feat(8.0): Model-B per-write generation-stamping + adaptive retention knob

Every write — transact() AND single-op add/update/remove/relate — is now its
own immutable generation (Model-B), so a now() pin always freezes and
asOf/since/diff/history/transactionLog reflect single-ops exactly like
transacts. Closes the Model-A hole where pins did not freeze against single-op
writes.

Generation-stamping:
- GenerationStore.commitSingleOp: a one-operation commitTransaction with
  deferred durability. Wired into add/update/remove/relate/updateRelation/
  unrelate + removeMany (the *Many and VFS paths delegate to these).
- Async group-commit (flushPendingSingleOps): the live write is acknowledged
  immediately; its before-image is buffered in an in-memory pending tier that
  resolveAt/chains/changedBetween/tx-log read like on-disk generations, so the
  synchronous now() freezes with no forced flush. One fsync per window
  (triggers: size / 50ms timer / flush / close / transact / compactHistory).
- Crash recovery is drop-without-restore for group-commit generations (marked
  groupCommit:true): a crash mid-flush discards the partial generation and
  never restores its before-images, which would otherwise revert the
  already-acknowledged live write.
- Init-time infrastructure (the VFS root) is the un-versioned generation-0
  baseline: a fresh brain reports generation()===0 and an empty
  transactionLog(); the first user write is generation 1.
- Historical find()/related() overlay bound is the full reserved watermark
  (generation()), so un-flushed single-op writes are overlaid too.

Retention knob:
- config `history` -> `retention`: 'all' | 'adaptive' |
  { maxGenerations?, maxAge?, maxBytes?, budgetBytes?, autoCompact? }; unset ->
  adaptive (disk/RAM pressure, zero-config). CompactHistoryOptions floors ->
  caps (retainGenerations->maxGenerations, retainMs->maxAge, +maxBytes):
  reclaim oldest-unpinned while ANY cap is exceeded; pins always exempt.
- brain.setRetentionBudget(bytes) drives the adaptive byte budget at runtime
  (a coordinator's fair-share input). Per-generation bytes recorded in each
  delta enable historyBytes() introspection without a storage size API.

Tests: per-write generation resolution, pin freeze vs add/update/remove,
drop-without-restore corruption-trap (fault injector), clean-reopen replay,
maxBytes/maxAge/no-cap reclamation, retention-then-reopen. 107 db/generation/
temporal tests green, tsc clean. Docs (ADR-001, consistency-model, snapshots
guide, api reference, RELEASES) updated to per-write granularity + retention.

docs/guides/snapshots-and-time-travel.md

@@ -135,10 +135,12 @@ await after.release()
 
 Three things to remember:
 
-- History granularity is `transact()` commits — single-operation writes
-  advance the clock but do not produce historical records (see the
-  [consistency model](../concepts/consistency-model.md)). Use `transact()`
-  for writes you want to travel back through.
+- History granularity is per-write: EVERY write — `transact()` AND a
+  single-operation `add`/`update`/`remove`/`relate` — is its own immutable
+  generation, so a pin always freezes against later writes and every write is
+  individually addressable via `asOf()` (see the
+  [consistency model](../concepts/consistency-model.md)). Use `transact()` when
+  you want several operations to share ONE atomic generation.
 - The first index-accelerated query (semantic search, traversal, cursors,
   aggregation) at a historical generation builds an in-memory index
   materialization — O(n at that generation), once per `Db`, freed on
@@ -336,20 +338,33 @@ For per-entity write coordination (rather than whole-store history), the
 
 ## Keeping history bounded
 
-Historical records cost disk space. Reclaim what no live pin protects:
+Under Model-B every write is a generation, so history can grow quickly —
+Brainy auto-compacts on every `flush()`/`close()` under the **`retention`**
+knob (configured on the constructor):
 
 ```typescript
-await brain.compactHistory({
-  retainGenerations: 100,            // keep the 100 most recent commits
-  retainMs: 7 * 24 * 60 * 60 * 1000  // and everything from the last 7 days
-})
+// Zero-config: ADAPTIVE — keep as much history as free disk/RAM allows,
+// reclaiming oldest-first under pressure. (This is the default.)
+new Brainy({ /* retention unset */ })
+
+// Unbounded — never reclaim history (opt in explicitly):
+new Brainy({ retention: 'all' })
+
+// Explicit CAPS — reclaim oldest-unpinned generations while ANY cap is exceeded:
+new Brainy({ retention: { maxGenerations: 1000, maxAge: 7 * 86_400_000, maxBytes: 512 * 1024 ** 2 } })
+```
+
+Reclaim manually at any time (the same caps):
+
+```typescript
+await brain.compactHistory({ maxGenerations: 100, maxAge: 7 * 24 * 60 * 60 * 1000 })
 ```
 
 Compaction never breaks a pinned read — record-sets are reclaimed only when
-no live `Db` could need them. Release views you are done with (including the
-ones `transact()` returns), and `persist()` any generation you want to keep
-beyond the retention window: snapshots are self-contained and unaffected by
-compaction.
+no live `Db` could need them (live pins are ALWAYS exempt). Release views you
+are done with (including the ones `transact()` returns), and `persist()` any
+generation you want to keep beyond the retention window: snapshots are
+self-contained and unaffected by compaction.
 
 ## From branches to values