feat(log): log authority is the fleet default — adopt-at-open, oracle-gated; plus the power-cut throw-site cures and the loud torn-record contract

THE DEFAULT FLIP (ruled on proven evidence — at-ack survived 301/301
acked-writes-through-power-cut in block-layer fault injection; deferred
tree authority demonstrably loses flush-covered acks): a brain with NO
stored authority artifact now ADOPTS LOG AUTHORITY AT OPEN. The oracle
gates the flip exactly as the guarded adoption path always did — curable
divergences baseline-backfilled, the flip lands ONLY on a green verdict —
and a brain that cannot verify STAYS tree-authoritative loudly, with the
refusal recorded on the switch artifact so subsequent opens are cheap.
config logAuthority: 'defer' is the explicit documented opt-out (no
automatic adoption; declared flush-window loss; adoptLogAuthority() flips
later). A stored artifact always wins. RELEASES.md carries the posture.

Two standing .fails debt pins FLIP TO HOLDING under the default: the
at-ack crash-survival gap and the ack-at-log durability target — both now
permanent asserted truths, not aspirations.

POWER-CUT THROW SITES (fault-injection findings, brainy-alone config):
- A manifest-listed-but-unloadable column segment QUARANTINES at
  discovery (loud once, counted always, quarantinedSegments() exposed for
  the heal) and the field serves its remaining segments DEGRADED — never
  a raw throw killing every query on the field. Real storage faults still
  propagate untouched.
- Torn generation artifacts (NaN/garbage in manifest or counter) DISCARD
  with narration at the store's open and recovery re-derives — plus a
  defensive finite-integer guard at the init consumer. Never a RangeError
  killing an open.

THE LOUD TORN-RECORD CONTRACT: an existing-but-unparseable stored record
now surfaces as a typed, counted TornRecordError on every entity-read
surface (including fifteen previously-blind per-item batch catches);
ENOENT stays clean-absent; artifact readers with designed absent-recovery
keep null-tolerance behind the loud floor. Disk corruption can no longer
read as silent data invisibility.

Suite migration: the default's pins inverted deliberately, generation
baselines made relative, quarantine-contract pins rewritten to the ruled
behavior.

Gates: tsc 0 · unit 2065/2065 (159 files) · integration 826 (93 files) ·
conformance 31/31 · kill-matrix 15/15 · torn-open guards 2/2.

src/storage/adapters/fileSystemStorage.ts

@@ -18,6 +18,11 @@ import {
 } from '../baseStorage.js'
 import { getBrainyVersion } from '../../utils/index.js'
 import { isAbsentError } from '../../utils/errorClassification.js'
+import {
+  TornRecordError,
+  isUnparseablePayloadError,
+  registerTornRecordEncounter
+} from '../tornRecordError.js'
 
 // Node.js modules - dynamically imported to avoid issues in browser environments
 let fs: any
@@ -410,8 +415,22 @@ export class FileSystemStorage extends BaseStorage {
   /**
    * Primitive operation: Read object from path
    * All metadata operations use this internally via base class routing
-   * Enhanced error handling for corrupted metadata files (Bug #3 mitigation)
    * Supports reading both compressed (.gz) and uncompressed files for backward compatibility
+   *
+   * Read contract (loud errors, never quiet losses):
+   * - Genuine absence (ENOENT on every variant) → `null`. Only a missing file
+   *   is "not found".
+   * - TORN record (a file EXISTS but its bytes cannot be decoded — invalid
+   *   JSON, truncated/garbled gzip) → the encounter is registered (production
+   *   ERROR log + per-process gauge) and a typed {@link TornRecordError} is
+   *   thrown. Corruption must NEVER read as absence: callers that can degrade
+   *   (manifest recovery, rebuildable statistics) catch the typed error at
+   *   their sites; entity reads surface it.
+   *   Legacy dual-format exception: when the `.gz` variant is torn but the
+   *   uncompressed fallback decodes, the recovered object is returned — AFTER
+   *   the torn `.gz` was logged and counted (loud recovery, not a silent skip).
+   * - Real storage fault (EIO/EACCES/EMFILE/…) → propagates as itself; a
+   *   fault is neither absence nor corruption and must not be reshaped.
    */
   protected async readObjectFromPath(pathStr: string): Promise<any | null> {
     await this.ensureInitialized()
@@ -419,7 +438,10 @@ export class FileSystemStorage extends BaseStorage {
     const fullPath = path.join(this.rootDir, pathStr)
     const compressedPath = `${fullPath}.gz`
 
