@origintrail-official/dkg-agent 10.0.20 → 10.0.21

package/dist/dkg-agent-swm-host.js

@@ -6,11 +6,15 @@
  * the catchup/enable/stats entrypoints. Bodies are a 1:1 move; methods take
  * `this: DKGAgent` so cross-calls resolve against the composed class.
  */
+import { orderVmRecoveryCandidates } from './vm-recovery-candidate-order.js';
 import { createHash } from 'node:crypto';
+import { createSwmHostModeHandler } from './internal/gossip/host-mode-handler.js';
 import { Buffer } from 'node:buffer';
+import { VmRecoveryCoreTransportPreferencePolicy } from './vm-recovery-core-transport-preference.js';
+import { VmRecoveryPassAuthority } from './vm-recovery-pass-authority.js';
 import { performance } from 'node:perf_hooks';
-import { PROTOCOL_GET_CIPHERTEXT_CHUNK, PROTOCOL_SWM_HOST_CATCHUP, contextGraphWorkspaceTopic, contextGraphWorkspaceGraphUri, contextGraphWorkspaceMetaGraphUri, contextGraphDataUri, contextGraphMetaUri, contextGraphLayerUri, MemoryLayer, GOSSIP_TYPE_WORKSPACE_PUBLISH, decodeGossipEnvelope, decodeEncryptedWorkspacePayload, ENCRYPTED_WORKSPACE_ENVELOPE_TYPE, decodeSwmSenderKeyMessage, SWM_SENDER_KEY_MESSAGE_TYPE, SYSTEM_CONTEXT_GRAPHS, createOperationContext, getMetrics, sparqlString, isSafeIri, assertSafeIri, TRUST_LEVEL_PREDICATE, LEGACY_TRUST_LEVEL_PREDICATE, GOSSIP_TYPE_WORKSPACE_PUBLISH_CHUNKED, ciphertextChunkStoreGraph, ciphertextChunkStoreSubject, CIPHERTEXT_CHUNK_PREDICATE, SUBSCRIPTION_SOURCES, } from '@origintrail-official/dkg-core';
-import { GraphManager, isStoreSchedulerBusyError, withDefaultStoreWorkPriority, asChangelogReader, asGraphWriteRevisionSource, tryUpdateWithTouchedGraphs } from '@origintrail-official/dkg-storage';
+import { PROTOCOL_GET_CIPHERTEXT_CHUNK, PROTOCOL_SWM_HOST_CATCHUP, contextGraphWorkspaceTopic, contextGraphDataUri, contextGraphMetaUri, contextGraphLayerUri, MemoryLayer, GOSSIP_TYPE_WORKSPACE_PUBLISH, decodeGossipEnvelope, decodeEncryptedWorkspacePayload, ENCRYPTED_WORKSPACE_ENVELOPE_TYPE, decodeSwmSenderKeyMessage, SWM_SENDER_KEY_MESSAGE_TYPE, SYSTEM_CONTEXT_GRAPHS, createOperationContext, sparqlString, isSafeIri, assertSafeIri, TRUST_LEVEL_PREDICATE, LEGACY_TRUST_LEVEL_PREDICATE, GOSSIP_TYPE_WORKSPACE_PUBLISH_CHUNKED, ciphertextChunkStoreGraph, ciphertextChunkStoreSubject, CIPHERTEXT_CHUNK_PREDICATE, SUBSCRIPTION_SOURCES, } from '@origintrail-official/dkg-core';
+import { GraphManager, isStoreSchedulerBusyError, withDefaultStoreWorkPriority, tryUpdateWithTouchedGraphs } from '@origintrail-official/dkg-storage';
 import { readMaterializedVersion, shouldApplyMaterialization, withMaterializationLock, isKnowledgeAssetWorkspaceHeadCorruptError, readConfirmedGraphKnowledgeAssetMetadataEnvelope, resolveKnowledgeAssetWorkspaceHead, } from '@origintrail-official/dkg-publisher';
 import { ethers } from 'ethers';
 import { isCoreHostedPublicCgRecorded, resolveCoreHostedPublicCgLocalId, } from './core-hosted-public-cg-record-decision.js';
@@ -24,11 +28,16 @@ import { decodeCiphertextChunkCatchupRequest, encodeCiphertextChunkCatchupReques
 import { orderCatchupPeers } from './p2p/peer-selection.js';
 import { reconcileContextGraph, VmReconcileSchedulingRuntime, } from './chain-reconciler.js';
 import { ContextGraphOnChainIdUnresolvedError, VmReconcileUnavailableError, VmReconcileQueueClosedError, } from './vm-reconcile-service.js';
+import { isUnansweredVmReconcileReadAuthority, VmReconcileReadAuthorityUnansweredError, } from './internal/vm-reconcile-read-authority.js';
 import { createCursorState } from './reconcile-cursor.js';
-import { planVmRecoveryMicrobatch, } from './vm-recovery-microbatch.js';
-import { enrichVmRecoveryFootprints } from './vm-recovery-footprint.js';
+import { resolveVmRecoveryExperimentPolicy } from './vm-recovery-experiment-policy.js';
+import { VmRecoveryTimingObserver } from './vm-recovery-timing-observer.js';
+import { noteVmReconcilePassEnd, observeVmRecoveryTiming, vmReconcilePassGapMs, } from './vm-recovery-phase-timing.js';
+import { existingVmRecoveryPreparation, vmRecoveryPreparationFor, } from './vm-recovery-preparation.js';
+import { planVmRecoveryTransport, VmRecoveryTransportPreparation, VM_EXACT_MICROBATCH_LIMITS } from './vm-recovery-transport-plan.js';
+import { EXACT_BATCH_STREAM_PROTOCOL } from './sync/exact-batch-stream-contract.js';
+import { exactBatchStreamUnsupported } from './sync/exact-batch-stream-capability.js';
 import { VmRecoveryProviderPolicy, } from './vm-recovery-provider-policy.js';
-import { encodeExactAssetUals, MAX_EXACT_SYNC_ASSETS, } from './sync/exact-assets.js';
 import { MAX_CONTEXT_GRAPH_ASSET_FETCH_PEERS, ExactAssetFetchLifecycleClosedError, ExactAssetVersionBehindError, exactAssetFetchPeerWindow, runExactAssetFetch, } from './sync/exact-asset-fetch.js';
 import { isBoundedOperationTimeoutError, runBoundedOperation } from './bounded-operation.js';
 /** Graph-scoped KA metadata marker; its presence names the metadata graph. */
@@ -76,12 +85,13 @@ function advanceRsHealCursor(cursorMap, cursorKey, bindings, batchSize, maxEntri
         cursorMap.delete(oldest);
     }
 }
-import { canReuseVmReconcilePeerTopology, createVmReconcileCleanMissPeerIds, createVmReconcilePeerTopology, encodeLegacyVmReconcilePeerTopologyKey, isVmReconcilePeerTopology, parseLegacyVmReconcilePeerTopologyKey, parseVmReconcileCleanMissPeerIds, UNREADABLE_VM_RECONCILE_PEER_TOPOLOGY, } from './vm-reconcile-peer-topology.js';
-import { TIMEOUT_SENTINEL, } from './dkg-agent-constants.js';
+import { SYNC_MIN_GRAPH_BUDGET_MS, TIMEOUT_SENTINEL, } from './dkg-agent-constants.js';
 import { chainAuthorityReadBudgetsOf } from './chain-authority-read-budgets.js';
 import { ContextGraphNotFoundError, } from './dkg-agent-types.js';
 import { DKGAgentBase } from './dkg-agent-base.js';
-import { resolveVmReconcilerEnabled } from './sync/backpressure.js';
+import { resolveExactBatchStreamEnabled, resolveVmReconcilerEnabled } from './sync/backpressure.js';
+import { mapWithConcurrencyDrained } from './map-with-concurrency.js';
+import { VM_RECOVERY_SYNC_PRIORITY } from './sync/catchup-policy.js';
 import { finalizedContextGraphSnapshotMismatchV1 } from './internal/context-graph-authority/finalized-context-graph-binding.js';
 import { CONTEXT_GRAPH_AUTHORITY_RPC_SITES as CG_AUTH_RPC_SITES, withOwnedRpcRequestContext, withRpcUsageSite, } from '@origintrail-official/dkg-chain';
 const DEFAULT_HOST_MODE_RECONCILE_BATCH_SIZE = 32;
@@ -108,26 +118,6 @@ function vmReconcileDeploymentMatches(value, expected) {
  * amplify into a per-message `eth_call` (Branimir review #1239 follow-on).
  */
 const HOST_MODE_PUBLISH_POLICY_MAX_CACHE_AGE_MS = 5_000;
-// Exact VM data responses are page-only and capped at 64 rows per page. Keep
-// one recovery microbatch near 64 non-empty pages so a single large graph does
-// not monopolize the global sync admission. This is a soft scheduling/fairness
-// cap, not a wire or correctness limit: an individually larger KA is still
-// admitted alone and remains bounded by the exact executor's hard guards.
-const VM_EXACT_MICROBATCH_PAGE_FAIRNESS_LEAVES = 4096n;
-const VM_EXACT_MICROBATCH_LIMITS = Object.freeze({
-    // Executor capability: the current exact-sync envelope accepts at most ten.
-    maxAssets: MAX_EXACT_SYNC_ASSETS,
-    // Soft recovery-window targets. A single public KA may exceed either; it is
-    // still admitted alone while the exact executor's own hard byte/quad guards
-    // remain authoritative.
-    targetBytes: 24n * 1024n * 1024n,
-    targetLeaves: VM_EXACT_MICROBATCH_PAGE_FAIRNESS_LEAVES,
-    fixedBytesPerAsset: 64n * 1024n,
-    bytesPerLeafOverhead: 128n,
-    byteSizeMultiplierBps: 11500n,
-    // Hard exact-selector cap, evaluated with the executor's real encoder.
-    maxSelectorBytes: 16 * 1024,
-});
 /**
  * Recovery-target root of an ordinal whose KA the node holds nowhere locally:
  * the sweep queues it without reading the chain root. Exact recovery fetches
@@ -322,6 +312,10 @@ export class SwmHostModeMethods extends DKGAgentBase {
      * reserved, or when the node is already subscribed in member mode.
      */
     async reconcileSwmHostModeSubscription(contextGraphId, source = SUBSCRIPTION_SOURCES.RECONCILER) {
+        const session = this.gossipSession;
+        const live = session.live();
+        if (live === null)
+            return;
         if (!this.swmHostModeStore)
             return;
         if (Object.values(SYSTEM_CONTEXT_GRAPHS).includes(contextGraphId))
@@ -357,7 +351,9 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 await this.isCuratedForHostMode(contextGraphId)) {
                 // A manually hosted CG can become curated later. Upgrade the cached
                 // classification so the existing handler starts stripping immediately.
-                this.swmHostModeCurated.set(hostKey, true);
+                if (!session.active || this.gossipSession !== session)
+                    return;
+                session.swmHostModeCurated.set(hostKey, true);
             }
             await this.maybeMarkRegisteredForHostMode(contextGraphId);
             return;
@@ -392,7 +388,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // critically, the host-only-core case where there's no local
         // `_meta` and `isPrivateContextGraph` alone returns false.
         const curated = await this.isCuratedForHostMode(contextGraphId);
-        if (!curated)
+        if (!curated || !session.active || this.gossipSession !== session)
             return;
         // OT-RFC-49 WS-A — the private-ciphertext strip. With `stripCiphertext`
         // ON (default), a core declines ALL host-mode custody for a curated CG:
@@ -512,15 +508,19 @@ export class SwmHostModeMethods extends DKGAgentBase {
      * so the host-mode lifecycle is in one place.
      */
     wireSwmHostModeHandler(contextGraphId, source = SUBSCRIPTION_SOURCES.RECONCILER, curated = true) {
+        const session = this.gossipSession;
+        const live = session.live();
+        if (live === null)
+            return;
         if (!this.rfc64LegacySwmGossipAllowedForContextGraph(contextGraphId)) {
             const hostKey = this.canonicalSwmHostModeKey(contextGraphId);
-            const hadRuntimeHostState = this.swmHostModeHandlers.has(hostKey)
-                || this.swmHostModeSubscribed.has(hostKey)
-                || this.swmHostModeCurated.has(hostKey);
+            const hadRuntimeHostState = session.swmHostModeHandlers.has(hostKey)
+                || session.swmHostModeSubscribed.has(hostKey)
+                || session.swmHostModeCurated.has(hostKey);
             this.unwireSwmHostModeHandler(contextGraphId);
-            const deletedStaleHandler = this.swmHostModeHandlers.delete(hostKey);
-            const deletedStaleSubscription = this.swmHostModeSubscribed.delete(hostKey);
-            const deletedStaleClassification = this.swmHostModeCurated.delete(hostKey);
+            const deletedStaleHandler = session.swmHostModeHandlers.delete(hostKey);
+            const deletedStaleSubscription = session.swmHostModeSubscribed.delete(hostKey);
+            const deletedStaleClassification = session.swmHostModeCurated.delete(hostKey);
             if (deletedStaleHandler || deletedStaleSubscription || deletedStaleClassification) {
                 // Heal partially restored/stale bookkeeping even when its handler
                 // reference is absent, which makes unwireSwmHostModeHandler a no-op.
@@ -548,7 +548,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // genuine no-op (instead of silently wiring a second handler on
         // the same topic).
         const wireCgId = this.canonicalSwmHostModeKey(contextGraphId);
-        if (this.swmHostModeHandlers.has(wireCgId)) {
+        if (session.swmHostModeHandlers.has(wireCgId)) {
             // Idempotent re-entry — preserve the original source. The first
             // discovery path to wire the handler wins the provenance label;
             // a later path covering the same CG is "also true" but the
@@ -556,44 +556,12 @@ export class SwmHostModeMethods extends DKGAgentBase {
             return;
         }
         const swmTopic = contextGraphWorkspaceTopic(wireCgId);
-        this.swmHostModeSubscribed.set(wireCgId, source);
-        this.swmHostModeCurated.set(wireCgId, curated);
-        this.gossip.subscribe(swmTopic);
-        const handler = (_topic, data, from) => {
-            // Fail closed when the classification is absent. Only an explicitly
-            // non-curated manual subscription retains the public host-mode hatch.
