+            if (err instanceof ExactAssetVersionBehindError) {
+                return { outcome: 'retry', detail: err.message };
+            }
+            throw err;
+        }
+        const status = result.items[0]?.status;
+        if (status === 'materialized' || status === 'fetched') {
+            return { outcome: 'refreshed', detail: `${status} after ${result.peerAttempts} peer attempt(s)` };
+        }
+        if (status === 'already-present') {
+            return { outcome: 'current', detail: 'the exact inspection found the current version' };
+        }
+        // The exact inspection can refuse a refreshed copy while a workspace head
+        // names another version (an older one, or one staged ahead of the chain);
+        // the confirmed copy itself is the answer here.
+        const after = await this.readVmRefreshLocalState(target.localCgId, target.ual);
+        if (after.kind === 'confirmed'
+            && after.merkleRoot === chainRoot
+            && (chainVersion === undefined || after.assertionVersion >= chainVersion)) {
+            return { outcome: 'refreshed', detail: 'the confirmed copy holds the chain root' };
+        }
+        return {
+            outcome: 'retry',
+            detail: `no peer served the current version; ${result.peerAttempts} peer attempt(s)`,
+        };
+    }
+    /**
+     * #2858 — the copy holds the root a live chain read returned. That read can
+     * predate the update (a lagging endpoint, a confirmation depth above one),
+     * and a root names content, not a version: an update may repeat an earlier
+     * root. So settle from a coherent view at or after the event's block:
+     * `current` when it holds the copy's root at a version no newer than the
+     * copy's, `retry` while it has not reached that block, and the root and
+     * version it shows otherwise, which the caller then fetches. On an adapter
+     * that reads no pinned view, the live read settles it.
+     */
+    async confirmVmRefreshCurrentAtEventBlock(target, local, isTargetCurrent, signal) {
+        const current = {
+            kind: 'settled',
+            attempt: { outcome: 'current', detail: 'the copy holds the chain root and version' },
+        };
+        if (typeof this.chain.readKnowledgeAssetVersionSnapshot !== 'function')
+            return current;
+        const view = await this.chain.readKnowledgeAssetVersionSnapshot(target.kaId, { signal });
+        if (!isTargetCurrent())
+            throw new VmReconcileQueueClosedError();
+        if (view === null) {
+            return {
+                kind: 'settled',
+                attempt: { outcome: 'retry', detail: 'no coherent chain view confirms the copy' },
+            };
+        }
+        const proofBlock = target.proofBlockNumber ?? target.blockNumber;
+        if (proofBlock !== undefined && view.blockNumber < proofBlock) {
+            return {
+                kind: 'settled',
+                attempt: {
+                    outcome: 'retry',
+                    detail: `the chain view at block ${view.blockNumber} is behind the update's block `
+                        + `${proofBlock}`,
+                },
+            };
+        }
+        const viewRoot = view.latestRoot.toLowerCase();
+        return viewRoot === local.merkleRoot && view.rootCount <= local.assertionVersion
+            ? current
+            : { kind: 'newer', chainRoot: viewRoot, rootCount: view.rootCount };
+    }
     /**
      * Canonical evidence-gated VM reconciliation operation for one CG.
      *
@@ -2529,6 +3051,31 @@ export class SwmHostModeMethods extends DKGAgentBase {
             throw new VmReconcileQueueClosedError();
         if (!canRead)
             throw new ContextGraphNotFoundError(localCgId);
+        // Bound through the prototype, as narrow hosts that borrow this operator
+        // method do not carry the shared tail.
+        return SwmHostModeMethods.prototype.runExactAssetFetchForContextGraph.call(this, localCgId, requestedUals, {
+            isCurrent,
+            ...(signal ? { signal } : {}),
+            ...(options.peerIds === undefined ? {} : { peerIds: options.peerIds }),
+            ...(subscription.onChainId ? { expectedOnChainId: subscription.onChainId } : {}),
+        });
+    }
+    /**
+     * The exact-asset fetch once its caller has proved read authority and owns
+     * the lifecycle: chain evidence, local inspection against the current root
+     * and version, a bounded peer traversal, and re-inspection. Shared by the
+     * operator fetch above and the VM refresh lane ({@link refreshConfirmedVmCopy}).
+     */
+    async runExactAssetFetchForContextGraph(localCgId, requestedUals, options) {
+        const { isCurrent, signal, peerStepTimeoutMs } = options;
+        /** One network step, under `peerStepTimeoutMs` when the caller set it. */
+        const runPeerStep = (label, step) => (peerStepTimeoutMs === undefined
+            ? step(signal)
+            : runBoundedOperation(step, {
+                timeoutMs: peerStepTimeoutMs,
+                label,
+                ...(signal ? { signal } : {}),
+            }));
         if (typeof this.chain.getKAContextGraphId !== 'function'
             || typeof this.chain.readKnowledgeAssetVersionSnapshot !== 'function') {
             throw new VmReconcileUnavailableError();
@@ -2541,7 +3088,11 @@ export class SwmHostModeMethods extends DKGAgentBase {
             contextGraphId: localCgId,
             requestedUals,
             ...(options.peerIds === undefined ? {} : { peerIds: options.peerIds }),
-            ...(subscription.onChainId ? { expectedOnChainId: subscription.onChainId } : {}),
+            ...(options.expectedOnChainId ? { expectedOnChainId: options.expectedOnChainId } : {}),
+            ...(options.maxPeers === undefined ? {} : { maxPeers: options.maxPeers }),
+            ...(options.minVersionBlock === undefined
+                ? {}
+                : { minVersionBlock: options.minVersionBlock }),
         }, {
             chainId: this.chain.chainId,
             signal,
@@ -2578,34 +3129,59 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 return 'missing';
             },
             resolvePeerIds: async () => {
-                const curatorResolution = await this.resolveCuratorPeerIdsForCg(localCgId, {
+                const curatorResolution = await runPeerStep(`Curator resolution for "${localCgId}"`, (stepSignal) => this.resolveCuratorPeerIdsForCg(localCgId, {
                     maxPeerIds: MAX_CONTEXT_GRAPH_ASSET_FETCH_PEERS,
-                    signal,
+                    signal: stepSignal,
                     isCurrent,
-                }).catch(() => ({ peerIds: [] }));
+                })).catch((error) => {
+                    if (isBoundedOperationTimeoutError(error)) {
+                        this.log.info(ctx, `Exact asset fetch: ${error.message}; asking connected peers`);
+                    }
+                    return { peerIds: [] };
+                });
                 if (!isCurrent())
                     throw new VmReconcileQueueClosedError();
                 const connectedPeerIds = this.node?.libp2p?.getConnections?.()
                     ?.map((connection) => connection.remotePeer.toString()) ?? [];
-                return [...new Set([
-                        ...curatorResolution.peerIds,
-                        this.preferredSyncPeers.get(localCgId),
-                        ...connectedPeerIds,
-                    ].filter((peerId) => Boolean(peerId && peerId !== this.peerId)))];
+                const usable = (peerId) => Boolean(peerId && peerId !== this.peerId);
+                const curators = [...new Set(curatorResolution.peerIds.filter(usable))];
+                const curatorSet = new Set(curators);
+                const ordinary = [...new Set([this.preferredSyncPeers.get(localCgId), ...connectedPeerIds].filter(usable))].filter((peerId) => !curatorSet.has(peerId));
+                const windowIndex = options.peerWindowIndex !== undefined
+                    && Number.isSafeInteger(options.peerWindowIndex)
+                    && options.peerWindowIndex > 0
+                    ? options.peerWindowIndex
+                    : 0;
+                const windowSize = exactAssetFetchPeerWindow(options.maxPeers);
+                const curatorSlots = Math.min(curators.length, windowSize);
+                return [
+                    ...rotatePeerIds(curators, windowIndex * curatorSlots),
+                    ...rotatePeerIds(ordinary, windowIndex * (windowSize - curatorSlots)),
+                ];
             },
-            preparePeer: async (peerId) => {
-                await this.ensurePeerConnected(peerId, { signal });
+            // A step past its bound rejects; the traversal logs it and moves on to
+            // the next candidate.
+            preparePeer: (peerId) => runPeerStep('Peer preparation', async (stepSignal) => {
+                await this.ensurePeerConnected(peerId, { signal: stepSignal });
                 if (!isCurrent())
                     throw new VmReconcileQueueClosedError();
                 const remotePeer = this.node.libp2p.getConnections()
                     .find((connection) => connection.remotePeer.toString() === peerId)
                     ?.remotePeer;
-                if (!remotePeer || !(await this.waitForSyncProtocol(remotePeer, signal)))
+                if (!remotePeer || !(await this.waitForSyncProtocol(remotePeer, stepSignal)))
                     return false;
-                return this.ensurePeerAdmittedForRecovery(peerId, ctx, 'Exact asset fetch peer', signal);
-            },
+                return this.ensurePeerAdmittedForRecovery(peerId, ctx, 'Exact asset fetch peer', stepSignal);
+            }),
             fetchFromPeer: async (peerId, uals) => {
-                await this.syncExactKnowledgeAssetsFromPeerDetailed(peerId, localCgId, [...uals], { signal, isCurrent });
+                await this.syncExactKnowledgeAssetsFromPeerDetailed(peerId, localCgId, [...uals], {
+                    signal,
+                    isCurrent,
+                    // The same UAL can move to a new root while the responder still
+                    // holds its older exact-asset page session. A refresh must start
+                    // from a new snapshot on every attempt; its pages still share one
+                    // session within this invocation.
+                    forceFreshExactSession: options.forceFreshExactSession === true,
+                });
             },
             flush: async () => {
                 await this.store.flush?.({
@@ -2638,12 +3214,18 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     this.log.debug(createOperationContext('system'), `VM reconcile for "${localCgId}" stopped: superseded by cleartext adoption of "${supersedingId}"`);
                     return;
                 }
+                // Reported where the graph was parked (executeVmReconcileForCg): it
+                // is asked again shortly and does not wait for the sweep.
+                if (err instanceof VmReconcileReadAuthorityUnansweredError)
+                    return;
                 this.log.warn(createOperationContext('system'), `VM reconcile for "${localCgId}" failed; retrying on the periodic sweep: ${err instanceof Error ? err.message : String(err)}`);
             }, {
                 concurrency: DKGAgentBase.VM_RECONCILE_CONCURRENCY,
                 maxPending: DKGAgentBase.VM_RECONCILE_QUEUE_MAX_PENDING,
                 maxForegroundBurst: DKGAgentBase.VM_RECONCILE_MAX_FOREGROUND_BURST,
-            }, DKGAgentBase.VM_RECONCILE_UNBOUND_BATCH_SIZE);
+                discoveryBatchSize: DKGAgentBase.VM_RECONCILE_UNBOUND_BATCH_SIZE,
+                periodicBoundBatchSize: DKGAgentBase.VM_RECONCILE_PERIODIC_BOUND_BATCH_SIZE,
+            });
             this.vmReconcileScheduling = scheduling;
         }
         return scheduling;
@@ -2668,11 +3250,46 @@ export class SwmHostModeMethods extends DKGAgentBase {
             ? work()
             : withOwnedRpcRequestContext({ requestClass: 'background', ...(lifecycleSignal ? { signal: lifecycleSignal } : {}) }, () => withDefaultStoreWorkPriority('background', work));
         const physicalRun = runInLane(async () => {
-            const target = await this.resolveVmReconcileTarget(localCgId, isLifecycleCurrent, lifecycleSignal);
+            const passStartedAt = performance.now();
+            const passGapMs = vmReconcilePassGapMs(this, localCgId, passStartedAt);
+            const target = await this.resolveVmReconcileTarget(localCgId, isLifecycleCurrent, lifecycleSignal).catch((err) => {
+                if (!(err instanceof VmReconcileReadAuthorityUnansweredError))
+                    throw err;
+                // The chain read behind the read-authority check got no answer, which
+                // is the node's RPC budget or its endpoint and not the graph. An
+                // automatic pass leaves the graph waiting to be asked again; without
+                // that its next attempt is the periodic sweep, up to a full interval
+                // after the read would have been answered. It is asked again only
+                // while its fetch could start, the readiness every waiter uses. An
+                // operator's request, and a graph the wait cannot take, end as they
+                // always did.
+                const waiting = source === 'manual'
+                    ? undefined
+                    : this.vmReconcileScheduling?.deferForReadAuthority(localCgId, {
+                        signal: lifecycleSignal,
+                        isCurrent: isLifecycleCurrent,
+                        canAdmit: () => this.vmRecoverySyncAdmissionAvailable(localCgId),
+                    });
+                if (waiting === undefined)
+                    throw new ContextGraphNotFoundError(localCgId);
+                const message = `VM reconcile for "${localCgId}" is waiting for read authority `
+                    + `(${err.readAuthority}): the chain read got no answer; asking again shortly`;
+                if (waiting === 'parked')
+                    this.log.info(createOperationContext('system'), message);
+                else
+                    this.log.debug(createOperationContext('system'), message);
+                throw err;
+            });
+            const resolveTargetMs = performance.now() - passStartedAt;
             const isTargetCurrent = () => isLifecycleCurrent()
                 && this.isVmReconcileTargetCurrent(localCgId, target, lifecycleGeneration);
             if (!isTargetCurrent())
                 throw new VmReconcileQueueClosedError();
+            // #2858 — confirmed copies behind an on-chain update. The ordinal cursor
+            // never revisits a settled ordinal, so a worker beside this pass
+            // refreshes them. The pass never waits on it, and a slice that fails
+            // does not hold it back.
+            this.startVmRefreshWorker(localCgId, target.onChainId, isTargetCurrent, lifecycleSignal);
             // Reconcile on a private cursor snapshot. The caller-facing abort race may
             // finish before an adapter physically settles; a stale continuation must
             // never mutate the live cursor or persist a watermark into a new binding.