-    // Try reading compressed file first (if compression is enabled or file exists)
+    // Try reading compressed file first (if compression is enabled or file exists).
+    // A torn .gz is remembered so the uncompressed fallback can either recover
+    // (legacy dual-format installs) or surface the corruption typed.
+    let tornCompressed: TornRecordError | null = null
     try {
       const compressedData = await fs.promises.readFile(compressedPath)
       const decompressed = await new Promise<Buffer>((resolve, reject) => {
@@ -430,9 +452,16 @@ export class FileSystemStorage extends BaseStorage {
       })
       return JSON.parse(decompressed.toString('utf-8'))
     } catch (error: any) {
-      // If compressed file doesn't exist, fall back to uncompressed
-      if (error.code !== 'ENOENT') {
-        console.warn(`Failed to read compressed file ${compressedPath}:`, error)
+      if (error.code === 'ENOENT') {
+        // No compressed variant — fall through to the uncompressed path.
+      } else if (isUnparseablePayloadError(error)) {
+        // The .gz EXISTS but cannot be decoded (zlib Z_* error or JSON
+        // SyntaxError after gunzip): torn record. Register NOW (log + gauge),
+        // then attempt the uncompressed fallback as a recovery read.
+        tornCompressed = registerTornRecordEncounter(`${pathStr}.gz`, error)
+      } else {
+        // Real storage fault on an existing .gz (EIO/EACCES/…): propagate.
+        throw error
       }
     }
 
@@ -442,24 +471,26 @@ export class FileSystemStorage extends BaseStorage {
       return JSON.parse(data)
     } catch (error: any) {
       if (error.code === 'ENOENT') {
+        // No uncompressed file. If the .gz variant existed but was torn, the
+        // object EXISTS and is unreadable — that must surface typed, never as
+        // "absent". Otherwise this is genuine absence.
+        if (tornCompressed !== null) {
+          throw tornCompressed
+        }
         return null
       }
 
-      // Enhanced error handling for corrupted JSON files (race condition from Bug #3)
-      if (error instanceof SyntaxError || error.name === 'SyntaxError') {
-        console.warn(
-          `⚠️  Corrupted metadata file detected: ${pathStr}\n` +
-          `   This may be caused by concurrent writes during import.\n` +
-          `   Gracefully skipping this entry. File may be repaired on next write.`
-        )
-        return null
+      // The file EXISTS but its content cannot be parsed: torn record.
+      // Register (production ERROR + gauge) and throw typed — a corrupt row
+      // must be distinguishable from a missing row, or nothing ever heals it.
+      if (isUnparseablePayloadError(error)) {
+        throw registerTornRecordEncounter(pathStr, error)
       }
 
       // A real storage fault (EIO/EACCES/EMFILE/…) is NOT "object absent". The
-      // ENOENT branch (above) already returns null, and the corrupted-JSON
-      // branch (above) is a deliberate concurrent-write tolerance; a genuine
-      // fault reaching here must propagate loudly rather than masquerade as a
-      // missing object — which would corrupt reads and drive needless rebuilds.
+      // ENOENT branch (above) already returns null; a genuine fault reaching
+      // here must propagate loudly rather than masquerade as a missing object
+      // — which would corrupt reads and drive needless rebuilds.
       throw error
     }
   }

src/storage/baseStorage.ts

@@ -32,6 +32,7 @@ import { BlobStorage, type BlobStoreAdapter } from './blobStorage.js'
 import { unwrapBinaryData } from './binaryDataCodec.js'
 import { prodLog } from '../utils/logger.js'
 import { isAbsentError } from '../utils/errorClassification.js'
+import { isTornRecordError } from './tornRecordError.js'
 import { BrainyError, ProtectedArtifactError, DerivedArtifactMissingError } from '../errors/brainyError.js'
 import { MetadataWriteBuffer } from '../utils/metadataWriteBuffer.js'
 import {
@@ -674,6 +675,10 @@ export abstract class BaseStorage extends BaseStorageAdapter {
           // — hash verification must run on the original content bytes.
           return unwrapBinaryData(data)
         } catch (error) {
+          // A TORN blob object (exists but undecodable) must not read as
+          // "blob absent" — that would misdiagnose disk corruption as a
+          // missing blob. Propagate the typed error to the blob layer.
+          if (isTornRecordError(error)) throw error
           return undefined
         }
       },
@@ -768,6 +773,20 @@ export abstract class BaseStorage extends BaseStorageAdapter {
       if (m) hashes.add(m[1])
     }
 
