fix(rust): skip servers known down for a link code, hold syncs while offline (F6, F7)

Two findings of the step-2 player walk (2026-09-27, both rigs).

F6, option (b) of the org lead (D186): a code no recent issuer holds -
every made-up one - was still asked of every other enabled server, and
while any of them was down the redeem waited out its whole timeout
(12 s on both rigs). The second pass now skips the servers the board
poll last saw without a connected game; they count as offline without
the wait. Issuers are still asked whatever their state, so a good code
on a down server stays "unsure". Live on the walk core: 338 ms with five
servers down, 360 ms with a rig stopped as well.

F7 (D187): on Carbon a due audit sync went out the moment the sidecar
reconnected, 80 s before "Server startup complete". The worldReady hold
reads the stored hello, which is the OLD boot's until the poll reads the
new one. reasonToSync now also holds while the stored state says the
game is not connected (online 0), which the poll writes the moment the
server goes away. titleSync already held on it.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01E14m6SuuY6i1vASFeGDBeY

server/test/planFixesStep2.test.js

@@ -6,7 +6,8 @@
 //   • F13/F14 — a zone that expired in the game is recorded `expired` by core,
 //     through `ctx.events.expired` (D170, D183)
 //   • F8      — a plugin that loads with permissions re-syncs within a tick (D184)
-//   • F7      — nothing is pushed to a game whose world is still loading
+//   • F7      — nothing is pushed to a game whose world is still loading, or
+//               that the poll saw go away (the step-2 walk)
 //   • D182    — the ZoneManager helper's state reaches the servers page
 
 const test = require('node:test')
@@ -97,6 +98,30 @@ test('no permission sync goes to a world that is still loading — unless a huma
   assert.equal(at({ worldReady: false }, true), 'requested')
 })
 
+test('no permission sync goes to a game the poll saw go away, however ready its last hello said it was', () => {
+  // The step-2 walk, on Carbon: the sidecar came back and a due audit went out in
+  // the same moment, 80 s before "Server startup complete". The stored hello was the
+  // OLD boot's (same boot id, hence "audit" and not "restart", worldReady true);
+  // only `online: 0` — written by the poll when the server went away — said the
+  // game was not there.
+  withCore()
+  const permSync = require('../permSync')
+  const stale = new Date(Date.now() - permSync.AUDIT_MS - 1000)
+  const sync = { state: 'ok', dirty: false, syncedHash: 'h1', bootId: 'boot-1', wipeId: 'w-1', lastAttemptAt: stale }
+  const at = (state, force = false) => permSync.reasonToSync({ desiredHash: 'h1', sync, state, force })
+
+  assert.equal(at({ online: 0, bootId: 'boot-1', wipeId: 'w-1', worldReady: true }), null)
+  assert.equal(at({ online: false, bootId: 'boot-1', wipeId: 'w-1', worldReady: true }), null)
+  // Back, with the new boot's hello still loading: held by worldReady, as before.
+  assert.equal(at({ online: 1, bootId: 'boot-2', wipeId: 'w-1', worldReady: false }), null)
+  // Loaded: the restart sync goes.
+  assert.equal(at({ online: 1, bootId: 'boot-2', wipeId: 'w-1', worldReady: true }), 'restart')
+  // The audit itself still runs for a server that is up.
+  assert.equal(at({ online: 1, bootId: 'boot-1', wipeId: 'w-1', worldReady: true }), 'audit')
+  // A human's "sync now" is not held.
+  assert.equal(at({ online: 0 }, true), 'requested')
+})
+
 test('no title push goes to a world that is still loading', async () => {
   withCore()
   const titleSync = require('../titleSync')