feat(log): log authority is the fleet default — adopt-at-open, oracle-gated; plus the power-cut throw-site cures and the loud torn-record contract

THE DEFAULT FLIP (ruled on proven evidence — at-ack survived 301/301
acked-writes-through-power-cut in block-layer fault injection; deferred
tree authority demonstrably loses flush-covered acks): a brain with NO
stored authority artifact now ADOPTS LOG AUTHORITY AT OPEN. The oracle
gates the flip exactly as the guarded adoption path always did — curable
divergences baseline-backfilled, the flip lands ONLY on a green verdict —
and a brain that cannot verify STAYS tree-authoritative loudly, with the
refusal recorded on the switch artifact so subsequent opens are cheap.
config logAuthority: 'defer' is the explicit documented opt-out (no
automatic adoption; declared flush-window loss; adoptLogAuthority() flips
later). A stored artifact always wins. RELEASES.md carries the posture.

Two standing .fails debt pins FLIP TO HOLDING under the default: the
at-ack crash-survival gap and the ack-at-log durability target — both now
permanent asserted truths, not aspirations.

POWER-CUT THROW SITES (fault-injection findings, brainy-alone config):
- A manifest-listed-but-unloadable column segment QUARANTINES at
  discovery (loud once, counted always, quarantinedSegments() exposed for
  the heal) and the field serves its remaining segments DEGRADED — never
  a raw throw killing every query on the field. Real storage faults still
  propagate untouched.
- Torn generation artifacts (NaN/garbage in manifest or counter) DISCARD
  with narration at the store's open and recovery re-derives — plus a
  defensive finite-integer guard at the init consumer. Never a RangeError
  killing an open.

THE LOUD TORN-RECORD CONTRACT: an existing-but-unparseable stored record
now surfaces as a typed, counted TornRecordError on every entity-read
surface (including fifteen previously-blind per-item batch catches);
ENOENT stays clean-absent; artifact readers with designed absent-recovery
keep null-tolerance behind the loud floor. Disk corruption can no longer
read as silent data invisibility.

Suite migration: the default's pins inverted deliberately, generation
baselines made relative, quarantine-contract pins rewritten to the ruled
behavior.

Gates: tsc 0 · unit 2065/2065 (159 files) · integration 826 (93 files) ·
conformance 31/31 · kill-matrix 15/15 · torn-open guards 2/2.

tests/unit/db/fact-log-group-sync.test.ts

@@ -7,12 +7,13 @@
  * one), a solo writer syncs immediately, and at the brain level an at-ack
  * ack resolving means the write's fact is on disk.
  *
- * One pin is marked `.fails` (real finding, not a test bug): the at-ack
- * durability contract says an acked write's fact survives power loss, but
- * FactLog.open() truncates every fact beyond the store's committed
- * generation watermark — which only advances at the pending-tier flush. A
- * crash-shaped reopen (acks landed, flush never ran) therefore DISCARDS the
- * fsynced facts at open. See the test comment for the exact mechanism.
+ * The final pin holds the at-ack durability contract END TO END: an acked
+ * write's fact survives a crash-shaped reopen. This was a `.fails` known
+ * gap (FactLog.open() truncated every fact beyond the committed watermark,
+ * which only advances at the pending-tier flush) — CURED by the 10.0.0
+ * adopt-at-open fleet default: a fresh brain stores the log-authority
+ * artifact at open, and under 'log' authority recovery REPLAYS intact
+ * facts above the manifest instead of truncating them.
  */
 import { describe, it, expect, beforeEach, afterEach } from 'vitest'
 import { mkdtempSync, rmSync } from 'node:fs'
@@ -188,9 +189,9 @@ describe('durable-at-ack through the brain (group commit end-to-end)', () => {
 
   it('at-ack: N concurrent add() acks all resolve, every ack was covered by a log sync, and every fact is on disk after reopen', async () => {
     const { brain, dir } = await openBrain()
-    // White-box: engage the at-ack durability mode directly (the guarded
-    // authority flip that normally enables it is covered by the integration
-    // suite — this test pins the durability machinery itself).
+    // The 10.0.0 fleet default already adopted log authority at open, so
+    // the brain is at-ack; the white-box engage stays so this pin holds the
+    // durability MACHINERY itself independent of the open-time posture.
     brain.generationStore.setLogDurability('at-ack')
 
     const factLog = brain.generationStore.getFactLog()
@@ -231,19 +232,17 @@ describe('durable-at-ack through the brain (group commit end-to-end)', () => {
     }
   })
 
-  // KNOWN GAP (marked .fails — remove the marker when fixed in src): the
-  // at-ack contract is that an acked write's fact survives power loss. The
-  // fsync at ack does put the fact's bytes on disk — but FactLog.open()
-  // truncates every fact with generation > the store's committed watermark,
-  // and that watermark only advances at the pending-tier flush
-  // (flushPendingSingleOps). So on a crash-shaped reopen (acks landed, flush
-  // never ran) the store logs "[FactLog] truncating N uncommitted fact(s)"
-  // and DISCARDS the acked, fsynced facts. Until recovery treats the log as
-  // authoritative past the tree's watermark (or the watermark goes durable
-  // at ack), durable-at-ack does not survive the very crash it exists for.
-  it.fails('at-ack CONTRACT: acked facts survive a crash-shaped reopen (no flush ever ran)', async () => {
+  // THE AT-ACK CONTRACT, HELD (was a `.fails` known gap): an acked write's
+  // fact survives a crash-shaped reopen. Fixed by the 10.0.0 adopt-at-open
+  // fleet default — this brain adopted LOG authority at open (artifact
+  // stored, durable-at-ack live), and under 'log' authority FactLog
+  // recovery REPLAYS intact facts above the committed watermark at the next
+  // open instead of truncating them back. Durable-at-ack now survives the
+  // very crash it exists for.
+  it('at-ack CONTRACT: acked facts survive a crash-shaped reopen (no flush ever ran)', async () => {
     const { brain, dir } = await openBrain()
-    brain.generationStore.setLogDurability('at-ack')
+    expect(brain.logAuthority().authority, 'the fleet default adopted at open').toBe('log')
+    expect(brain.generationStore.logDurability).toBe('at-ack')
     // Crash simulation: the pending-tier durability flush never happens
     // (every trigger routes through flushPendingSingleOps), and the brain is
     // abandoned without close() — exactly the power-loss shape at-ack is for.