feat(log): log authority is the fleet default — adopt-at-open, oracle-gated; plus the power-cut throw-site cures and the loud torn-record contract

THE DEFAULT FLIP (ruled on proven evidence — at-ack survived 301/301
acked-writes-through-power-cut in block-layer fault injection; deferred
tree authority demonstrably loses flush-covered acks): a brain with NO
stored authority artifact now ADOPTS LOG AUTHORITY AT OPEN. The oracle
gates the flip exactly as the guarded adoption path always did — curable
divergences baseline-backfilled, the flip lands ONLY on a green verdict —
and a brain that cannot verify STAYS tree-authoritative loudly, with the
refusal recorded on the switch artifact so subsequent opens are cheap.
config logAuthority: 'defer' is the explicit documented opt-out (no
automatic adoption; declared flush-window loss; adoptLogAuthority() flips
later). A stored artifact always wins. RELEASES.md carries the posture.

Two standing .fails debt pins FLIP TO HOLDING under the default: the
at-ack crash-survival gap and the ack-at-log durability target — both now
permanent asserted truths, not aspirations.

POWER-CUT THROW SITES (fault-injection findings, brainy-alone config):
- A manifest-listed-but-unloadable column segment QUARANTINES at
  discovery (loud once, counted always, quarantinedSegments() exposed for
  the heal) and the field serves its remaining segments DEGRADED — never
  a raw throw killing every query on the field. Real storage faults still
  propagate untouched.
- Torn generation artifacts (NaN/garbage in manifest or counter) DISCARD
  with narration at the store's open and recovery re-derives — plus a
  defensive finite-integer guard at the init consumer. Never a RangeError
  killing an open.

THE LOUD TORN-RECORD CONTRACT: an existing-but-unparseable stored record
now surfaces as a typed, counted TornRecordError on every entity-read
surface (including fifteen previously-blind per-item batch catches);
ENOENT stays clean-absent; artifact readers with designed absent-recovery
keep null-tolerance behind the loud floor. Disk corruption can no longer
read as silent data invisibility.

Suite migration: the default's pins inverted deliberately, generation
baselines made relative, quarantine-contract pins rewritten to the ruled
behavior.

Gates: tsc 0 · unit 2065/2065 (159 files) · integration 826 (93 files) ·
conformance 31/31 · kill-matrix 15/15 · torn-open guards 2/2.

src/brainy.ts

@@ -202,6 +202,7 @@ import {
   flipToLogAuthority,
   recordDigest,
   nounEntityTruth,
+  LOG_AUTHORITY_PATH,
   type LogAuthorityRecord,
   type LogAuthorityStorage,
   type OracleReport
@@ -1371,7 +1372,20 @@ export class Brainy<T = any> implements BrainyInterface<T> {
       // gap for observability.
       for (const provider of this.versionedIndexProviders()) {
         const providerGen = provider.generation()
-        const committed = BigInt(this.generationStore.committedGeneration())
+        // Defensive finite-integer guard: committedGeneration() is validated
+        // at the store's open (torn artifacts discard, narrated) — but a
+        // RangeError here would kill the whole open, so the consumer guards
+        // too. A non-finite value narrates and skips the gap check (the
+        // provider's own replay contract still governs).
+        const committedRaw = this.generationStore.committedGeneration()
+        if (!Number.isSafeInteger(committedRaw) || committedRaw < 0) {
+          prodLog.warn(
+            `[Brainy] committed generation is non-integer (${String(committedRaw)}) at ` +
+              `init — torn-artifact survivor; skipping the provider replay-gap check`
+          )
+          continue
+        }
+        const committed = BigInt(committedRaw)
         if (providerGen < committed) {
           prodLog.info(
             `[Brainy] Versioned index provider is at generation ${providerGen} ` +
@@ -1492,16 +1506,58 @@ export class Brainy<T = any> implements BrainyInterface<T> {
         this._generationStampingActive = true
       }
 