@@ -2683,10 +3300,12 @@ export class SwmHostModeMethods extends DKGAgentBase {
             };
             let pendingWatermark;
             let result;
+            let engineTimings;
             try {
                 result = await reconcileContextGraph(this.createVmReconcileDeps(localCgId, lifecycleGeneration, target, lifecycleSignal, {
                     identityCursor: target.cursor,
                     persistWatermark: (_lcg, watermark) => { pendingWatermark = watermark; },
+                    observePassTimings: (timings) => { engineTimings = timings; },
                 }), workingCursor, localCgId, target.onChainCgId);
             }
             catch (err) {
@@ -2706,16 +3325,22 @@ export class SwmHostModeMethods extends DKGAgentBase {
             }
             if (!isTargetCurrent())
                 throw new VmReconcileQueueClosedError();
+            let flushMs = 0;
             if (result.reconciled > 0 || pendingWatermark !== undefined) {
+                const flushStartedAt = performance.now();
                 await this.store.flush?.({
                     priority: 'background',
                     source: 'agent.vmReconcile.materialization.flush',
                 });
+                flushMs = performance.now() - flushStartedAt;
                 if (!isTargetCurrent())
                     throw new VmReconcileQueueClosedError();
             }
+            let watermarkMs = 0;
             if (pendingWatermark !== undefined) {
+                const watermarkStartedAt = performance.now();
                 await this.persistVmReconcileWatermark(localCgId, pendingWatermark, target);
+                watermarkMs = performance.now() - watermarkStartedAt;
                 if (!isTargetCurrent())
                     throw new VmReconcileQueueClosedError();
             }
@@ -2724,11 +3349,40 @@ export class SwmHostModeMethods extends DKGAgentBase {
             target.cursor.scanOrdinal = workingCursor.scanOrdinal;
             const response = this.toContextGraphReconcileResult(localCgId, source, target, result);
             this.emitVmReconcileTelemetry(localCgId, target, result, response.status);
+            observeVmRecoveryTiming(() => {
+                const timings = engineTimings;
+                this.log.info(createOperationContext('system'), `VM reconcile pass timing for "${localCgId}": source=${source} `
+                    + `gapSincePreviousPassMs=${passGapMs === undefined ? '-' : Math.round(passGapMs)} `
+                    + `resolveTargetMs=${Math.round(resolveTargetMs)} `
+                    + `headReadMs=${Math.round(timings?.headReadMs ?? 0)} blockReadMs=${Math.round(timings?.blockReadMs ?? 0)} `
+                    + `scanMs=${Math.round(timings?.scanMs ?? 0)} recoverMs=${Math.round(timings?.recoverMs ?? 0)} `
+                    + `engineMs=${Math.round(timings?.totalMs ?? 0)} flushMs=${Math.round(flushMs)} `
+                    + `watermarkMs=${Math.round(watermarkMs)} totalMs=${Math.round(performance.now() - passStartedAt)} `
+                    + `processed=${result.processed} reconciled=${result.reconciled} pending=${result.pending} `
+                    + `continue=${result.shouldContinueImmediately ? 1 : 0}`);
+            });
             // The reconciler owns the continuation policy: productive slices, stale
             // bindings, and explicit provider rotations continue immediately, while
             // pending-only historical inventory yields to the periodic sweep.
-            if (isLifecycleCurrent() && result.shouldContinueImmediately) {
-                this.vmReconcileScheduling?.triggerLive(localCgId);
+            const localAdmissionWait = {
+                signal: lifecycleSignal,
+                isCurrent: isTargetCurrent,
+                canAdmit: () => this.vmRecoverySyncAdmissionAvailable(localCgId),
+            };
+            if (isTargetCurrent() && result.localAdmissionDeferred) {
+                this.vmReconcileScheduling?.retryLocalAdmission(localCgId, localAdmissionWait);
+            }
+            else if (isLifecycleCurrent() && result.shouldContinueImmediately) {
+                // A graph that just fetched from peers takes its next turn behind the
+                // graphs the node's sync admission refused while it did. Without that
+                // the freed capacity goes back to whichever pass asks first, which is
+                // this one, and the others repeat their passes to be refused again.
+                const yielded = result.recoveryAttempted === true
+                    && !result.staleTarget
+                    && isTargetCurrent()
+                    && this.vmReconcileScheduling?.yieldLocalAdmissionTurn(localCgId, localAdmissionWait) === true;
+                if (!yielded)
+                    this.vmReconcileScheduling?.triggerLive(localCgId);
             }
             else if (isTargetCurrent()) {
                 // RS heal is bounded, best-effort maintenance. Run it only after the
@@ -2749,6 +3403,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 if (!isTargetCurrent())
                     throw new VmReconcileQueueClosedError();
             }
+            noteVmReconcilePassEnd(this, localCgId, performance.now());
             return response;
         });
         trackVmReconcilePhysicalRun(this.vmReconcilePhysicalRuns, physicalRun);
@@ -2835,8 +3490,10 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // Central defense for periodic, live-chain, and manual reconciliation.
         // Every dispatcher entry point converges here and must independently prove
         // read authority. Never let a persisted subscription authorize itself.
+        let authorityDecision;
         const authorityRead = withRpcUsageSite(CG_AUTH_RPC_SITES.vmReconcile, () => this.canReadContextGraph(localCgId, {
             allowSubscriptionFallback: false,
+            onReadAuthorityDecision: (decision) => { authorityDecision = decision; },
         }));
         // Cancellation releases the dispatcher worker, but an underlying store/RPC
         // read may ignore it. Keep that physical dependency in the shutdown drain.
@@ -2844,8 +3501,16 @@ export class SwmHostModeMethods extends DKGAgentBase {
         const canRead = await raceVmReconcileAbort(authorityRead, signal).catch(() => false);
         if (!isCurrent())
             throw new VmReconcileQueueClosedError();
-        if (!canRead)
+        if (!canRead) {
+            // Still a refusal for this pass. The class only records that the chain
+            // never answered, so scheduling can ask again instead of treating the
+            // graph as unreadable until the next sweep.
+            const decision = authorityDecision;
+            if (isUnansweredVmReconcileReadAuthority(decision)) {
+                throw new VmReconcileReadAuthorityUnansweredError(localCgId, decision);
+            }
             throw new ContextGraphNotFoundError(localCgId);
+        }
         if (this.contextGraphBindingState.currentBindingFor(localCgId, sub) === undefined
             && sub.subscribed) {
             await this.selfPrimeSubscriptionOnChainId(localCgId, sub, undefined, isCurrent, signal);
@@ -3136,7 +3801,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
             reconcileOrdinal: (lcg, ocg, ordinal, headBlock, context) => this.reconcileChainOrdinal(lcg, ocg, ordinal, headBlock, {
                 isTargetCurrent,
                 revalidateTarget,
-                deferActiveFetch: true,
                 rememberFinalizedEvidence: context === undefined
                     || context.headOrdinal - ordinal <= DKGAgentBase.VM_RECONCILE_BATCH_SIZE,
             }),
@@ -3171,6 +3835,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             },
             confirmationDepth: DKGAgentBase.VM_RECONCILE_CONFIRMATION_DEPTH,
             log: (msg) => this.log.info(createOperationContext('system'), msg),
+            ...(execution?.observePassTimings ? { observePassTimings: execution.observePassTimings } : {}),
         };
     }
     async persistVmReconcileWatermark(localCgId, watermark, target) {
@@ -3217,7 +3882,11 @@ export class SwmHostModeMethods extends DKGAgentBase {
             });
             return;
         }
-        await this.persistContextGraphSubscriptionStrict(localCgId, { ...sub, lastReconciledOrdinal: watermark }, undefined, isTargetCurrent);
+        // Authoritative progress follows the subscription's own lifetime. A durable
+        // row (always-on member intent, or a Core's host-only obligation) is saved
+        // before the live cursor moves. An on-demand subscription writes nothing:
+        // like the subscription itself, its progress lives only in this process.
+        await this.persistContextGraphSyncStateStrict(localCgId, { ...sub, lastReconciledOrdinal: watermark }, 'VM reconcile cursor', isTargetCurrent);
         if (!isTargetCurrent())
             return;
         sub.lastReconciledOrdinal = watermark;
@@ -3545,452 +4214,56 @@ export class SwmHostModeMethods extends DKGAgentBase {
             return { status: 'skipped', reason: 'failed' };
         }
     }
-    async collectVmReconcileSwmCandidateState(localCgId) {
-        const candidateNamespaces = await this.collectVmReconcileSwmCandidateNamespacesBestEffort(localCgId);
-        return {
-            candidateNamespaces: candidateNamespaces.namespaces,
-            swmGen: await this.readVmReconcileSwmGen(candidateNamespaces.namespaces),
-            peerTopology: await this.vmReconcilePeerTopology(localCgId),
-            cleanMissPeerIds: [],
-        };
+    initializeVmReconcilePublicCoreTransportPreferencePolicy() {
+        this.vmReconcilePublicCoreTransportPreferencePolicy ??= new VmRecoveryCoreTransportPreferencePolicy({
+            now: () => this.vmReconcileRotationNow(),
+            connectionKey: peerId => this.getSyncReconcilerConnectionKey(peerId),
+            supportsCore: peerId => this.peerCapabilityRegistry.supportsCore(peerId),
+            holderReuseEnabled: resolveExactBatchStreamEnabled,
+            captureScope: (localCgId, candidatePeerIds) => typeof this.chain.deploymentId === 'string' ? {
+                deploymentId: this.chain.deploymentId,
+                lifecycleGeneration: this.vmReconcileLifecycleGeneration,
+                bindingGeneration: this.contextGraphBindingState.capture(localCgId),
+                selectedBindingGeneration: this.selectedVmReconcileCursors.get(localCgId)?.bindingGeneration,
+                candidatePeerIds: [...candidatePeerIds],
+            } : undefined,
+            scopeIsCurrent: (localCgId, scope) => this.chain.deploymentId === scope.deploymentId
+                && this.vmReconcileLifecycleGeneration === scope.lifecycleGeneration
+                && !this.vmReconcileRotationClosed
+                && this.contextGraphBindingState.capture(localCgId) === scope.bindingGeneration
+                && this.selectedVmReconcileCursors.get(localCgId)?.bindingGeneration === scope.selectedBindingGeneration
+                && this.vmReconcilePeerMembershipMatches(new Set(scope.candidatePeerIds), this.vmReconcileObservedCandidatePeerIds(localCgId)),
+        }, {
+            ttlMs: DKGAgentBase.VM_RECONCILE_PUBLIC_CORE_TRANSPORT_TTL_MS,
+            maxEntries: DKGAgentBase.VM_RECONCILE_CG_STATE_MAX_ENTRIES,
+        });
     }
-    vmReconcileRootSwmCandidateNamespaces(localCgId) {
-        return [{
-                metaGraph: contextGraphWorkspaceMetaGraphUri(localCgId),
-                dataGraph: contextGraphWorkspaceGraphUri(localCgId),
-            }];
+    vmReconcileRotationNow() {
+        return performance.now();
     }
-    async collectVmReconcileSwmCandidateNamespaces(localCgId) {
-        const graphManager = new GraphManager(this.store);
-        // `listSubGraphs` finds sub-graphs by their data or `_meta` graphs; a
-        // hosted-only core holds only `<cg>/<sub>/_shared_memory*` copies, which
-        // its StorageACK ledger names.
-        const subGraphs = [...new Set([
-                ...await graphManager.listSubGraphs(localCgId),
-                ...await this.storageAckLedgerNamespaceSubGraphs(localCgId),
-            ])];
-        const subGraphNamespaces = subGraphs
-            .map((sg) => ({
-            metaGraph: graphManager.sharedMemoryMetaUri(localCgId, sg),
-            dataGraph: graphManager.sharedMemoryUri(localCgId, sg),
-        }))
-            .sort((a, b) => `${a.metaGraph}\0${a.dataGraph}`.localeCompare(`${b.metaGraph}\0${b.dataGraph}`));
-        return [
-            ...this.vmReconcileRootSwmCandidateNamespaces(localCgId),
-            ...subGraphNamespaces,
-        ];
+    vmReconcileRotationSlotKey(target) {
+        return `${target.localCgId}\0${target.onChainCgId}\0${target.ordinal}`;
     }
-    async collectVmReconcileSwmCandidateNamespacesBestEffort(localCgId) {
-        try {
-            return { namespaces: await this.collectVmReconcileSwmCandidateNamespaces(localCgId), complete: true };
-        }
-        catch {
-            return { namespaces: this.vmReconcileRootSwmCandidateNamespaces(localCgId), complete: false };
-        }
+    clearVmReconcileRotationStateForSlot(localCgId, onChainCgId, ordinal) {
+        this.vmReconcileRotationState.delete(`${localCgId}\0${onChainCgId.toString()}\0${ordinal}`);
     }
-    vmReconcileSwmNamespaceKey(candidateNamespaces) {
-        return candidateNamespaces
-            .map((namespace) => `${namespace.metaGraph}\0${namespace.dataGraph}`)
-            .sort()
-            .join('\n');
+    vmReconcileRotationFingerprint(target) {
+        return `${target.ual}\0${target.merkleRoot.toLowerCase()}`;
     }
-    async vmReconcilePeerTopology(localCgId) {
-        try {
-            const preferredPeerId = await this.resolvePreferredSyncPeerId(localCgId);
-            const isPrivateContextGraph = await this.isPrivateContextGraph(localCgId);
-            const libp2p = this.node?.libp2p;
-            const getConnections = libp2p?.getConnections;
-            if (typeof getConnections !== 'function')
-                return UNREADABLE_VM_RECONCILE_PEER_TOPOLOGY;
-            const peerIds = [...new Map(getConnections.call(libp2p)
-                    .map((connection) => [connection.remotePeer?.toString(), connection.remotePeer])
-                    .filter((entry) => typeof entry[0] === 'string' && entry[0].length > 0 && !!entry[1])).keys()].sort();
-            const orderedPeers = this.selectCatchupPeers(peerIds.map((peerId) => ({ toString: () => peerId })), preferredPeerId, isPrivateContextGraph);
-            return createVmReconcilePeerTopology({
-                preferredPeerId: preferredPeerId ?? null,
-                privateOnly: isPrivateContextGraph,
-                peers: orderedPeers.map((peer) => {
-                    const peerId = peer.toString();
-                    return {
-                        peerId,
-                        core: this.peerCapabilityRegistry.supportsCore(peerId),
-                    };
-                }),
-            });
-        }
-        catch {
-            return UNREADABLE_VM_RECONCILE_PEER_TOPOLOGY;
+    vmReconcileObservedCandidatePeerIds(localCgId) {
+        const curatorOrder = this.vmReconcileCuratorPeersByCg.get(localCgId) ?? [];
+        const libp2p = this.node?.libp2p;
+        const getConnections = libp2p?.getConnections;
+        if (typeof getConnections !== 'function') {
+            return curatorOrder.slice(0, DKGAgentBase.VM_RECONCILE_EXACT_ROSTER_MAX);
         }
-    }
-    async readVmReconcileSwmGen(candidateNamespaces) {
-        if (candidateNamespaces.length === 0)
-            return 'empty:0';
-        try {
-            // The changelog cursor is a durable write generation: it survives daemon
-            // restart, advances at the store mutation choke point, and is O(1) after
-            // its one-time seed. It lets large (> fingerprint cap) stores reuse a
-            // proven negative without reconstructing or sampling their SWM content.
