[Router] Prove a bootstrapped replica answers like the one it copied (11/13)

[Kangyan-Zhou]

Stack 11 of 13. Base: router-peer-bootstrap-10-splice-probe. 2 files changed, 646 insertions(+)

The stack

#	PR	lines	what it adds
1	#40687	962	the sharded tree gains export_snapshot / restore_snapshot; nothing calls them yet
2	#40688	2213	GET /internal/kv_snapshot — the producer half; nothing consumes it yet
3	#40689	536	--kv-peer-selector, the peer registry, the _peers gauges; no behaviour change
4	#40690	1150	the EndpointSlice watch that fills the registry; still no consumer
5	#40691	1177	BootstrapTracker + the fetch client; the consumer's state and transport
6	#40692	933	VettedSnapshot::from_wire — the only bridge from wire bytes to the tree
7	#40693	2750	the pump holds a Pending rank's batches and grafts a snapshot handed to it
8	#40694	2478	the sweep: ask siblings, vet, deliver — one sweep per discovered worker
9	#40695	1211	fold a discovery burst into one fleet-wide fetch, plus the gap retry it enables
10	#40696	844	a graft nothing witnessed asks the fleet instead of guessing
11	#40697	646	component test over the real transport: same match_prefix answers as the source ← this PR
12	#40698	943	kind-cluster proof, the KV-publishing fake worker, and the RBAC/downward-API manifest
13	#40699	869	/readyz holds until bootstrap settles; --kv-bootstrap-seed-required; the metrics

Each PR's base is the branch below it, so every diff shown here is that
PR's own change. Review bottom-up; GitHub retargets each child to main as
its parent merges.

What the series does

A router replica subscribes to each worker's KV topic mid-stream, so every
block already resident in the engine's radix cache is invisible to it — and
engines publish BlockStored only as they insert, so a prefix cached hours
ago is never re-announced. A cache-blind replica then scatters the prefixes the
warm replicas were keeping consolidated, degrading the engines' locality for
the whole fleet; a rolling update does that to every replica in turn. This
series makes a booting replica pull a tree snapshot from a warm sibling over
HTTP and graft it beneath its live delta stream. Off unless --kv-peer-selector
is set.

Supersedes #39750, which carried the same work as one branch on a stale base.

What this change does

Component-level proof over the real transport: an axum server serving
/internal/kv_snapshot, a reqwest client fetching it, JSON over a loopback
socket. The interesting failure modes live in the wire format and the vetting
step, not in the tree algebra — that is already covered by the unit tests on
export_snapshot / restore_snapshot. Where a test needs a real tree, the
body served is the production producer's own export (peer_snapshot_body),
over both identity and gzip transports, so a change to how the producer builds
it cannot slip past a test-local copy.

The equivalence assertion is deliberately behavioural: for a large query set,
prefix_depths (what the local routing policies score on) and match_prefix
(the deepest matched node's carriers and their tiers) must agree on both
replicas. That is the property routing actually depends on; comparing node
counts alone would pass while routing diverged.

Fresh-engine fix

Rebased onto the fixed #40693–#40696. The one change: the component test's PeerSnapshot literal gains the new empty_ranks field.

Tests

cargo fmt --check, cargo clippy --all-targets -- -D warnings, and the lib +
component + proxy suites all pass on this branch on its own, not only on the
tip of the stack.

Review pass

Reviewed with /code-review --fix and /simplify; fixes were folded into this PR's own commit and the stack was re-verified tier by tier (cargo fmt --check, cargo clippy --all-targets -D warnings, lib + component + proxy tests on every branch).

• Fixed: the test now fails when vetting stops pruning (mutation-checked).
• File layout: test-only — this PR's code is tests/component/policies/kv_events_peer_bootstrap.rs; it touches none of the split src/ files.

🤖 Generated with Claude Code

https://claude.ai/code/session_016HmJvHV7QDPk3qAjQYzthd

---

CI States

Latest PR Test (Base): ✅ Run #36705762191
Latest PR Test (Extra): ❌ Run #36705761997
Latest PR Test (AMD ROCm 10): ➖ No AMD PR run found for this commit.

[ShangmingCai]

/tag-and-rerun-ci

[ShangmingCai]

Additive only, LGTM