Copy-pass completion: restore whole history only after finalization; unstick cursor removal #1146

Problem

The copy-pass completion lifecycle in replication has two gaps. Both fail closed.

1. Restoring partialHistory: false requires only completeReceived and seqDurableAtCopyStart, not the copy watermark's finalization. On a repeated or resumed copy, the anchor can already be at or below the durable watermark, so the restore can land while a copy blob is still outstanding. A base copy sets no certifiedFrom, so nothing is admitted. The route is only marked whole early, until the next reconnect re-marks it.
2. isCopyPassRouteRestoredDurable returns false and re-queues nothing when a captured origin is missing from [seq, peer] (or carries a genless fullCoverage: false). Copy-cursor removal then retries every second, and the cursor survives into the next restart.

Possible direction

Gate restoration on the watermark's finalization barrier. Make the cursor-removal check re-queue the missing origin's restoration, or drop origins that no longer exist.

Raised by the cross-model review on harper-pro#1092 and deferred there: it is outside that PR's invariant.

Review-Deferral: 5f72a66bbbf2
Review-Deferral: 7fa8347d5e7f
Review-Deferral: 0e0bda27443d
Review-Deferral: 120974ab1c7e
Review-Deferral: 2d1031542b98
Review-Deferral: 1f4888f5d2c9
Review-Deferral: 9c091d6823317a7d severity=minor category=correctness
Review-Deferral: ca549b89e1c9767e severity=nit category=reliability

Also deferred here from harper-pro#1092's later rounds (see the comment below): earlier attempts' reservations after a completed projection, the separate-commit fullCoverage restore, a narrow unit test pinning isCopyPassRouteRestoredDurable to the route row, and that check refusing forever (so the copy cursor is never removed) when the route row's own node keeps fullCoverage: false without a generation a restore mark can name, or when an origin captured at COPY_START has no node in the row any more.

Review-Deferral: 4214b28e7ada5c62 severity=nit category=reliability
Review-Deferral: 396ae72049e60539 severity=nit category=reliability
Review-Deferral: 335f7f85ee85a0c6 severity=nit category=test-coverage