Recall execution, admission, and frozen-baseline invariants

Consume synchronous recall results in the same turn; invoking recall as the final action creates a false search loop. Chose liveness-only admission over execution, token, item, result-byte, or retained-coverage quotas because productive chains may keep finding distinct sources; only the foreground deadline (with final-synthesis reserve) or proven consecutive no-progress coverage forces finalization. A bounded coverage ledger may evict keys, but evicted keys become unknown/progress rather than evidence of a stall. Offloaded frozen-baseline builders fall back to synchronous scan on READ_JOB_TIMED_OUT, never []; forSession may return [] because it reruns each turn.