-            if (this.swmHostModeStripCiphertext() &&
-                this.swmHostModeCurated.get(wireCgId) !== false) {
-                this.log.debug(createOperationContext('share'), `Dropping host-mode envelope on cg=${contextGraphId} from=${from}: ` +
-                    `private-ciphertext strip is ON for a curated CG (OT-RFC-49 WS-A)`);
-                return;
-            }
-            // OT-RFC-38 LU-11: peek envelope type and dispatch. Chunked
-            // envelopes (`type='share-write-chunked'`) take the V2 chunk
-            // persistence path; everything else flows through the legacy
-            // host-mode store unchanged. Failed decode falls through to
-            // `ingestSwmHostModeEnvelope` which is also defensive — the
-            // dispatch here is best-effort, not a security boundary.
-            let envelopeType;
-            try {
-                const peek = decodeGossipEnvelope(data);
-                envelopeType = peek?.type;
-            }
-            catch { /* drop into legacy path */ }
-            if (envelopeType === GOSSIP_TYPE_WORKSPACE_PUBLISH_CHUNKED) {
-                this.ingestSwmCiphertextChunkEnvelope(contextGraphId, data, from).catch((err) => {
-                    const msg = err instanceof Error ? err.message : String(err);
-                    this.log.warn(createOperationContext('system'), `LU-11: chunked SWM ingest failed for "${contextGraphId}": ${msg}`);
-                });
-                return;
-            }
-            this.ingestSwmHostModeEnvelope(contextGraphId, data, from).catch((err) => {
-                const msg = err instanceof Error ? err.message : String(err);
-                this.log.warn(createOperationContext('system'), `Host-mode SWM ingest failed for "${contextGraphId}": ${msg}`);
-            });
-        };
-        this.swmHostModeHandlers.set(wireCgId, handler);
-        this.gossip.onMessage(swmTopic, handler);
+        session.swmHostModeSubscribed.set(wireCgId, source);
+        session.swmHostModeCurated.set(wireCgId, curated);
+        live.manager.subscribe(swmTopic);
+        const handler = createSwmHostModeHandler(this, this.log, session, contextGraphId, wireCgId);
+        session.swmHostModeHandlers.set(wireCgId, handler);
+        live.manager.onMessage(swmTopic, handler);
         // B3: persist the host-mode designation so a restart re-engages
         // this handler before the chain-event poller catches up.
         // Codex PR #620 R2: chain wire/unwire writes through a per-CG
@@ -1632,7 +1600,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         }
         if (!authOk) {
             try {
-                const allowedPeers = await this.getContextGraphAllowedPeers(req.contextGraphId);
+                const allowedPeers = await this.resolveSwmAllowedPeersForCurrentAuthority(req.contextGraphId);
                 if (allowedPeers !== null) {
                     anyAuthorityFound = true;
                     if (allowedPeers.includes(fromPeerId))
@@ -3246,12 +3214,18 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     this.log.debug(createOperationContext('system'), `VM reconcile for "${localCgId}" stopped: superseded by cleartext adoption of "${supersedingId}"`);
                     return;
                 }
+                // Reported where the graph was parked (executeVmReconcileForCg): it
+                // is asked again shortly and does not wait for the sweep.
+                if (err instanceof VmReconcileReadAuthorityUnansweredError)
+                    return;
                 this.log.warn(createOperationContext('system'), `VM reconcile for "${localCgId}" failed; retrying on the periodic sweep: ${err instanceof Error ? err.message : String(err)}`);
             }, {
                 concurrency: DKGAgentBase.VM_RECONCILE_CONCURRENCY,
                 maxPending: DKGAgentBase.VM_RECONCILE_QUEUE_MAX_PENDING,
                 maxForegroundBurst: DKGAgentBase.VM_RECONCILE_MAX_FOREGROUND_BURST,
-            }, DKGAgentBase.VM_RECONCILE_UNBOUND_BATCH_SIZE);
+                discoveryBatchSize: DKGAgentBase.VM_RECONCILE_UNBOUND_BATCH_SIZE,
+                periodicBoundBatchSize: DKGAgentBase.VM_RECONCILE_PERIODIC_BOUND_BATCH_SIZE,
+            });
             this.vmReconcileScheduling = scheduling;
         }
         return scheduling;
@@ -3276,7 +3250,37 @@ export class SwmHostModeMethods extends DKGAgentBase {
             ? work()
             : withOwnedRpcRequestContext({ requestClass: 'background', ...(lifecycleSignal ? { signal: lifecycleSignal } : {}) }, () => withDefaultStoreWorkPriority('background', work));
         const physicalRun = runInLane(async () => {
-            const target = await this.resolveVmReconcileTarget(localCgId, isLifecycleCurrent, lifecycleSignal);
+            const passStartedAt = performance.now();
+            const passGapMs = vmReconcilePassGapMs(this, localCgId, passStartedAt);
+            const target = await this.resolveVmReconcileTarget(localCgId, isLifecycleCurrent, lifecycleSignal).catch((err) => {
+                if (!(err instanceof VmReconcileReadAuthorityUnansweredError))
+                    throw err;
+                // The chain read behind the read-authority check got no answer, which
+                // is the node's RPC budget or its endpoint and not the graph. An
+                // automatic pass leaves the graph waiting to be asked again; without
+                // that its next attempt is the periodic sweep, up to a full interval
+                // after the read would have been answered. It is asked again only
+                // while its fetch could start, the readiness every waiter uses. An
+                // operator's request, and a graph the wait cannot take, end as they
+                // always did.
+                const waiting = source === 'manual'
+                    ? undefined
+                    : this.vmReconcileScheduling?.deferForReadAuthority(localCgId, {
+                        signal: lifecycleSignal,
+                        isCurrent: isLifecycleCurrent,
+                        canAdmit: () => this.vmRecoverySyncAdmissionAvailable(localCgId),
+                    });
+                if (waiting === undefined)
+                    throw new ContextGraphNotFoundError(localCgId);
+                const message = `VM reconcile for "${localCgId}" is waiting for read authority `
+                    + `(${err.readAuthority}): the chain read got no answer; asking again shortly`;
+                if (waiting === 'parked')
+                    this.log.info(createOperationContext('system'), message);
+                else
+                    this.log.debug(createOperationContext('system'), message);
+                throw err;
+            });
+            const resolveTargetMs = performance.now() - passStartedAt;
             const isTargetCurrent = () => isLifecycleCurrent()
                 && this.isVmReconcileTargetCurrent(localCgId, target, lifecycleGeneration);
             if (!isTargetCurrent())
@@ -3296,10 +3300,12 @@ export class SwmHostModeMethods extends DKGAgentBase {
             };
             let pendingWatermark;
             let result;
+            let engineTimings;
             try {
                 result = await reconcileContextGraph(this.createVmReconcileDeps(localCgId, lifecycleGeneration, target, lifecycleSignal, {
                     identityCursor: target.cursor,
                     persistWatermark: (_lcg, watermark) => { pendingWatermark = watermark; },
+                    observePassTimings: (timings) => { engineTimings = timings; },
                 }), workingCursor, localCgId, target.onChainCgId);
             }
             catch (err) {
@@ -3319,16 +3325,22 @@ export class SwmHostModeMethods extends DKGAgentBase {
             }
             if (!isTargetCurrent())
                 throw new VmReconcileQueueClosedError();
+            let flushMs = 0;
             if (result.reconciled > 0 || pendingWatermark !== undefined) {
+                const flushStartedAt = performance.now();
                 await this.store.flush?.({
                     priority: 'background',
                     source: 'agent.vmReconcile.materialization.flush',
                 });
+                flushMs = performance.now() - flushStartedAt;
                 if (!isTargetCurrent())
                     throw new VmReconcileQueueClosedError();
             }
+            let watermarkMs = 0;
             if (pendingWatermark !== undefined) {
+                const watermarkStartedAt = performance.now();
                 await this.persistVmReconcileWatermark(localCgId, pendingWatermark, target);
+                watermarkMs = performance.now() - watermarkStartedAt;
                 if (!isTargetCurrent())
                     throw new VmReconcileQueueClosedError();
             }
@@ -3337,11 +3349,40 @@ export class SwmHostModeMethods extends DKGAgentBase {
             target.cursor.scanOrdinal = workingCursor.scanOrdinal;
             const response = this.toContextGraphReconcileResult(localCgId, source, target, result);
             this.emitVmReconcileTelemetry(localCgId, target, result, response.status);
+            observeVmRecoveryTiming(() => {
+                const timings = engineTimings;
+                this.log.info(createOperationContext('system'), `VM reconcile pass timing for "${localCgId}": source=${source} `
+                    + `gapSincePreviousPassMs=${passGapMs === undefined ? '-' : Math.round(passGapMs)} `
+                    + `resolveTargetMs=${Math.round(resolveTargetMs)} `
+                    + `headReadMs=${Math.round(timings?.headReadMs ?? 0)} blockReadMs=${Math.round(timings?.blockReadMs ?? 0)} `
+                    + `scanMs=${Math.round(timings?.scanMs ?? 0)} recoverMs=${Math.round(timings?.recoverMs ?? 0)} `
+                    + `engineMs=${Math.round(timings?.totalMs ?? 0)} flushMs=${Math.round(flushMs)} `
+                    + `watermarkMs=${Math.round(watermarkMs)} totalMs=${Math.round(performance.now() - passStartedAt)} `
+                    + `processed=${result.processed} reconciled=${result.reconciled} pending=${result.pending} `
+                    + `continue=${result.shouldContinueImmediately ? 1 : 0}`);
+            });
             // The reconciler owns the continuation policy: productive slices, stale
             // bindings, and explicit provider rotations continue immediately, while
             // pending-only historical inventory yields to the periodic sweep.
-            if (isLifecycleCurrent() && result.shouldContinueImmediately) {
-                this.vmReconcileScheduling?.triggerLive(localCgId);
+            const localAdmissionWait = {
+                signal: lifecycleSignal,
+                isCurrent: isTargetCurrent,
+                canAdmit: () => this.vmRecoverySyncAdmissionAvailable(localCgId),
+            };
+            if (isTargetCurrent() && result.localAdmissionDeferred) {
+                this.vmReconcileScheduling?.retryLocalAdmission(localCgId, localAdmissionWait);
+            }
+            else if (isLifecycleCurrent() && result.shouldContinueImmediately) {
+                // A graph that just fetched from peers takes its next turn behind the
+                // graphs the node's sync admission refused while it did. Without that
+                // the freed capacity goes back to whichever pass asks first, which is
+                // this one, and the others repeat their passes to be refused again.
+                const yielded = result.recoveryAttempted === true
+                    && !result.staleTarget
+                    && isTargetCurrent()
+                    && this.vmReconcileScheduling?.yieldLocalAdmissionTurn(localCgId, localAdmissionWait) === true;
+                if (!yielded)
+                    this.vmReconcileScheduling?.triggerLive(localCgId);
             }
             else if (isTargetCurrent()) {
                 // RS heal is bounded, best-effort maintenance. Run it only after the
@@ -3362,6 +3403,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 if (!isTargetCurrent())
                     throw new VmReconcileQueueClosedError();
             }
+            noteVmReconcilePassEnd(this, localCgId, performance.now());
             return response;
         });
         trackVmReconcilePhysicalRun(this.vmReconcilePhysicalRuns, physicalRun);
@@ -3448,8 +3490,10 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // Central defense for periodic, live-chain, and manual reconciliation.
         // Every dispatcher entry point converges here and must independently prove
         // read authority. Never let a persisted subscription authorize itself.
+        let authorityDecision;
         const authorityRead = withRpcUsageSite(CG_AUTH_RPC_SITES.vmReconcile, () => this.canReadContextGraph(localCgId, {
             allowSubscriptionFallback: false,
+            onReadAuthorityDecision: (decision) => { authorityDecision = decision; },
         }));
         // Cancellation releases the dispatcher worker, but an underlying store/RPC
         // read may ignore it. Keep that physical dependency in the shutdown drain.
@@ -3457,8 +3501,16 @@ export class SwmHostModeMethods extends DKGAgentBase {
         const canRead = await raceVmReconcileAbort(authorityRead, signal).catch(() => false);
         if (!isCurrent())
             throw new VmReconcileQueueClosedError();
-        if (!canRead)
+        if (!canRead) {
+            // Still a refusal for this pass. The class only records that the chain
+            // never answered, so scheduling can ask again instead of treating the
+            // graph as unreadable until the next sweep.
+            const decision = authorityDecision;
+            if (isUnansweredVmReconcileReadAuthority(decision)) {
+                throw new VmReconcileReadAuthorityUnansweredError(localCgId, decision);
+            }
             throw new ContextGraphNotFoundError(localCgId);
+        }
         if (this.contextGraphBindingState.currentBindingFor(localCgId, sub) === undefined
             && sub.subscribed) {
             await this.selfPrimeSubscriptionOnChainId(localCgId, sub, undefined, isCurrent, signal);
@@ -3749,7 +3801,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
             reconcileOrdinal: (lcg, ocg, ordinal, headBlock, context) => this.reconcileChainOrdinal(lcg, ocg, ordinal, headBlock, {
                 isTargetCurrent,
                 revalidateTarget,
-                deferActiveFetch: true,
                 rememberFinalizedEvidence: context === undefined
                     || context.headOrdinal - ordinal <= DKGAgentBase.VM_RECONCILE_BATCH_SIZE,
             }),
@@ -3784,6 +3835,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             },
             confirmationDepth: DKGAgentBase.VM_RECONCILE_CONFIRMATION_DEPTH,
             log: (msg) => this.log.info(createOperationContext('system'), msg),
+            ...(execution?.observePassTimings ? { observePassTimings: execution.observePassTimings } : {}),
         };
     }
     async persistVmReconcileWatermark(localCgId, watermark, target) {
@@ -4162,425 +4214,29 @@ export class SwmHostModeMethods extends DKGAgentBase {
             return { status: 'skipped', reason: 'failed' };
         }
     }
-    async collectVmReconcileSwmCandidateState(localCgId) {
-        const candidateNamespaces = await this.collectVmReconcileSwmCandidateNamespacesBestEffort(localCgId);
-        return {
-            candidateNamespaces: candidateNamespaces.namespaces,
-            swmGen: await this.readVmReconcileSwmGen(candidateNamespaces.namespaces),
-            peerTopology: await this.vmReconcilePeerTopology(localCgId),
-            cleanMissPeerIds: [],
-        };
-    }
-    vmReconcileRootSwmCandidateNamespaces(localCgId) {
-        return [{
-                metaGraph: contextGraphWorkspaceMetaGraphUri(localCgId),
-                dataGraph: contextGraphWorkspaceGraphUri(localCgId),
-            }];
-    }
-    async collectVmReconcileSwmCandidateNamespaces(localCgId) {
-        const graphManager = new GraphManager(this.store);
-        // `listSubGraphs` finds sub-graphs by their data or `_meta` graphs; a
-        // hosted-only core holds only `<cg>/<sub>/_shared_memory*` copies, which
-        // its StorageACK ledger names.