-            const changelog = asChangelogReader(this.store);
-            if (changelog) {
-                const head = await changelog.changelogHead({
-                    priority: 'background',
-                    source: 'agent.vmReconcile.negativeGeneration',
-                });
-                return `changelog:${head.era}:${head.seq}`;
-            }
-            const parts = [];
-            const digestRows = (rows) => createHash('sha256').update(rows.join('\n'), 'utf8').digest('hex');
-            const maxRows = DKGAgentBase.VM_RECONCILE_SWM_GEN_FINGERPRINT_MAX_ROWS;
-            const isTooLarge = (rows) => rows.length > maxRows;
-            for (const namespace of candidateNamespaces) {
-                const metaGraph = assertSafeIri(namespace.metaGraph);
-                const dataGraph = assertSafeIri(namespace.dataGraph);
-                const operationRows = await this.store.query(`SELECT ?op ?root ?ts WHERE {
-            GRAPH <${metaGraph}> {
-              ?op <http://dkg.io/ontology/rootEntity> ?root .
-              OPTIONAL { ?op <http://dkg.io/ontology/publishedAt> ?ts . }
-            }
-          } ORDER BY ?op ?root ?ts LIMIT ${maxRows + 1}`, { source: 'agent.vmReconcile.swmFingerprint.operations' });
-                if (operationRows.type !== 'bindings')
-                    return null;
-                if (isTooLarge(operationRows.bindings))
-                    return null;
-                const operations = operationRows.bindings
-                    .map((row) => [
-                    String(row['op'] ?? ''),
-                    String(row['root'] ?? ''),
-                    String(row['ts'] ?? ''),
-                ].join('\0'))
-                    .sort();
-                const dataRows = await this.store.query(`SELECT ?s ?p ?o WHERE {
-            GRAPH <${dataGraph}> { ?s ?p ?o . }
-          } ORDER BY ?s ?p ?o LIMIT ${maxRows + 1}`, { source: 'agent.vmReconcile.swmFingerprint.data' });
-                if (dataRows.type !== 'bindings')
-                    return null;
-                if (isTooLarge(dataRows.bindings))
-                    return null;
-                const dataTriples = dataRows.bindings
-                    .map((row) => [
-                    String(row['s'] ?? ''),
-                    String(row['p'] ?? ''),
-                    String(row['o'] ?? ''),
-                ].join('\0'))
-                    .sort();
-                const privateRootRows = await this.store.query(`SELECT ?privateEntity ?privateRoot WHERE {
-            GRAPH <${metaGraph}> {
-              ?privateEntity <http://dkg.io/ontology/privateMerkleRoot> ?privateRoot .
-            }
-          } ORDER BY ?privateEntity ?privateRoot LIMIT ${maxRows + 1}`, { source: 'agent.vmReconcile.swmFingerprint.privateRoots' });
-                if (privateRootRows.type !== 'bindings')
-                    return null;
-                if (isTooLarge(privateRootRows.bindings))
-                    return null;
-                const privateRoots = privateRootRows.bindings
-                    .map((row) => [
-                    String(row['privateEntity'] ?? ''),
-                    String(row['privateRoot'] ?? ''),
-                ].join('\0'))
-                    .sort();
-                parts.push([
-                    `meta:${namespace.metaGraph}`,
-                    `data:${namespace.dataGraph}`,
-                    `ops:${operations.length}`,
-                    `opHash:${digestRows(operations)}`,
-                    `dataTriples:${dataTriples.length}`,
-                    `dataHash:${digestRows(dataTriples)}`,
-                    `privateRoots:${privateRoots.length}`,
-                    `privateRootHash:${digestRows(privateRoots)}`,
-                ].join(';'));
-            }
-            // Catch writes into a newly-created/unregistered namespace that the
-            // current namespace enumeration cannot yet name. This process-local term
-            // complements (rather than replaces) the content fingerprint: after a
-            // restart the fingerprint remains the correctness gate while the counter
-            // restarts harmlessly.
-            const rootDataGraph = candidateNamespaces[0]?.dataGraph ?? '';
-            const swmSuffix = rootDataGraph.indexOf('/_shared_memory');
-            const graphPrefix = swmSuffix >= 0 ? `${rootDataGraph.slice(0, swmSuffix)}/` : rootDataGraph;
-            const writeRevision = asGraphWriteRevisionSource(this.store)?.getWriteRevision(graphPrefix);
-            // A remote mutation can still commit after this fingerprint's reads.
-            // Never turn such an in-flight/indeterminate observation into a stable
-            // negative-cache key.
-            if (writeRevision && !writeRevision.stable)
-                return null;
-            if (writeRevision)
-                parts.push(`writeGen:${writeRevision.generation}`);
-            return parts.join('|');
-        }
-        catch {
-            // Probe failures are not a stable SWM generation. Callers must not cache
-            // or preserve a negative-cache gate from this result.
-        }
-        return null;
-    }
-    vmReconcileSwmGenHasOperations(swmGen) {
-        return swmGen.split('|').some((part) => {
-            const match = /(?:^|;)ops:(\d+)(?:;|$)/.exec(part);
-            return match ? Number(match[1]) > 0 : false;
-        });
-    }
-    vmReconcileSwmGenSupportsDurableNegative(swmGen) {
-        // A changelog cursor covers every descendant graph mutation. The fallback
-        // fingerprint covers only the bare SWM bucket, so an operation whose data
-        // later lands in a per-KA child graph must fail open after restart.
-        return swmGen.startsWith('changelog:') || !this.vmReconcileSwmGenHasOperations(swmGen);
-    }
-    vmReconcileSwmGenContainsSnapshot(cachedSwmGen, currentSwmGen) {
-        return cachedSwmGen === currentSwmGen || cachedSwmGen.split('|').includes(currentSwmGen);
-    }
-    vmReconcileWorkspaceOperationPattern(candidateMetaGraphs) {
-        const branches = [];
-        for (const graph of candidateMetaGraphs) {
-            try {
-                branches.push(`{ GRAPH <${assertSafeIri(graph)}> {
-          ?op <http://dkg.io/ontology/rootEntity> ?root .
-          OPTIONAL { ?op <http://dkg.io/ontology/publishedAt> ?ts . }
-        } }`);
-            }
-            catch {
-                // Skip unsafe graph names instead of building a malformed query.
-            }
-        }
-        return branches.join(' UNION ');
-    }
-    deleteVmReconcileNegativeCacheEntry(cacheKey) {
-        const existing = this.vmReconcileNegativeCache.get(cacheKey);
-        this.markVmReconcileNegativeCacheHydrated(cacheKey, existing?.localCgId ?? cacheKey.slice(0, Math.max(0, cacheKey.indexOf('\0'))));
-        if (existing) {
-            this.vmReconcileNegativeCache.delete(cacheKey);
-            const keys = this.vmReconcileNegativeCacheKeysByCg.get(existing.localCgId);
-            if (keys) {
-                keys.delete(cacheKey);
-                if (keys.size === 0)
-                    this.vmReconcileNegativeCacheKeysByCg.delete(existing.localCgId);
-            }
-        }
-        void this.config.contextGraphSubscriptionStore?.deleteVmReconcileNegative?.(cacheKey).catch(() => {
-            // The in-memory invalidation remains authoritative for this process.
-        });
-    }
-    indexVmReconcileNegativeCacheEntry(localCgId, cacheKey) {
-        let keys = this.vmReconcileNegativeCacheKeysByCg.get(localCgId);
-        if (!keys) {
-            keys = new Set();
-            this.vmReconcileNegativeCacheKeysByCg.set(localCgId, keys);
-        }
-        keys.add(cacheKey);
-    }
-    markVmReconcileNegativeCacheHydrated(cacheKey, localCgId) {
-        // Access order keeps actively reused keys resident while old one-shot
-        // misses fall out. Eviction is fail-open: it only permits another durable
-        // lookup if the same key is encountered later.
-        this.vmReconcileNegativeCacheHydrated.delete(cacheKey);
-        this.vmReconcileNegativeCacheHydrated.set(cacheKey, localCgId);
-        while (this.vmReconcileNegativeCacheHydrated.size
-            > DKGAgentBase.VM_RECONCILE_CACHE_MAX_ENTRIES) {
-            const oldestKey = this.vmReconcileNegativeCacheHydrated.keys().next().value;
-            if (oldestKey === undefined)
-                break;
-            this.vmReconcileNegativeCacheHydrated.delete(oldestKey);
-        }
-    }
-    async shouldDeferVmReconcileByNegativeCache(cacheKey, localCgId) {
-        let cached = this.vmReconcileNegativeCache.get(cacheKey);
-        const durableStateAlreadyConsulted = this.vmReconcileNegativeCacheHydrated.has(cacheKey);
-        this.markVmReconcileNegativeCacheHydrated(cacheKey, localCgId);
-        if (!cached && !durableStateAlreadyConsulted) {
-            try {
-                const durable = await this.config.contextGraphSubscriptionStore
-                    ?.loadVmReconcileNegative?.(cacheKey);
-                const durablePeerTopology = durable
-                    ? isVmReconcilePeerTopology(durable.peerTopology)
-                        ? durable.peerTopology
-                        : parseLegacyVmReconcilePeerTopologyKey(durable.peerTopologyKey)
-                    : null;
-                const durableCleanMissPeerIds = durablePeerTopology
-                    ? parseVmReconcileCleanMissPeerIds(durable?.cleanMissPeerIds ?? [], durablePeerTopology)
-                    : null;
-                if (durable &&
-                    durable.cacheKey === cacheKey &&
-                    durable.localCgId === localCgId &&
-                    Number.isInteger(durable.failures) && durable.failures > 0 &&
-                    Number.isFinite(durable.nextRetryAt) &&
-                    typeof durable.swmGen === 'string' &&
-                    Array.isArray(durable.candidateNamespaces) &&
-                    durable.candidateNamespaces.every((item) => typeof item?.metaGraph === 'string' && typeof item?.dataGraph === 'string') &&
-                    durablePeerTopology !== null &&
-                    durableCleanMissPeerIds !== null) {
-                    if (!this.vmReconcileSwmGenSupportsDurableNegative(durable.swmGen)) {
-                        await this.config.contextGraphSubscriptionStore
-                            ?.deleteVmReconcileNegative?.(cacheKey);
-                    }
-                    else {
-                        cached = {
-                            localCgId: durable.localCgId,
-                            failures: durable.failures,
-                            nextRetryAt: durable.nextRetryAt,
-                            swmGen: durable.swmGen,
-                            candidateNamespaces: durable.candidateNamespaces,
-                            peerTopology: durablePeerTopology,
-                            cleanMissPeerIds: durableCleanMissPeerIds,
-                        };
-                        this.vmReconcileNegativeCache.set(cacheKey, cached);
-                        this.indexVmReconcileNegativeCacheEntry(localCgId, cacheKey);
-                    }
-                }
-            }
-            catch {
-                // Persistence is an accelerator only. Fail open to an authoritative scan.
-            }
-        }
-        if (!cached)
-            return false;
-        if (Date.now() >= cached.nextRetryAt)
-            return false;
-        try {
-            try {
-                await this.primeCatchupConnections();
-            }
-            catch {
-                // Best effort only; an unchanged connection view can still honor the
-                // cached miss until the backoff expires.
-            }
-            const currentPeerTopology = await this.vmReconcilePeerTopology(localCgId);
-            if (!canReuseVmReconcilePeerTopology({
-                topology: cached.peerTopology,
-                cleanMissPeerIds: cached.cleanMissPeerIds,
-            }, currentPeerTopology)) {
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                this.clearVmReconcileActiveFetchCooldown(localCgId);
-                return false;
-            }
-            const currentNamespaces = await this.collectVmReconcileSwmCandidateNamespacesBestEffort(localCgId);
-            const currentNamespaceKey = this.vmReconcileSwmNamespaceKey(currentNamespaces.namespaces);
-            const cachedNamespaceKey = this.vmReconcileSwmNamespaceKey(cached.candidateNamespaces);
-            if (currentNamespaceKey !== cachedNamespaceKey) {
-                if (!currentNamespaces.complete) {
-                    const currentSwmGen = await this.readVmReconcileSwmGen(currentNamespaces.namespaces);
-                    if (currentSwmGen === null) {
-                        this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                        return false;
-                    }
-                    if (!this.vmReconcileSwmGenContainsSnapshot(cached.swmGen, currentSwmGen)) {
-                        this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                        return false;
-                    }
-                    return true;
-                }
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                return false;
-            }
-            const pattern = this.vmReconcileWorkspaceOperationPattern(currentNamespaces.namespaces.map((namespace) => namespace.metaGraph));
-            if (!pattern)
-                return true;
-            const currentSwmGen = await this.readVmReconcileSwmGen(currentNamespaces.namespaces);
-            if (currentSwmGen === null) {
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                return false;
-            }
-            if (currentSwmGen !== cached.swmGen) {
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                return false;
-            }
-        }
-        catch {
-            // Unexpected validation failures leave the existing backoff in place;
-            // expected generation probe failures return null and clear the gate above.