+    // Recovery-path read: a TORN object here maps to "not usable" (null) BY
+    // DESIGN — the adapter has already logged + counted the encounter, and
+    // treating a torn `_cas/` copy as absent lets the re-copy from `_cow/`
+    // OVERWRITE the corrupt file with the good original (the heal), while a
+    // torn `_cow/` original is reported via `incomplete`. Real faults propagate.
+    const readOrNullIfTorn = async (p: string): Promise<any | null> => {
+      try {
+        return await this.readObjectFromPath(p)
+      } catch (error) {
+        if (isTornRecordError(error)) return null
+        throw error
+      }
+    }
+
     let adopted = 0
     let alreadyPresent = 0
     let incomplete = 0
@@ -775,15 +794,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
       // A blob counts as present only when BOTH its bytes and its metadata
       // already live in `_cas/`. A half-adopted blob (bytes without meta — the
       // exact "Blob metadata not found" state) is re-adopted.
-      const casBlob = await this.readObjectFromPath(`_cas/blob:${hash}`)
-      const casMeta = await this.readObjectFromPath(`_cas/blob-meta:${hash}`)
+      const casBlob = await readOrNullIfTorn(`_cas/blob:${hash}`)
+      const casMeta = await readOrNullIfTorn(`_cas/blob-meta:${hash}`)
       if (casBlob !== null && casMeta !== null) {
         alreadyPresent++
         continue
       }
 
-      const cowBlob = await this.readObjectFromPath(`_cow/blob:${hash}`)
-      const cowMeta = await this.readObjectFromPath(`_cow/blob-meta:${hash}`)
+      const cowBlob = await readOrNullIfTorn(`_cow/blob:${hash}`)
+      const cowMeta = await readOrNullIfTorn(`_cow/blob-meta:${hash}`)
       if (cowBlob === null || cowMeta === null) {
         // Can't register a blob the store can't fully describe — report it so an
         // operator investigates rather than silently half-adopting.
@@ -1134,12 +1153,28 @@ export abstract class BaseStorage extends BaseStorageAdapter {
    * cache (record-layer files are written through
    * {@link BaseStorage.writeRawObject} only).
    *
+   * TORN-record contract (deliberate, loud-by-design): this surface serves
+   * SYSTEM ARTIFACTS — manifests with recovery paths, markers whose verdict
+   * machinery treats "unreadable" as rescan, generation/transaction records
+   * whose recovery is built for absent artifacts. For these readers a torn
+   * file maps to their existing absent-artifact degrade, so a typed
+   * torn-record error from the adapter is caught here and returned as `null`
+   * — AFTER the adapter has already logged a production ERROR and counted
+   * the per-process torn-record gauge (never silent). Entity reads do NOT go
+   * through this surface; they use the canonical read paths, which propagate
+   * the typed error. Real storage faults (EIO/EACCES/…) still propagate.
+   *
    * @param path - Storage-root-relative object path (e.g. `_system/manifest.json`).
-   * @returns The parsed object, or `null` if absent.
+   * @returns The parsed object, or `null` if absent (or torn — logged + counted).
    */
   public async readRawObject(path: string): Promise<any | null> {
     await this.ensureInitialized()
-    return this.readObjectFromPath(path)
+    try {
+      return await this.readObjectFromPath(path)
+    } catch (error) {
+      if (isTornRecordError(error)) return null
+      throw error
+    }
   }
 
   /**
@@ -2146,6 +2181,9 @@ export abstract class BaseStorage extends BaseStorageAdapter {
                 if (!metadata) return null
                 return { deserialized, metadata }
               } catch (error) {
+                // A TORN record must surface typed — a paginated read that
+                // silently skips a corrupt row hides data loss from the caller.
+                if (isTornRecordError(error)) throw error
                 // Skip nouns that fail to load
                 return null
               }
@@ -2175,6 +2213,8 @@ export abstract class BaseStorage extends BaseStorageAdapter {
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -2283,7 +2323,9 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               batch.map(async (id) => {
                 try {
                   return { id, metadata: await this.getNounMetadata(id) }
-                } catch {
+                } catch (error) {
+                  // A TORN record must surface typed, never as a skipped id.
+                  if (isTornRecordError(error)) throw error
                   return null
                 }
               })
@@ -2305,6 +2347,8 @@ export abstract class BaseStorage extends BaseStorageAdapter {
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards with no data
       }
     }
@@ -2515,10 +2559,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
             // reserved fields top-level, ONLY custom fields in `metadata`.
             collected.push({ verb: this.hydrateVerbWithMetadata(verb, metadata), shard })
           } catch (error) {
+            // A TORN record must surface typed — a paginated read that
+            // silently skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip verbs that fail to load
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -3669,8 +3718,17 @@ export abstract class BaseStorage extends BaseStorageAdapter {
       )
 