-        const subGraphs = [...new Set([
-                ...await graphManager.listSubGraphs(localCgId),
-                ...await this.storageAckLedgerNamespaceSubGraphs(localCgId),
-            ])];
-        const subGraphNamespaces = subGraphs
-            .map((sg) => ({
-            metaGraph: graphManager.sharedMemoryMetaUri(localCgId, sg),
-            dataGraph: graphManager.sharedMemoryUri(localCgId, sg),
-        }))
-            .sort((a, b) => `${a.metaGraph}\0${a.dataGraph}`.localeCompare(`${b.metaGraph}\0${b.dataGraph}`));
-        return [
-            ...this.vmReconcileRootSwmCandidateNamespaces(localCgId),
-            ...subGraphNamespaces,
-        ];
-    }
-    async collectVmReconcileSwmCandidateNamespacesBestEffort(localCgId) {
-        try {
-            return { namespaces: await this.collectVmReconcileSwmCandidateNamespaces(localCgId), complete: true };
-        }
-        catch {
-            return { namespaces: this.vmReconcileRootSwmCandidateNamespaces(localCgId), complete: false };
-        }
-    }
-    vmReconcileSwmNamespaceKey(candidateNamespaces) {
-        return candidateNamespaces
-            .map((namespace) => `${namespace.metaGraph}\0${namespace.dataGraph}`)
-            .sort()
-            .join('\n');
-    }
-    async vmReconcilePeerTopology(localCgId) {
-        try {
-            const preferredPeerId = await this.resolvePreferredSyncPeerId(localCgId);
-            const isPrivateContextGraph = await this.isPrivateContextGraph(localCgId);
-            const libp2p = this.node?.libp2p;
-            const getConnections = libp2p?.getConnections;
-            if (typeof getConnections !== 'function')
-                return UNREADABLE_VM_RECONCILE_PEER_TOPOLOGY;
-            const peerIds = [...new Map(getConnections.call(libp2p)
-                    .map((connection) => [connection.remotePeer?.toString(), connection.remotePeer])
-                    .filter((entry) => typeof entry[0] === 'string' && entry[0].length > 0 && !!entry[1])).keys()].sort();
-            const orderedPeers = this.selectCatchupPeers(peerIds.map((peerId) => ({ toString: () => peerId })), preferredPeerId, isPrivateContextGraph);
-            return createVmReconcilePeerTopology({
-                preferredPeerId: preferredPeerId ?? null,
-                privateOnly: isPrivateContextGraph,
-                peers: orderedPeers.map((peer) => {
-                    const peerId = peer.toString();
-                    return {
-                        peerId,
-                        core: this.peerCapabilityRegistry.supportsCore(peerId),
-                    };
-                }),
-            });
-        }
-        catch {
-            return UNREADABLE_VM_RECONCILE_PEER_TOPOLOGY;
-        }
-    }
-    async readVmReconcileSwmGen(candidateNamespaces) {
-        if (candidateNamespaces.length === 0)
-            return 'empty:0';
-        try {
-            // The changelog cursor is a durable write generation: it survives daemon
-            // restart, advances at the store mutation choke point, and is O(1) after
-            // its one-time seed. It lets large (> fingerprint cap) stores reuse a
-            // proven negative without reconstructing or sampling their SWM content.
-            const changelog = asChangelogReader(this.store);
-            if (changelog) {
-                const head = await changelog.changelogHead({
-                    priority: 'background',
-                    source: 'agent.vmReconcile.negativeGeneration',
-                });
-                return `changelog:${head.era}:${head.seq}`;
-            }
-            const parts = [];
-            const digestRows = (rows) => createHash('sha256').update(rows.join('\n'), 'utf8').digest('hex');
-            const maxRows = DKGAgentBase.VM_RECONCILE_SWM_GEN_FINGERPRINT_MAX_ROWS;
-            const isTooLarge = (rows) => rows.length > maxRows;
-            for (const namespace of candidateNamespaces) {
-                const metaGraph = assertSafeIri(namespace.metaGraph);
-                const dataGraph = assertSafeIri(namespace.dataGraph);
-                const operationRows = await this.store.query(`SELECT ?op ?root ?ts WHERE {
-            GRAPH <${metaGraph}> {
-              ?op <http://dkg.io/ontology/rootEntity> ?root .
-              OPTIONAL { ?op <http://dkg.io/ontology/publishedAt> ?ts . }
-            }
-          } ORDER BY ?op ?root ?ts LIMIT ${maxRows + 1}`, { source: 'agent.vmReconcile.swmFingerprint.operations' });
-                if (operationRows.type !== 'bindings')
-                    return null;
-                if (isTooLarge(operationRows.bindings))
-                    return null;
-                const operations = operationRows.bindings
-                    .map((row) => [
-                    String(row['op'] ?? ''),
-                    String(row['root'] ?? ''),
-                    String(row['ts'] ?? ''),
-                ].join('\0'))
-                    .sort();
-                const dataRows = await this.store.query(`SELECT ?s ?p ?o WHERE {
-            GRAPH <${dataGraph}> { ?s ?p ?o . }
-          } ORDER BY ?s ?p ?o LIMIT ${maxRows + 1}`, { source: 'agent.vmReconcile.swmFingerprint.data' });
-                if (dataRows.type !== 'bindings')
-                    return null;
-                if (isTooLarge(dataRows.bindings))
-                    return null;
-                const dataTriples = dataRows.bindings
-                    .map((row) => [
-                    String(row['s'] ?? ''),
-                    String(row['p'] ?? ''),
-                    String(row['o'] ?? ''),
-                ].join('\0'))
-                    .sort();
-                const privateRootRows = await this.store.query(`SELECT ?privateEntity ?privateRoot WHERE {
-            GRAPH <${metaGraph}> {
-              ?privateEntity <http://dkg.io/ontology/privateMerkleRoot> ?privateRoot .
-            }
-          } ORDER BY ?privateEntity ?privateRoot LIMIT ${maxRows + 1}`, { source: 'agent.vmReconcile.swmFingerprint.privateRoots' });
-                if (privateRootRows.type !== 'bindings')
-                    return null;
-                if (isTooLarge(privateRootRows.bindings))
-                    return null;
-                const privateRoots = privateRootRows.bindings
-                    .map((row) => [
-                    String(row['privateEntity'] ?? ''),
-                    String(row['privateRoot'] ?? ''),
-                ].join('\0'))
-                    .sort();
-                parts.push([
-                    `meta:${namespace.metaGraph}`,
-                    `data:${namespace.dataGraph}`,
-                    `ops:${operations.length}`,
-                    `opHash:${digestRows(operations)}`,
-                    `dataTriples:${dataTriples.length}`,
-                    `dataHash:${digestRows(dataTriples)}`,
-                    `privateRoots:${privateRoots.length}`,
-                    `privateRootHash:${digestRows(privateRoots)}`,
-                ].join(';'));
-            }
-            // Catch writes into a newly-created/unregistered namespace that the
-            // current namespace enumeration cannot yet name. This process-local term
-            // complements (rather than replaces) the content fingerprint: after a
-            // restart the fingerprint remains the correctness gate while the counter
-            // restarts harmlessly.
-            const rootDataGraph = candidateNamespaces[0]?.dataGraph ?? '';
-            const swmSuffix = rootDataGraph.indexOf('/_shared_memory');
-            const graphPrefix = swmSuffix >= 0 ? `${rootDataGraph.slice(0, swmSuffix)}/` : rootDataGraph;
-            const writeRevision = asGraphWriteRevisionSource(this.store)?.getWriteRevision(graphPrefix);
-            // A remote mutation can still commit after this fingerprint's reads.
-            // Never turn such an in-flight/indeterminate observation into a stable
-            // negative-cache key.
-            if (writeRevision && !writeRevision.stable)
-                return null;
-            if (writeRevision)
-                parts.push(`writeGen:${writeRevision.generation}`);
-            return parts.join('|');
-        }
-        catch {
-            // Probe failures are not a stable SWM generation. Callers must not cache
-            // or preserve a negative-cache gate from this result.
-        }
-        return null;
-    }
-    vmReconcileSwmGenHasOperations(swmGen) {
-        return swmGen.split('|').some((part) => {
-            const match = /(?:^|;)ops:(\d+)(?:;|$)/.exec(part);
-            return match ? Number(match[1]) > 0 : false;
-        });
-    }
-    vmReconcileSwmGenSupportsDurableNegative(swmGen) {
-        // A changelog cursor covers every descendant graph mutation. The fallback
-        // fingerprint covers only the bare SWM bucket, so an operation whose data
-        // later lands in a per-KA child graph must fail open after restart.
-        return swmGen.startsWith('changelog:') || !this.vmReconcileSwmGenHasOperations(swmGen);
-    }
-    vmReconcileSwmGenContainsSnapshot(cachedSwmGen, currentSwmGen) {
-        return cachedSwmGen === currentSwmGen || cachedSwmGen.split('|').includes(currentSwmGen);
-    }
-    vmReconcileWorkspaceOperationPattern(candidateMetaGraphs) {
-        const branches = [];
-        for (const graph of candidateMetaGraphs) {
-            try {
-                branches.push(`{ GRAPH <${assertSafeIri(graph)}> {
-          ?op <http://dkg.io/ontology/rootEntity> ?root .
-          OPTIONAL { ?op <http://dkg.io/ontology/publishedAt> ?ts . }
-        } }`);
-            }
-            catch {
-                // Skip unsafe graph names instead of building a malformed query.
-            }
-        }
-        return branches.join(' UNION ');
-    }
-    deleteVmReconcileNegativeCacheEntry(cacheKey) {
-        const existing = this.vmReconcileNegativeCache.get(cacheKey);
-        this.markVmReconcileNegativeCacheHydrated(cacheKey, existing?.localCgId ?? cacheKey.slice(0, Math.max(0, cacheKey.indexOf('\0'))));
-        if (existing) {
-            this.vmReconcileNegativeCache.delete(cacheKey);
-            const keys = this.vmReconcileNegativeCacheKeysByCg.get(existing.localCgId);
-            if (keys) {
-                keys.delete(cacheKey);
-                if (keys.size === 0)
-                    this.vmReconcileNegativeCacheKeysByCg.delete(existing.localCgId);
-            }
-        }
-        void this.config.contextGraphSubscriptionStore?.deleteVmReconcileNegative?.(cacheKey).catch(() => {
-            // The in-memory invalidation remains authoritative for this process.
-        });
-    }
-    indexVmReconcileNegativeCacheEntry(localCgId, cacheKey) {
-        let keys = this.vmReconcileNegativeCacheKeysByCg.get(localCgId);
-        if (!keys) {
-            keys = new Set();
-            this.vmReconcileNegativeCacheKeysByCg.set(localCgId, keys);
-        }
-        keys.add(cacheKey);
-    }
-    markVmReconcileNegativeCacheHydrated(cacheKey, localCgId) {
-        // Access order keeps actively reused keys resident while old one-shot
-        // misses fall out. Eviction is fail-open: it only permits another durable
-        // lookup if the same key is encountered later.
-        this.vmReconcileNegativeCacheHydrated.delete(cacheKey);
-        this.vmReconcileNegativeCacheHydrated.set(cacheKey, localCgId);
-        while (this.vmReconcileNegativeCacheHydrated.size
-            > DKGAgentBase.VM_RECONCILE_CACHE_MAX_ENTRIES) {
-            const oldestKey = this.vmReconcileNegativeCacheHydrated.keys().next().value;
-            if (oldestKey === undefined)
-                break;
-            this.vmReconcileNegativeCacheHydrated.delete(oldestKey);
-        }
-    }
-    async shouldDeferVmReconcileByNegativeCache(cacheKey, localCgId) {
-        let cached = this.vmReconcileNegativeCache.get(cacheKey);
-        const durableStateAlreadyConsulted = this.vmReconcileNegativeCacheHydrated.has(cacheKey);
-        this.markVmReconcileNegativeCacheHydrated(cacheKey, localCgId);
-        if (!cached && !durableStateAlreadyConsulted) {
-            try {
-                const durable = await this.config.contextGraphSubscriptionStore
-                    ?.loadVmReconcileNegative?.(cacheKey);
-                const durablePeerTopology = durable
-                    ? isVmReconcilePeerTopology(durable.peerTopology)
-                        ? durable.peerTopology
-                        : parseLegacyVmReconcilePeerTopologyKey(durable.peerTopologyKey)
-                    : null;
-                const durableCleanMissPeerIds = durablePeerTopology
-                    ? parseVmReconcileCleanMissPeerIds(durable?.cleanMissPeerIds ?? [], durablePeerTopology)
-                    : null;
-                if (durable &&
-                    durable.cacheKey === cacheKey &&
-                    durable.localCgId === localCgId &&
-                    Number.isInteger(durable.failures) && durable.failures > 0 &&
-                    Number.isFinite(durable.nextRetryAt) &&
-                    typeof durable.swmGen === 'string' &&
-                    Array.isArray(durable.candidateNamespaces) &&
-                    durable.candidateNamespaces.every((item) => typeof item?.metaGraph === 'string' && typeof item?.dataGraph === 'string') &&
-                    durablePeerTopology !== null &&
-                    durableCleanMissPeerIds !== null) {
-                    if (!this.vmReconcileSwmGenSupportsDurableNegative(durable.swmGen)) {
-                        await this.config.contextGraphSubscriptionStore
-                            ?.deleteVmReconcileNegative?.(cacheKey);
-                    }
-                    else {
-                        cached = {
-                            localCgId: durable.localCgId,
-                            failures: durable.failures,
-                            nextRetryAt: durable.nextRetryAt,
-                            swmGen: durable.swmGen,
-                            candidateNamespaces: durable.candidateNamespaces,
-                            peerTopology: durablePeerTopology,
-                            cleanMissPeerIds: durableCleanMissPeerIds,
-                        };
-                        this.vmReconcileNegativeCache.set(cacheKey, cached);
-                        this.indexVmReconcileNegativeCacheEntry(localCgId, cacheKey);
-                    }
-                }
-            }
-            catch {
-                // Persistence is an accelerator only. Fail open to an authoritative scan.