-        }
-        return true;
-    }
-    recordVmReconcileNegativeCache(cacheKey, localCgId, state) {
-        if (state.swmGen === null) {
-            this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-            return;
-        }
-        this.pruneVmReconcileState();
-        const previous = this.vmReconcileNegativeCache.get(cacheKey);
-        const failures = (previous?.failures ?? 0) + 1;
-        const exponentialBackoff = Math.min(DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS, DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_BASE_MS * 2 ** Math.max(0, failures - 1));
-        const jitterSample = createHash('sha256')
-            .update(`${this.node.peerId.toString()}\0${cacheKey}\0${failures}`)
-            .digest()
-            .readUInt32BE(0) / 0x1_0000_0000;
-        const backoff = Math.min(DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS, Math.max(1, Math.round(exponentialBackoff * (0.8 + jitterSample * 0.4))));
-        getMetrics().storeRetryAttemptsTotal.add(1, {
-            scope: 'vm_reconcile',
-            reason: 'no_swm',
-            attempt: Math.min(failures, 16),
-        });
-        if (previous) {
-            // Replace in place without racing an asynchronous durable DELETE against
-            // the SAVE below. The record key/local CG are unchanged here.
-            this.vmReconcileNegativeCache.delete(cacheKey);
-            const keys = this.vmReconcileNegativeCacheKeysByCg.get(previous.localCgId);
-            keys?.delete(cacheKey);
-            if (keys?.size === 0)
-                this.vmReconcileNegativeCacheKeysByCg.delete(previous.localCgId);
-        }
-        const record = {
-            localCgId,
-            failures,
-            nextRetryAt: Date.now() + backoff,
-            swmGen: state.swmGen,
-            candidateNamespaces: state.candidateNamespaces,
-            peerTopology: state.peerTopology,
-            cleanMissPeerIds: state.cleanMissPeerIds,
-        };
-        this.vmReconcileNegativeCache.set(cacheKey, record);
-        this.markVmReconcileNegativeCacheHydrated(cacheKey, localCgId);
-        this.indexVmReconcileNegativeCacheEntry(localCgId, cacheKey);
-        const durableStore = this.config.contextGraphSubscriptionStore;
-        if (this.vmReconcileSwmGenSupportsDurableNegative(record.swmGen)) {
-            void durableStore?.saveVmReconcileNegative?.({
-                cacheKey,
-                localCgId: record.localCgId,
-                failures: record.failures,
-                nextRetryAt: record.nextRetryAt,
-                swmGen: record.swmGen,
-                candidateNamespaces: record.candidateNamespaces,
-                peerTopologyKey: encodeLegacyVmReconcilePeerTopologyKey(record.peerTopology),
-                peerTopology: record.peerTopology,
-                cleanMissPeerIds: record.cleanMissPeerIds,
-            }).catch(() => {
-                // Persistence is an accelerator only; the process-local gate still works.
-            });
-        }
-        else {
-            void durableStore?.deleteVmReconcileNegative?.(cacheKey).catch(() => {
-                // Fail open after restart even if best-effort cleanup cannot complete.
-            });
-        }
-        this.pruneVmReconcileState();
-    }
-    vmReconcileRotationNow() {
-        return performance.now();
-    }
-    vmReconcileRotationSlotKey(target) {
-        return `${target.localCgId}\0${target.onChainCgId}\0${target.ordinal}`;
-    }
-    clearVmReconcileRotationStateForSlot(localCgId, onChainCgId, ordinal) {
-        this.vmReconcileRotationState.delete(`${localCgId}\0${onChainCgId.toString()}\0${ordinal}`);
-    }
-    vmReconcileRotationFingerprint(target) {
-        return `${target.ual}\0${target.merkleRoot.toLowerCase()}`;
-    }
-    vmReconcileObservedCandidatePeerIds(localCgId) {
-        const curatorOrder = this.vmReconcileCuratorPeersByCg.get(localCgId) ?? [];
-        const libp2p = this.node?.libp2p;
-        const getConnections = libp2p?.getConnections;
-        if (typeof getConnections !== 'function') {
-            return curatorOrder.slice(0, DKGAgentBase.VM_RECONCILE_EXACT_ROSTER_MAX);
-        }
-        const peersById = new Map();
-        for (const connection of getConnections.call(libp2p)) {
-            const peer = connection.remotePeer;
-            const peerId = peer?.toString();
-            if (!peer || !peerId || peerId === this.peerId || peersById.has(peerId))
-                continue;
-            peersById.set(peerId, peer);
+        const peersById = new Map();
+        for (const connection of getConnections.call(libp2p)) {
+            const peer = connection.remotePeer;
+            const peerId = peer?.toString();
+            if (!peer || !peerId || peerId === this.peerId || peersById.has(peerId))
+                continue;
+            peersById.set(peerId, peer);
         }
         // `getConnections()` iteration order is transport state, not candidate
         // identity. Sort before tiering/capping so harmless connection reorder can
@@ -4244,11 +4517,26 @@ export class SwmHostModeMethods extends DKGAgentBase {
      * mutable transition so partial responses revoke affinity consistently.
      * Unavailable peers and the global considered-peer cap remain authoritative.
      */
-    selectVmReconcileExactCandidate(record, fallbackCandidatePeerIds, policy) {
+    selectVmReconcileExactCandidate(record, fallbackCandidatePeerIds, policy, binding) {
         const uncreditedCandidateOrder = record
             ? this.vmReconcileUncreditedCandidateOrder(record)
             : fallbackCandidatePeerIds;
-        return policy.selectNextCandidate(uncreditedCandidateOrder, DKGAgentBase.VM_RECONCILE_EXACT_PEER_MAX);
+        const preferredPeerId = binding
+            ? this.vmReconcilePublicCoreTransportPreferencePolicy.preferredPeer(binding.localCgId, binding.onChainCgId, uncreditedCandidateOrder)
+            : undefined;
+        const now = this.vmReconcileRotationNow();
+        const { order, heldOffPeerIds } = orderVmRecoveryCandidates({
+            candidatePeerIds: uncreditedCandidateOrder,
+            preferredPeerId,
+            streamPeerIds: binding?.experimentalStreamPeerIds,
+            lastAttemptedPeerId: record?.lastAttemptedPeerId,
+            hasSetback: (peerId) => binding !== undefined
+                && record?.streamSetbackPeerIds?.has(peerId) === true
+                && this.vmReconcileStreamSetbackPolicy.inSetbackStreak(binding.localCgId, peerId, now),
+            isHeldOff: (peerId) => binding !== undefined
+                && this.vmReconcileStreamSetbackPolicy.heldOff(binding.localCgId, peerId, now),
+        });
+        return policy.selectNextCandidate(order, DKGAgentBase.VM_RECONCILE_EXACT_PEER_MAX, heldOffPeerIds);
     }
     findVmReconcileRotationReplacement(requestingCgId) {
         if (this.vmReconcileRotationState.size < DKGAgentBase.VM_RECONCILE_CACHE_MAX_ENTRIES) {
@@ -4319,7 +4607,11 @@ export class SwmHostModeMethods extends DKGAgentBase {
             if (key.startsWith(prefix))
                 this.vmReconcileRotationState.delete(key);
         }
+        this.vmReconcileTransportBudgetPolicy.forgetContextGraph(localCgId);
+        this.vmReconcileStreamSetbackPolicy.forgetContextGraph(localCgId);
         this.vmReconcileRotationAdmissionCursorByCg.delete(localCgId);
+        this.vmReconcilePublicCoreTransportPreferencePolicy?.forgetContextGraph(localCgId);
+        existingVmRecoveryPreparation(this)?.discard(localCgId);
     }
     closeVmReconcileRotationState() {
         this.vmReconcileLifecycleController?.abort();
@@ -4330,10 +4622,22 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // without running the base constructor. Shutdown must remain best-effort
         // for that supported test seam and never mask later teardown failures.
         this.vmReconcileRotationState?.clear();
+        this.vmReconcileTransportBudgetPolicy?.clear();
+        this.vmReconcileStreamSetbackPolicy?.clear();
         this.vmReconcileRotationAdmissionCursorByCg?.clear();
         this.vmReconcileCuratorPeersByCg?.clear();
         this.vmReconcileCuratorPageCursorByCg?.clear();
         this.vmReconcileExactPeerCapabilities?.clear();
+        this.vmReconcilePublicCoreTransportPreferencePolicy?.clear();
+        this.vmRefreshQueue?.clear();
+        // Cancel speculative sizing reads and let shutdown wait for them to settle.
+        const preparation = existingVmRecoveryPreparation(this);
+        if (preparation && this.vmReconcilePhysicalRuns) {
+            trackVmReconcilePhysicalRun(this.vmReconcilePhysicalRuns, preparation.close());
+        }
+        else {
+            void preparation?.close();
+        }
     }
     openVmReconcileRotationState() {
         if (!this.vmReconcileLifecycleController || this.vmReconcileLifecycleController.signal.aborted) {
@@ -4360,6 +4664,8 @@ export class SwmHostModeMethods extends DKGAgentBase {
             return;
         if (peerId !== undefined) {
             capturedRecord.attemptedPeerIds.add(peerId);
+            // This attempt gave a verdict: an earlier setback with the peer is history.
+            capturedRecord.streamSetbackPeerIds?.delete(peerId);
             if (disposition === 'clean-absent')
                 capturedRecord.cleanAbsentPeerIds.add(peerId);
             // Preserve fairly accumulated proof progress while other targets share
@@ -4384,6 +4690,23 @@ export class SwmHostModeMethods extends DKGAgentBase {
         }
         this.touchVmReconcileRotationRecord(slotKey, capturedRecord);
     }
+    /**
+     * Hand a target its turn at `peerId` back after an attempt that ended
+     * without a verdict on the peer's data. The peer is uncredited again, so the
+     * cycle cannot complete, and so cannot back off, without asking it. Removing
+     * a mark is safe against any roster, which is why membership is not checked.
+     * The setback is noted on the target, for candidate selection to order by.
+     */
+    releaseVmReconcileRotationAttempt(target, peerId, capturedRecord) {
+        if (this.vmReconcileRotationClosed)
+            return;
+        const slotKey = this.vmReconcileRotationSlotKey(target);
+        if (this.vmReconcileRotationState.get(slotKey) !== capturedRecord)
+            return;
+        capturedRecord.attemptedPeerIds.delete(peerId);
+        (capturedRecord.streamSetbackPeerIds ??= new Set()).add(peerId);
+        this.touchVmReconcileRotationRecord(slotKey, capturedRecord);
+    }
     creditVmReconcileCleanAbsence(target, peerId, expectedCandidatePeerIds, capturedRecord) {
         this.settleVmReconcileRotationAttempt(target, peerId, 'clean-absent', expectedCandidatePeerIds, capturedRecord);
     }
@@ -4414,26 +4737,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         this.installVmReconcileActiveFetchCooldown(localCgId, now);
         return true;
     }
-    vmReconcileActiveFetchHadUsableResponse(result) {
-        if ((result.peersSucceeded ?? 0) > 0)
-            return true;
-        if ((result.sharedMemorySynced ?? 0) > 0)
-            return true;
-        const shared = result.diagnostics?.sharedMemory;
-        if (!shared)
-            return false;
-        return (shared.insertedDataTriples ?? 0) > 0
-            || (shared.insertedMetaTriples ?? 0) > 0
-            || (shared.checkpointAdvances ?? 0) > 0
-            || ((shared.completedPhases ?? 0) > 0 && (shared.resumedPhases ?? 0) > 0);
-    }
     pruneVmReconcileState(now = Date.now()) {
-        while (this.vmReconcileNegativeCache.size > DKGAgentBase.VM_RECONCILE_CACHE_MAX_ENTRIES) {
-            const oldestKey = this.vmReconcileNegativeCache.keys().next().value;
-            if (oldestKey === undefined)
-                break;
-            this.deleteVmReconcileNegativeCacheEntry(oldestKey);
-        }
         for (const [localCgId, cooldown] of this.vmReconcileFetchCooldowns) {
             if (now - cooldown.startedAt >= DKGAgentBase.VM_RECONCILE_SWEEP_INTERVAL_MS) {
                 this.clearVmReconcileActiveFetchCooldown(localCgId);
@@ -4492,22 +4796,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
         });
     }
     forceClearVmReconcileStateForContextGraph(localCgId, options = {}) {
-        const negativeCacheKeys = this.vmReconcileNegativeCacheKeysByCg.get(localCgId);
-        if (negativeCacheKeys) {
-            for (const cacheKey of Array.from(negativeCacheKeys)) {
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-            }
-        }
-        for (const [cacheKey, hydratedLocalCgId] of this.vmReconcileNegativeCacheHydrated) {
-            if (hydratedLocalCgId === localCgId) {
-                this.vmReconcileNegativeCacheHydrated.delete(cacheKey);
-            }
-        }
-        void this.config.contextGraphSubscriptionStore
-            ?.deleteVmReconcileNegativesForContextGraph?.(localCgId)
-            .catch(() => {
-            // Best-effort durable cleanup; generation checks still reject stale rows.
