Preserve contacts when source discovery is unknown

Do not classify legacy or page-name stat errors as unread payloads. Keep candidate contact files unchanged, retry source selection, and use bounded volatile operation if authority remains unknown. Cover legacy absence, downgrade leftovers, cleanup-time metadata recovery and persistent faults with actual-source sanitizer tests and restored-bug negative controls.

docs/research/companion_contact_cache.md

@@ -44,7 +44,10 @@ If damaged contacts cannot be removed, the node remains usable with volatile
 contacts; explicit saves still report failure, while reboot/shutdown remain
 available. Identity, credentials, channels and unrelated settings are not erased.
 Allocation/capacity failures and shared filesystem-migration authority errors
-are not corrupt-contact evidence and do not authorize this reset. The path checksum also rejects
+are not corrupt-contact evidence and do not authorize this reset. Failed source
+discovery also preserves contact files; if authority stays unknown, use volatile
+contacts instead of deleting readable pages or selecting a potentially stale view.
+The path checksum also rejects
 a cold path changed underneath a live handle; it does not add a new checksum
 to the legacy ESP32 on-disk format.