-            }
-        }
-        if (!cached)
-            return false;
-        if (Date.now() >= cached.nextRetryAt)
-            return false;
-        try {
-            try {
-                await this.primeCatchupConnections();
-            }
-            catch {
-                // Best effort only; an unchanged connection view can still honor the
-                // cached miss until the backoff expires.
-            }
-            const currentPeerTopology = await this.vmReconcilePeerTopology(localCgId);
-            if (!canReuseVmReconcilePeerTopology({
-                topology: cached.peerTopology,
-                cleanMissPeerIds: cached.cleanMissPeerIds,
-            }, currentPeerTopology)) {
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                this.clearVmReconcileActiveFetchCooldown(localCgId);
-                return false;
-            }
-            const currentNamespaces = await this.collectVmReconcileSwmCandidateNamespacesBestEffort(localCgId);
-            const currentNamespaceKey = this.vmReconcileSwmNamespaceKey(currentNamespaces.namespaces);
-            const cachedNamespaceKey = this.vmReconcileSwmNamespaceKey(cached.candidateNamespaces);
-            if (currentNamespaceKey !== cachedNamespaceKey) {
-                if (!currentNamespaces.complete) {
-                    const currentSwmGen = await this.readVmReconcileSwmGen(currentNamespaces.namespaces);
-                    if (currentSwmGen === null) {
-                        this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                        return false;
-                    }
-                    if (!this.vmReconcileSwmGenContainsSnapshot(cached.swmGen, currentSwmGen)) {
-                        this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                        return false;
-                    }
-                    return true;
-                }
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                return false;
-            }
-            const pattern = this.vmReconcileWorkspaceOperationPattern(currentNamespaces.namespaces.map((namespace) => namespace.metaGraph));
-            if (!pattern)
-                return true;
-            const currentSwmGen = await this.readVmReconcileSwmGen(currentNamespaces.namespaces);
-            if (currentSwmGen === null) {
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                return false;
-            }
-            if (currentSwmGen !== cached.swmGen) {
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-                return false;
-            }
-        }
-        catch {
-            // Unexpected validation failures leave the existing backoff in place;
-            // expected generation probe failures return null and clear the gate above.
-        }
-        return true;
-    }
-    recordVmReconcileNegativeCache(cacheKey, localCgId, state) {
-        if (state.swmGen === null) {
-            this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-            return;
-        }
-        this.pruneVmReconcileState();
-        const previous = this.vmReconcileNegativeCache.get(cacheKey);
-        const failures = (previous?.failures ?? 0) + 1;
-        const exponentialBackoff = Math.min(DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS, DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_BASE_MS * 2 ** Math.max(0, failures - 1));
-        const jitterSample = createHash('sha256')
-            .update(`${this.node.peerId.toString()}\0${cacheKey}\0${failures}`)
-            .digest()
-            .readUInt32BE(0) / 0x1_0000_0000;
-        const backoff = Math.min(DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS, Math.max(1, Math.round(exponentialBackoff * (0.8 + jitterSample * 0.4))));
-        getMetrics().storeRetryAttemptsTotal.add(1, {
-            scope: 'vm_reconcile',
-            reason: 'no_swm',
-            attempt: Math.min(failures, 16),
+    initializeVmReconcilePublicCoreTransportPreferencePolicy() {
+        this.vmReconcilePublicCoreTransportPreferencePolicy ??= new VmRecoveryCoreTransportPreferencePolicy({
+            now: () => this.vmReconcileRotationNow(),
+            connectionKey: peerId => this.getSyncReconcilerConnectionKey(peerId),
+            supportsCore: peerId => this.peerCapabilityRegistry.supportsCore(peerId),
+            holderReuseEnabled: resolveExactBatchStreamEnabled,
+            captureScope: (localCgId, candidatePeerIds) => typeof this.chain.deploymentId === 'string' ? {
+                deploymentId: this.chain.deploymentId,
+                lifecycleGeneration: this.vmReconcileLifecycleGeneration,
+                bindingGeneration: this.contextGraphBindingState.capture(localCgId),
+                selectedBindingGeneration: this.selectedVmReconcileCursors.get(localCgId)?.bindingGeneration,
+                candidatePeerIds: [...candidatePeerIds],
+            } : undefined,
+            scopeIsCurrent: (localCgId, scope) => this.chain.deploymentId === scope.deploymentId
+                && this.vmReconcileLifecycleGeneration === scope.lifecycleGeneration
+                && !this.vmReconcileRotationClosed
+                && this.contextGraphBindingState.capture(localCgId) === scope.bindingGeneration
+                && this.selectedVmReconcileCursors.get(localCgId)?.bindingGeneration === scope.selectedBindingGeneration
+                && this.vmReconcilePeerMembershipMatches(new Set(scope.candidatePeerIds), this.vmReconcileObservedCandidatePeerIds(localCgId)),
+        }, {
+            ttlMs: DKGAgentBase.VM_RECONCILE_PUBLIC_CORE_TRANSPORT_TTL_MS,
+            maxEntries: DKGAgentBase.VM_RECONCILE_CG_STATE_MAX_ENTRIES,
         });
-        if (previous) {
-            // Replace in place without racing an asynchronous durable DELETE against
-            // the SAVE below. The record key/local CG are unchanged here.
-            this.vmReconcileNegativeCache.delete(cacheKey);
-            const keys = this.vmReconcileNegativeCacheKeysByCg.get(previous.localCgId);
-            keys?.delete(cacheKey);
-            if (keys?.size === 0)
-                this.vmReconcileNegativeCacheKeysByCg.delete(previous.localCgId);
-        }
-        const record = {
-            localCgId,
-            failures,
-            nextRetryAt: Date.now() + backoff,
-            swmGen: state.swmGen,
-            candidateNamespaces: state.candidateNamespaces,
-            peerTopology: state.peerTopology,
-            cleanMissPeerIds: state.cleanMissPeerIds,
-        };
-        this.vmReconcileNegativeCache.set(cacheKey, record);
-        this.markVmReconcileNegativeCacheHydrated(cacheKey, localCgId);
-        this.indexVmReconcileNegativeCacheEntry(localCgId, cacheKey);
-        const durableStore = this.config.contextGraphSubscriptionStore;
-        if (this.vmReconcileSwmGenSupportsDurableNegative(record.swmGen)) {
-            void durableStore?.saveVmReconcileNegative?.({
-                cacheKey,
-                localCgId: record.localCgId,
-                failures: record.failures,
-                nextRetryAt: record.nextRetryAt,
-                swmGen: record.swmGen,
-                candidateNamespaces: record.candidateNamespaces,
-                peerTopologyKey: encodeLegacyVmReconcilePeerTopologyKey(record.peerTopology),
-                peerTopology: record.peerTopology,
-                cleanMissPeerIds: record.cleanMissPeerIds,
-            }).catch(() => {
-                // Persistence is an accelerator only; the process-local gate still works.
-            });
-        }
-        else {
-            void durableStore?.deleteVmReconcileNegative?.(cacheKey).catch(() => {
-                // Fail open after restart even if best-effort cleanup cannot complete.
-            });
-        }
-        this.pruneVmReconcileState();
     }
     vmReconcileRotationNow() {
         return performance.now();
@@ -4861,11 +4517,26 @@ export class SwmHostModeMethods extends DKGAgentBase {
      * mutable transition so partial responses revoke affinity consistently.
      * Unavailable peers and the global considered-peer cap remain authoritative.
      */
-    selectVmReconcileExactCandidate(record, fallbackCandidatePeerIds, policy) {
+    selectVmReconcileExactCandidate(record, fallbackCandidatePeerIds, policy, binding) {
         const uncreditedCandidateOrder = record
             ? this.vmReconcileUncreditedCandidateOrder(record)
             : fallbackCandidatePeerIds;
-        return policy.selectNextCandidate(uncreditedCandidateOrder, DKGAgentBase.VM_RECONCILE_EXACT_PEER_MAX);
+        const preferredPeerId = binding
+            ? this.vmReconcilePublicCoreTransportPreferencePolicy.preferredPeer(binding.localCgId, binding.onChainCgId, uncreditedCandidateOrder)
+            : undefined;
+        const now = this.vmReconcileRotationNow();
+        const { order, heldOffPeerIds } = orderVmRecoveryCandidates({
+            candidatePeerIds: uncreditedCandidateOrder,
+            preferredPeerId,
+            streamPeerIds: binding?.experimentalStreamPeerIds,
+            lastAttemptedPeerId: record?.lastAttemptedPeerId,
+            hasSetback: (peerId) => binding !== undefined
+                && record?.streamSetbackPeerIds?.has(peerId) === true
+                && this.vmReconcileStreamSetbackPolicy.inSetbackStreak(binding.localCgId, peerId, now),
+            isHeldOff: (peerId) => binding !== undefined
+                && this.vmReconcileStreamSetbackPolicy.heldOff(binding.localCgId, peerId, now),
+        });
+        return policy.selectNextCandidate(order, DKGAgentBase.VM_RECONCILE_EXACT_PEER_MAX, heldOffPeerIds);
     }
     findVmReconcileRotationReplacement(requestingCgId) {
         if (this.vmReconcileRotationState.size < DKGAgentBase.VM_RECONCILE_CACHE_MAX_ENTRIES) {
@@ -4936,7 +4607,11 @@ export class SwmHostModeMethods extends DKGAgentBase {
             if (key.startsWith(prefix))
                 this.vmReconcileRotationState.delete(key);
         }
+        this.vmReconcileTransportBudgetPolicy.forgetContextGraph(localCgId);
+        this.vmReconcileStreamSetbackPolicy.forgetContextGraph(localCgId);
         this.vmReconcileRotationAdmissionCursorByCg.delete(localCgId);
+        this.vmReconcilePublicCoreTransportPreferencePolicy?.forgetContextGraph(localCgId);
+        existingVmRecoveryPreparation(this)?.discard(localCgId);
     }
     closeVmReconcileRotationState() {
         this.vmReconcileLifecycleController?.abort();
@@ -4947,11 +4622,22 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // without running the base constructor. Shutdown must remain best-effort
         // for that supported test seam and never mask later teardown failures.
         this.vmReconcileRotationState?.clear();
+        this.vmReconcileTransportBudgetPolicy?.clear();
+        this.vmReconcileStreamSetbackPolicy?.clear();
         this.vmReconcileRotationAdmissionCursorByCg?.clear();
         this.vmReconcileCuratorPeersByCg?.clear();
         this.vmReconcileCuratorPageCursorByCg?.clear();
         this.vmReconcileExactPeerCapabilities?.clear();
+        this.vmReconcilePublicCoreTransportPreferencePolicy?.clear();
         this.vmRefreshQueue?.clear();
+        // Cancel speculative sizing reads and let shutdown wait for them to settle.
+        const preparation = existingVmRecoveryPreparation(this);
+        if (preparation && this.vmReconcilePhysicalRuns) {
+            trackVmReconcilePhysicalRun(this.vmReconcilePhysicalRuns, preparation.close());
+        }
+        else {
+            void preparation?.close();
+        }
     }
     openVmReconcileRotationState() {
         if (!this.vmReconcileLifecycleController || this.vmReconcileLifecycleController.signal.aborted) {
@@ -4978,6 +4664,8 @@ export class SwmHostModeMethods extends DKGAgentBase {
             return;
         if (peerId !== undefined) {
             capturedRecord.attemptedPeerIds.add(peerId);
+            // This attempt gave a verdict: an earlier setback with the peer is history.
+            capturedRecord.streamSetbackPeerIds?.delete(peerId);
             if (disposition === 'clean-absent')
                 capturedRecord.cleanAbsentPeerIds.add(peerId);
             // Preserve fairly accumulated proof progress while other targets share
@@ -5002,6 +4690,23 @@ export class SwmHostModeMethods extends DKGAgentBase {
         }
         this.touchVmReconcileRotationRecord(slotKey, capturedRecord);
     }
+    /**
+     * Hand a target its turn at `peerId` back after an attempt that ended
+     * without a verdict on the peer's data. The peer is uncredited again, so the
+     * cycle cannot complete, and so cannot back off, without asking it. Removing
+     * a mark is safe against any roster, which is why membership is not checked.
+     * The setback is noted on the target, for candidate selection to order by.