-        });
         this.reconcileCursors.delete(localCgId);
         if (options.includeSelectedCursor !== false
             && this.selectedVmReconcileCursors.delete(localCgId)) {
@@ -4520,6 +4808,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         this.vmReconcileCatchupPeerCursor.delete(localCgId);
         this.vmReconcileCatchupPeerOrder.delete(localCgId);
         this.clearRecentVmReconcileStateForContextGraph(localCgId);
+        this.vmRefreshQueue?.clearContextGraph(localCgId);
     }
     clearRecentVmReconcileStateForContextGraph(localCgId) {
         this.recentReconciledUals.deleteByPrefix(`${localCgId}\0`);
@@ -4595,97 +4884,120 @@ export class SwmHostModeMethods extends DKGAgentBase {
     }
     pruneVmReconcileCacheKeySiblings(cacheKey) {
         const prefix = this.vmReconcileCacheKeyPrefix(cacheKey);
-        for (const key of this.vmReconcileNegativeCache.keys()) {
-            if (key !== cacheKey && key.startsWith(prefix)) {
-                this.deleteVmReconcileNegativeCacheEntry(key);
-            }
-        }
         this.recentReconciledUals.deleteByPrefix(prefix, cacheKey);
     }
-    vmReconcileConnectedPeerCount() {
-        try {
-            const libp2p = this.node?.libp2p;
-            const getConnections = libp2p?.getConnections;
-            if (typeof getConnections !== 'function')
-                return 0;
-            const uniquePeers = new Set(getConnections.call(libp2p)
-                .map((connection) => connection.remotePeer?.toString())
-                .filter((peerId) => typeof peerId === 'string' && peerId.length > 0));
-            return uniquePeers.size;
-        }
-        catch {
-            return 0;
-        }
-    }
     /**
-     * Execute one already-admitted provider attempt. The caller owns
-     * roster/admission, packing, and provider affinity; this executor owns the
-     * exact request or cached legacy fallback, per-UAL chain revalidation, and
-     * rotation settlement.
+     * Execute one provider after connection/network readiness. The caller owns
+     * roster, packing, and provider affinity; local sync admission starts the
+     * physical attempt before rotation marks are installed. This executor owns
+     * exact or cached legacy work, per-UAL chain revalidation, and settlement.
      * Returns immutable evidence for the caller to merge. A stale lifecycle is
      * discriminated by whether the physical attempt had already been admitted;
      * only the pre-admission variant guarantees zero attempt side effects.
      */
     async executeVmRecoveryBatch(input) {
-        const { localCgId, onChainCgId, peerId, attempts, unavailablePeerIds, headBlock, signal, isRecoveryCurrent, revalidateTarget, ctx, } = input;
+        const { localCgId, onChainCgId, peerId, attempts, unavailablePeerIds, headBlock, signal, isRecoveryCurrent, revalidateTarget, ctx, exactRecoveryTransportMode = 'stream-preferred', legacyAttemptTimeoutMs, registeredPublicEvidence, phases, } = input;
         const unavailablePeerIdSet = new Set(unavailablePeerIds);
         // The caller's last guard can race an unsubscribe/rebind before this
         // executor begins. Do not retain attempt evidence or emit a fetch event
         // until this exact lifecycle has been re-proved at the ownership boundary.
         if (!isRecoveryCurrent())
             return { kind: 'not-started-stale' };
-        const useCachedLegacyFallback = this.vmReconcileExactFilterUnsupported(peerId);
+        const useCachedLegacyFallback = exactRecoveryTransportMode !== 'stream-required'
+            && this.vmReconcileExactFilterUnsupported(peerId);
         const handledOrdinals = [];
         const attemptedOrdinals = [];
         const outcomes = [];
-        for (const attempt of attempts) {
-            const batchTarget = attempt.entry.target;
-            handledOrdinals.push(batchTarget.ordinal);
-            attemptedOrdinals.push(batchTarget.ordinal);
-            if (attempt.installedRecord) {
-                attempt.installedRecord.lastAttemptedPeerId = peerId;
-                attempt.installedRecord.attemptedPeerIds.add(peerId);
-                attempt.installedRecord.collectionDeadlineAt = this.vmReconcileRotationNow()
-                    + DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS;
-                this.touchVmReconcileRotationRecord(this.vmReconcileRotationSlotKey(batchTarget), attempt.installedRecord);
+        let workStarted = false;
+        const onWorkStarted = () => {
+            if (workStarted || !isRecoveryCurrent())
+                return;
+            workStarted = true;
+            for (const attempt of attempts) {
+                const batchTarget = attempt.entry.target;
+                this.vmReconcileTransportBudgetPolicy.recordAdmitted(batchTarget, peerId);
+                handledOrdinals.push(batchTarget.ordinal);
+                attemptedOrdinals.push(batchTarget.ordinal);
+                const record = attempt.installedRecord;
+                const slotKey = this.vmReconcileRotationSlotKey(batchTarget);
+                if (record && this.vmReconcileRotationState.get(slotKey) === record
+                    && record.fingerprint === this.vmReconcileRotationFingerprint(batchTarget)) {
+                    record.lastAttemptedPeerId = peerId;
+                    record.attemptedPeerIds.add(peerId);
+                    record.collectionDeadlineAt = this.vmReconcileRotationNow()
+                        + DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS;
+                    this.touchVmReconcileRotationRecord(slotKey, record);
+                }
+                this.emitReplication({
+                    contextGraphId: localCgId,
+                    onChainCgId: onChainCgId.toString(),
+                    action: 'fetch',
+                    ordinal: batchTarget.ordinal,
+                    kaId: batchTarget.kaId,
+                    ual: batchTarget.ual,
+                    detail: useCachedLegacyFallback
+                        ? 'legacy-sync'
+                        : attempts.length > 1 ? 'exact-asset-batch' : 'exact-asset',
+                });
             }
-            this.emitReplication({
-                contextGraphId: localCgId,
-                onChainCgId: onChainCgId.toString(),
-                action: 'fetch',
-                ordinal: batchTarget.ordinal,
-                kaId: batchTarget.kaId,
-                ual: batchTarget.ual,
-                detail: useCachedLegacyFallback
-                    ? 'legacy-sync'
-                    : attempts.length > 1 ? 'exact-asset-batch' : 'exact-asset',
-            });
-        }
+        };
         let disposition = 'incomplete';
+        let streamOutcome;
+        let localAdmissionDeferred = false;
+        const legacyAttemptStartedAt = Date.now();
+        const remainingLegacyAttemptMs = () => legacyAttemptTimeoutMs === undefined
+            ? undefined
+            : Math.max(0, legacyAttemptTimeoutMs - (Date.now() - legacyAttemptStartedAt));
         const runLegacyFallback = async () => {
+            const remainingMs = remainingLegacyAttemptMs();
+            // Both the exact-filter probe and a full-scan fallback belong to one
+            // provider turn. Do not grant a fresh long deadline after the probe has
+            // already spent the bounded legacy window.
+            if (remainingMs !== undefined && remainingMs < SYNC_MIN_GRAPH_BUDGET_MS) {
+                this.log.info(ctx, `VM legacy fallback for "${localCgId}" from ${peerId.slice(-8)} skipped: attempt budget exhausted`);
+                return;
+            }
             try {
                 const fallback = await this.runLegacyDurableSyncDetailed(ctx, peerId, [localCgId], undefined, undefined, undefined, {
                     stopOnBackoffWorthyFailure: true,
-                    priority: 1_000,
+                    priority: VM_RECOVERY_SYNC_PRIORITY,
                     source: 'vm-recovery',
+                    onWorkStarted,
                     signal,
                     isCurrent: isRecoveryCurrent,
+                    ...(remainingMs === undefined ? {} : { totalTimeoutMs: remainingMs }),
                 });
+                if (fallback.admission === 'work-started')
+                    onWorkStarted();
+                // An admitted exact request retains its attempt through a refused
+                // fallback. Only the original never-started operation can defer.
+                localAdmissionDeferred = !workStarted && fallback.admission === 'local-admission-deferred';
                 this.log.info(ctx, `VM legacy fallback for "${localCgId}" from ${peerId.slice(-8)}: fetched=${fallback.result.fetchedDataTriples + fallback.result.fetchedMetaTriples} inserted=${fallback.result.insertedTriples} failed=${fallback.result.failedPeers + fallback.result.failedPhases}`);
             }
             catch (fallbackError) {
                 this.log.info(ctx, `VM legacy fallback for "${localCgId}" from ${peerId.slice(-8)} failed: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
             }
         };
+        const exchangeInterval = phases?.begin();
         try {
             if (useCachedLegacyFallback) {
                 await runLegacyFallback();
             }
             else {
-                const detailed = await this.syncExactKnowledgeAssetsFromPeerDetailed(peerId, localCgId, attempts.map(({ entry }) => entry.target.ual), { signal, isCurrent: isRecoveryCurrent });
+                const detailed = await this.syncExactKnowledgeAssetsFromPeerDetailed(peerId, localCgId, attempts.map(({ entry }) => entry.target.ual), {
+                    signal, isCurrent: isRecoveryCurrent, onWorkStarted, exactRecoveryTransportMode,
+                    ...(legacyAttemptTimeoutMs === undefined ? {} : { totalTimeoutMs: legacyAttemptTimeoutMs }),
+                    ...(registeredPublicEvidence ? { registeredPublicEvidence } : {}),
+                });
                 const { result } = detailed;
                 disposition = detailed.disposition;
-                if (detailed.responderCapability === 'legacy-filter-unsupported') {
+                streamOutcome = detailed.streamOutcome;
+                // A fresh capability response is physical peer evidence even when
+                // its later ordinary fallback cannot acquire local capacity.
+                if (detailed.admission === 'work-started' || detailed.responderCapability !== undefined)
+                    onWorkStarted();
+                localAdmissionDeferred = !workStarted && detailed.admission === 'local-admission-deferred';
+                if (exactRecoveryTransportMode !== 'stream-required' && detailed.responderCapability === 'legacy-filter-unsupported') {
                     this.rememberVmReconcileExactFilterUnsupported(peerId);
                     if (isRecoveryCurrent() && disposition === 'incomplete') {
                         await runLegacyFallback();
@@ -4697,18 +5009,44 @@ export class SwmHostModeMethods extends DKGAgentBase {
         catch (error) {
             this.log.info(ctx, `VM exact fetch for "${localCgId}" from ${peerId.slice(-8)} failed: ${error instanceof Error ? error.message : String(error)}`);
         }
+        if (phases && exchangeInterval)
+            phases.chargeSince('exchange', exchangeInterval.startedAt, exchangeInterval.before);
         if (!isRecoveryCurrent())
-            return { kind: 'stale-after-attempt' };
+            return { kind: workStarted ? 'stale-after-attempt' : 'not-started-stale' };
+        if (localAdmissionDeferred)
+            return { kind: 'local-admission-deferred' };
+        // A stream that answered busy or broke says nothing about the peer's data.
+        // The policy decides whether the targets still pending keep their turn at it.
+        let providerTurnKept = false;
+        if (workStarted && streamOutcome !== undefined) {
+            if (streamOutcome === 'complete') {
+                this.vmReconcileStreamSetbackPolicy.recordServed(localCgId, peerId, this.vmReconcileRotationNow());
+            }
+            else {
+                const setback = this.vmReconcileStreamSetbackPolicy.recordSetback(localCgId, peerId, streamOutcome, this.vmReconcileRotationNow());
+                providerTurnKept = setback.keepsTurn;
+                observeVmRecoveryTiming(() => this.log.info(ctx, `VM exact recovery stream setback for "${localCgId}" from ${peerId.slice(-8)}: `
+                    + `kind=${streamOutcome} assets=${attempts.length} keepsTurn=${setback.keepsTurn ? 1 : 0} `
+                    + `holdOffMs=${setback.holdOffMs}`));
+            }
+        }
         const perUalDispositions = new Map();
-        for (const attempt of attempts) {
+        // The batch's targets are re-verified side by side, with the scan's own
+        // bound, so their chain reads can leave in one request. Like the scan, a
+        // target that throws stops the ones not yet started and the batch rejects
+        // only once the ones in flight have finished: nothing here outlives the
+        // pass. They are settled in order below: each step still sees the rotation
+        // state its predecessor left.
+        const revalidateBatch = () => mapWithConcurrencyDrained(attempts, DKGAgentBase.VM_RECONCILE_ORDINAL_CONCURRENCY, (attempt) => this.reconcileChainOrdinal(localCgId, onChainCgId, attempt.entry.target.ordinal, headBlock, {
+            isTargetCurrent: isRecoveryCurrent,
+            revalidateTarget,
+        }));
+        const revalidated = await (phases ? phases.measure('post-fetch', revalidateBatch) : revalidateBatch());
+        if (!isRecoveryCurrent())
+            return { kind: 'stale-after-attempt' };
+        for (const [attemptIndex, attempt] of attempts.entries()) {
             const batchTarget = attempt.entry.target;
-            const outcome = await this.reconcileChainOrdinal(localCgId, onChainCgId, batchTarget.ordinal, headBlock, {
-                isTargetCurrent: isRecoveryCurrent,
-                revalidateTarget,
-                deferActiveFetch: true,
-            });
-            if (!isRecoveryCurrent())
-                return { kind: 'stale-after-attempt' };
+            const outcome = revalidated[attemptIndex];
             outcomes.push([batchTarget.ordinal, outcome]);
             const perTargetDisposition = (outcome.status === 'reconciled' || outcome.status === 'already')
                 ? 'found'
@@ -4717,6 +5055,8 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     : 'incomplete';
             perUalDispositions.set(batchTarget.ual, perTargetDisposition);
             if (outcome.status === 'pending' && outcome.recovery) {
+                if (!workStarted)
+                    continue;
                 const batchRecord = attempt.installedRecord;
                 if (!batchRecord || this.vmReconcileRotationClosed)
                     continue;
@@ -4724,10 +5064,14 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     !== batchRecord)
                     continue;
                 const candidateMembershipAfter = this.vmReconcileObservedCandidatePeerIds(localCgId);
+                if (providerTurnKept) {
+                    this.releaseVmReconcileRotationAttempt(batchTarget, peerId, batchRecord);
+                }
                 if (!this.vmReconcilePeerMembershipMatches(batchRecord.candidatePeerIds, candidateMembershipAfter)) {
                     this.prepareVmReconcileRotationTarget(outcome.recovery, candidateMembershipAfter, this.vmReconcileRotationNow());
                 }
-                else if (this.vmReconcileRecoveryTargetMatches(batchTarget, outcome.recovery)) {
+                else if (!providerTurnKept
+                    && this.vmReconcileRecoveryTargetMatches(batchTarget, outcome.recovery)) {
                     this.settleVmReconcileRotationAttempt(batchTarget, peerId, perTargetDisposition, attempt.candidatePeerIds, batchRecord, unavailablePeerIdSet);
                 }
             }
@@ -4742,6 +5086,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             attemptedOrdinals,
             providerDisposition: disposition,
             perUalDispositions: [...perUalDispositions],
+            providerTurnKept,
         };
     }
     /**
@@ -4757,6 +5102,26 @@ export class SwmHostModeMethods extends DKGAgentBase {
             && this.vmReconcileLifecycleGeneration === rotationGeneration
             && isTargetCurrent();
         const ctx = createOperationContext('system');
+        // Advisory sizing preparation (opt-in, default off). Created lazily and
+        // owned by this host; every hint is bound to this exact recovery operation.
