refactor: close bounded phase 16 restart truth seams

Bind non-authoritative inventory, restart primary-truth rebasing, and sparse replica readiness retention into the heartbeat/master seam, and package the bounded finish-line checkpoint with explicit claims, non-claims, and proof commands.

Made-with: Cursor

weed/server/master_grpc_server.go

@@ -277,7 +277,16 @@ func (ms *MasterServer) SendHeartbeat(stream master_pb.Seaweed_SendHeartbeatServ
 		// (BlockVolumeInfos on first heartbeat) or deltas (NewBlockVolumes/DeletedBlockVolumes
 		// on subsequent heartbeats), never both in the same message.
 		if len(heartbeat.BlockVolumeInfos) > 0 || heartbeat.HasNoBlockVolumes {
-			hbResult := ms.blockRegistry.UpdateFullHeartbeat(dn.Url(), heartbeat.BlockVolumeInfos, heartbeat.BlockNvmeAddr)
+			blockInventoryAuthoritative := true
+			if heartbeat.BlockVolumeInventoryAuthoritative != nil {
+				blockInventoryAuthoritative = heartbeat.GetBlockVolumeInventoryAuthoritative()
+			}
+			hbResult := ms.blockRegistry.UpdateFullHeartbeatWithInventoryAuthority(
+				dn.Url(),
+				heartbeat.BlockVolumeInfos,
+				heartbeat.BlockNvmeAddr,
+				blockInventoryAuthoritative,
+			)
 			// CP13-8: If a replica's receiver address changed (e.g., restart with port conflict),
 			// immediately refresh the primary's assignment with the new addresses.
 			for _, ac := range hbResult.AddrChanges {