+     */
+    releaseVmReconcileRotationAttempt(target, peerId, capturedRecord) {
+        if (this.vmReconcileRotationClosed)
+            return;
+        const slotKey = this.vmReconcileRotationSlotKey(target);
+        if (this.vmReconcileRotationState.get(slotKey) !== capturedRecord)
+            return;
+        capturedRecord.attemptedPeerIds.delete(peerId);
+        (capturedRecord.streamSetbackPeerIds ??= new Set()).add(peerId);
+        this.touchVmReconcileRotationRecord(slotKey, capturedRecord);
+    }
     creditVmReconcileCleanAbsence(target, peerId, expectedCandidatePeerIds, capturedRecord) {
         this.settleVmReconcileRotationAttempt(target, peerId, 'clean-absent', expectedCandidatePeerIds, capturedRecord);
     }
@@ -5032,26 +4737,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         this.installVmReconcileActiveFetchCooldown(localCgId, now);
         return true;
     }
-    vmReconcileActiveFetchHadUsableResponse(result) {
-        if ((result.peersSucceeded ?? 0) > 0)
-            return true;
-        if ((result.sharedMemorySynced ?? 0) > 0)
-            return true;
-        const shared = result.diagnostics?.sharedMemory;
-        if (!shared)
-            return false;
-        return (shared.insertedDataTriples ?? 0) > 0
-            || (shared.insertedMetaTriples ?? 0) > 0
-            || (shared.checkpointAdvances ?? 0) > 0
-            || ((shared.completedPhases ?? 0) > 0 && (shared.resumedPhases ?? 0) > 0);
-    }
     pruneVmReconcileState(now = Date.now()) {
-        while (this.vmReconcileNegativeCache.size > DKGAgentBase.VM_RECONCILE_CACHE_MAX_ENTRIES) {
-            const oldestKey = this.vmReconcileNegativeCache.keys().next().value;
-            if (oldestKey === undefined)
-                break;
-            this.deleteVmReconcileNegativeCacheEntry(oldestKey);
-        }
         for (const [localCgId, cooldown] of this.vmReconcileFetchCooldowns) {
             if (now - cooldown.startedAt >= DKGAgentBase.VM_RECONCILE_SWEEP_INTERVAL_MS) {
                 this.clearVmReconcileActiveFetchCooldown(localCgId);
@@ -5110,22 +4796,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
         });
     }
     forceClearVmReconcileStateForContextGraph(localCgId, options = {}) {
-        const negativeCacheKeys = this.vmReconcileNegativeCacheKeysByCg.get(localCgId);
-        if (negativeCacheKeys) {
-            for (const cacheKey of Array.from(negativeCacheKeys)) {
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
-            }
-        }
-        for (const [cacheKey, hydratedLocalCgId] of this.vmReconcileNegativeCacheHydrated) {
-            if (hydratedLocalCgId === localCgId) {
-                this.vmReconcileNegativeCacheHydrated.delete(cacheKey);
-            }
-        }
-        void this.config.contextGraphSubscriptionStore
-            ?.deleteVmReconcileNegativesForContextGraph?.(localCgId)
-            .catch(() => {
-            // Best-effort durable cleanup; generation checks still reject stale rows.
-        });
         this.reconcileCursors.delete(localCgId);
         if (options.includeSelectedCursor !== false
             && this.selectedVmReconcileCursors.delete(localCgId)) {
@@ -5214,97 +4884,120 @@ export class SwmHostModeMethods extends DKGAgentBase {
     }
     pruneVmReconcileCacheKeySiblings(cacheKey) {
         const prefix = this.vmReconcileCacheKeyPrefix(cacheKey);
-        for (const key of this.vmReconcileNegativeCache.keys()) {
-            if (key !== cacheKey && key.startsWith(prefix)) {
-                this.deleteVmReconcileNegativeCacheEntry(key);
-            }
-        }
         this.recentReconciledUals.deleteByPrefix(prefix, cacheKey);
     }
-    vmReconcileConnectedPeerCount() {
-        try {
-            const libp2p = this.node?.libp2p;
-            const getConnections = libp2p?.getConnections;
-            if (typeof getConnections !== 'function')
-                return 0;
-            const uniquePeers = new Set(getConnections.call(libp2p)
-                .map((connection) => connection.remotePeer?.toString())
-                .filter((peerId) => typeof peerId === 'string' && peerId.length > 0));
-            return uniquePeers.size;
-        }
-        catch {
-            return 0;
-        }
-    }
     /**
-     * Execute one already-admitted provider attempt. The caller owns
-     * roster/admission, packing, and provider affinity; this executor owns the
-     * exact request or cached legacy fallback, per-UAL chain revalidation, and
-     * rotation settlement.
+     * Execute one provider after connection/network readiness. The caller owns
+     * roster, packing, and provider affinity; local sync admission starts the
+     * physical attempt before rotation marks are installed. This executor owns
+     * exact or cached legacy work, per-UAL chain revalidation, and settlement.
      * Returns immutable evidence for the caller to merge. A stale lifecycle is
      * discriminated by whether the physical attempt had already been admitted;
      * only the pre-admission variant guarantees zero attempt side effects.
      */
     async executeVmRecoveryBatch(input) {
-        const { localCgId, onChainCgId, peerId, attempts, unavailablePeerIds, headBlock, signal, isRecoveryCurrent, revalidateTarget, ctx, } = input;
+        const { localCgId, onChainCgId, peerId, attempts, unavailablePeerIds, headBlock, signal, isRecoveryCurrent, revalidateTarget, ctx, exactRecoveryTransportMode = 'stream-preferred', legacyAttemptTimeoutMs, registeredPublicEvidence, phases, } = input;
         const unavailablePeerIdSet = new Set(unavailablePeerIds);
         // The caller's last guard can race an unsubscribe/rebind before this
         // executor begins. Do not retain attempt evidence or emit a fetch event
         // until this exact lifecycle has been re-proved at the ownership boundary.
         if (!isRecoveryCurrent())
             return { kind: 'not-started-stale' };
-        const useCachedLegacyFallback = this.vmReconcileExactFilterUnsupported(peerId);
+        const useCachedLegacyFallback = exactRecoveryTransportMode !== 'stream-required'
+            && this.vmReconcileExactFilterUnsupported(peerId);
         const handledOrdinals = [];
         const attemptedOrdinals = [];
         const outcomes = [];
-        for (const attempt of attempts) {
-            const batchTarget = attempt.entry.target;
-            handledOrdinals.push(batchTarget.ordinal);
-            attemptedOrdinals.push(batchTarget.ordinal);
-            if (attempt.installedRecord) {
-                attempt.installedRecord.lastAttemptedPeerId = peerId;
-                attempt.installedRecord.attemptedPeerIds.add(peerId);
-                attempt.installedRecord.collectionDeadlineAt = this.vmReconcileRotationNow()
-                    + DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS;
-                this.touchVmReconcileRotationRecord(this.vmReconcileRotationSlotKey(batchTarget), attempt.installedRecord);
+        let workStarted = false;
+        const onWorkStarted = () => {
+            if (workStarted || !isRecoveryCurrent())
+                return;
+            workStarted = true;
+            for (const attempt of attempts) {
+                const batchTarget = attempt.entry.target;
+                this.vmReconcileTransportBudgetPolicy.recordAdmitted(batchTarget, peerId);
+                handledOrdinals.push(batchTarget.ordinal);
+                attemptedOrdinals.push(batchTarget.ordinal);
+                const record = attempt.installedRecord;
+                const slotKey = this.vmReconcileRotationSlotKey(batchTarget);
+                if (record && this.vmReconcileRotationState.get(slotKey) === record
+                    && record.fingerprint === this.vmReconcileRotationFingerprint(batchTarget)) {
+                    record.lastAttemptedPeerId = peerId;
+                    record.attemptedPeerIds.add(peerId);
+                    record.collectionDeadlineAt = this.vmReconcileRotationNow()
+                        + DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS;
+                    this.touchVmReconcileRotationRecord(slotKey, record);
+                }
+                this.emitReplication({
+                    contextGraphId: localCgId,
+                    onChainCgId: onChainCgId.toString(),
+                    action: 'fetch',
+                    ordinal: batchTarget.ordinal,
+                    kaId: batchTarget.kaId,
+                    ual: batchTarget.ual,
+                    detail: useCachedLegacyFallback
+                        ? 'legacy-sync'
+                        : attempts.length > 1 ? 'exact-asset-batch' : 'exact-asset',
+                });
             }
-            this.emitReplication({
-                contextGraphId: localCgId,
-                onChainCgId: onChainCgId.toString(),
-                action: 'fetch',
-                ordinal: batchTarget.ordinal,
-                kaId: batchTarget.kaId,
-                ual: batchTarget.ual,
-                detail: useCachedLegacyFallback
-                    ? 'legacy-sync'
-                    : attempts.length > 1 ? 'exact-asset-batch' : 'exact-asset',
-            });
-        }
+        };
         let disposition = 'incomplete';
+        let streamOutcome;
+        let localAdmissionDeferred = false;
+        const legacyAttemptStartedAt = Date.now();
+        const remainingLegacyAttemptMs = () => legacyAttemptTimeoutMs === undefined
+            ? undefined
+            : Math.max(0, legacyAttemptTimeoutMs - (Date.now() - legacyAttemptStartedAt));
         const runLegacyFallback = async () => {
+            const remainingMs = remainingLegacyAttemptMs();
+            // Both the exact-filter probe and a full-scan fallback belong to one
+            // provider turn. Do not grant a fresh long deadline after the probe has
+            // already spent the bounded legacy window.
+            if (remainingMs !== undefined && remainingMs < SYNC_MIN_GRAPH_BUDGET_MS) {
+                this.log.info(ctx, `VM legacy fallback for "${localCgId}" from ${peerId.slice(-8)} skipped: attempt budget exhausted`);
+                return;
+            }
             try {
                 const fallback = await this.runLegacyDurableSyncDetailed(ctx, peerId, [localCgId], undefined, undefined, undefined, {
                     stopOnBackoffWorthyFailure: true,
-                    priority: 1_000,
+                    priority: VM_RECOVERY_SYNC_PRIORITY,
                     source: 'vm-recovery',
+                    onWorkStarted,
                     signal,
                     isCurrent: isRecoveryCurrent,
+                    ...(remainingMs === undefined ? {} : { totalTimeoutMs: remainingMs }),
                 });
+                if (fallback.admission === 'work-started')
+                    onWorkStarted();
+                // An admitted exact request retains its attempt through a refused
+                // fallback. Only the original never-started operation can defer.
+                localAdmissionDeferred = !workStarted && fallback.admission === 'local-admission-deferred';
                 this.log.info(ctx, `VM legacy fallback for "${localCgId}" from ${peerId.slice(-8)}: fetched=${fallback.result.fetchedDataTriples + fallback.result.fetchedMetaTriples} inserted=${fallback.result.insertedTriples} failed=${fallback.result.failedPeers + fallback.result.failedPhases}`);
             }
             catch (fallbackError) {
                 this.log.info(ctx, `VM legacy fallback for "${localCgId}" from ${peerId.slice(-8)} failed: ${fallbackError instanceof Error ? fallbackError.message : String(fallbackError)}`);
             }
         };
+        const exchangeInterval = phases?.begin();
         try {
             if (useCachedLegacyFallback) {
                 await runLegacyFallback();
             }
             else {
-                const detailed = await this.syncExactKnowledgeAssetsFromPeerDetailed(peerId, localCgId, attempts.map(({ entry }) => entry.target.ual), { signal, isCurrent: isRecoveryCurrent });
+                const detailed = await this.syncExactKnowledgeAssetsFromPeerDetailed(peerId, localCgId, attempts.map(({ entry }) => entry.target.ual), {
+                    signal, isCurrent: isRecoveryCurrent, onWorkStarted, exactRecoveryTransportMode,
+                    ...(legacyAttemptTimeoutMs === undefined ? {} : { totalTimeoutMs: legacyAttemptTimeoutMs }),
+                    ...(registeredPublicEvidence ? { registeredPublicEvidence } : {}),
+                });
                 const { result } = detailed;
                 disposition = detailed.disposition;
-                if (detailed.responderCapability === 'legacy-filter-unsupported') {
+                streamOutcome = detailed.streamOutcome;
+                // A fresh capability response is physical peer evidence even when
+                // its later ordinary fallback cannot acquire local capacity.
+                if (detailed.admission === 'work-started' || detailed.responderCapability !== undefined)
+                    onWorkStarted();
+                localAdmissionDeferred = !workStarted && detailed.admission === 'local-admission-deferred';
+                if (exactRecoveryTransportMode !== 'stream-required' && detailed.responderCapability === 'legacy-filter-unsupported') {
                     this.rememberVmReconcileExactFilterUnsupported(peerId);
                     if (isRecoveryCurrent() && disposition === 'incomplete') {
                         await runLegacyFallback();
@@ -5316,18 +5009,44 @@ export class SwmHostModeMethods extends DKGAgentBase {
         catch (error) {
             this.log.info(ctx, `VM exact fetch for "${localCgId}" from ${peerId.slice(-8)} failed: ${error instanceof Error ? error.message : String(error)}`);
         }
+        if (phases && exchangeInterval)
+            phases.chargeSince('exchange', exchangeInterval.startedAt, exchangeInterval.before);
         if (!isRecoveryCurrent())
-            return { kind: 'stale-after-attempt' };
+            return { kind: workStarted ? 'stale-after-attempt' : 'not-started-stale' };
+        if (localAdmissionDeferred)
+            return { kind: 'local-admission-deferred' };
+        // A stream that answered busy or broke says nothing about the peer's data.
+        // The policy decides whether the targets still pending keep their turn at it.
+        let providerTurnKept = false;
+        if (workStarted && streamOutcome !== undefined) {
+            if (streamOutcome === 'complete') {
+                this.vmReconcileStreamSetbackPolicy.recordServed(localCgId, peerId, this.vmReconcileRotationNow());
+            }
+            else {
+                const setback = this.vmReconcileStreamSetbackPolicy.recordSetback(localCgId, peerId, streamOutcome, this.vmReconcileRotationNow());
+                providerTurnKept = setback.keepsTurn;
+                observeVmRecoveryTiming(() => this.log.info(ctx, `VM exact recovery stream setback for "${localCgId}" from ${peerId.slice(-8)}: `
+                    + `kind=${streamOutcome} assets=${attempts.length} keepsTurn=${setback.keepsTurn ? 1 : 0} `
+                    + `holdOffMs=${setback.holdOffMs}`));
+            }
+        }
         const perUalDispositions = new Map();
-        for (const attempt of attempts) {
+        // The batch's targets are re-verified side by side, with the scan's own
+        // bound, so their chain reads can leave in one request. Like the scan, a
+        // target that throws stops the ones not yet started and the batch rejects
+        // only once the ones in flight have finished: nothing here outlives the
+        // pass. They are settled in order below: each step still sees the rotation
+        // state its predecessor left.