+        const readUpdateContextForPreparation = this.chain.getKnowledgeAssetUpdateContext;
+        const experimentPolicy = resolveVmRecoveryExperimentPolicy(this.config.vmRecoveryPrefetchEnabled, existingVmRecoveryPreparation(this)?.limits);
+        const preparation = experimentPolicy.prefetchEnabled
+            ? vmRecoveryPreparationFor(this, typeof readUpdateContextForPreparation === 'function'
+                ? { readUpdateContext: (id, readOptions) => readUpdateContextForPreparation.call(this.chain, id, readOptions) }
+                : null)
+            : undefined;
+        const preparationScope = {
+            localCgId,
+            onChainCgId,
+            generation: rotationGeneration,
+            ...(signal ? { signal } : {}),
+            isCurrent: isRecoveryCurrent,
+        };
+        const transportPreparation = preparation
+            ? new VmRecoveryTransportPreparation(preparation, preparationScope) : undefined;
+        const timing = new VmRecoveryTimingObserver(localCgId, (message) => this.log.info(ctx, message));
+        const phases = timing.phases;
         const noRecovery = (continuationOrdinal, cooldownOnly = false) => ({
             outcomes: new Map(),
             attemptedOrdinals: [],
@@ -4889,7 +5254,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             ...(this.vmReconcileCuratorPeersByCg.get(localCgId) ?? []),
         ];
         const curatorPageCursor = this.vmReconcileCuratorPageCursorByCg.get(localCgId);
-        const curatorResolution = await this.resolveCuratorPeerIdsForCg(localCgId, {
+        const curatorResolution = await phases.measure('roster', () => this.resolveCuratorPeerIdsForCg(localCgId, {
             maxPeerIds: DKGAgentBase.VM_RECONCILE_EXACT_ROSTER_MAX,
             // Once overflow is proven, expose exactly one new ordered peer per pass.
             // One target can spend only one peer attempt, so advancing by more would
@@ -4904,7 +5269,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             curatorIsLocal: false,
             legacyTripleResolved: false,
             lookupFailed: true,
-        }));
+        })));
         if (!isRecoveryCurrent())
             return staleRecovery();
         const allResolvedCuratorPeerIds = [...new Set(curatorResolution.peerIds
@@ -4950,7 +5315,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         let legacyPreferredPeerId;
         if (resolutionSucceeded && !curatorResolution.curatorIsLocal
             && resolvedCuratorPeerIds.length === 0) {
-            legacyPreferredPeerId = await this.resolvePreferredSyncPeerId(localCgId);
+            legacyPreferredPeerId = await phases.measure('roster', () => this.resolvePreferredSyncPeerId(localCgId));
         }
         if (!isRecoveryCurrent())
             return staleRecovery();
@@ -4986,9 +5351,18 @@ export class SwmHostModeMethods extends DKGAgentBase {
             this.vmReconcileCuratorPageCursorByCg.delete(localCgId);
             this.vmReconcileCuratorPageCursorByCg.set(localCgId, legacyPagination.nextPageAfterPeerId);
         }
-        if (!curatorResolution.curatorIsLocal && curatorPeerIds.length > 0) {
-            this.vmReconcileCuratorPeersByCg.delete(localCgId);
-            this.vmReconcileCuratorPeersByCg.set(localCgId, curatorPeerIds);
+        if (!curatorResolution.curatorIsLocal) {
+            if (curatorPeerIds.length > 0) {
+                this.vmReconcileCuratorPeersByCg.delete(localCgId);
+                this.vmReconcileCuratorPeersByCg.set(localCgId, curatorPeerIds);
+            }
+            else {
+                // Without the durable phonebook an empty curator tier usually means
+                // the owner's profile was never fetched, and this pass can only ask
+                // peers it is already connected to. One bounded phonebook fetch serves
+                // every graph; its completion re-schedules this graph's recovery.
+                this.requestOnDemandAgentsPhonebook(localCgId, 'vm-reconcile');
+            }
         }
         this.pruneVmReconcileState();
         const connectedByPeerId = new Map(this.node.libp2p.getConnections()
@@ -4997,6 +5371,79 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // Curator resolution may connect a missing peer, but it must not substitute
         // a different ranking algorithm and invalidate an otherwise stable roster.
         const orderedPeerIds = this.vmReconcileObservedCandidatePeerIds(localCgId);
+        // Only an explicit experimental run may reorder these existing capped
+        // transport candidates. The proof roster and every target's independent
+        // attempted/absence credits stay unchanged. Identify does not prove data.
+        const experimentalStreamPeerIds = new Set();
+        // Observation only: why this pass did or did not choose the stream wire.
+        let streamAdvertisedCount = 0;
+        const advertisedStreamPeers = new Set();
+        // The registered-public answer that gates the stream wire. Retry eligibility, the wire
+        // choice and the log label all derive from this one typed observation.
+        const passAuthority = new VmRecoveryPassAuthority(undefined, undefined, experimentPolicy.authorityRetry);
+        const readRegisteredPublicAuthority = async () => {
+            await phases.measure('authority', () => passAuthority.read(() => this.resolveRegisteredContextGraphAuthority(localCgId, {
+                authorityReadMode: 'finalized-index-or-live', signal,
+            })));
+            if (passAuthority.isPublic && isRecoveryCurrent()) {
+                for (const advertisedPeerId of advertisedStreamPeers)
+                    experimentalStreamPeerIds.add(advertisedPeerId);
+            }
+        };
+        const prepareThisPassTargets = () => {
+            if (!experimentPolicy.prefetchEnabled || orderedPeerIds.length === 0)
+                return;
+            // The planner sizes this pass's own targets as soon as a provider is chosen.
+            // Start that early, but never ahead of the registered-authority read that gates
+            // the wire: a miss there costs far more than the sizing it would overlap. The
+            // first target keeps its own live read (a probe sizes its single asset itself),
+            // so preparing never adds a read the unprepared path would not make. Pure
+            // metadata: nothing is marked handled or attempted.
+            transportPreparation?.preparePass(currentTargets
+                .slice(1)
+                .map((candidate) => ({ kaId: candidate.kaId })));
+        };
+        if (resolveExactBatchStreamEnabled()) {
+            const transportInterval = phases.begin();
+            const advertised = await Promise.all(orderedPeerIds
+                .filter((peerId) => connectedByPeerId.has(peerId)
+                && this.peerCapabilityRegistry.supportsCore(peerId)
+                && !exactBatchStreamUnsupported(this, peerId, this.getSyncReconcilerConnectionKey(peerId), Date.now(), this.captureExperimentalExactBatchRefusalScope(localCgId)))
+                .map(async (peerId) => {
+                try {
+                    return (await this.getPeerProtocols(peerId)).includes(EXACT_BATCH_STREAM_PROTOCOL) ? peerId : undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            }));
+            phases.chargeSince('transport', transportInterval.startedAt, transportInterval.before);
+            streamAdvertisedCount = advertised.filter((peerId) => peerId !== undefined).length;
+            if (streamAdvertisedCount > 0) {
+                for (const advertisedPeerId of advertised) {
+                    if (advertisedPeerId !== undefined)
+                        advertisedStreamPeers.add(advertisedPeerId);
+                }
+                await readRegisteredPublicAuthority();
+                if (!isRecoveryCurrent())
+                    return staleRecovery();
+                prepareThisPassTargets();
+                if (experimentPolicy.authorityRetry.kind === 'spaced' && passAuthority.missed) {
+                    // A miss here is usually the shared local request budget, not the graph: the
+                    // read's detached resolution keeps warming the projection cache after its
+                    // deadline. Give it a short, bounded moment and ask once more before the
+                    // pass commits to the legacy singleton wire for every provider it tries.
+                    const retry = await phases.measure('authority', () => passAuthority.waitForMissRetry(signal));
+                    if (!isRecoveryCurrent())
+                        return staleRecovery();
+                    if (retry)
+                        await readRegisteredPublicAuthority();
+                    if (!isRecoveryCurrent())
+                        return staleRecovery();
+                }
+            }
+        }
+        prepareThisPassTargets();
         // Curator preparation may have grown or shrunk the connected candidate
         // set. Re-evaluate every target against that observed change. Any roster
         // change breaks backoff and starts a fresh proof cycle.
@@ -5062,6 +5509,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         const providerPolicy = new VmRecoveryProviderPolicy();
         const handledBatchOrdinals = new Set();
         let recoveryWorkRan = false;
+        let localAdmissionDeferred = false;
         for (let eligibleIndex = 0; eligibleIndex < eligible.length; eligibleIndex += 1) {
             if (!isRecoveryCurrent())
                 break;
@@ -5069,6 +5517,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             const { target } = entry;
             if (handledBatchOrdinals.has(target.ordinal))
                 continue;
+            const batchTiming = timing.beginBatch();
             const record = entry.prepared.record;
             const installedRecord = record
                 && this.vmReconcileRotationState.get(this.vmReconcileRotationSlotKey(target)) === record
@@ -5083,21 +5532,27 @@ export class SwmHostModeMethods extends DKGAgentBase {
             // uncredited, but consume this target's turn so another missing KA gets
             // the next physical peer slot in the same bounded pass.
             let peerId;
-            const candidatePeerId = this.selectVmReconcileExactCandidate(installedRecord, orderedPeerIds, providerPolicy);
+            if (advertisedStreamPeers.size > 0
+                && passAuthority.retryDue()) {
+                // One pass can try several providers over minutes, and every wire choice below
+                // follows this single registered-public observation. A transient miss at pass
+                // start (the read shares a saturated local request budget; its detached
+                // resolution keeps warming the projection cache) would otherwise pin every
+                // later provider of the pass to the legacy singleton wire. Read it again, at
+                // most once per interval, before choosing the next provider.
+                await readRegisteredPublicAuthority();
+                if (!isRecoveryCurrent())
+                    return staleRecovery();
+            }
+            const candidatePeerId = this.selectVmReconcileExactCandidate(installedRecord, orderedPeerIds, providerPolicy, { localCgId, onChainCgId: expectedOnChainCgId, experimentalStreamPeerIds });
+            // One policy capture owns every later transition and token fence.
+            const preferenceAttempt = this.vmReconcilePublicCoreTransportPreferencePolicy.capture(localCgId, expectedOnChainCgId, orderedPeerIds);
             if (candidatePeerId) {
-                attemptedOrdinals.add(target.ordinal);
-                if (installedRecord) {
-                    installedRecord.lastAttemptedPeerId = candidatePeerId;
-                    installedRecord.attemptedPeerIds.add(candidatePeerId);
-                    installedRecord.collectionDeadlineAt = this.vmReconcileRotationNow()
-                        + DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS;
-                    this.touchVmReconcileRotationRecord(this.vmReconcileRotationSlotKey(target), installedRecord);
-                }
                 let connectedPeer = connectedByPeerId.get(candidatePeerId);
                 if (!connectedPeer) {
-                    await this.ensurePeerConnected(candidatePeerId, { signal }).catch((error) => {
+                    await phases.measure('peer-ready', () => this.ensurePeerConnected(candidatePeerId, { signal }).catch((error) => {
                         this.log.info(ctx, `VM exact fetch could not connect candidate peer ${candidatePeerId.slice(-8)}: ${error instanceof Error ? error.message : String(error)}`);
-                    });
+                    }));
                     if (!isRecoveryCurrent())
                         return staleRecovery();
                     const connection = this.node.libp2p.getConnections()
@@ -5108,7 +5563,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 }
                 recoveryWorkRan = true;
                 const protocolReady = connectedPeer
-                    ? await this.waitForSyncProtocol(connectedPeer, signal)
+                    ? await phases.measure('peer-ready', () => this.waitForSyncProtocol(connectedPeer, signal))
                     : false;
                 if (!isRecoveryCurrent())
                     return staleRecovery();
@@ -5119,7 +5574,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     // Network boundary: a merely-connected peer is not necessarily
                     // admitted to this DKG network. Never send an authenticated exact
                     // request to an unverified or rejected peer.
-                    const peerAdmitted = await this.ensurePeerAdmittedForRecovery(candidatePeerId, ctx, 'VM exact fetch', signal);
+                    const peerAdmitted = await phases.measure('peer-ready', () => this.ensurePeerAdmittedForRecovery(candidatePeerId, ctx, 'VM exact fetch', signal));
                     if (!isRecoveryCurrent())
                         return staleRecovery();
                     if (!peerAdmitted)
@@ -5129,25 +5584,41 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 }
             }
             if (!peerId) {
+                if (candidatePeerId) {
+                    this.vmReconcilePublicCoreTransportPreferencePolicy.revoke(preferenceAttempt, candidatePeerId);
+                }
+                // A failed connection/protocol/network-admission probe still consumes
+                // its bounded provider turn. A ready peer is marked only by the exact
+                // executor after local sync capacity admits its physical work.
+                if (candidatePeerId) {
+                    attemptedOrdinals.add(target.ordinal);
+                    if (installedRecord) {
+                        installedRecord.lastAttemptedPeerId = candidatePeerId;
+                        installedRecord.attemptedPeerIds.add(candidatePeerId);
+                        installedRecord.collectionDeadlineAt = this.vmReconcileRotationNow()
+                            + DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS;
+                        this.touchVmReconcileRotationRecord(this.vmReconcileRotationSlotKey(target), installedRecord);
+                    }
+                }
                 if (installedRecord) {
                     this.settleVmReconcileRotationAttempt(target, undefined, 'incomplete', candidatePeerIds, installedRecord, providerPolicy.unavailablePeerIds());
                 }
                 continue;
             }
+            const carriedHolder = this.vmReconcilePublicCoreTransportPreferencePolicy.canReuse(preferenceAttempt, peerId, candidatePeerIds);
+            if (carriedHolder)
+                providerPolicy.seedProvenHolder(peerId);
             const providerAttempt = providerPolicy.beginAttempt(peerId);
             if (!providerAttempt)
                 continue;
-            let batchAttempts = [{
-                    entry,
-                    installedRecord,
-                    candidatePeerIds,
-                }];
-            // The first exact request to a peer remains a single-KA probe. Once that
-            // probe has proved the peer is a holder, pack a stable compatible prefix
-            // by authoritative size hints. Unknown footprints stay singleton; the
-            // exact-sync protocol's ten-UAL cap remains the hard upper bound.