-      // LOG-AUTHORITY SWITCH (checked at open only): a brain that has
-      // flipped to log-authoritative storage gets durable-at-ack fact
-      // writes (group-committed fsync covering every ack). Default 'tree'
-      // = today's behavior, zero added latency.
+      // LOG-AUTHORITY SWITCH (checked at open only). A STORED artifact
+      // always wins: an already-flipped brain runs durable-at-ack; an
+      // explicitly-recorded tree posture is honored. With NO artifact, the
+      // 10.0.0 FLEET DEFAULT is ADOPT-AT-OPEN (config logAuthority:
+      // 'adopt'): the verification oracle gates the flip — curable
+      // divergences are baseline-backfilled, the brain flips ONLY on green,
+      // and a brain that cannot go green STAYS tree-authoritative LOUDLY
+      // with the refusal recorded (cheap subsequent opens; an operator
+      // re-runs adoptLogAuthority() after fixing the divergence).
+      // 'defer' is the documented opt-out: no automatic adoption.
       if (!this.isReadOnly) {
+        const storedArtifact = await this.storage
+          .readRawObject(LOG_AUTHORITY_PATH)
+          .catch(() => null)
         const authority = await readLogAuthority(this.storage)
         this._logAuthority = authority
         if (authority.authority === 'log') {
           this.generationStore.setLogDurability('at-ack')
           prodLog.info('[Brainy] storage authority: generation log (durable-at-ack enabled)')
+        } else if (
+          storedArtifact === null &&
+          this.config.logAuthority === 'adopt' &&
+          this.generationStore.getFactLog() !== null
+        ) {
+          try {
+            await this.adoptLogAuthority()
+            prodLog.info(
+              '[Brainy] storage authority adopted at open: generation log ' +
+                '(fleet default; oracle green; durable-at-ack enabled)'
+            )
+          } catch (err) {
+            // The guarded ruling: a brain that cannot verify STAYS tree,
+            // loudly, with the refusal recorded so subsequent opens are
+            // cheap. Never a silent half-state; never a failed open.
+            const reason = (err as Error).message
+            prodLog.warn(
+              `[Brainy] log-authority adoption REFUSED at open — this brain stays ` +
+                `tree-authoritative until an operator resolves the divergence and ` +
+                `re-runs adoptLogAuthority(). Reason: ${reason}`
+            )
+            try {
+              const refusal: LogAuthorityRecord = {
+                authority: 'tree',
+                adoptRefusal: { at: Date.now(), reason: reason.slice(0, 500) }
+              }
+              await this.storage.writeRawObject(LOG_AUTHORITY_PATH, refusal)
+              this._logAuthority = refusal
+            } catch {
+              // Unrecordable refusal = the next open retries the oracle —
+              // the conservative outcome.
+            }
+          }
         }
       }
 
@@ -15786,7 +15842,8 @@ export class Brainy<T = any> implements BrainyInterface<T> {
       force: config?.force ?? false,
       // Engine-owned persistence cadence — defaults resolve at the trigger
       // site (policy 'auto': 512 writes / 30s interval / 2s idle).
-      persistence: config?.persistence
+      persistence: config?.persistence,
+      logAuthority: config?.logAuthority ?? 'adopt'
     }
   }
 

src/db/generationStore.ts

@@ -468,9 +468,26 @@ export class GenerationStore {
       | null
     const manifest = (await this.storage.readRawObject(MANIFEST_PATH)) as GenerationManifest | null
 
-    this.committed = manifest?.generation ?? 0
-    this.horizonGen = manifest?.horizon ?? 0
-    this.counter = Math.max(counterFile?.generation ?? 0, this.committed)
+    // TORN-ARTIFACT VALIDATION (power-loss survivors): a torn manifest or
+    // counter can carry NaN/garbage where a generation belongs — unguarded,
+    // that NaN reaches BigInt() conversions at init and kills the open with
+    // a RangeError. A non-finite-integer generation is DISCARDED with
+    // narration (the conservative floor: 0 = re-derive from the record
+    // directories / fact log below, exactly the recovery machinery's job).
+    const finiteGen = (v: unknown, source: string): number => {
+      if (typeof v === 'number' && Number.isSafeInteger(v) && v >= 0) return v
+      if (v !== undefined && v !== null) {
+        prodLog.warn(
+          `[GenerationStore] ${source} carries a non-integer generation ` +
+            `(${String(v)}) — torn write survivor; discarding and re-deriving ` +
+            `from recovery (never a RangeError at open)`
+        )
+      }
+      return 0
+    }
+    this.committed = finiteGen(manifest?.generation, 'manifest')
+    this.horizonGen = finiteGen(manifest?.horizon, 'manifest horizon')
+    this.counter = Math.max(finiteGen(counterFile?.generation, 'generation counter'), this.committed)
 