+        const revalidateBatch = () => mapWithConcurrencyDrained(attempts, DKGAgentBase.VM_RECONCILE_ORDINAL_CONCURRENCY, (attempt) => this.reconcileChainOrdinal(localCgId, onChainCgId, attempt.entry.target.ordinal, headBlock, {
+            isTargetCurrent: isRecoveryCurrent,
+            revalidateTarget,
+        }));
+        const revalidated = await (phases ? phases.measure('post-fetch', revalidateBatch) : revalidateBatch());
+        if (!isRecoveryCurrent())
+            return { kind: 'stale-after-attempt' };
+        for (const [attemptIndex, attempt] of attempts.entries()) {
             const batchTarget = attempt.entry.target;
-            const outcome = await this.reconcileChainOrdinal(localCgId, onChainCgId, batchTarget.ordinal, headBlock, {
-                isTargetCurrent: isRecoveryCurrent,
-                revalidateTarget,
-                deferActiveFetch: true,
-            });
-            if (!isRecoveryCurrent())
-                return { kind: 'stale-after-attempt' };
+            const outcome = revalidated[attemptIndex];
             outcomes.push([batchTarget.ordinal, outcome]);
             const perTargetDisposition = (outcome.status === 'reconciled' || outcome.status === 'already')
                 ? 'found'
@@ -5336,6 +5055,8 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     : 'incomplete';
             perUalDispositions.set(batchTarget.ual, perTargetDisposition);
             if (outcome.status === 'pending' && outcome.recovery) {
+                if (!workStarted)
+                    continue;
                 const batchRecord = attempt.installedRecord;
                 if (!batchRecord || this.vmReconcileRotationClosed)
                     continue;
@@ -5343,10 +5064,14 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     !== batchRecord)
                     continue;
                 const candidateMembershipAfter = this.vmReconcileObservedCandidatePeerIds(localCgId);
+                if (providerTurnKept) {
+                    this.releaseVmReconcileRotationAttempt(batchTarget, peerId, batchRecord);
+                }
                 if (!this.vmReconcilePeerMembershipMatches(batchRecord.candidatePeerIds, candidateMembershipAfter)) {
                     this.prepareVmReconcileRotationTarget(outcome.recovery, candidateMembershipAfter, this.vmReconcileRotationNow());
                 }
-                else if (this.vmReconcileRecoveryTargetMatches(batchTarget, outcome.recovery)) {
+                else if (!providerTurnKept
+                    && this.vmReconcileRecoveryTargetMatches(batchTarget, outcome.recovery)) {
                     this.settleVmReconcileRotationAttempt(batchTarget, peerId, perTargetDisposition, attempt.candidatePeerIds, batchRecord, unavailablePeerIdSet);
                 }
             }
@@ -5361,6 +5086,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             attemptedOrdinals,
             providerDisposition: disposition,
             perUalDispositions: [...perUalDispositions],
+            providerTurnKept,
         };
     }
     /**
@@ -5376,6 +5102,26 @@ export class SwmHostModeMethods extends DKGAgentBase {
             && this.vmReconcileLifecycleGeneration === rotationGeneration
             && isTargetCurrent();
         const ctx = createOperationContext('system');
+        // Advisory sizing preparation (opt-in, default off). Created lazily and
+        // owned by this host; every hint is bound to this exact recovery operation.
+        const readUpdateContextForPreparation = this.chain.getKnowledgeAssetUpdateContext;
+        const experimentPolicy = resolveVmRecoveryExperimentPolicy(this.config.vmRecoveryPrefetchEnabled, existingVmRecoveryPreparation(this)?.limits);
+        const preparation = experimentPolicy.prefetchEnabled
+            ? vmRecoveryPreparationFor(this, typeof readUpdateContextForPreparation === 'function'
+                ? { readUpdateContext: (id, readOptions) => readUpdateContextForPreparation.call(this.chain, id, readOptions) }
+                : null)
+            : undefined;
+        const preparationScope = {
+            localCgId,
+            onChainCgId,
+            generation: rotationGeneration,
+            ...(signal ? { signal } : {}),
+            isCurrent: isRecoveryCurrent,
+        };
+        const transportPreparation = preparation
+            ? new VmRecoveryTransportPreparation(preparation, preparationScope) : undefined;
+        const timing = new VmRecoveryTimingObserver(localCgId, (message) => this.log.info(ctx, message));
+        const phases = timing.phases;
         const noRecovery = (continuationOrdinal, cooldownOnly = false) => ({
             outcomes: new Map(),
             attemptedOrdinals: [],
@@ -5508,7 +5254,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             ...(this.vmReconcileCuratorPeersByCg.get(localCgId) ?? []),
         ];
         const curatorPageCursor = this.vmReconcileCuratorPageCursorByCg.get(localCgId);
-        const curatorResolution = await this.resolveCuratorPeerIdsForCg(localCgId, {
+        const curatorResolution = await phases.measure('roster', () => this.resolveCuratorPeerIdsForCg(localCgId, {
             maxPeerIds: DKGAgentBase.VM_RECONCILE_EXACT_ROSTER_MAX,
             // Once overflow is proven, expose exactly one new ordered peer per pass.
             // One target can spend only one peer attempt, so advancing by more would
@@ -5523,7 +5269,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             curatorIsLocal: false,
             legacyTripleResolved: false,
             lookupFailed: true,
-        }));
+        })));
         if (!isRecoveryCurrent())
             return staleRecovery();
         const allResolvedCuratorPeerIds = [...new Set(curatorResolution.peerIds
@@ -5569,7 +5315,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         let legacyPreferredPeerId;
         if (resolutionSucceeded && !curatorResolution.curatorIsLocal
             && resolvedCuratorPeerIds.length === 0) {
-            legacyPreferredPeerId = await this.resolvePreferredSyncPeerId(localCgId);
+            legacyPreferredPeerId = await phases.measure('roster', () => this.resolvePreferredSyncPeerId(localCgId));
         }
         if (!isRecoveryCurrent())
             return staleRecovery();
@@ -5625,6 +5371,79 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // Curator resolution may connect a missing peer, but it must not substitute
         // a different ranking algorithm and invalidate an otherwise stable roster.
         const orderedPeerIds = this.vmReconcileObservedCandidatePeerIds(localCgId);
+        // Only an explicit experimental run may reorder these existing capped
+        // transport candidates. The proof roster and every target's independent
+        // attempted/absence credits stay unchanged. Identify does not prove data.
+        const experimentalStreamPeerIds = new Set();
+        // Observation only: why this pass did or did not choose the stream wire.
+        let streamAdvertisedCount = 0;
+        const advertisedStreamPeers = new Set();
+        // The registered-public answer that gates the stream wire. Retry eligibility, the wire
+        // choice and the log label all derive from this one typed observation.
+        const passAuthority = new VmRecoveryPassAuthority(undefined, undefined, experimentPolicy.authorityRetry);
+        const readRegisteredPublicAuthority = async () => {
+            await phases.measure('authority', () => passAuthority.read(() => this.resolveRegisteredContextGraphAuthority(localCgId, {
+                authorityReadMode: 'finalized-index-or-live', signal,
+            })));
+            if (passAuthority.isPublic && isRecoveryCurrent()) {
+                for (const advertisedPeerId of advertisedStreamPeers)
+                    experimentalStreamPeerIds.add(advertisedPeerId);
+            }
+        };
+        const prepareThisPassTargets = () => {
+            if (!experimentPolicy.prefetchEnabled || orderedPeerIds.length === 0)
+                return;
+            // The planner sizes this pass's own targets as soon as a provider is chosen.
+            // Start that early, but never ahead of the registered-authority read that gates
+            // the wire: a miss there costs far more than the sizing it would overlap. The
+            // first target keeps its own live read (a probe sizes its single asset itself),
+            // so preparing never adds a read the unprepared path would not make. Pure
+            // metadata: nothing is marked handled or attempted.
+            transportPreparation?.preparePass(currentTargets
+                .slice(1)
+                .map((candidate) => ({ kaId: candidate.kaId })));
+        };
+        if (resolveExactBatchStreamEnabled()) {
+            const transportInterval = phases.begin();
+            const advertised = await Promise.all(orderedPeerIds
+                .filter((peerId) => connectedByPeerId.has(peerId)
+                && this.peerCapabilityRegistry.supportsCore(peerId)
+                && !exactBatchStreamUnsupported(this, peerId, this.getSyncReconcilerConnectionKey(peerId), Date.now(), this.captureExperimentalExactBatchRefusalScope(localCgId)))
+                .map(async (peerId) => {
+                try {
+                    return (await this.getPeerProtocols(peerId)).includes(EXACT_BATCH_STREAM_PROTOCOL) ? peerId : undefined;
+                }
+                catch {
+                    return undefined;
+                }
+            }));
+            phases.chargeSince('transport', transportInterval.startedAt, transportInterval.before);
+            streamAdvertisedCount = advertised.filter((peerId) => peerId !== undefined).length;
+            if (streamAdvertisedCount > 0) {
+                for (const advertisedPeerId of advertised) {
+                    if (advertisedPeerId !== undefined)
+                        advertisedStreamPeers.add(advertisedPeerId);
+                }
+                await readRegisteredPublicAuthority();
+                if (!isRecoveryCurrent())
+                    return staleRecovery();
+                prepareThisPassTargets();
+                if (experimentPolicy.authorityRetry.kind === 'spaced' && passAuthority.missed) {
+                    // A miss here is usually the shared local request budget, not the graph: the
+                    // read's detached resolution keeps warming the projection cache after its
+                    // deadline. Give it a short, bounded moment and ask once more before the
+                    // pass commits to the legacy singleton wire for every provider it tries.
+                    const retry = await phases.measure('authority', () => passAuthority.waitForMissRetry(signal));
+                    if (!isRecoveryCurrent())
+                        return staleRecovery();
+                    if (retry)
+                        await readRegisteredPublicAuthority();
+                    if (!isRecoveryCurrent())
+                        return staleRecovery();
+                }
+            }
+        }
+        prepareThisPassTargets();
         // Curator preparation may have grown or shrunk the connected candidate
         // set. Re-evaluate every target against that observed change. Any roster
         // change breaks backoff and starts a fresh proof cycle.
@@ -5690,6 +5509,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         const providerPolicy = new VmRecoveryProviderPolicy();
         const handledBatchOrdinals = new Set();
         let recoveryWorkRan = false;
+        let localAdmissionDeferred = false;
         for (let eligibleIndex = 0; eligibleIndex < eligible.length; eligibleIndex += 1) {
             if (!isRecoveryCurrent())
                 break;
@@ -5697,6 +5517,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
             const { target } = entry;
             if (handledBatchOrdinals.has(target.ordinal))
                 continue;
+            const batchTiming = timing.beginBatch();
             const record = entry.prepared.record;
             const installedRecord = record
                 && this.vmReconcileRotationState.get(this.vmReconcileRotationSlotKey(target)) === record
@@ -5711,21 +5532,27 @@ export class SwmHostModeMethods extends DKGAgentBase {
             // uncredited, but consume this target's turn so another missing KA gets
             // the next physical peer slot in the same bounded pass.
             let peerId;
-            const candidatePeerId = this.selectVmReconcileExactCandidate(installedRecord, orderedPeerIds, providerPolicy);
+            if (advertisedStreamPeers.size > 0
+                && passAuthority.retryDue()) {
+                // One pass can try several providers over minutes, and every wire choice below
+                // follows this single registered-public observation. A transient miss at pass
+                // start (the read shares a saturated local request budget; its detached
+                // resolution keeps warming the projection cache) would otherwise pin every
+                // later provider of the pass to the legacy singleton wire. Read it again, at
+                // most once per interval, before choosing the next provider.
+                await readRegisteredPublicAuthority();
+                if (!isRecoveryCurrent())
+                    return staleRecovery();
+            }
+            const candidatePeerId = this.selectVmReconcileExactCandidate(installedRecord, orderedPeerIds, providerPolicy, { localCgId, onChainCgId: expectedOnChainCgId, experimentalStreamPeerIds });
+            // One policy capture owns every later transition and token fence.
+            const preferenceAttempt = this.vmReconcilePublicCoreTransportPreferencePolicy.capture(localCgId, expectedOnChainCgId, orderedPeerIds);
             if (candidatePeerId) {
-                attemptedOrdinals.add(target.ordinal);
-                if (installedRecord) {
-                    installedRecord.lastAttemptedPeerId = candidatePeerId;
-                    installedRecord.attemptedPeerIds.add(candidatePeerId);
-                    installedRecord.collectionDeadlineAt = this.vmReconcileRotationNow()
-                        + DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS;
-                    this.touchVmReconcileRotationRecord(this.vmReconcileRotationSlotKey(target), installedRecord);
-                }
                 let connectedPeer = connectedByPeerId.get(candidatePeerId);
                 if (!connectedPeer) {
-                    await this.ensurePeerConnected(candidatePeerId, { signal }).catch((error) => {
+                    await phases.measure('peer-ready', () => this.ensurePeerConnected(candidatePeerId, { signal }).catch((error) => {
                         this.log.info(ctx, `VM exact fetch could not connect candidate peer ${candidatePeerId.slice(-8)}: ${error instanceof Error ? error.message : String(error)}`);
-                    });
+                    }));
                     if (!isRecoveryCurrent())
                         return staleRecovery();
                     const connection = this.node.libp2p.getConnections()
@@ -5736,7 +5563,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 }
                 recoveryWorkRan = true;
                 const protocolReady = connectedPeer
-                    ? await this.waitForSyncProtocol(connectedPeer, signal)
+                    ? await phases.measure('peer-ready', () => this.waitForSyncProtocol(connectedPeer, signal))
                     : false;
                 if (!isRecoveryCurrent())
                     return staleRecovery();
@@ -5747,7 +5574,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     // Network boundary: a merely-connected peer is not necessarily
                     // admitted to this DKG network. Never send an authenticated exact
                     // request to an unverified or rejected peer.
-                    const peerAdmitted = await this.ensurePeerAdmittedForRecovery(candidatePeerId, ctx, 'VM exact fetch', signal);
+                    const peerAdmitted = await phases.measure('peer-ready', () => this.ensurePeerAdmittedForRecovery(candidatePeerId, ctx, 'VM exact fetch', signal));
                     if (!isRecoveryCurrent())
                         return staleRecovery();
                     if (!peerAdmitted)
@@ -5757,25 +5584,41 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 }
             }
             if (!peerId) {
+                if (candidatePeerId) {
+                    this.vmReconcilePublicCoreTransportPreferencePolicy.revoke(preferenceAttempt, candidatePeerId);
+                }
+                // A failed connection/protocol/network-admission probe still consumes
+                // its bounded provider turn. A ready peer is marked only by the exact
+                // executor after local sync capacity admits its physical work.
