REM stop-re-serve kernel: tri-state digestState + bounded re-serve

Context

The urgent load-reducer first slice of #13835 (the graduated #12839 disposition), split out as the narrow delivered leaf for PR #13843 — a close-target review correctly flagged that #13843 delivers this kernel, not #13835's full tri-state contract.

The chronic bleed: a session that cannot be digested is never marked graphDigested, so DreamService.findUndigestedSessions re-serves it every REM cycle, re-attempting + re-paying the per-session pre-check on the saturated local model — forever.

The Fix (delivered in PR #13843)

• Tri-state digestState (undigested / digested / deferred) + digestAttempts + deferReason on the session digest metadata.
• On digest failure, track the attempt and classify the observable reason.
• Safe-subset bounded re-serve: at MAX_DIGEST_ATTEMPTS, only deterministic skip-over-band failures become deferred; under-band-choke and ingestion-failure remain undigested and keep retrying until typed extractor failure semantics can prove terminality.
• findUndigestedSessions excludes deferred (the load-reduction lever for the proven over-band class — stops the steady-cadence re-hammering).
• deferReason ∈ {ingestion-failure, skip-over-band, under-band-choke} — the classes observable in processUndigestedSessions.
• Back-compat: absent digestState ≡ undigested when graphDigested !== true; ChromaManager Axis-A counts unaffected for digested rows.

Acceptance Criteria

• digestState tri-state + digestAttempts + deferReason on the summary digest metadata.
• findUndigestedSessions excludes deferred and still serves back-compat rows without digestState.
• bounded re-serve safe subset: skip-over-band reaches deferred at MAX_DIGEST_ATTEMPTS.
• ambiguous/transient classes stay retryable: under-band-choke and ingestion-failure remain undigested even past MAX_DIGEST_ATTEMPTS.
• back-compat for graphDigested / ChromaManager Axis-A.
• unit coverage: exclusion + deterministic bounded-marking + under-band retry + ingestion retry + back-compat.

Out of Scope (remains open in the #13835 parent)

The remaining #13835 ACs stay open in the parent: the 4th/5th deferReason (wall-clock-timeout, schema-failure — need the extractor's return-contract), the terminal undigestible state, AiConfig-backed N, and the SemanticGraphExtractor choke-vs-context-overflow relabel. The deep-drain of deferred sessions = #12439's gated deep-extraction. The under-band-choke bleed-stop remains in #13835 until typed extractor failure semantics distinguish choke from schema-failure, timeout, and transient-empty.

Parent

Parent: #13835 (the full tri-state digest-state contract). Delivered-by: PR #13843.

Release classification: boardless — operational load-reducer (the urgent #12839 bleed-stop slice).

Origin Session ID: e193849e-afc9-4190-b36c-41095d97147a