     // Discover existing generation record directories.
     const recordPaths = await this.storage.listRawObjects(GENERATIONS_PREFIX)

src/db/logAuthority.ts

@@ -43,6 +43,12 @@ export interface LogAuthorityRecord {
     nounsChecked: number
     verbsChecked: number
   }
+  /**
+   * Recorded when an OPEN-TIME adoption attempt (the 10.0.0 fleet default)
+   * was refused — the oracle could not go green. Keeps subsequent opens
+   * cheap; an operator re-runs adoptLogAuthority() after resolving it.
+   */
+  adoptRefusal?: { at: number; reason: string }
 }
 
 /** The narrow storage surface this module needs. */

src/index.ts

@@ -362,6 +362,15 @@ export { MemoryStorage, createStorage }
 // FileSystemStorage is exported separately to avoid browser build issues.
 export { FileSystemStorage } from './storage/adapters/fileSystemStorage.js'
 
+// Torn-record surface: a stored file that EXISTS but cannot be decoded throws
+// a typed, catchable error on entity reads (never a silent "not found"), and
+// every encounter is counted on a per-process gauge.
+export {
+  TornRecordError,
+  isTornRecordError,
+  getTornRecordGauge
+} from './storage/tornRecordError.js'
+
 // Export types
 import type {
   Vector,

src/indexes/columnStore/ColumnStore.ts

@@ -31,6 +31,7 @@ import { ColumnSegmentCursor, TailBufferCursor, type CursorEntry } from './Colum
 import { writeSegmentToBuffer, readSegmentFromBuffer } from './ColumnSegmentFormat.js'
 import { RoaringBitmap32 } from '../../utils/roaring/index.js'
 import { compareCodePoints } from '../../utils/collation.js'
+import { prodLog } from '../../utils/logger.js'
 
 /**
  * Configuration for the ColumnStore.
@@ -612,6 +613,24 @@ export class ColumnStore implements ColumnStoreProvider {
   /**
    * Get all segment cursors for a field, loading from storage if needed.
    */
+  /**
+   * Per-field quarantine ledger for torn segments (power-loss survivors:
+   * manifest-listed but unloadable). A quarantined segment is skipped with
+   * per-doubling narration and the field serves its REMAINING segments as a
+   * DEGRADED-ANNOUNCED result — never a raw throw killing the query, never
+   * a silent drop. Cleared when a heal/rebuild rewrites the field.
+   */
+  private readonly segmentQuarantine = new Map<string, { error: string; hits: number }>()
+
+  /** Torn-segment quarantine entries for a field (observability + heal input). */
+  quarantinedSegments(field: string): Array<{ segment: string; error: string; hits: number }> {
+    const out: Array<{ segment: string; error: string; hits: number }> = []
+    for (const [key, q] of this.segmentQuarantine) {
+      if (key.startsWith(`${field}:`)) out.push({ segment: key.slice(field.length + 1), error: q.error, hits: q.hits })
+    }
+    return out
+  }
+
   private async getSegmentCursors(field: string): Promise<ColumnSegmentCursor[]> {
     const manifest = this.manifests.get(field)
     if (!manifest) return []
@@ -622,11 +641,38 @@ export class ColumnStore implements ColumnStoreProvider {
       let cursor = this.segmentCache.get(cacheKey)
 
       if (!cursor) {
-        // loadSegmentCursor either returns a cursor or THROWS — a corrupt /
-        // missing manifest-listed segment raises ColumnSegmentLoadError and a
-        // real storage fault propagates, so a listed segment is never silently
-        // dropped from the result set.
-        cursor = await this.loadSegmentCursor(field, seg)
+        const quarantined = this.segmentQuarantine.get(cacheKey)
+        if (quarantined) {
+          // Already-quarantined torn segment: skip, count, narrate per doubling.
+          quarantined.hits++
+          if ((quarantined.hits & (quarantined.hits - 1)) === 0) {
+            prodLog.warn(
+              `[ColumnStore] field '${field}' serving DEGRADED: torn segment ${seg.id} ` +
+                `quarantined (${quarantined.error}) — ${quarantined.hits} queries served ` +
+                `without it; heal/rebuild the metadata index to restore`
+            )
+          }
+          continue
+        }
+        try {
+          cursor = await this.loadSegmentCursor(field, seg)
+        } catch (err) {
+          if (err instanceof ColumnSegmentLoadError) {
+            // POWER-LOSS SURVIVOR: a manifest-listed segment whose bytes are
+            // torn/absent. Quarantine at DISCOVERY and serve the remaining
+            // segments degraded-announced — a raw throw here killed every
+            // query on the field forever; a silent skip hid the loss. The
+            // quarantine is the middle: loud once, counted always, healable.
+            this.segmentQuarantine.set(cacheKey, { error: (err as Error).message, hits: 1 })
+            prodLog.error(
+              `[ColumnStore] torn segment QUARANTINED at discovery: field '${field}' ` +
+                `segment ${seg.id} — ${(err as Error).message}. The field serves its ` +
+                `remaining segments DEGRADED until a heal/rebuild rewrites it.`
+            )
+            continue
+          }
+          throw err // real storage faults propagate — never absorbed
+        }
         this.segmentCache.set(cacheKey, cursor)
       }
 