+                if (candidatePeerId) {
+                    attemptedOrdinals.add(target.ordinal);
+                    if (installedRecord) {
+                        installedRecord.lastAttemptedPeerId = candidatePeerId;
+                        installedRecord.attemptedPeerIds.add(candidatePeerId);
+                        installedRecord.collectionDeadlineAt = this.vmReconcileRotationNow()
+                            + DKGAgentBase.VM_RECONCILE_NEGATIVE_BACKOFF_MAX_MS;
+                        this.touchVmReconcileRotationRecord(this.vmReconcileRotationSlotKey(target), installedRecord);
+                    }
+                }
                 if (installedRecord) {
                     this.settleVmReconcileRotationAttempt(target, undefined, 'incomplete', candidatePeerIds, installedRecord, providerPolicy.unavailablePeerIds());
                 }
                 continue;
             }
+            const carriedHolder = this.vmReconcilePublicCoreTransportPreferencePolicy.canReuse(preferenceAttempt, peerId, candidatePeerIds);
+            if (carriedHolder)
+                providerPolicy.seedProvenHolder(peerId);
             const providerAttempt = providerPolicy.beginAttempt(peerId);
             if (!providerAttempt)
                 continue;
-            let batchAttempts = [{
-                    entry,
-                    installedRecord,
-                    candidatePeerIds,
-                }];
-            // The first exact request to a peer remains a single-KA probe. Once that
-            // probe has proved the peer is a holder, pack a stable compatible prefix
-            // by authoritative size hints. Unknown footprints stay singleton; the
-            // exact-sync protocol's ten-UAL cap remains the hard upper bound.
-            if (providerAttempt.kind === 'proven-holder-reuse') {
-                const compatible = [];
+            const admittedConnectionKey = this.getSyncReconcilerConnectionKey(peerId);
+            // Choose the admitted singleton probe or rotation-compatible holder
+            // prefix before sizing; one pipeline owns its selection and wire mode.
+            const candidateAttempts = [];
+            if (providerAttempt.kind === 'probe') {
+                candidateAttempts.push({ entry, installedRecord, candidatePeerIds });
+            }
+            else {
                 for (let candidateIndex = eligibleIndex; candidateIndex < eligible.length; candidateIndex += 1) {
                     const candidateEntry = eligible[candidateIndex];
                     const candidateTarget = candidateEntry.target;
@@ -5786,8 +5629,8 @@ export class SwmHostModeMethods extends DKGAgentBase {
                         && this.vmReconcileRotationState.get(this.vmReconcileRotationSlotKey(candidateTarget)) === candidateRecord
                         ? candidateRecord
                         : undefined;
-                    // The current target was selected and marked attempted before the
-                    // connection/admission boundary. Later candidates must still prove
+                    // The current target already passed connection/network admission.
+                    // Later candidates must still prove
                     // this peer remains uncredited in their independent rotation record.
                     const peerEligible = candidateIndex === eligibleIndex
                         || (candidateInstalledRecord
@@ -5795,7 +5638,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                             : orderedPeerIds.includes(peerId));
                     if (!peerEligible)
                         break;
-                    compatible.push({
+                    candidateAttempts.push({
                         entry: candidateEntry,
                         installedRecord: candidateInstalledRecord,
                         candidatePeerIds: candidateInstalledRecord
@@ -5803,53 +5646,85 @@ export class SwmHostModeMethods extends DKGAgentBase {
                             : orderedPeerIds,
                     });
                 }
-                // Only candidates that survived rotation/admission are sized. Keeping
-                // this hint local to the planner avoids broadening the canonical chain
-                // ordinal target and does not waste bounded RPC reads on ineligible
-                // prefixes. Missing/failed hints remain conservative singletons.
-                const readVmRecoveryUpdateContext = this.chain.getKnowledgeAssetUpdateContext;
-                const sizedCandidates = await enrichVmRecoveryFootprints(compatible.map((attempt) => ({
-                    attempt,
-                    kaId: attempt.entry.target.kaId,
-                })), onChainCgId, {
-                    resolvePublicAccess: async (contextGraphId) => (await withRpcUsageSite(CG_AUTH_RPC_SITES.vmSizing, 
-                    // Sizing a recovery batch: this decides how much to READ, not
-                    // who may. A bound stale by one index tick changes a batch
-                    // size, and the next pass corrects it. Inert unless the
-                    // operator enables `chain.boundedAuthorityReads`.
-                    () => this.readLiveOnChainAccessPolicy(contextGraphId.toString(), ctx, { freshness: 'bounded' }))) === 0,
-                    sizing: typeof readVmRecoveryUpdateContext === 'function'
-                        ? {
-                            readUpdateContext: (kaId, readOptions) => readVmRecoveryUpdateContext.call(this.chain, kaId, readOptions),
-                        }
-                        : null,
-                }, {
-                    maxContextReads: MAX_EXACT_SYNC_ASSETS,
-                    signal,
-                    isCurrent: isRecoveryCurrent,
-                });
-                if (!isRecoveryCurrent())
-                    return noRecovery();
-                const plannableTargets = sizedCandidates.map(({ attempt, recoveryFootprint }) => ({
-                    attempt,
-                    recoveryFootprint,
-                }));
-                const plan = planVmRecoveryMicrobatch(plannableTargets, VM_EXACT_MICROBATCH_LIMITS, (plannedTargets) => Buffer.byteLength(encodeExactAssetUals(plannedTargets.map(({ attempt }) => attempt.entry.target.ual)), 'utf8'));
-                if (plan.targets.length === 0) {
-                    this.log.warn(ctx, `VM exact recovery selector for "${localCgId}" exceeds the executor cap; `
-                        + `ordinal=${target.ordinal} selectorCap=${VM_EXACT_MICROBATCH_LIMITS.maxSelectorBytes}`);
-                    if (installedRecord) {
-                        this.settleVmReconcileRotationAttempt(target, undefined, 'incomplete', candidatePeerIds, installedRecord, providerPolicy.unavailablePeerIds());
-                    }
-                    providerPolicy.finishAttempt(providerAttempt, 'incomplete', new Map([[target.ual, 'incomplete']]));
-                    continue;
+            }
+            const streamEligibleProvider = passAuthority.isPublic && experimentalStreamPeerIds.has(peerId)
+                && !exactBatchStreamUnsupported(this, peerId, admittedConnectionKey, Date.now(), this.captureExperimentalExactBatchRefusalScope(localCgId));
+            let transportPlan;
+            transportPlan = await phases.measure('sizing', () => planVmRecoveryTransport({
+                candidates: candidateAttempts.map(attempt => ({
+                    attempt, kaId: attempt.entry.target.kaId, assetUal: attempt.entry.target.ual,
+                })),
+                providerAttemptKind: providerAttempt.kind, onChainCgId,
+                streamEligible: streamEligibleProvider, registeredPublicAccess: passAuthority.isPublic,
+                legacyAttemptTimeoutMs: this.vmReconcileTransportBudgetPolicy.timeoutFor({
+                    target, peerId, providerAttemptKind: providerAttempt.kind,
+                    registeredPublicAccess: passAuthority.isPublic,
+                    competingStreamAvailable: experimentalStreamPeerIds.size > 0
+                        && !experimentalStreamPeerIds.has(peerId),
+                    streamEligible: streamEligibleProvider,
+                }),
+                signal, isCurrent: isRecoveryCurrent,
+                observeSizing: batchTiming.observeSizing,
+                // Start reads in candidate order with a small bound so each read's
+                // deadline measures its own round trip, not its wait in the local
+                // RPC governor behind earlier candidates.
+                ...experimentPolicy.sizing,
+                ...(experimentPolicy.prefetchEnabled ? {
+                    probeRemainder: eligible.slice(eligibleIndex + 1)
+                        .filter(candidate => !handledBatchOrdinals.has(candidate.target.ordinal))
+                        .map(candidate => ({ kaId: candidate.target.kaId })),
+                } : {}),
+            }, {
+                createSizingReader: () => {
+                    const readContext = this.chain.getKnowledgeAssetUpdateContext;
+                    return typeof readContext === 'function'
+                        ? { readUpdateContext: (kaId, readOptions) => readContext.call(this.chain, kaId, readOptions) }
+                        : null;
+                },
+                resolvePublicAccess: async (contextGraphId) => (await withRpcUsageSite(CG_AUTH_RPC_SITES.vmSizing, 
+                // This bounded observation controls soft sizing only. Canonical
+                // root/version/binding authority is still checked per asset.
+                () => this.readLiveOnChainAccessPolicy(contextGraphId.toString(), ctx, { freshness: 'bounded' }))) === 0,
+                preparation: transportPreparation,
+            }));
+            if (!isRecoveryCurrent())
+                return providerAttempt.kind === 'probe' ? staleRecovery() : noRecovery();
+            const { attempts: batchAttempts, transportMode: exactRecoveryTransportMode, publicAccessEvidence: publicRecoveryAccessVerified, packing, legacyAttemptTimeoutMs, } = transportPlan;
+            if (batchAttempts.length === 0) {
+                this.vmReconcilePublicCoreTransportPreferencePolicy.revoke(preferenceAttempt, peerId);
+                this.log.warn(ctx, `VM exact recovery selector for "${localCgId}" exceeds the executor cap; `
+                    + `ordinal=${target.ordinal} selectorCap=${VM_EXACT_MICROBATCH_LIMITS.maxSelectorBytes}`);
+                if (installedRecord) {
+                    this.settleVmReconcileRotationAttempt(target, undefined, 'incomplete', candidatePeerIds, installedRecord, providerPolicy.unavailablePeerIds());
                 }
-                batchAttempts = plan.targets.map(({ attempt }) => attempt);
+                providerPolicy.finishAttempt(providerAttempt, 'incomplete', new Map([[target.ual, 'incomplete']]));
+                continue;
+            }
+            observeVmRecoveryTiming(() => this.log.info(ctx, `VM exact recovery transport for "${localCgId}" from ${peerId.slice(-8)}: kind=${providerAttempt.kind} `
+                + `transport=${exactRecoveryTransportMode} assets=${batchAttempts.length} `
+                + `streamAdvertised=${streamAdvertisedCount} streamPeers=${experimentalStreamPeerIds.size} `
+                + `registeredAuthority=${passAuthority.label}`));
+            if (packing !== undefined) {
                 this.log.info(ctx, `VM exact recovery plan for "${localCgId}" from ${peerId.slice(-8)}: `
-                    + `assets=${batchAttempts.length} estimatedBytes=${plan.estimatedBytes} `
-                    + `estimatedLeaves=${plan.estimatedLeaves} `
-                    + `completeFootprints=${plan.completeFootprints}`);
+                    + `assets=${batchAttempts.length} estimatedBytes=${packing.estimatedBytes} `
+                    + `estimatedLeaves=${packing.estimatedLeaves} `
+                    + `completeFootprints=${packing.completeFootprints} transport=${exactRecoveryTransportMode}`);
+            }
+            if (carriedHolder && !this.vmReconcilePublicCoreTransportPreferencePolicy.revalidateReuse(preferenceAttempt, peerId, admittedConnectionKey)) {
+                // Sizing outlived the captured holder proof; the next slice must probe.
+                if (activeFetchCooldownOwner !== undefined) {
+                    this.clearVmReconcileActiveFetchCooldown(localCgId, activeFetchCooldownOwner);
+                }
+                return {
+                    outcomes, attemptedOrdinals: [...attemptedOrdinals],
+                    continuationOrdinal: target.ordinal, hasImmediateRecoveryWork: true, cooldownOnly: false,
+                };
             }
+            // Only while preparation is on: the exchange may rely on this pass's own fresh positive
+            // answer instead of reading it again. The handle dies with the exchange.
+            const registeredPublicEvidence = experimentPolicy.sharePassAuthorityEvidence
+                ? passAuthority.evidence({ contextGraphId: localCgId, signal, isCurrent: isRecoveryCurrent })
+                : undefined;
             const execution = await this.executeVmRecoveryBatch({
                 localCgId,
                 onChainCgId,
@@ -5861,16 +5736,52 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 isRecoveryCurrent,
                 revalidateTarget,
                 ctx,
-            });
-            if (execution.kind !== 'completed')
+                exactRecoveryTransportMode,
+                ...(legacyAttemptTimeoutMs === undefined ? {} : { legacyAttemptTimeoutMs }),
+                ...(registeredPublicEvidence ? { registeredPublicEvidence } : {}),
+                phases,
+            }).finally(() => registeredPublicEvidence?.revoke());
+            if (execution.kind === 'local-admission-deferred') {
+                // Capacity is node-local, so trying other providers would burn their
+                // turns under the same refusal. Retain all peer evidence and yield the
+                // whole slice for the scheduler's bounded local retry.
+                localAdmissionDeferred = true;
+                break;
+            }
+            if (execution.kind !== 'completed' || !isRecoveryCurrent())
                 return staleRecovery();
+            batchTiming.complete({ peerId, assets: batchAttempts.length,
+                candidates: eligible.length - eligibleIndex, kind: providerAttempt.kind,
+                transport: exactRecoveryTransportMode, streamAdvertised: streamAdvertisedCount,
+                streamPeers: experimentalStreamPeerIds.size, registeredAuthority: passAuthority.label });
             for (const [ordinal, outcome] of execution.outcomes)
                 outcomes.set(ordinal, outcome);
             for (const ordinal of execution.handledOrdinals)
                 handledBatchOrdinals.add(ordinal);
             for (const ordinal of execution.attemptedOrdinals)
                 attemptedOrdinals.add(ordinal);
-            providerPolicy.finishAttempt(providerAttempt, execution.providerDisposition, new Map(execution.perUalDispositions));
+            if (execution.providerTurnKept) {
+                // Busy or a broken stream: the peer is not spent for this slice. It is
+                // asked again, with a fresh probe, once its hold-off has passed.