-            if (providerAttempt.kind === 'proven-holder-reuse') {
-                const compatible = [];
+            const admittedConnectionKey = this.getSyncReconcilerConnectionKey(peerId);
+            // Choose the admitted singleton probe or rotation-compatible holder
+            // prefix before sizing; one pipeline owns its selection and wire mode.
+            const candidateAttempts = [];
+            if (providerAttempt.kind === 'probe') {
+                candidateAttempts.push({ entry, installedRecord, candidatePeerIds });
+            }
+            else {
                 for (let candidateIndex = eligibleIndex; candidateIndex < eligible.length; candidateIndex += 1) {
                     const candidateEntry = eligible[candidateIndex];
                     const candidateTarget = candidateEntry.target;
@@ -5158,8 +5629,8 @@ export class SwmHostModeMethods extends DKGAgentBase {
                         && this.vmReconcileRotationState.get(this.vmReconcileRotationSlotKey(candidateTarget)) === candidateRecord
                         ? candidateRecord
                         : undefined;
-                    // The current target was selected and marked attempted before the
-                    // connection/admission boundary. Later candidates must still prove
+                    // The current target already passed connection/network admission.
+                    // Later candidates must still prove
                     // this peer remains uncredited in their independent rotation record.
                     const peerEligible = candidateIndex === eligibleIndex
                         || (candidateInstalledRecord
@@ -5167,7 +5638,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                             : orderedPeerIds.includes(peerId));
                     if (!peerEligible)
                         break;
-                    compatible.push({
+                    candidateAttempts.push({
                         entry: candidateEntry,
                         installedRecord: candidateInstalledRecord,
                         candidatePeerIds: candidateInstalledRecord
@@ -5175,53 +5646,85 @@ export class SwmHostModeMethods extends DKGAgentBase {
                             : orderedPeerIds,
                     });
                 }
-                // Only candidates that survived rotation/admission are sized. Keeping
-                // this hint local to the planner avoids broadening the canonical chain
-                // ordinal target and does not waste bounded RPC reads on ineligible
-                // prefixes. Missing/failed hints remain conservative singletons.
-                const readVmRecoveryUpdateContext = this.chain.getKnowledgeAssetUpdateContext;
-                const sizedCandidates = await enrichVmRecoveryFootprints(compatible.map((attempt) => ({
-                    attempt,
-                    kaId: attempt.entry.target.kaId,
-                })), onChainCgId, {
-                    resolvePublicAccess: async (contextGraphId) => (await withRpcUsageSite(CG_AUTH_RPC_SITES.vmSizing, 
-                    // Sizing a recovery batch: this decides how much to READ, not
-                    // who may. A bound stale by one index tick changes a batch
-                    // size, and the next pass corrects it. Inert unless the
-                    // operator enables `chain.boundedAuthorityReads`.
-                    () => this.readLiveOnChainAccessPolicy(contextGraphId.toString(), ctx, { freshness: 'bounded' }))) === 0,
-                    sizing: typeof readVmRecoveryUpdateContext === 'function'
-                        ? {
-                            readUpdateContext: (kaId, readOptions) => readVmRecoveryUpdateContext.call(this.chain, kaId, readOptions),
-                        }
-                        : null,
-                }, {
-                    maxContextReads: MAX_EXACT_SYNC_ASSETS,
-                    signal,
-                    isCurrent: isRecoveryCurrent,
-                });
-                if (!isRecoveryCurrent())
-                    return noRecovery();
-                const plannableTargets = sizedCandidates.map(({ attempt, recoveryFootprint }) => ({
-                    attempt,
-                    recoveryFootprint,
-                }));
-                const plan = planVmRecoveryMicrobatch(plannableTargets, VM_EXACT_MICROBATCH_LIMITS, (plannedTargets) => Buffer.byteLength(encodeExactAssetUals(plannedTargets.map(({ attempt }) => attempt.entry.target.ual)), 'utf8'));
-                if (plan.targets.length === 0) {
-                    this.log.warn(ctx, `VM exact recovery selector for "${localCgId}" exceeds the executor cap; `
-                        + `ordinal=${target.ordinal} selectorCap=${VM_EXACT_MICROBATCH_LIMITS.maxSelectorBytes}`);
-                    if (installedRecord) {
-                        this.settleVmReconcileRotationAttempt(target, undefined, 'incomplete', candidatePeerIds, installedRecord, providerPolicy.unavailablePeerIds());
-                    }
-                    providerPolicy.finishAttempt(providerAttempt, 'incomplete', new Map([[target.ual, 'incomplete']]));
-                    continue;
+            }
+            const streamEligibleProvider = passAuthority.isPublic && experimentalStreamPeerIds.has(peerId)
+                && !exactBatchStreamUnsupported(this, peerId, admittedConnectionKey, Date.now(), this.captureExperimentalExactBatchRefusalScope(localCgId));
+            let transportPlan;
+            transportPlan = await phases.measure('sizing', () => planVmRecoveryTransport({
+                candidates: candidateAttempts.map(attempt => ({
+                    attempt, kaId: attempt.entry.target.kaId, assetUal: attempt.entry.target.ual,
+                })),
+                providerAttemptKind: providerAttempt.kind, onChainCgId,
+                streamEligible: streamEligibleProvider, registeredPublicAccess: passAuthority.isPublic,
+                legacyAttemptTimeoutMs: this.vmReconcileTransportBudgetPolicy.timeoutFor({
+                    target, peerId, providerAttemptKind: providerAttempt.kind,
+                    registeredPublicAccess: passAuthority.isPublic,
+                    competingStreamAvailable: experimentalStreamPeerIds.size > 0
+                        && !experimentalStreamPeerIds.has(peerId),
+                    streamEligible: streamEligibleProvider,
+                }),
+                signal, isCurrent: isRecoveryCurrent,
+                observeSizing: batchTiming.observeSizing,
+                // Start reads in candidate order with a small bound so each read's
+                // deadline measures its own round trip, not its wait in the local
+                // RPC governor behind earlier candidates.
+                ...experimentPolicy.sizing,
+                ...(experimentPolicy.prefetchEnabled ? {
+                    probeRemainder: eligible.slice(eligibleIndex + 1)
+                        .filter(candidate => !handledBatchOrdinals.has(candidate.target.ordinal))
+                        .map(candidate => ({ kaId: candidate.target.kaId })),
+                } : {}),
+            }, {
+                createSizingReader: () => {
+                    const readContext = this.chain.getKnowledgeAssetUpdateContext;
+                    return typeof readContext === 'function'
+                        ? { readUpdateContext: (kaId, readOptions) => readContext.call(this.chain, kaId, readOptions) }
+                        : null;
+                },
+                resolvePublicAccess: async (contextGraphId) => (await withRpcUsageSite(CG_AUTH_RPC_SITES.vmSizing, 
+                // This bounded observation controls soft sizing only. Canonical
+                // root/version/binding authority is still checked per asset.
+                () => this.readLiveOnChainAccessPolicy(contextGraphId.toString(), ctx, { freshness: 'bounded' }))) === 0,
+                preparation: transportPreparation,
+            }));
+            if (!isRecoveryCurrent())
+                return providerAttempt.kind === 'probe' ? staleRecovery() : noRecovery();
+            const { attempts: batchAttempts, transportMode: exactRecoveryTransportMode, publicAccessEvidence: publicRecoveryAccessVerified, packing, legacyAttemptTimeoutMs, } = transportPlan;
+            if (batchAttempts.length === 0) {
+                this.vmReconcilePublicCoreTransportPreferencePolicy.revoke(preferenceAttempt, peerId);
+                this.log.warn(ctx, `VM exact recovery selector for "${localCgId}" exceeds the executor cap; `
+                    + `ordinal=${target.ordinal} selectorCap=${VM_EXACT_MICROBATCH_LIMITS.maxSelectorBytes}`);
+                if (installedRecord) {
+                    this.settleVmReconcileRotationAttempt(target, undefined, 'incomplete', candidatePeerIds, installedRecord, providerPolicy.unavailablePeerIds());
                 }
-                batchAttempts = plan.targets.map(({ attempt }) => attempt);
+                providerPolicy.finishAttempt(providerAttempt, 'incomplete', new Map([[target.ual, 'incomplete']]));
+                continue;
+            }
+            observeVmRecoveryTiming(() => this.log.info(ctx, `VM exact recovery transport for "${localCgId}" from ${peerId.slice(-8)}: kind=${providerAttempt.kind} `
+                + `transport=${exactRecoveryTransportMode} assets=${batchAttempts.length} `
+                + `streamAdvertised=${streamAdvertisedCount} streamPeers=${experimentalStreamPeerIds.size} `
+                + `registeredAuthority=${passAuthority.label}`));
+            if (packing !== undefined) {
                 this.log.info(ctx, `VM exact recovery plan for "${localCgId}" from ${peerId.slice(-8)}: `
-                    + `assets=${batchAttempts.length} estimatedBytes=${plan.estimatedBytes} `
-                    + `estimatedLeaves=${plan.estimatedLeaves} `
-                    + `completeFootprints=${plan.completeFootprints}`);
+                    + `assets=${batchAttempts.length} estimatedBytes=${packing.estimatedBytes} `
+                    + `estimatedLeaves=${packing.estimatedLeaves} `
+                    + `completeFootprints=${packing.completeFootprints} transport=${exactRecoveryTransportMode}`);
+            }
+            if (carriedHolder && !this.vmReconcilePublicCoreTransportPreferencePolicy.revalidateReuse(preferenceAttempt, peerId, admittedConnectionKey)) {
+                // Sizing outlived the captured holder proof; the next slice must probe.
+                if (activeFetchCooldownOwner !== undefined) {
+                    this.clearVmReconcileActiveFetchCooldown(localCgId, activeFetchCooldownOwner);
+                }
+                return {
+                    outcomes, attemptedOrdinals: [...attemptedOrdinals],
+                    continuationOrdinal: target.ordinal, hasImmediateRecoveryWork: true, cooldownOnly: false,
+                };
             }
+            // Only while preparation is on: the exchange may rely on this pass's own fresh positive
+            // answer instead of reading it again. The handle dies with the exchange.
+            const registeredPublicEvidence = experimentPolicy.sharePassAuthorityEvidence
+                ? passAuthority.evidence({ contextGraphId: localCgId, signal, isCurrent: isRecoveryCurrent })
+                : undefined;
             const execution = await this.executeVmRecoveryBatch({
                 localCgId,
                 onChainCgId,
@@ -5233,16 +5736,52 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 isRecoveryCurrent,
                 revalidateTarget,
                 ctx,
-            });
-            if (execution.kind !== 'completed')
+                exactRecoveryTransportMode,
+                ...(legacyAttemptTimeoutMs === undefined ? {} : { legacyAttemptTimeoutMs }),
+                ...(registeredPublicEvidence ? { registeredPublicEvidence } : {}),
+                phases,
+            }).finally(() => registeredPublicEvidence?.revoke());
+            if (execution.kind === 'local-admission-deferred') {
+                // Capacity is node-local, so trying other providers would burn their
+                // turns under the same refusal. Retain all peer evidence and yield the
+                // whole slice for the scheduler's bounded local retry.
+                localAdmissionDeferred = true;
+                break;
+            }
+            if (execution.kind !== 'completed' || !isRecoveryCurrent())
                 return staleRecovery();
+            batchTiming.complete({ peerId, assets: batchAttempts.length,
+                candidates: eligible.length - eligibleIndex, kind: providerAttempt.kind,
+                transport: exactRecoveryTransportMode, streamAdvertised: streamAdvertisedCount,
+                streamPeers: experimentalStreamPeerIds.size, registeredAuthority: passAuthority.label });
             for (const [ordinal, outcome] of execution.outcomes)
                 outcomes.set(ordinal, outcome);
             for (const ordinal of execution.handledOrdinals)
                 handledBatchOrdinals.add(ordinal);
             for (const ordinal of execution.attemptedOrdinals)
                 attemptedOrdinals.add(ordinal);
-            providerPolicy.finishAttempt(providerAttempt, execution.providerDisposition, new Map(execution.perUalDispositions));
+            if (execution.providerTurnKept) {
+                // Busy or a broken stream: the peer is not spent for this slice. It is
+                // asked again, with a fresh probe, once its hold-off has passed.
