feat(log): log authority is the fleet default — adopt-at-open, oracle-gated; plus the power-cut throw-site cures and the loud torn-record contract

THE DEFAULT FLIP (ruled on proven evidence — at-ack survived 301/301
acked-writes-through-power-cut in block-layer fault injection; deferred
tree authority demonstrably loses flush-covered acks): a brain with NO
stored authority artifact now ADOPTS LOG AUTHORITY AT OPEN. The oracle
gates the flip exactly as the guarded adoption path always did — curable
divergences baseline-backfilled, the flip lands ONLY on a green verdict —
and a brain that cannot verify STAYS tree-authoritative loudly, with the
refusal recorded on the switch artifact so subsequent opens are cheap.
config logAuthority: 'defer' is the explicit documented opt-out (no
automatic adoption; declared flush-window loss; adoptLogAuthority() flips
later). A stored artifact always wins. RELEASES.md carries the posture.

Two standing .fails debt pins FLIP TO HOLDING under the default: the
at-ack crash-survival gap and the ack-at-log durability target — both now
permanent asserted truths, not aspirations.

POWER-CUT THROW SITES (fault-injection findings, brainy-alone config):
- A manifest-listed-but-unloadable column segment QUARANTINES at
  discovery (loud once, counted always, quarantinedSegments() exposed for
  the heal) and the field serves its remaining segments DEGRADED — never
  a raw throw killing every query on the field. Real storage faults still
  propagate untouched.
- Torn generation artifacts (NaN/garbage in manifest or counter) DISCARD
  with narration at the store's open and recovery re-derives — plus a
  defensive finite-integer guard at the init consumer. Never a RangeError
  killing an open.

THE LOUD TORN-RECORD CONTRACT: an existing-but-unparseable stored record
now surfaces as a typed, counted TornRecordError on every entity-read
surface (including fifteen previously-blind per-item batch catches);
ENOENT stays clean-absent; artifact readers with designed absent-recovery
keep null-tolerance behind the loud floor. Disk corruption can no longer
read as silent data invisibility.

Suite migration: the default's pins inverted deliberately, generation
baselines made relative, quarantine-contract pins rewritten to the ruled
behavior.

Gates: tsc 0 · unit 2065/2065 (159 files) · integration 826 (93 files) ·
conformance 31/31 · kill-matrix 15/15 · torn-open guards 2/2.

tests/integration/log-authority-adopt.test.ts

@@ -22,8 +22,12 @@ afterEach(async () => {
   for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true })
 })
 
-async function open(dir: string): Promise<Brainy> {
-  const b = new Brainy({ storage: { type: 'filesystem', path: dir }, requireSubtype: false })
+async function open(dir: string, logAuthority?: 'adopt' | 'defer'): Promise<Brainy> {
+  const b = new Brainy({
+    storage: { type: 'filesystem', path: dir },
+    requireSubtype: false,
+    ...(logAuthority ? { logAuthority } : {})
+  })
   await b.init()
   brains.push(b)
   return b
@@ -80,4 +84,31 @@ describe('adoptLogAuthority — the sanctioned flip with self-backfill', () => {
     expect(report.verdict).toBe('green')
     expect(brain.logAuthority().authority).toBe('log')
   }, 120000)
+
+  // THE OPT-OUT CONTRACT (`logAuthority: 'defer'`): no automatic adoption —
+  // the fresh brain stays tree-authoritative and writes NO artifact (a
+  // deferred posture is config, not stored state); the EXPLICIT
+  // adoptLogAuthority() then flips it exactly as before the fleet default.
+  it("opt-out: 'defer' stays tree with no artifact until the explicit adoptLogAuthority() flips it", async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'brainy-adopt-defer-'))
+    dirs.push(dir)
+    const brain = await open(dir, 'defer')
+    await brain.add({ data: 'deferred row', type: NounType.Document, metadata: { n: 1 } })
+    await brain.flush()
+
+    expect(brain.logAuthority().authority, "'defer' skips open-time adoption").toBe('tree')
+    const storage = (brain as unknown as {
+      storage: { readRawObject(p: string): Promise<unknown | null> }
+    }).storage
+    const artifact = await storage.readRawObject('_system/log-authority.json').catch(() => null)
+    expect(artifact, "'defer' writes no authority artifact").toBeNull()
+
+    const report = await brain.adoptLogAuthority()
+    expect(report.verdict, 'the explicit flip still lands on green').toBe('green')
+    expect(brain.logAuthority().authority).toBe('log')
+    const stored = (await storage.readRawObject('_system/log-authority.json')) as {
+      authority?: string
+    } | null
+    expect(stored?.authority, 'the explicit flip stores the artifact').toBe('log')
+  }, 120000)
 })