+                providerPolicy.releaseAttempt(providerAttempt);
+            }
+            else {
+                providerPolicy.finishAttempt(providerAttempt, execution.providerDisposition, new Map(execution.perUalDispositions));
+            }
+            const completelyVerified = execution.providerDisposition === 'found'
+                && execution.perUalDispositions.length === batchAttempts.length
+                && execution.perUalDispositions.every(([, disposition]) => disposition === 'found');
+            const preferenceSettlement = this.vmReconcilePublicCoreTransportPreferencePolicy.settle(preferenceAttempt, {
+                peerId, connectionKey: admittedConnectionKey, completelyVerified,
+                publicAccessVerified: publicRecoveryAccessVerified,
+                reusedHolder: providerAttempt.kind === 'proven-holder-reuse', carriedHolder,
+            });
+            if (preferenceSettlement.yield) {
+                this.log.info(ctx, `VM exact recovery yield: reason=verified-core-turn assets=${batchAttempts.length} `
+                    + `publicSizingAccess=${publicRecoveryAccessVerified === undefined ? 'unknown' : publicRecoveryAccessVerified} `
+                    + `holderCreditPresent=${preferenceSettlement.holderCreditPresent}`);
+                break;
+            }
         }
         const eligibleOrdinals = new Set(eligible.map(({ target }) => target.ordinal));
         const unattemptedContinuationOrdinal = currentTargets.find((target) => eligibleOrdinals.has(target.ordinal) && !attemptedOrdinals.has(target.ordinal))?.ordinal;
@@ -5901,6 +5812,19 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // negative backoff applies exactly as before.
         if (!isRecoveryCurrent())
             return staleRecovery();
+        if (localAdmissionDeferred) {
+            if (activeFetchCooldownOwner !== undefined) {
+                this.clearVmReconcileActiveFetchCooldown(localCgId, activeFetchCooldownOwner);
+            }
+            return {
+                outcomes,
+                attemptedOrdinals: [...attemptedOrdinals],
+                continuationOrdinal: unattemptedContinuationOrdinal,
+                hasImmediateRecoveryWork: false,
+                cooldownOnly: false,
+                localAdmissionDeferred: true,
+            };
+        }
         const recoveredAny = [...outcomes.values()]
             .some((outcome) => outcome.status === 'reconciled' || outcome.status === 'already');
         if (!recoveryWorkRan
@@ -5917,6 +5841,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 this.installVmReconcileActiveFetchCooldown(localCgId, Date.now());
             }
         }
+        timing.finish(eligible.length, preparation ? () => preparation.stats() : undefined);
         return {
             outcomes,
             attemptedOrdinals: [...attemptedOrdinals],
@@ -5934,7 +5859,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
      * latest on-chain merkle root + publisher, build the UAL, and ask the
      * finalization handler to promote the matching local SWM snapshot to VM
      * (verifying the CG binding from chain). When no local SWM matches, run an
-     * active core-first catch-up fetch and retry once. A successful result is
+     * queue the exact target for bounded batch recovery. A successful result is
      * validated against one coherent pinned version snapshot before it earns a
      * same-finalized-block shortcut; a new block always reads again. `headBlock`
      * remains the independent cursor observation for the reorg-depth gate. See
@@ -5942,7 +5867,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
      *
      * Local first: before any root, publisher or version read, the handler
      * classifies what the store holds for the KA. A confirmed VM copy with
-     * nothing else to promote settles as `already`, and in the deferred mode an
+     * nothing else to promote settles as `already`, and an
      * asset held nowhere locally goes straight to the exact-recovery queue, both
      * without chain reads. Only local state whose outcome depends on the root
      * takes the chain-backed path below.
@@ -6016,11 +5941,10 @@ export class SwmHostModeMethods extends DKGAgentBase {
             });
             return { status: 'already', blockNumber: headBlock ?? 0 };
         }
-        if (localCandidate.kind === 'none' && options.deferActiveFetch) {
+        if (localCandidate.kind === 'none') {
             // Nothing local can match any root, so the chain-backed path could only
             // answer `no-swm`. Queue the same exact-recovery target it would; the
             // recovery batch keeps its rotation backoff, cooldown and peer gating.
-            // The inline mode keys its negative cache by the root and keeps reading it.
             if (!(await targetMayMaterialize()))
                 return { status: 'skip' };
             this.emitReplication({
@@ -6082,18 +6006,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
             }
             merkleRoot = await this.chain.getLatestMerkleRoot(kaId);
             cacheKey = this.vmReconcileCacheKey(localCgId, ual, merkleRoot);
-            if (!options.deferActiveFetch && await this.shouldDeferVmReconcileByNegativeCache(cacheKey, localCgId)) {
-                this.emitReplication({
-                    contextGraphId: localCgId,
-                    onChainCgId: onChainCgId.toString(),
-                    action: 'defer',
-                    ordinal,
-                    kaId: kaId.toString(),
-                    ual,
-                    detail: 'negative-cache',
-                });
-                return { status: 'pending' };
-            }
             publisherAddress = (this.chain.getLatestMerkleRootPublisher
                 ? await this.chain.getLatestMerkleRootPublisher(kaId)
                 : '') ?? '';
@@ -6140,119 +6052,33 @@ export class SwmHostModeMethods extends DKGAgentBase {
                 return undefined;
             }
         };
-        let swmState;
-        let activeFetchRan = false;
-        let activeFetchHadUsableResponse = false;
-        const cleanMissPeerIds = new Set();
         if (!(await targetMayMaterialize()))
             return { status: 'skip' };
-        let outcome = await reconcileKnowledgeAsset();
+        const outcome = await reconcileKnowledgeAsset();
         if (outcome === undefined)
             return { status: 'pending' };
         if (outcome === 'no-swm' || outcome === 'verified-vm-metadata-pending') {
-            if (options.deferActiveFetch) {
-                this.emitReplication({
-                    contextGraphId: localCgId,
+            this.emitReplication({
+                contextGraphId: localCgId,
+                onChainCgId: onChainCgId.toString(),
+                action: 'defer',
+                ordinal,
+                kaId: kaId.toString(),
+                ual,
+                detail: outcome,
+            });
+            return {
+                status: 'pending',
+                recovery: {
+                    localCgId,
                     onChainCgId: onChainCgId.toString(),
-                    action: 'defer',
                     ordinal,
-                    kaId: kaId.toString(),
                     ual,
-                    detail: outcome,
-                });
-                return {
-                    status: 'pending',
-                    recovery: {
-                        localCgId,
-                        onChainCgId: onChainCgId.toString(),
-                        ordinal,
-                        ual,
-                        merkleRoot: Array.from(merkleRoot, (byte) => byte.toString(16).padStart(2, '0')).join(''),
-                        kaId: kaId.toString(),
-                        reason: outcome,
-                    },
-                };
-            }
-            if (outcome === 'no-swm') {
-                swmState = await this.collectVmReconcileSwmCandidateState(localCgId);
-            }
-            // Active fetch: pull the missing snapshot core-first (selectCatchupPeers
-            // already prioritises known cores + the preferred sync peer), then retry.
-            // Metadata-pending exact VM content needs the same recovery: a durable
-            // sync can supply the missing provenance-bearing assertion metadata even
-            // when no content triples need to move.
-            const batchAllowsFetch = options.acquireActiveFetchPermit?.() ?? true;
-            const cooldownAllowsFetch = batchAllowsFetch
-                && this.shouldRunVmReconcileActiveFetch(localCgId);
-            if (batchAllowsFetch && cooldownAllowsFetch) {
-                activeFetchRan = true;
-                this.emitReplication({
-                    contextGraphId: localCgId, onChainCgId: onChainCgId.toString(),
-                    action: 'fetch', ordinal, kaId: kaId.toString(), ual,
-                });
-                let maxAttempts = 1;
-                const fixedMaxAttempts = options.maxPeerAttempts === undefined
-                    ? undefined
-                    : Math.max(1, Math.floor(options.maxPeerAttempts));
-                if (fixedMaxAttempts !== undefined)
-                    maxAttempts = fixedMaxAttempts;
-                for (let attempt = 0; attempt < maxAttempts
-                    && (outcome === 'no-swm' || outcome === 'verified-vm-metadata-pending'); attempt += 1) {
-                    if (options.isTargetCurrent && !options.isTargetCurrent()) {
-                        break;
-                    }
-                    try {
-                        const recovery = await this.syncVmRecoveryFromConnectedPeers(localCgId, {
-                            includeSharedMemory: true,
-                            maxPeers: 1,
-                            peerRotationKey: localCgId,
-                            // This is recovery, not routine background catch-up. Without the
-                            // override it would enter through the default-background path and
-                            // be reported as `catchup-background`, merging repair traffic into
-                            // the background lane. Attribution only — mode, priority, peer
-                            // selection and the coalescing key are all unchanged.
-                            sourceOverride: 'vm-recovery',
-                        });
-                        const fetchResult = recovery.catchup;
-                        if (fixedMaxAttempts === undefined) {
-                            maxAttempts = Math.max(maxAttempts, fetchResult.totalPeers ?? fetchResult.connectedPeers ?? 0, this.vmReconcileConnectedPeerCount());
-                        }
-                        if ((fetchResult.peersTried ?? 0) === 0 && (fetchResult.syncCapablePeers ?? 0) === 0) {
-                            continue;
-                        }
-                        if (!this.vmReconcileActiveFetchHadUsableResponse(fetchResult)) {
-                            continue;
-                        }
-                        activeFetchHadUsableResponse = true;
-                        for (const peerId of recovery.cleanMissPeerIds) {
-                            cleanMissPeerIds.add(peerId);
-                        }
-                    }
-                    catch (err) {
-                        this.log.info(ctx, `Phase B: active fetch for "${localCgId}" (ordinal ${ordinal}) failed: ${err instanceof Error ? err.message : String(err)}`);
-                        if (fixedMaxAttempts === undefined) {
-                            maxAttempts = Math.max(maxAttempts, this.vmReconcileConnectedPeerCount());
-                        }
-                        continue;
-                    }
-                    if (options.isTargetCurrent && !options.isTargetCurrent()) {
-                        break;
-                    }
-                    if (!(await targetMayMaterialize()))
-                        return { status: 'skip' };
-                    outcome = await reconcileKnowledgeAsset();
-                    if (outcome === undefined)
-                        return { status: 'pending' };
-                }
-                if (outcome === 'no-swm') {
-                    swmState = await this.collectVmReconcileSwmCandidateState(localCgId);
-                    swmState.cleanMissPeerIds = createVmReconcileCleanMissPeerIds(swmState.peerTopology, [...cleanMissPeerIds]);
-                }
-            }
-            else {
-                const reason = batchAllowsFetch ? 'per-CG cooldown' : 'per-batch fetch budget';
-                this.log.info(ctx, `Phase B: active fetch for "${localCgId}" (ordinal ${ordinal}) skipped by ${reason}`);
-            }
+                    merkleRoot: Array.from(merkleRoot, (byte) => byte.toString(16).padStart(2, '0')).join(''),
+                    kaId: kaId.toString(),
+                    reason: outcome,
+                },
+            };
         }
         if (options.isTargetCurrent && !options.isTargetCurrent()) {
             return { status: 'skip' };
@@ -6268,7 +6094,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
             case 'promoted':
                 this.clearVmReconcileRotationStateForSlot(localCgId, onChainCgId, ordinal);
                 this.pruneVmReconcileCacheKeySiblings(cacheKey);
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
                 this.recentReconciledUals.add(cacheKey);
                 await this.confirmAndRememberVmReconcileFinalizedSlot(localCgId, onChainCgId, ordinal, rememberSlotBlock, kaId, merkleRoot, publisherAddress);
                 this.emitReplication({
@@ -6285,7 +6110,6 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     contextGraphId: localCgId, onChainCgId: onChainCgId.toString(),
                     action: 'already', ordinal, kaId: kaId.toString(), ual,
                 });
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
                 return { status: 'already', blockNumber: completionBlock };
             case 'stale-target':
                 this.clearVmReconcileRotationStateForSlot(localCgId, onChainCgId, ordinal);
@@ -6296,20 +6120,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
                     contextGraphId: localCgId, onChainCgId: onChainCgId.toString(),
                     action: 'already', ordinal, kaId: kaId.toString(), ual,
                 });
-                this.deleteVmReconcileNegativeCacheEntry(cacheKey);
                 return { status: 'already', blockNumber: completionBlock };
-            case 'no-swm':
-                if (activeFetchRan && !activeFetchHadUsableResponse) {
-                    this.clearVmReconcileActiveFetchCooldown(localCgId);
-                }
-                else {
-                    this.recordVmReconcileNegativeCache(cacheKey, localCgId, swmState ?? await this.collectVmReconcileSwmCandidateState(localCgId));
-                }
-                this.emitReplication({
-                    contextGraphId: localCgId, onChainCgId: onChainCgId.toString(),
-                    action: 'defer', ordinal, kaId: kaId.toString(), ual, detail: activeFetchRan && !activeFetchHadUsableResponse ? 'network-unavailable' : outcome,
-                });
-                return { status: 'pending' };
             case 'receipt-revalidation-pending':
             case 'unverified':
             default:
@@ -6529,7 +6340,7 @@ export class SwmHostModeMethods extends DKGAgentBase {
         // on nodes that have persisted the CG's `allowedPeers`; host-only
         // cores never see it.
         try {
-            const allowedPeers = await this.getContextGraphAllowedPeers(req.contextGraphId);
+            const allowedPeers = await this.resolveSwmAllowedPeersForCurrentAuthority(req.contextGraphId);
             if (allowedPeers !== null) {
                 anyAuthoritySourceFound = true;
                 if (allowedPeers.includes(fromPeerId)) {
@@ -6859,6 +6670,9 @@ export class SwmHostModeMethods extends DKGAgentBase {
      *    two would race / duplicate every apply (Codex PR #610 R4).
      */
     async enableSwmHostModeFor(contextGraphId) {
+        const session = this.gossipSession;
+        if (!session.active)
+            return { subscribed: false, alreadySubscribed: false, hostingEnabled: false };
         if (!this.swmHostModeStore) {
             return { subscribed: false, alreadySubscribed: false, hostingEnabled: false };
         }
@@ -6882,6 +6696,9 @@ export class SwmHostModeMethods extends DKGAgentBase {
         }
         const hostKey = this.canonicalSwmHostModeKey(contextGraphId);
         const curated = await this.isCuratedForHostMode(contextGraphId);
+        if (!session.active || this.gossipSession !== session) {
+            return { subscribed: false, alreadySubscribed: false, hostingEnabled: true };
+        }
         if (this.swmHostModeSubscribed.has(hostKey)) {
             // Idempotent re-entry: even when the subscription is already
             // active, re-probe registration state. This handles the