src/storage/adapters/fileSystemStorage.ts

@@ -18,6 +18,11 @@ import {
 } from '../baseStorage.js'
 import { getBrainyVersion } from '../../utils/index.js'
 import { isAbsentError } from '../../utils/errorClassification.js'
+import {
+  TornRecordError,
+  isUnparseablePayloadError,
+  registerTornRecordEncounter
+} from '../tornRecordError.js'
 
 // Node.js modules - dynamically imported to avoid issues in browser environments
 let fs: any
@@ -410,8 +415,22 @@ export class FileSystemStorage extends BaseStorage {
   /**
    * Primitive operation: Read object from path
    * All metadata operations use this internally via base class routing
-   * Enhanced error handling for corrupted metadata files (Bug #3 mitigation)
    * Supports reading both compressed (.gz) and uncompressed files for backward compatibility
+   *
+   * Read contract (loud errors, never quiet losses):
+   * - Genuine absence (ENOENT on every variant) → `null`. Only a missing file
+   *   is "not found".
+   * - TORN record (a file EXISTS but its bytes cannot be decoded — invalid
+   *   JSON, truncated/garbled gzip) → the encounter is registered (production
+   *   ERROR log + per-process gauge) and a typed {@link TornRecordError} is
+   *   thrown. Corruption must NEVER read as absence: callers that can degrade
+   *   (manifest recovery, rebuildable statistics) catch the typed error at
+   *   their sites; entity reads surface it.
+   *   Legacy dual-format exception: when the `.gz` variant is torn but the
+   *   uncompressed fallback decodes, the recovered object is returned — AFTER
+   *   the torn `.gz` was logged and counted (loud recovery, not a silent skip).
+   * - Real storage fault (EIO/EACCES/EMFILE/…) → propagates as itself; a
+   *   fault is neither absence nor corruption and must not be reshaped.
    */
   protected async readObjectFromPath(pathStr: string): Promise<any | null> {
     await this.ensureInitialized()
@@ -419,7 +438,10 @@ export class FileSystemStorage extends BaseStorage {
     const fullPath = path.join(this.rootDir, pathStr)
     const compressedPath = `${fullPath}.gz`
 
-    // Try reading compressed file first (if compression is enabled or file exists)
+    // Try reading compressed file first (if compression is enabled or file exists).
+    // A torn .gz is remembered so the uncompressed fallback can either recover
+    // (legacy dual-format installs) or surface the corruption typed.
+    let tornCompressed: TornRecordError | null = null
     try {
       const compressedData = await fs.promises.readFile(compressedPath)
       const decompressed = await new Promise<Buffer>((resolve, reject) => {
@@ -430,9 +452,16 @@ export class FileSystemStorage extends BaseStorage {
       })
       return JSON.parse(decompressed.toString('utf-8'))
     } catch (error: any) {
-      // If compressed file doesn't exist, fall back to uncompressed
-      if (error.code !== 'ENOENT') {
-        console.warn(`Failed to read compressed file ${compressedPath}:`, error)
+      if (error.code === 'ENOENT') {
+        // No compressed variant — fall through to the uncompressed path.
+      } else if (isUnparseablePayloadError(error)) {
+        // The .gz EXISTS but cannot be decoded (zlib Z_* error or JSON
+        // SyntaxError after gunzip): torn record. Register NOW (log + gauge),
+        // then attempt the uncompressed fallback as a recovery read.
+        tornCompressed = registerTornRecordEncounter(`${pathStr}.gz`, error)
+      } else {
+        // Real storage fault on an existing .gz (EIO/EACCES/…): propagate.
+        throw error
       }
     }
 
