feat(8.0): Model-B per-write generation-stamping + adaptive retention knob

Every write — transact() AND single-op add/update/remove/relate — is now its
own immutable generation (Model-B), so a now() pin always freezes and
asOf/since/diff/history/transactionLog reflect single-ops exactly like
transacts. Closes the Model-A hole where pins did not freeze against single-op
writes.

Generation-stamping:
- GenerationStore.commitSingleOp: a one-operation commitTransaction with
  deferred durability. Wired into add/update/remove/relate/updateRelation/
  unrelate + removeMany (the *Many and VFS paths delegate to these).
- Async group-commit (flushPendingSingleOps): the live write is acknowledged
  immediately; its before-image is buffered in an in-memory pending tier that
  resolveAt/chains/changedBetween/tx-log read like on-disk generations, so the
  synchronous now() freezes with no forced flush. One fsync per window
  (triggers: size / 50ms timer / flush / close / transact / compactHistory).
- Crash recovery is drop-without-restore for group-commit generations (marked
  groupCommit:true): a crash mid-flush discards the partial generation and
  never restores its before-images, which would otherwise revert the
  already-acknowledged live write.
- Init-time infrastructure (the VFS root) is the un-versioned generation-0
  baseline: a fresh brain reports generation()===0 and an empty
  transactionLog(); the first user write is generation 1.
- Historical find()/related() overlay bound is the full reserved watermark
  (generation()), so un-flushed single-op writes are overlaid too.

Retention knob:
- config `history` -> `retention`: 'all' | 'adaptive' |
  { maxGenerations?, maxAge?, maxBytes?, budgetBytes?, autoCompact? }; unset ->
  adaptive (disk/RAM pressure, zero-config). CompactHistoryOptions floors ->
  caps (retainGenerations->maxGenerations, retainMs->maxAge, +maxBytes):
  reclaim oldest-unpinned while ANY cap is exceeded; pins always exempt.
- brain.setRetentionBudget(bytes) drives the adaptive byte budget at runtime
  (a coordinator's fair-share input). Per-generation bytes recorded in each
  delta enable historyBytes() introspection without a storage size API.

Tests: per-write generation resolution, pin freeze vs add/update/remove,
drop-without-restore corruption-trap (fault injector), clean-reopen replay,
maxBytes/maxAge/no-cap reclamation, retention-then-reopen. 107 db/generation/
temporal tests green, tsc clean. Docs (ADR-001, consistency-model, snapshots
guide, api reference, RELEASES) updated to per-write granularity + retention.

tests/integration/db-temporal.test.ts

@@ -330,8 +330,8 @@ describe('8.0 Db API — temporal range verbs', () => {
     await dbAtG2.release()
   })
 
-  // 7. Granularity -------------------------------------------------------------
-  it('granularity: single-operation writes (outside transact) are invisible to the temporal verbs', async () => {
+  // 7. Granularity (Model-B) ---------------------------------------------------
+  it('granularity: single-operation writes ARE versioned and visible to the temporal verbs', async () => {
     const brain = await openMemoryBrain()
     const a = uid('gran-a')
     const r1 = await brain.transact([
@@ -340,13 +340,26 @@ describe('8.0 Db API — temporal range verbs', () => {
     await r1.release()
     expect((await brain.transactionLog()).length).toBe(1)
 
-    // A single-op write bumps the counter but writes no generation record/log entry.
+    // Model-B: a single-op write is its OWN immutable generation — logged,
+    // diffable, and time-travelable, exactly like a transact() of one op.
     await brain.update({ id: a, metadata: { v: 2 } })
 
-    expect((await brain.transactionLog()).length).toBe(1) // unchanged — not logged
+    // The single-op update appended a generation/log entry.
+    expect((await brain.transactionLog()).length).toBe(2)
+    expect(brain.generation()).toBe(r1.generation + 1)
+
+    // diff sees the single-op update as a modification of `a`.
     const d = await brain.diff(r1.generation, brain.generation())
-    expect(d.added.nouns).toEqual([]) // the single-op update is not a recorded change
-    expect(d.modified.nouns).toEqual([])
+    expect(d.added.nouns).toEqual([])
+    expect(d.modified.nouns).toEqual([a])
+
+    // And asOf() resolves both states: v=1 at the transact gen, v=2 at the single-op gen.
+    const atTransact = await brain.asOf(r1.generation)
+    const atSingleOp = await brain.asOf(brain.generation())
+    expect((await atTransact.get(a))?.metadata?.v).toBe(1)
+    expect((await atSingleOp.get(a))?.metadata?.v).toBe(2)
+    await atTransact.release()
+    await atSingleOp.release()
   })
 
   // 8. Compaction policy contrast ---------------------------------------------
@@ -363,7 +376,7 @@ describe('8.0 Db API — temporal range verbs', () => {
       ).release()
     } // gens 1..6, all pins released
 
-    await brain.compactHistory({ retainGenerations: 2 }) // raise the horizon
+    await brain.compactHistory({ maxGenerations: 2 }) // raise the horizon
     const horizon = generationStoreOf(brain).horizon()
     expect(horizon).toBeGreaterThan(0)