feat(log): log authority is the fleet default — adopt-at-open, oracle-gated; plus the power-cut throw-site cures and the loud torn-record contract

THE DEFAULT FLIP (ruled on proven evidence — at-ack survived 301/301
acked-writes-through-power-cut in block-layer fault injection; deferred
tree authority demonstrably loses flush-covered acks): a brain with NO
stored authority artifact now ADOPTS LOG AUTHORITY AT OPEN. The oracle
gates the flip exactly as the guarded adoption path always did — curable
divergences baseline-backfilled, the flip lands ONLY on a green verdict —
and a brain that cannot verify STAYS tree-authoritative loudly, with the
refusal recorded on the switch artifact so subsequent opens are cheap.
config logAuthority: 'defer' is the explicit documented opt-out (no
automatic adoption; declared flush-window loss; adoptLogAuthority() flips
later). A stored artifact always wins. RELEASES.md carries the posture.

Two standing .fails debt pins FLIP TO HOLDING under the default: the
at-ack crash-survival gap and the ack-at-log durability target — both now
permanent asserted truths, not aspirations.

POWER-CUT THROW SITES (fault-injection findings, brainy-alone config):
- A manifest-listed-but-unloadable column segment QUARANTINES at
  discovery (loud once, counted always, quarantinedSegments() exposed for
  the heal) and the field serves its remaining segments DEGRADED — never
  a raw throw killing every query on the field. Real storage faults still
  propagate untouched.
- Torn generation artifacts (NaN/garbage in manifest or counter) DISCARD
  with narration at the store's open and recovery re-derives — plus a
  defensive finite-integer guard at the init consumer. Never a RangeError
  killing an open.

THE LOUD TORN-RECORD CONTRACT: an existing-but-unparseable stored record
now surfaces as a typed, counted TornRecordError on every entity-read
surface (including fifteen previously-blind per-item batch catches);
ENOENT stays clean-absent; artifact readers with designed absent-recovery
keep null-tolerance behind the loud floor. Disk corruption can no longer
read as silent data invisibility.

Suite migration: the default's pins inverted deliberately, generation
baselines made relative, quarantine-contract pins rewritten to the ruled
behavior.

Gates: tsc 0 · unit 2065/2065 (159 files) · integration 826 (93 files) ·
conformance 31/31 · kill-matrix 15/15 · torn-open guards 2/2.

tests/integration/db-temporal.test.ts

@@ -36,6 +36,9 @@ import { GenerationCompactedError } from '../../src/db/errors.js'
 import type { GenerationStore } from '../../src/db/generationStore.js'
 import { NounType } from '../../src/types/graphTypes.js'
 
+/** The VFS root — re-committed by the adopt-at-open baseline backfill. */
+const VFS_ROOT = '00000000-0000-0000-0000-000000000000'
+
 /** Deterministic 384-dim vector so no test ever invokes the embedder. */
 function vec(seed: number): number[] {
   return Array.from({ length: 384 }, (_, i) => ((seed * 31 + i * 7) % 100) / 100)
@@ -133,7 +136,11 @@ describe('8.0 Db API — temporal range verbs', () => {
     expect(viaDb).toEqual(viaGen)
     expect(viaDb.fromGeneration).toBe(g1)
     expect(viaDb.nouns).toEqual([a, b].sort()) // a (updated after g1) + b (added after g1)
-    expect(viaEpoch.nouns).toEqual([a, b].sort()) // (0, now] also includes a's creation, still {a, b}
+    // (0, now] also includes a's creation — still {a, b} among user rows. The
+    // adopt-at-open baseline backfill re-commits the VFS root as a real
+    // generation, so the full-epoch window legitimately reports it too;
+    // filter it to keep this pin about the user writes.
+    expect(viaEpoch.nouns.filter((n) => n !== VFS_ROOT)).toEqual([a, b].sort())
 
     // direction guard: an older view cannot be `since` a newer lower bound
     const older = await brain.asOf(1)
@@ -163,7 +170,11 @@ describe('8.0 Db API — temporal range verbs', () => {
     }
 
     const all = await brain.transactionLog()
-    expect(all.map((e) => e.generation)).toEqual([...gens].reverse()) // newest first
+    // Newest first — compared above the open baseline (the adopt-at-open
+    // backfill logs its own generation(s) below the first user write).
+    expect(all.map((e) => e.generation).filter((g) => g >= gens[0])).toEqual(
+      [...gens].reverse()
+    )
 
     // INCLUSIVE both ends — gens[1] AND gens[3] are present (contrast since's exclusive lower).
     const windowed = await brain.transactionLog({ from: gens[1], to: gens[3] })
@@ -334,19 +345,22 @@ describe('8.0 Db API — temporal range verbs', () => {
   // 7. Granularity (Model-B) ---------------------------------------------------
   it('granularity: single-operation writes ARE versioned and visible to the temporal verbs', async () => {
     const brain = await openMemoryBrain()
+    // Relative baseline: the adopt-at-open backfill already logged its own
+    // generation(s) — pin the DELTA this test's writes add, not a count.
+    const baseCount = (await brain.transactionLog()).length
     const a = uid('gran-a')
     const r1 = await brain.transact([
       { op: 'add', id: a, type: NounType.Document, data: 'a', vector: vec(1), metadata: { v: 1 } }
     ])
     await r1.release()
-    expect((await brain.transactionLog()).length).toBe(1)
+    expect((await brain.transactionLog()).length).toBe(baseCount + 1)
 
     // Model-B: a single-op write is its OWN immutable generation — logged,
     // diffable, and time-travelable, exactly like a transact() of one op.
     await brain.update({ id: a, metadata: { v: 2 } })
 
     // The single-op update appended a generation/log entry.
-    expect((await brain.transactionLog()).length).toBe(2)
+    expect((await brain.transactionLog()).length).toBe(baseCount + 2)
     expect(brain.generation()).toBe(r1.generation + 1)
 
     // diff sees the single-op update as a modification of `a`.