+                providerPolicy.releaseAttempt(providerAttempt);
+            }
+            else {
+                providerPolicy.finishAttempt(providerAttempt, execution.providerDisposition, new Map(execution.perUalDispositions));
+            }
+            const completelyVerified = execution.providerDisposition === 'found'
+                && execution.perUalDispositions.length === batchAttempts.length
+                && execution.perUalDispositions.every(([, disposition]) => disposition === 'found');
+            const preferenceSettlement = this.vmReconcilePublicCoreTransportPreferencePolicy.settle(preferenceAttempt, {
+                peerId, connectionKey: admittedConnectionKey, completelyVerified,
+                publicAccessVerified: publicRecoveryAccessVerified,
+                reusedHolder: providerAttempt.kind === 'proven-holder-reuse', carriedHolder,
+            });
+            if (preferenceSettlement.yield) {
+                this.log.info(ctx, `VM exact recovery yield: reason=verified-core-turn assets=${batchAttempts.length} `
+                    + `publicSizingAccess=${publicRecoveryAccessVerified === undefined ? 'unknown' : publicRecoveryAccessVerified} `
+                    + `holderCreditPresent=${preferenceSettlement.holderCreditPresent}`);
+                break;
+            }
         }
         const eligibleOrdinals = new Set(eligible.map(({ target }) => target.ordinal));
         const unattemptedContinuationOrdinal = currentTargets.find((target) => eligibleOrdinals.has(target.ordinal) && !attemptedOrdinals.has(target.ordinal))?.ordinal;
@@ -5273,6 +5812,19 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // negative backoff applies exactly as before.
         if (!isRecoveryCurrent())
             return staleRecovery();
+        if (localAdmissionDeferred) {
+            if (activeFetchCooldownOwner !== undefined) {
+                this.clearVmReconcileActiveFetchCooldown(localCgId, activeFetchCooldownOwner);
+            }
+            return {
+                outcomes,
+                attemptedOrdinals: [...attemptedOrdinals],
+                continuationOrdinal: unattemptedContinuationOrdinal,
+                hasImmediateRecoveryWork: false,
+                cooldownOnly: false,
+                localAdmissionDeferred: true,
+            };
+        }
         const recoveredAny = [...outcomes.values()]
             .some((outcome) => outcome.status === 'reconciled' || outcome.status === 'already');
         if (!recoveryWorkRan
@@ -5289,6 +5841,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 this.installVmReconcileActiveFetchCooldown(localCgId, Date.now());
             }
         }
+        timing.finish(eligible.length, preparation ? () => preparation.stats() : undefined);
         return {
             outcomes,
             attemptedOrdinals: [...attemptedOrdinals],
@@ -5306,7 +5859,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
      * latest on-chain merkle root + publisher, build the UAL, and ask the
      * finalization handler to promote the matching local SWM snapshot to VM
      * (verifying the CG binding from chain). When no local SWM matches, run an
-     * active core-first catch-up fetch and retry once. A successful result is
+     * queue the exact target for bounded batch recovery. A successful result is
      * validated against one coherent pinned version snapshot before it earns a
      * same-finalized-block shortcut; a new block always reads again. `headBlock`
      * remains the independent cursor observation for the reorg-depth gate. See
@@ -5314,7 +5867,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
      *
      * Local first: before any root, publisher or version read, the handler
      * classifies what the store holds for the KA. A confirmed VM copy with
-     * nothing else to promote settles as `already`, and in the deferred mode an
+     * nothing else to promote settles as `already`, and an
      * asset held nowhere locally goes straight to the exact-recovery queue, both
      * without chain reads. Only local state whose outcome depends on the root
      * takes the chain-backed path below.
@@ -5375,8 +5928,10 @@ export class SwmHostModeMethods extends DKGAgentBase {
             }, ctx)
             : { kind: 'present' };
         if (localCandidate.kind === 'confirmed-vm') {
-            // Trusted at the root the copy was confirmed at; see the classifier for
-            // how an update to it still reaches VM.
+            // Trusted at the root the copy was confirmed at, with no chain read. An
+            // update to it reaches VM through the `KnowledgeAssetUpdated` refresh
+            // (`handleKAUpdatedNudge`), not through this walk: a settled ordinal is
+            // never visited again.
             if (!(await targetMayMaterialize()))
                 return { status: 'skip' };
             this.clearVmReconcileRotationStateForSlot(localCgId, onChainCgId, ordinal);
@@ -5386,11 +5941,10 @@ export class SwmHostModeMethods extends DKGAgentBase {
             });
             return { status: 'already', blockNumber: headBlock ?? 0 };
         }
-        if (localCandidate.kind === 'none' && options.deferActiveFetch) {
+        if (localCandidate.kind === 'none') {
             // Nothing local can match any root, so the chain-backed path could only
             // answer `no-swm`. Queue the same exact-recovery target it would; the
             // recovery batch keeps its rotation backoff, cooldown and peer gating.
-            // The inline mode keys its negative cache by the root and keeps reading it.
             if (!(await targetMayMaterialize()))
                 return { status: 'skip' };
             this.emitReplication({
@@ -5452,18 +6006,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
             }
             merkleRoot = await this.chain.getLatestMerkleRoot(kaId);
             cacheKey = this.vmReconcileCacheKey(localCgId, ual, merkleRoot);
-            if (!options.deferActiveFetch && await this.shouldDeferVmReconcileByNegativeCache(cacheKey, localCgId)) {
-                this.emitReplication({
-                    contextGraphId: localCgId,
-                    onChainCgId: onChainCgId.toString(),
-                    action: 'defer',
-                    ordinal,
-                    kaId: kaId.toString(),
-                    ual,
-                    detail: 'negative-cache',
-                });
-                return { status: 'pending' };
-            }
             publisherAddress = (this.chain.getLatestMerkleRootPublisher
                 ? await this.chain.getLatestMerkleRootPublisher(kaId)
                 : '') ?? '';
@@ -5510,119 +6052,33 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 return undefined;
             }
         };
-        let swmState;
-        let activeFetchRan = false;
-        let activeFetchHadUsableResponse = false;
-        const cleanMissPeerIds = new Set();
         if (!(await targetMayMaterialize()))
             return { status: 'skip' };
-        let outcome = await reconcileKnowledgeAsset();
+        const outcome = await reconcileKnowledgeAsset();
         if (outcome === undefined)
             return { status: 'pending' };
         if (outcome === 'no-swm' || outcome === 'verified-vm-metadata-pending') {
-            if (options.deferActiveFetch) {
-                this.emitReplication({
-                    contextGraphId: localCgId,
+            this.emitReplication({
+                contextGraphId: localCgId,
+                onChainCgId: onChainCgId.toString(),
+                action: 'defer',
+                ordinal,
+                kaId: kaId.toString(),
+                ual,
+                detail: outcome,
+            });
+            return {
+                status: 'pending',
+                recovery: {
+                    localCgId,
                     onChainCgId: onChainCgId.toString(),
-                    action: 'defer',
                     ordinal,
-                    kaId: kaId.toString(),
                     ual,
-                    detail: outcome,
-                });
-                return {
-                    status: 'pending',
-                    recovery: {
-                        localCgId,
-                        onChainCgId: onChainCgId.toString(),
-                        ordinal,
-                        ual,
-                        merkleRoot: Array.from(merkleRoot, (byte) => byte.toString(16).padStart(2, '0')).join(''),
-                        kaId: kaId.toString(),
-                        reason: outcome,
-                    },
-                };
-            }
-            if (outcome === 'no-swm') {
-                swmState = await this.collectVmReconcileSwmCandidateState(localCgId);
-            }
-            // Active fetch: pull the missing snapshot core-first (selectCatchupPeers
-            // already prioritises known cores + the preferred sync peer), then retry.
-            // Metadata-pending exact VM content needs the same recovery: a durable
-            // sync can supply the missing provenance-bearing assertion metadata even
-            // when no content triples need to move.
-            const batchAllowsFetch = options.acquireActiveFetchPermit?.() ?? true;
-            const cooldownAllowsFetch = batchAllowsFetch
-                && this.shouldRunVmReconcileActiveFetch(localCgId);
-            if (batchAllowsFetch && cooldownAllowsFetch) {
-                activeFetchRan = true;
-                this.emitReplication({
-                    contextGraphId: localCgId, onChainCgId: onChainCgId.toString(),
-                    action: 'fetch', ordinal, kaId: kaId.toString(), ual,
-                });
-                let maxAttempts = 1;
-                const fixedMaxAttempts = options.maxPeerAttempts === undefined
-                    ? undefined
-                    : Math.max(1, Math.floor(options.maxPeerAttempts));
-                if (fixedMaxAttempts !== undefined)
-                    maxAttempts = fixedMaxAttempts;
-                for (let attempt = 0; attempt < maxAttempts
-                    && (outcome === 'no-swm' || outcome === 'verified-vm-metadata-pending'); attempt += 1) {
-                    if (options.isTargetCurrent && !options.isTargetCurrent()) {
-                        break;
-                    }
-                    try {
-                        const recovery = await this.syncVmRecoveryFromConnectedPeers(localCgId, {
-                            includeSharedMemory: true,
-                            maxPeers: 1,
-                            peerRotationKey: localCgId,
-                            // This is recovery, not routine background catch-up. Without the
-                            // override it would enter through the default-background path and
-                            // be reported as `catchup-background`, merging repair traffic into
-                            // the background lane. Attribution only — mode, priority, peer
-                            // selection and the coalescing key are all unchanged.
-                            sourceOverride: 'vm-recovery',
-                        });
-                        const fetchResult = recovery.catchup;
-                        if (fixedMaxAttempts === undefined) {
-                            maxAttempts = Math.max(maxAttempts, fetchResult.totalPeers ?? fetchResult.connectedPeers ?? 0, this.vmReconcileConnectedPeerCount());
-                        }
-                        if ((fetchResult.peersTried ?? 0) === 0 && (fetchResult.syncCapablePeers ?? 0) === 0) {
-                            continue;
-                        }
-                        if (!this.vmReconcileActiveFetchHadUsableResponse(fetchResult)) {
-                            continue;
-                        }
-                        activeFetchHadUsableResponse = true;
-                        for (const peerId of recovery.cleanMissPeerIds) {
-                            cleanMissPeerIds.add(peerId);
-                        }
-                    }
-                    catch (err) {
-                        this.log.info(ctx, `Phase B: active fetch for "${localCgId}" (ordinal ${ordinal}) failed: ${err instanceof Error ? err.message : String(err)}`);
-                        if (fixedMaxAttempts === undefined) {
-                            maxAttempts = Math.max(maxAttempts, this.vmReconcileConnectedPeerCount());
-                        }
-                        continue;
-                    }
-                    if (options.isTargetCurrent && !options.isTargetCurrent()) {
-                        break;
-                    }
-                    if (!(await targetMayMaterialize()))
-                        return { status: 'skip' };
-                    outcome = await reconcileKnowledgeAsset();
-                    if (outcome === undefined)
-                        return { status: 'pending' };
-                }
-                if (outcome === 'no-swm') {
-                    swmState = await this.collectVmReconcileSwmCandidateState(localCgId);
-                    swmState.cleanMissPeerIds = createVmReconcileCleanMissPeerIds(swmState.peerTopology, [...cleanMissPeerIds]);
-                }
-            }
-            else {
-                const reason = batchAllowsFetch ? 'per-CG cooldown' : 'per-batch fetch budget';
-                this.log.info(ctx, `Phase B: active fetch for "${localCgId}" (ordinal ${ordinal}) skipped by ${reason}`);
-            }
+                    merkleRoot: Array.from(merkleRoot, (byte) => byte.toString(16).padStart(2, '0')).join(''),
+                    kaId: kaId.toString(),
+                    reason: outcome,
+                },
+            };
         }
         if (options.isTargetCurrent && !options.isTargetCurrent()) {
             return { status: 'skip' };
@@ -5638,7 +6094,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
             case 'promoted':
                 this.clearVmReconcileRotationStateForSlot(localCgId, onChainCgId, ordinal);
                 this.pruneVmReconcileCacheKeySiblings(cacheKey);
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
                 this.recentReconciledUals.add(cacheKey);
                 await this.confirmAndRememberVmReconcileFinalizedSlot(localCgId, onChainCgId, ordinal, rememberSlotBlock, kaId, merkleRoot, publisherAddress);
                 this.emitReplication({
@@ -5655,7 +6110,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     contextGraphId: localCgId, onChainCgId: onChainCgId.toString(),
                     action: 'already', ordinal, kaId: kaId.toString(), ual,
                 });
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
                 return { status: 'already', blockNumber: completionBlock };
             case 'stale-target':
                 this.clearVmReconcileRotationStateForSlot(localCgId, onChainCgId, ordinal);
@@ -5666,20 +6120,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     contextGraphId: localCgId, onChainCgId: onChainCgId.toString(),
                     action: 'already', ordinal, kaId: kaId.toString(), ual,
                 });
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
                 return { status: 'already', blockNumber: completionBlock };
-            case 'no-swm':
-                if (activeFetchRan && !activeFetchHadUsableResponse) {
-                    this.clearVmReconcileActiveFetchCooldown(localCgId);
-                }
-                else {
-                    this.recordVmReconcileNegativeCache(cacheKey, localCgId, swmState ?? await this.collectVmReconcileSwmCandidateState(localCgId));
-                }
-                this.emitReplication({
-                    contextGraphId: localCgId, onChainCgId: onChainCgId.toString(),
-                    action: 'defer', ordinal, kaId: kaId.toString(), ual, detail: activeFetchRan && !activeFetchHadUsableResponse ? 'network-unavailable' : outcome,
-                });
-                return { status: 'pending' };
             case 'receipt-revalidation-pending':
             case 'unverified':
             default:
@@ -5899,7 +6340,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // on nodes that have persisted the CG's `allowedPeers`; host-only
         // cores never see it.
         try {
-            const allowedPeers = await this.getContextGraphAllowedPeers(req.contextGraphId);
+            const allowedPeers = await this.resolveSwmAllowedPeersForCurrentAuthority(req.contextGraphId);
             if (allowedPeers !== null) {
                 anyAuthoritySourceFound = true;
                 if (allowedPeers.includes(fromPeerId)) {
@@ -6229,6 +6670,9 @@ export class SwmHostModeMethods extends DKGAgentBase {
      *    two would race / duplicate every apply (Codex PR #610 R4).
      */
     async enableSwmHostModeFor(contextGraphId) {
+        const session = this.gossipSession;
+        if (!session.active)
+            return { subscribed: false, alreadySubscribed: false, hostingEnabled: false };
         if (!this.swmHostModeStore) {
             return { subscribed: false, alreadySubscribed: false, hostingEnabled: false };
         }
@@ -6252,6 +6696,9 @@ export class SwmHostModeMethods extends DKGAgentBase {
         }
         const hostKey = this.canonicalSwmHostModeKey(contextGraphId);
         const curated = await this.isCuratedForHostMode(contextGraphId);
+        if (!session.active || this.gossipSession !== session) {
+            return { subscribed: false, alreadySubscribed: false, hostingEnabled: true };
+        }
         if (this.swmHostModeSubscribed.has(hostKey)) {
             // Idempotent re-entry: even when the subscription is already
             // active, re-probe registration state. This handles the