fix(replication): recover physical creation time and align policy status

An independent adversarial review of the bucket metadata convergence
work found three defects it had introduced.

GetBucketInfo overwrote the physical creation probe with cached
metadata, which a bucket that never held a configuration legitimately
lacks. The new creation-time requirement then failed every policy, tag,
SSE, quota, versioning and Object Lock write on such a bucket, with no
operator recovery path, and initial synchronization skipped it silently.
Return the physical result unchanged when metadata is not requested, as
ListBuckets already does, recover the time during initial
synchronization, and pass it to MakeBucketHook so peers adopt the same
bucket generation.

Replication status compared parsed policies statement by statement while
heal compares the canonical key. An upgraded peer that stored an
equivalent statement order was therefore reported as mismatched forever,
and heal never had anything to write. Compare the key heal compares;
per-site presence counting is unchanged.

Heal diagnostics shared one log key across four conditions, so a real
peer RPC failure could be deduplicated away by an earlier message, and
they were logged at error level for the normal transient of a peer that
does not have the bucket yet. Give each reason its own key at warning
level, report only a field state that exists and still cannot be
ordered, and diagnose nothing when no site holds a state to propagate.

The recovery test now runs against the real ObjectLayer; the stub it
replaced returned the expected time and hid the defect. The policy
status test uses a statement order the canonical encoder reorders, and
adoption coverage is extended past a real field time.

Signed-off-by: Feng Ruohang <rh@vonng.com>

docs/site-replication/README.md

@@ -103,12 +103,20 @@ bucket identity conflicts first, then resubmit the intended configuration or
 delete at the authoritative site. A local write advances beyond an existing
 future field timestamp. Source times before the target bucket's creation are
 ignored; an unknown creation time is recovered from the physical bucket, or the
-operation fails without writing.
+operation fails without writing. That recovery happens on the write path. While
+a bucket's stored metadata still carries no creation time, site status reports
+it that way and periodic healing skips that bucket in both directions; the first
+configuration write on it, local or replicated, records the physical time and
+returns the bucket to the normal path.
 
-The server emits bounded diagnostics for `legacy-zero`, `before-created` and
-`indeterminate`. Keys and error messages remain stable for each bucket/field/
-reason; timestamps and peer details are log attributes. Existing hourly logger
-cleanup applies. Normal duplicates, older events and resolved ties are quiet.
+The server emits bounded warnings for `legacy-zero`, `before-created`,
+`indeterminate`, `unreachable` and `peer-error`. Each reason keeps its own log
+key, so a peer that did not report cannot hide an unusable peer state or a real
+heal RPC failure for the same bucket and field. A peer that simply does not
+have the bucket yet is a normal transient and is not reported here. Keys and
+error messages remain stable for each bucket/field/reason; timestamps and peer
+details are log attributes. Existing hourly logger cleanup applies. Normal
+duplicates, older events and resolved ties are quiet.
 
 A local PUT of a policy whose parsed statements are empty now consistently
 means deletion: PUT succeeds and GET returns the existing NotFound response.
@@ -117,3 +125,10 @@ JSON (`{}`, `null`, or a valid zero quota document) remains a live document;
 it is not silently sent as a deletion. Bulk omission preserves a field,
 whereas an explicit Policy JSON `null` deletes it. These rules use the existing
 wire fields and on-disk metadata format.
+
+Policy GET and admin export use the same validated encoder as replication.
+Statement and set arrays may appear in a different order from older output;
+policy evaluation is unchanged. This also makes policies using the parser's
+existing NotAction/NotResource alternatives writable and readable. Public
+replication status compares the same stable policy key as heal, so a peer's
+equivalent legacy statement order does not remain a false mismatch.