       for (const result of chunkResults) {
-        if (result.status === 'fulfilled' && result.value.data !== null) {
-          results.set(result.value.path, result.value.data)
+        if (result.status === 'fulfilled') {
+          if (result.value.data !== null) {
+            results.set(result.value.path, result.value.data)
+          }
+        } else {
+          // A rejected read is a torn record or a real storage fault — NOT an
+          // absent object. Batch hydration backs entity reads (getNounBatch /
+          // getVerbsBatch / find hydration); swallowing the rejection would
+          // silently drop a row the caller cannot distinguish from "never
+          // existed". Propagate the typed/real error loudly instead.
+          throw result.reason
         }
       }
     }
@@ -4636,10 +4694,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               }
             }
           } catch (error) {
+            // A TORN record must surface typed — an enumeration that silently
+            // skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip nouns that fail to load
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -4825,11 +4888,16 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               results.push(this.hydrateVerbWithMetadata(verb, metadata))
             }
           } catch (error) {
+            // A TORN record must surface typed — an enumeration that silently
+            // skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip verbs that fail to load
             prodLog.debug(`[BaseStorage] Failed to load verb from ${verbPath}:`, error)
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -4945,6 +5013,9 @@ export abstract class BaseStorage extends BaseStorageAdapter {
           sourceVerbs.push(hydratedVerb)
         }
       } catch (error) {
+        // A TORN record propagates (typed) — batch hydration must not
+        // silently drop a corrupt row. Only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -5030,10 +5101,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               results.push(this.hydrateVerbWithMetadata(verb, metadata))
             }
           } catch (error) {
+            // A TORN record must surface typed — an enumeration that silently
+            // skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip verbs that fail to load
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }
@@ -5078,10 +5154,15 @@ export abstract class BaseStorage extends BaseStorageAdapter {
               )
             )
           } catch (error) {
+            // A TORN record must surface typed — an enumeration that silently
+            // skips a corrupt row hides data loss from the caller.
+            if (isTornRecordError(error)) throw error
             // Skip verbs that fail to load
           }
         }
       } catch (error) {
+        // A TORN record propagates (typed) — only shard-listing absence is skippable.
+        if (isTornRecordError(error)) throw error
         // Skip shards that have no data
       }
     }