@@ -442,24 +471,26 @@ export class FileSystemStorage extends BaseStorage {
       return JSON.parse(data)
     } catch (error: any) {
       if (error.code === 'ENOENT') {
+        // No uncompressed file. If the .gz variant existed but was torn, the
+        // object EXISTS and is unreadable — that must surface typed, never as
+        // "absent". Otherwise this is genuine absence.
+        if (tornCompressed !== null) {
+          throw tornCompressed
+        }
         return null
       }
 
-      // Enhanced error handling for corrupted JSON files (race condition from Bug #3)
-      if (error instanceof SyntaxError || error.name === 'SyntaxError') {
-        console.warn(
-          `⚠️  Corrupted metadata file detected: ${pathStr}\n` +
-          `   This may be caused by concurrent writes during import.\n` +
-          `   Gracefully skipping this entry. File may be repaired on next write.`
-        )
-        return null
+      // The file EXISTS but its content cannot be parsed: torn record.
+      // Register (production ERROR + gauge) and throw typed — a corrupt row
+      // must be distinguishable from a missing row, or nothing ever heals it.
+      if (isUnparseablePayloadError(error)) {
+        throw registerTornRecordEncounter(pathStr, error)
       }
 
       // A real storage fault (EIO/EACCES/EMFILE/…) is NOT "object absent". The
-      // ENOENT branch (above) already returns null, and the corrupted-JSON
-      // branch (above) is a deliberate concurrent-write tolerance; a genuine
-      // fault reaching here must propagate loudly rather than masquerade as a
-      // missing object — which would corrupt reads and drive needless rebuilds.
+      // ENOENT branch (above) already returns null; a genuine fault reaching
+      // here must propagate loudly rather than masquerade as a missing object
+      // — which would corrupt reads and drive needless rebuilds.
       throw error
     }
   }

src/storage/baseStorage.ts

@@ -32,6 +32,7 @@ import { BlobStorage, type BlobStoreAdapter } from './blobStorage.js'
 import { unwrapBinaryData } from './binaryDataCodec.js'
 import { prodLog } from '../utils/logger.js'
 import { isAbsentError } from '../utils/errorClassification.js'
+import { isTornRecordError } from './tornRecordError.js'
 import { BrainyError, ProtectedArtifactError, DerivedArtifactMissingError } from '../errors/brainyError.js'
 import { MetadataWriteBuffer } from '../utils/metadataWriteBuffer.js'
 import {
@@ -674,6 +675,10 @@ export abstract class BaseStorage extends BaseStorageAdapter {
           // — hash verification must run on the original content bytes.
           return unwrapBinaryData(data)
         } catch (error) {
+          // A TORN blob object (exists but undecodable) must not read as
+          // "blob absent" — that would misdiagnose disk corruption as a
+          // missing blob. Propagate the typed error to the blob layer.
+          if (isTornRecordError(error)) throw error
           return undefined
         }
       },
@@ -768,6 +773,20 @@ export abstract class BaseStorage extends BaseStorageAdapter {
       if (m) hashes.add(m[1])
     }
 
+    // Recovery-path read: a TORN object here maps to "not usable" (null) BY
+    // DESIGN — the adapter has already logged + counted the encounter, and
+    // treating a torn `_cas/` copy as absent lets the re-copy from `_cow/`
+    // OVERWRITE the corrupt file with the good original (the heal), while a
+    // torn `_cow/` original is reported via `incomplete`. Real faults propagate.
+    const readOrNullIfTorn = async (p: string): Promise<any | null> => {
+      try {
+        return await this.readObjectFromPath(p)
+      } catch (error) {
+        if (isTornRecordError(error)) return null
+        throw error
+      }
+    }
+
     let adopted = 0
     let alreadyPresent = 0
     let incomplete = 0
@@ -775,15 +794,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
       // A blob counts as present only when BOTH its bytes and its metadata
       // already live in `_cas/`. A half-adopted blob (bytes without meta — the
       // exact "Blob metadata not found" state) is re-adopted.
-      const casBlob = await this.readObjectFromPath(`_cas/blob:${hash}`)
-      const casMeta = await this.readObjectFromPath(`_cas/blob-meta:${hash}`)
+      const casBlob = await readOrNullIfTorn(`_cas/blob:${hash}`)
+      const casMeta = await readOrNullIfTorn(`_cas/blob-meta:${hash}`)
       if (casBlob !== null && casMeta !== null) {
         alreadyPresent++
         continue
       }
 
