recover problems

- [x] Ns may oom if the recover list is too long
- [ ] When read/write load is heavy, recover process will become slow
- [ ] Blocks need to be recover are store in set, so Ns will always pick the ones with smaller block id
- [x] 突然有一大批需recover的话ns会oom
- [ ] 读写负载高的时候recover会很慢
- [ ] 要恢复的block在set里，每次都是顺序挑，导致一旦负载高，出现timeout check，前面的副本会被恢复N多次

No files, tests, or entry points are named. Start by tracing the recovery process and how pending blocks are stored and selected, then reproduce behavior under heavy read/write load and with a large recovery batch. Done means recovery avoids excess memory use, repeated recovery, timeouts, and severe slowdown.

Written by the indexing model from the issue text.