src/storage/tornRecordError.ts

@@ -0,0 +1,132 @@
+/**
+ * @module storage/tornRecordError
+ * @description Typed surface for TORN records — files that EXIST in storage but
+ * cannot be decoded (invalid JSON, truncated/garbled gzip). A torn record is
+ * disk corruption, not absence: reading it as `null` ("not found") makes the
+ * consumer unable to distinguish "never existed" from "exists but unreadable",
+ * so nothing ever heals it. Mandate: loud errors, never quiet losses.
+ *
+ * Contract implemented across the storage layer:
+ * - Genuine absence (ENOENT) still reads as clean `null` — no error, no noise.
+ * - A torn record ALWAYS registers here (error log + per-process gauge), then:
+ *   - entity read paths (get/getBatch/pagination/enumeration hydration) throw
+ *     {@link TornRecordError} to the caller — a row is never silently dropped;
+ *   - system-artifact read paths whose machinery is designed for
+ *     absent-artifact degradation (manifests with recovery paths, markers
+ *     whose verdict is "rescan", rebuildable statistics) map torn → their
+ *     existing degrade AFTER the encounter is logged and counted.
+ */
+
+import { prodLog } from '../utils/logger.js'
+
+/**
+ * @description Thrown when a stored object EXISTS but cannot be decoded —
+ * corrupt/torn bytes on disk (invalid JSON, undecodable gzip). Deliberately
+ * distinct from absence: `readObjectFromPath` returns `null` only for ENOENT.
+ * Catchable by type (`instanceof`), by `name === 'TornRecordError'`, or by
+ * `code === 'TORN_RECORD'` (cross-realm safe; never matches `isAbsentError`).
+ */
+export class TornRecordError extends Error {
+  /** Stable machine-checkable discriminator (errno-style). */
+  public readonly code = 'TORN_RECORD'
+  /** Storage-root-relative path of the torn object. */
+  public readonly path: string
+  /** The underlying decode failure (SyntaxError, zlib error, …). */
+  public override readonly cause: unknown
+
+  /**
+   * @param path - Storage-root-relative path of the torn object.
+   * @param cause - The underlying decode failure.
+   */
+  constructor(path: string, cause: unknown) {
+    const causeMessage =
+      cause instanceof Error ? cause.message : String(cause)
+    super(
+      `Torn record at '${path}': file exists but cannot be decoded (${causeMessage}). ` +
+        `This is storage corruption, not absence — the record was not silently skipped.`
+    )
+    this.name = 'TornRecordError'
+    this.path = path
+    this.cause = cause
+  }
+}
+
+/**
+ * @description True IFF `e` is a torn-record error — matches by `instanceof`
+ * first, then by `name`/`code` so errors crossing module-duplication or realm
+ * boundaries are still recognized.
+ * @param e - The caught value.
+ * @returns Whether `e` denotes an existing-but-undecodable stored object.
+ */
+export function isTornRecordError(e: unknown): e is TornRecordError {
+  if (e instanceof TornRecordError) return true
+  if (e === null || typeof e !== 'object') return false
+  const { name, code } = e as { name?: unknown; code?: unknown }
+  return name === 'TornRecordError' || code === 'TORN_RECORD'
+}
+
+/**
+ * @description True IFF `e` is a payload-decode failure — the file's BYTES were
+ * read fine but could not be turned back into an object: `SyntaxError` from
+ * `JSON.parse`, or a zlib error (`Z_DATA_ERROR`, `Z_BUF_ERROR`, …) from gunzip.
+ * Distinguishes "torn record" from real I/O faults (EIO/EACCES/…), which must
+ * propagate as themselves.
+ * @param e - The caught value.
+ * @returns Whether the error means "bytes present, content undecodable".
+ */
+export function isUnparseablePayloadError(e: unknown): boolean {
+  if (e === null || typeof e !== 'object') return false
+  if (e instanceof SyntaxError) return true
+  const { name, code } = e as { name?: unknown; code?: unknown }
+  if (name === 'SyntaxError') return true
+  return typeof code === 'string' && code.startsWith('Z_')
+}
+
+/** Per-process torn-record gauge state (module-scoped; see the accessors). */
+let tornRecordCount = 0
+let lastTornRecordPath: string | null = null
+
+/**
+ * @description Register a torn-record encounter: logs a production ERROR
+ * naming the path, increments the per-process gauge, and returns the typed
+ * error for the caller to throw (or to map into a documented loud degrade).
+ * EVERY torn encounter goes through here, whatever the caller decides —
+ * the floor is: never silent.
+ * @param path - Storage-root-relative path of the torn object.
+ * @param cause - The underlying decode failure.
+ * @returns The constructed {@link TornRecordError}.
+ */
+export function registerTornRecordEncounter(
+  path: string,
+  cause: unknown
+): TornRecordError {
+  tornRecordCount++
+  lastTornRecordPath = path
+  const error = new TornRecordError(path, cause)
+  prodLog.error(
+    `[Storage] TORN RECORD #${tornRecordCount}: '${path}' exists but cannot be decoded — ` +
+      `corrupt or partially written bytes. Cause: ${
+        cause instanceof Error ? `${cause.name}: ${cause.message}` : String(cause)
+      }`
+  )
+  return error
+}
+
+/**
+ * @description Read the per-process torn-record gauge: how many torn records
+ * this process has encountered and the most recent path. Observability seam —
+ * lets operators and tests confirm that corruption was seen, not swallowed.
+ * @returns The current gauge snapshot.
+ */
+export function getTornRecordGauge(): { count: number; lastPath: string | null } {
+  return { count: tornRecordCount, lastPath: lastTornRecordPath }
+}
+
+/**
+ * @description Reset the per-process torn-record gauge to zero. Test seam only
+ * (the gauge is process-lifetime state); production code never resets it.
+ */
+export function resetTornRecordGauge(): void {
+  tornRecordCount = 0
+  lastTornRecordPath = null
+}