-      const cowBlob = await this.readObjectFromPath(`_cow/blob:${hash}`)
-      const cowMeta = await this.readObjectFromPath(`_cow/blob-meta:${hash}`)
+      const cowBlob = await readOrNullIfTorn(`_cow/blob:${hash}`)
+      const cowMeta = await readOrNullIfTorn(`_cow/blob-meta:${hash}`)
       if (cowBlob === null || cowMeta === null) {
         // Can't register a blob the store can't fully describe — report it so an
         // operator investigates rather than silently half-adopting.
@@ -1134,12 +1153,28 @@ export abstract class BaseStorage extends BaseStorageAdapter {
    * cache (record-layer files are written through
    * {@link BaseStorage.writeRawObject} only).
    *
+   * TORN-record contract (deliberate, loud-by-design): this surface serves
+   * SYSTEM ARTIFACTS — manifests with recovery paths, markers whose verdict
+   * machinery treats "unreadable" as rescan, generation/transaction records
+   * whose recovery is built for absent artifacts. For these readers a torn
+   * file maps to their existing absent-artifact degrade, so a typed
+   * torn-record error from the adapter is caught here and returned as `null`
+   * — AFTER the adapter has already logged a production ERROR and counted
+   * the per-process torn-record gauge (never silent). Entity reads do NOT go
+   * through this surface; they use the canonical read paths, which propagate
+   * the typed error. Real storage faults (EIO/EACCES/…) still propagate.
+   *
    * @param path - Storage-root-relative object path (e.g. `_system/manifest.json`).
-   * @returns The parsed object, or `null` if absent.
+   * @returns The parsed object, or `null` if absent (or torn — logged + counted).
    */
   public async readRawObject(path: string): Promise<any | null> {
     await this.ensureInitialized()
-    return this.readObjectFromPath(path)
+    try {
+      return await this.readObjectFromPath(path)
+    } catch (error) {
+      if (isTornRecordError(error)) return null
+      throw error
+    }
   }
 
   /**
@@ -2146,6 +2181,9 @@ export abstract class BaseStorage extends BaseStorageAdapter {
                 if (!metadata) return null
                 return { deserialized, metadata }
               } catch (error) {
+                // A TORN record must surface typed — a paginated read that
+                // silently skips a corrupt row hides data loss from the caller.
+                if (isTornRecordError(error)) throw error
                 // Skip nouns that fail to load
                 return null
               }
@@ -2175,6 +2213,8 @@ export abstract class BaseStorage extends BaseStorageAdapter {
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -2283,7 +2323,9 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               batch.map(async (id) => {
                 try {
                   return { id, metadata: await this.getNounMetadata(id) }
-                } catch {
+                } catch (error) {
+                  // A TORN record must surface typed, never as a skipped id.
+                  if (isTornRecordError(error)) throw error
                   return null
                 }
               })
@@ -2305,6 +2347,8 @@ export abstract class BaseStorage extends BaseStorageAdapter {
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards with no data
       }
     }
@@ -2515,10 +2559,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
             // reserved fields top-level, ONLY custom fields in `metadata`.
             collected.push({ verb: this.hydrateVerbWithMetadata(verb, metadata), shard })
           } catch (error) {
+            // A TORN record must surface typed — a paginated read that
+            // silently skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip verbs that fail to load
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -3669,8 +3718,17 @@ export abstract class BaseStorage extends BaseStorageAdapter {
       )
 
