feat(log): v2 is the LIVE write format — envelope records with minted ints, genesis, sector seals; v1 readable forever

The cutover: new tail segments write format v2 (per-record [type, version,
cipherFlag, keyId] envelope; noun/verb after-images carry dense ints
MINTED AT APPEND from the id mapper — a rebuilt mapper reproduces
assignments exactly; log.genesis opens every new log with the id-space
width + a minted brain id; sync() seals to the header-declared sector
boundary with reader-invisible pad frames). Existing v1 segments are
never rewritten — per-segment decoder dispatch reads both formats and v2
facts map to the exact CommitFact shape all consumers already read.
Cutover on a live v1 log: an empty v1 tail re-heads in place; a non-empty
one is sealed by rotation, byte-identical. Records reserve the encryption
fields (cipherFlag 0 / keyId nil are the only legal values; anything else
refuses typed naming the needed newer reader) — crypto-ready with no
future bump on the compat surface. Empty-records facts are legal (an
all-deduped batch is a real generation — v1 semantics preserved; the
refusal there tore a column-store flush mid-commit in the full suite, the
consistency guard caught it loudly, and the root is fixed).

Golden byte vectors pinned for the second (native) reader implementation.
Pins: cutover 5/5 · codec 54 · kill-matrix stays 11/11.

tests/integration/log-authority.test.ts

@@ -41,6 +41,7 @@ type BrainInternals = {
     saveNoun(n: unknown): Promise<void>
     saveNounMetadata(id: string, m: Record<string, unknown>): Promise<void>
     getNounMetadata(id: string): Promise<Record<string, unknown> | null>
+    writeNounRaw(id: string, r: { metadata: null; vector: null }): Promise<void>
   }
 }
 
@@ -219,28 +220,21 @@ describe('log authority — the switch, the oracle, the guarded flip', () => {
     })
   })
 
-  it('THE FLIP REFUSES ON RED: names the oracle verdict and the cure, writes nothing, changes nothing', async () => {
+  it('THE FLIP REFUSES ON A LOG-AHEAD DIVERGENCE: the witness denies what the log claims — nothing written, nothing changed', async () => {
+    // Contract update (adoptLogAuthority's baseline backfill): curable
+    // divergences — pre-log records and witness drift — are re-committed
+    // and the flip proceeds; ONLY log-AHEAD divergences (the log claims
+    // state canonical denies) refuse, because no backfill can make the log
+    // un-claim a live row. This test stages exactly that incurable shape.
     const { brain } = await openBrain()
-    await seedWrites(brain)
+    const { kept } = await seedWrites(brain)
     await backfillBaseline(brain)
     await brain.flush()
 
-    // Age the brain: one canonical record the log never saw.
-    const legacyId = '00000000-0000-4000-8000-00000000a6ed'
+    // The log says `kept` is live; its canonical record vanishes behind the
+    // write path's back (log-live-canonical-absent — the witness wins).
     const storage = internals(brain).storage
-    await storage.saveNoun({
-      id: legacyId,
-      vector: new Array(384).fill(0.01),
-      connections: new Map(),
-      level: 0
-    })
-    await storage.saveNounMetadata(legacyId, {
-      noun: 'document',
-      confidence: 0.5,
-      createdAt: 1700000000000,
-      updatedAt: 1700000000000,
-      _rev: 1
-    })
+    await storage.writeNounRaw(kept, { metadata: null, vector: null })
 
     let error: Error | null = null
     try {
@@ -248,9 +242,9 @@ describe('log authority — the switch, the oracle, the guarded flip', () => {
     } catch (err) {
       error = err as Error
     }
-    expect(error, 'the flip rejects on a red oracle').not.toBeNull()
-    expect(error!.message).toMatch(/oracle is RED/)
-    expect(error!.message).toMatch(/baseline backfill/)
+    expect(error, 'the flip rejects on a log-ahead divergence').not.toBeNull()
+    expect(error!.message).toMatch(/witness denies/)
+    expect(error!.message).toMatch(/log-live-canonical-absent/)
 
     // Nothing changed: authority still tree, no artifact, deferred durability.
     expect(brain.logAuthority().authority).toBe('tree')