Copies made before level-2 certification leave no copy bound, so an upgraded node can certify across them #1218

Problem

Copy bounds ([copyBound, peer, ...]), which core admission uses to void a route start below what an audit-less base copy wrote, are recorded only while the local engine certifies at level 2: supportsCheckpointFloors() gates the COPY_START reservation and the per-row accounting. A RocksDB node without syncWal (rocksdb-js before 2.13.0), or any node running a build without harper-pro#1092, still applies audit-less snapshots and leaves no bound.

After the same data directory starts certifying at level 2 (engine or build upgrade), a route can resume floor-only and record a certifiedFrom below a row such a copy wrote. The replayed entry for that row ties the stored snapshot and is skipped without restoring its audit entry. A checkpoint can then claim a complete replay across the missing entry.

Silent, and reached by the ordinary upgrade path.

Possible direction

Fence history from before level-2 certification began. For example, at the first level-2 activation of a database generation, record a conservative bound at the activation time for every known origin (one copy-bound row). That makes every start before it void, so routes certify only from after it. Alternatively, record copy bounds on RocksDB regardless of level from now on. That alone does not cover copies made by older builds.

Raised by the cross-model review on harper-pro#1092 and deferred there: it is a rollout gap of level 2 itself, not of that PR's fixes.

Review-Deferral: d4d66cee8b714757 severity=minor category=data-integrity