       for (const result of chunkResults) {
-        if (result.status === 'fulfilled' && result.value.data !== null) {
-          results.set(result.value.path, result.value.data)
+        if (result.status === 'fulfilled') {
+          if (result.value.data !== null) {
+            results.set(result.value.path, result.value.data)
+          }
+        } else {
+          // A rejected read is a torn record or a real storage fault — NOT an
+          // absent object. Batch hydration backs entity reads (getNounBatch /
+          // getVerbsBatch / find hydration); swallowing the rejection would
+          // silently drop a row the caller cannot distinguish from "never
+          // existed". Propagate the typed/real error loudly instead.
+          throw result.reason
         }
       }
     }
@@ -4636,10 +4694,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               }
             }
           } catch (error) {
+            // A TORN record must surface typed — an enumeration that silently
+            // skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip nouns that fail to load
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -4825,11 +4888,16 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               results.push(this.hydrateVerbWithMetadata(verb, metadata))
             }
           } catch (error) {
+            // A TORN record must surface typed — an enumeration that silently
+            // skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip verbs that fail to load
             prodLog.debug(`[BaseStorage] Failed to load verb from ${verbPath}:`, error)
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -4945,6 +5013,9 @@ export abstract class BaseStorage extends BaseStorageAdapter {
           sourceVerbs.push(hydratedVerb)
         }
       } catch (error) {
+        // A TORN record propagates (typed) — batch hydration must not
+        // silently drop a corrupt row. Only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -5030,10 +5101,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               results.push(this.hydrateVerbWithMetadata(verb, metadata))
             }
           } catch (error) {
+            // A TORN record must surface typed — an enumeration that silently
+            // skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip verbs that fail to load
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -5078,10 +5154,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               )
             )
           } catch (error) {
+            // A TORN record must surface typed — an enumeration that silently
+            // skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip verbs that fail to load
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }

src/storage/tornRecordError.ts

@@ -0,0 +1,132 @@
+/**
+ * @module storage/tornRecordError
+ * @description Typed surface for TORN records — files that EXIST in storage but
+ * cannot be decoded (invalid JSON, truncated/garbled gzip). A torn record is
+ * disk corruption, not absence: reading it as `null` ("not found") makes the
+ * consumer unable to distinguish "never existed" from "exists but unreadable",
+ * so nothing ever heals it. Mandate: loud errors, never quiet losses.
+ *
+ * Contract implemented across the storage layer:
+ * - Genuine absence (ENOENT) still reads as clean `null` — no error, no noise.
+ * - A torn record ALWAYS registers here (error log + per-process gauge), then:
+ *   - entity read paths (get/getBatch/pagination/enumeration hydration) throw
+ *     {@link TornRecordError} to the caller — a row is never silently dropped;
+ *   - system-artifact read paths whose machinery is designed for
+ *     absent-artifact degradation (manifests with recovery paths, markers
+ *     whose verdict is "rescan", rebuildable statistics) map torn → their
+ *     existing degrade AFTER the encounter is logged and counted.
+ */
+
+import { prodLog } from '../utils/logger.js'
+
+/**
+ * @description Thrown when a stored object EXISTS but cannot be decoded —
+ * corrupt/torn bytes on disk (invalid JSON, undecodable gzip). Deliberately
+ * distinct from absence: `readObjectFromPath` returns `null` only for ENOENT.
+ * Catchable by type (`instanceof`), by `name === 'TornRecordError'`, or by
+ * `code === 'TORN_RECORD'` (cross-realm safe; never matches `isAbsentError`).
+ */
+export class TornRecordError extends Error {
+  /** Stable machine-checkable discriminator (errno-style). */
+  public readonly code = 'TORN_RECORD'
+  /** Storage-root-relative path of the torn object. */
+  public readonly path: string
+  /** The underlying decode failure (SyntaxError, zlib error, …). */
+  public override readonly cause: unknown
+
+  /**
+   * @param path - Storage-root-relative path of the torn object.
+   * @param cause - The underlying decode failure.
+   */
+  constructor(path: string, cause: unknown) {
+    const causeMessage =
+      cause instanceof Error ? cause.message : String(cause)
+    super(
+      `Torn record at '${path}': file exists but cannot be decoded (${causeMessage}). ` +
+        `This is storage corruption, not absence — the record was not silently skipped.`
+    )
+    this.name = 'TornRecordError'
+    this.path = path
+    this.cause = cause
+  }
+}
+
+/**
+ * @description True IFF `e` is a torn-record error — matches by `instanceof`
+ * first, then by `name`/`code` so errors crossing module-duplication or realm
+ * boundaries are still recognized.
+ * @param e - The caught value.
+ * @returns Whether `e` denotes an existing-but-undecodable stored object.
+ */
+export function isTornRecordError(e: unknown): e is TornRecordError {
+  if (e instanceof TornRecordError) return true
+  if (e === null || typeof e !== 'object') return false
+  const { name, code } = e as { name?: unknown; code?: unknown }
+  return name === 'TornRecordError' || code === 'TORN_RECORD'
+}
+
+/**
+ * @description True IFF `e` is a payload-decode failure — the file's BYTES were
+ * read fine but could not be turned back into an object: `SyntaxError` from
+ * `JSON.parse`, or a zlib error (`Z_DATA_ERROR`, `Z_BUF_ERROR`, …) from gunzip.
+ * Distinguishes "torn record" from real I/O faults (EIO/EACCES/…), which must
+ * propagate as themselves.
+ * @param e - The caught value.
+ * @returns Whether the error means "bytes present, content undecodable".
+ */
+export function isUnparseablePayloadError(e: unknown): boolean {
+  if (e === null || typeof e !== 'object') return false
+  if (e instanceof SyntaxError) return true
+  const { name, code } = e as { name?: unknown; code?: unknown }
+  if (name === 'SyntaxError') return true
+  return typeof code === 'string' && code.startsWith('Z_')
+}
+
+/** Per-process torn-record gauge state (module-scoped; see the accessors). */
+let tornRecordCount = 0
+let lastTornRecordPath: string | null = null
+
+/**
+ * @description Register a torn-record encounter: logs a production ERROR
+ * naming the path, increments the per-process gauge, and returns the typed
+ * error for the caller to throw (or to map into a documented loud degrade).
+ * EVERY torn encounter goes through here, whatever the caller decides —
+ * the floor is: never silent.
+ * @param path - Storage-root-relative path of the torn object.
+ * @param cause - The underlying decode failure.
+ * @returns The constructed {@link TornRecordError}.
+ */
+export function registerTornRecordEncounter(
+  path: string,
+  cause: unknown
+): TornRecordError {
+  tornRecordCount++
+  lastTornRecordPath = path
+  const error = new TornRecordError(path, cause)
+  prodLog.error(
+    `[Storage] TORN RECORD #${tornRecordCount}: '${path}' exists but cannot be decoded — ` +
+      `corrupt or partially written bytes. Cause: ${
+        cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause)
+      }`
+  )
+  return error
+}
+
+/**
+ * @description Read the per-process torn-record gauge: how many torn records
+ * this process has encountered and the most recent path. Observability seam —
+ * lets operators and tests confirm that corruption was seen, not swallowed.
+ * @returns The current gauge snapshot.
+ */
+export function getTornRecordGauge(): { count: number; lastPath: string | null } {
+  return { count: tornRecordCount, lastPath: lastTornRecordPath }
+}
+
+/**
+ * @description Reset the per-process torn-record gauge to zero. Test seam only
+ * (the gauge is process-lifetime state); production code never resets it.
+ */
+export function resetTornRecordGauge(): void {
+  tornRecordCount = 0
+  lastTornRecordPath = null
+}

