feat(log): log authority is the fleet default — adopt-at-open, oracle-gated; plus the power-cut throw-site cures and the loud torn-record contract

THE DEFAULT FLIP (ruled on proven evidence — at-ack survived 301/301
acked-writes-through-power-cut in block-layer fault injection; deferred
tree authority demonstrably loses flush-covered acks): a brain with NO
stored authority artifact now ADOPTS LOG AUTHORITY AT OPEN. The oracle
gates the flip exactly as the guarded adoption path always did — curable
divergences baseline-backfilled, the flip lands ONLY on a green verdict —
and a brain that cannot verify STAYS tree-authoritative loudly, with the
refusal recorded on the switch artifact so subsequent opens are cheap.
config logAuthority: 'defer' is the explicit documented opt-out (no
automatic adoption; declared flush-window loss; adoptLogAuthority() flips
later). A stored artifact always wins. RELEASES.md carries the posture.

Two standing .fails debt pins FLIP TO HOLDING under the default: the
at-ack crash-survival gap and the ack-at-log durability target — both now
permanent asserted truths, not aspirations.

POWER-CUT THROW SITES (fault-injection findings, brainy-alone config):
- A manifest-listed-but-unloadable column segment QUARANTINES at
  discovery (loud once, counted always, quarantinedSegments() exposed for
  the heal) and the field serves its remaining segments DEGRADED — never
  a raw throw killing every query on the field. Real storage faults still
  propagate untouched.
- Torn generation artifacts (NaN/garbage in manifest or counter) DISCARD
  with narration at the store's open and recovery re-derives — plus a
  defensive finite-integer guard at the init consumer. Never a RangeError
  killing an open.

THE LOUD TORN-RECORD CONTRACT: an existing-but-unparseable stored record
now surfaces as a typed, counted TornRecordError on every entity-read
surface (including fifteen previously-blind per-item batch catches);
ENOENT stays clean-absent; artifact readers with designed absent-recovery
keep null-tolerance behind the loud floor. Disk corruption can no longer
read as silent data invisibility.

Suite migration: the default's pins inverted deliberately, generation
baselines made relative, quarantine-contract pins rewritten to the ruled
behavior.

Gates: tsc 0 · unit 2065/2065 (159 files) · integration 826 (93 files) ·
conformance 31/31 · kill-matrix 15/15 · torn-open guards 2/2.

src/db/generationStore.ts

@@ -468,9 +468,26 @@ export class GenerationStore {
       | null
     const manifest = (await this.storage.readRawObject(MANIFEST_PATH)) as GenerationManifest | null
 
-    this.committed = manifest?.generation ?? 0
-    this.horizonGen = manifest?.horizon ?? 0
-    this.counter = Math.max(counterFile?.generation ?? 0, this.committed)
+    // TORN-ARTIFACT VALIDATION (power-loss survivors): a torn manifest or
+    // counter can carry NaN/garbage where a generation belongs — unguarded,
+    // that NaN reaches BigInt() conversions at init and kills the open with
+    // a RangeError. A non-finite-integer generation is DISCARDED with
+    // narration (the conservative floor: 0 = re-derive from the record
+    // directories / fact log below, exactly the recovery machinery's job).
+    const finiteGen = (v: unknown, source: string): number => {
+      if (typeof v === 'number' && Number.isSafeInteger(v) && v >= 0) return v
+      if (v !== undefined && v !== null) {
+        prodLog.warn(
+          `[GenerationStore] ${source} carries a non-integer generation ` +
+            `(${String(v)}) — torn write survivor; discarding and re-deriving ` +
+            `from recovery (never a RangeError at open)`
+        )
+      }
+      return 0
+    }
+    this.committed = finiteGen(manifest?.generation, 'manifest')
+    this.horizonGen = finiteGen(manifest?.horizon, 'manifest horizon')
+    this.counter = Math.max(finiteGen(counterFile?.generation, 'generation counter'), this.committed)
 
     // Discover existing generation record directories.
     const recordPaths = await this.storage.listRawObjects(GENERATIONS_PREFIX)