feat(log): log authority is the fleet default — adopt-at-open, oracle-gated; plus the power-cut throw-site cures and the loud torn-record contract

THE DEFAULT FLIP (ruled on proven evidence — at-ack survived 301/301
acked-writes-through-power-cut in block-layer fault injection; deferred
tree authority demonstrably loses flush-covered acks): a brain with NO
stored authority artifact now ADOPTS LOG AUTHORITY AT OPEN. The oracle
gates the flip exactly as the guarded adoption path always did — curable
divergences baseline-backfilled, the flip lands ONLY on a green verdict —
and a brain that cannot verify STAYS tree-authoritative loudly, with the
refusal recorded on the switch artifact so subsequent opens are cheap.
config logAuthority: 'defer' is the explicit documented opt-out (no
automatic adoption; declared flush-window loss; adoptLogAuthority() flips
later). A stored artifact always wins. RELEASES.md carries the posture.

Two standing .fails debt pins FLIP TO HOLDING under the default: the
at-ack crash-survival gap and the ack-at-log durability target — both now
permanent asserted truths, not aspirations.

POWER-CUT THROW SITES (fault-injection findings, brainy-alone config):
- A manifest-listed-but-unloadable column segment QUARANTINES at
  discovery (loud once, counted always, quarantinedSegments() exposed for
  the heal) and the field serves its remaining segments DEGRADED — never
  a raw throw killing every query on the field. Real storage faults still
  propagate untouched.
- Torn generation artifacts (NaN/garbage in manifest or counter) DISCARD
  with narration at the store's open and recovery re-derives — plus a
  defensive finite-integer guard at the init consumer. Never a RangeError
  killing an open.

THE LOUD TORN-RECORD CONTRACT: an existing-but-unparseable stored record
now surfaces as a typed, counted TornRecordError on every entity-read
surface (including fifteen previously-blind per-item batch catches);
ENOENT stays clean-absent; artifact readers with designed absent-recovery
keep null-tolerance behind the loud floor. Disk corruption can no longer
read as silent data invisibility.

Suite migration: the default's pins inverted deliberately, generation
baselines made relative, quarantine-contract pins rewritten to the ruled
behavior.

Gates: tsc 0 · unit 2065/2065 (159 files) · integration 826 (93 files) ·
conformance 31/31 · kill-matrix 15/15 · torn-open guards 2/2.

tests/integration/fact-log-contracts.test.ts

@@ -4,14 +4,13 @@
  *
  * (1) FSYNC-BEFORE-ACK: an acknowledged write's fact survives an abrupt
  *     process end (no flush, no close — reopen from disk).
- *     - transact(): HOLDS TODAY — the fact is fsync'd before transact returns.
- *     - single-op: PINNED AS `it.fails` — today's group-commit batches
- *       DURABILITY (ack precedes the group fsync; a hard kill loses the fact
- *       AND the generation together, coherently — the documented Model-B
- *       contract, fine while the tree is authoritative). The destination
- *       (ack-at-log) requires group commit to become LATENCY batching: the
- *       ack waits for the shared fsync. When that lands, this pin flips red —
- *       remove `.fails` and the contract is permanent. No cliff to discover.
+ *     - transact(): HOLDS — the fact is fsync'd before transact returns.
+ *     - single-op: HOLDS (was pinned `it.fails` until the ack-at-log
+ *       destination landed): the 10.0.0 adopt-at-open fleet default flips a
+ *       fresh brain to log authority at open, so single-op acks await the
+ *       covering group fsync (durable-at-ack) and recovery REPLAYS intact
+ *       facts above the manifest at the next open. The contract is now
+ *       permanent on every path.
  *
  * (2) SCAN STABILITY UNDER ROTATION: a scan handle opened before segment
  *     rotation yields exactly its snapshot — byte-identical facts, no gaps,
@@ -63,9 +62,11 @@ describe('fsync-before-ack contract (fact durability at the ack boundary)', () =
     expect(facts.some((f) => f.generation === receipt.generation)).toBe(true)
   })
 
-  // PINNED (flips red when group commit becomes latency batching — then
-  // remove `.fails` and the ack-at-log contract is permanent on every path).
-  it.fails('single-op: the fact is durable the moment the ack returns (the ack-at-log target)', async () => {
+  // THE ACK-AT-LOG CONTRACT, HELD (was `.fails` until it landed): under the
+  // adopt-at-open fleet default this brain runs durable-at-ack from open —
+  // the ack waits for the covering log fsync, and the log-authority recovery
+  // path replays the intact fact at the next open instead of truncating it.
+  it('single-op: the fact is durable the moment the ack returns (the ack-at-log target)', async () => {
     await brain.add({ data: 'acked single-op', type: 'document', metadata: { n: 1 } })
     const ackedHead = brain.scanFacts()!.headGeneration
     // Abrupt end immediately after the ack — before any flush window.