src/types/brainy.types.ts

@@ -2084,6 +2084,28 @@ export interface BrainyConfig {
    * `'manual'` restores the pre-9.1 behavior: the engine never flushes on
    * its own (except at `close()`); the caller owns the cadence.
    */
+  /**
+   * Storage-authority posture at open (10.0.0+ fleet default: `'adopt'`).
+   *
+   * `'adopt'` — a brain with NO stored authority artifact adopts LOG
+   * AUTHORITY at open, oracle-gated: the verification oracle replays the
+   * generation log against stored truth; curable divergences (pre-log
+   * rows, witness drift) are baseline-backfilled; the brain flips ONLY on
+   * a green verdict and writes the durable per-brain switch. On green,
+   * writes become durable-at-ack (group-committed log fsync covers every
+   * ack). A brain whose oracle cannot go green STAYS tree-authoritative,
+   * says so loudly, and records the refusal — never a silent half-state.
+   *
+   * `'defer'` — the explicit opt-out: no automatic adoption; the brain
+   * stays tree-authoritative until `adoptLogAuthority()` is called. The
+   * pre-10 behavior, documented for operators who stage their own flips.
+   *
+   * A STORED artifact always wins over this setting (checked-at-open law):
+   * an already-flipped brain stays flipped; an explicitly-recorded tree
+   * posture is honored until an operator re-runs adoption.
+   */
+  logAuthority?: 'adopt' | 'defer'
+
   persistence?: {
     policy?: 'auto' | 'manual'
     /** Background flush after this many committed writes (default 512). */