fix(adoption): the baseline backfill runs to completion — one call adopts a pre-log baseline of any size

A production brain with a 12.7k-row pre-log baseline advanced exactly 800
rows per adoptLogAuthority() call (a five-pass ceiling × the oracle's
200-row listing cap), refused the flip, and sat tree-authoritative for
hours across restarts. The bound was sized for drift, never for a baseline.

Now: the adoption path runs the oracle uncapped so ONE scan yields the
ENTIRE curable set, every pass cures all of it, and the loop runs to
completion with the no-progress guard as its only stop. Pace rides the
write path (one full-brain scan amortizes over thousands of cures, not two
hundred): 1,000 drifted rows adopt green in one call in ~10s. Progress is
narrated for a live operator. The wire report keeps its 200-row cap.

Pinned: a baseline above the old ceiling adopts green in a single call.

src/brainy.ts

@@ -8208,10 +8208,20 @@ export class Brainy<T = any> implements BrainyInterface<T> {
    * (digests, never bodies).
    */
   async verifyLogAuthority(): Promise<OracleReport> {
+    return this.runOracle()
+  }
+
+  /**
+   * The oracle run behind {@link Brainy.verifyLogAuthority}; the adoption
+   * backfill calls it with `listAll` so one scan yields the ENTIRE curable
+   * mismatch set instead of the wire-capped first 200.
+   */
+  private async runOracle(options?: { listAll?: boolean }): Promise<OracleReport> {
     await this.ensureInitialized()
     return runLogCompletenessOracle({
       storage: this.storage as unknown as LogAuthorityStorage,
       scanFacts: () => this.scanFacts(),
+      ...(options?.listAll ? { mismatchListCap: Number.POSITIVE_INFINITY } : {}),
       // Both sides normalize to ENTITY TRUTH before digesting: canonical
       // wrappers denormalize HNSW residue (connections/level) the log never
       // carries — digesting it would fake state-differs on any nonzero-level
@@ -8256,7 +8266,7 @@ export class Brainy<T = any> implements BrainyInterface<T> {
   /** The adoption body — see {@link Brainy.adoptLogAuthority} (which owns the
    *  fold-checkpoint bootstrap arm/disarm around it). */
   private async adoptLogAuthorityInner(): Promise<OracleReport> {
-    let report = await this.verifyLogAuthority()
+    let report = await this.runOracle({ listAll: true })
 
     // BASELINE BACKFILL: curable divergences are rows whose CANONICAL truth
     // simply never reached the log — pre-log records (e.g. the generation-0
@@ -8268,8 +8278,18 @@ export class Brainy<T = any> implements BrainyInterface<T> {
     // Log-AHEAD divergences (log-live-canonical-absent /
     // log-tombstone-canonical-present) are NOT curable by backfill — the
     // log claims things the witness denies — and refuse loudly below.
+    //
+    // RUNS TO COMPLETION. Each pass sees the ENTIRE curable set (the oracle
+    // is run uncapped here) and cures all of it, so a pre-log baseline of
+    // any size adopts in ONE call — the only stop is the no-progress guard.
+    // A production brain with a 12.7k-row baseline once advanced exactly
+    // 800 rows per call (a five-pass ceiling × the 200-row wire cap) and sat
+    // tree-authoritative for hours; the bound was sized for drift, never
+    // for a baseline. Pace rides the write path now: one full-brain scan
+    // per pass amortizes over thousands of cures, not two hundred.
     let passes = 0
-    while (report.verdict === 'red' && passes < 5) {
+    for (;;) {
+      if (report.verdict !== 'red') break
       passes++
       const curable = report.mismatches.filter(
         (m) => m.reason === 'pre-log-record' || m.reason === 'state-differs'
@@ -8290,9 +8310,19 @@ export class Brainy<T = any> implements BrainyInterface<T> {
         `[Brainy] adoptLogAuthority: baseline backfill pass ${passes} — re-committing ` +
           `${curable.length} row(s) whose canonical truth never reached the log`
       )
+      // Progress narration for a live operator: a large baseline is minutes
+      // of visible motion, never a silent wait.
+      const narrateEvery = curable.length >= 2000 ? 1000 : curable.length >= 400 ? 200 : 0
+      let cured = 0
       for (const m of curable) {
         const raw = await this.storage.readNounRaw(m.id)
         if (raw.metadata === null && raw.vector === null) continue // vanished since the scan
+        cured++
+        if (narrateEvery > 0 && cured % narrateEvery === 0) {
+          prodLog.info(
+            `[Brainy] adoptLogAuthority: backfill pass ${passes} — ${cured}/${curable.length} rows re-committed`
+          )
+        }
         // LAW-SHAPE RE-COMMIT: rewrite canonical as EXACTLY the wrapper the
         // log's reconstruction produces (the hydration law: denormalized
         // enumeration fields derived from the metadata leg + the embedding
@@ -8330,12 +8360,11 @@ export class Brainy<T = any> implements BrainyInterface<T> {
           })
         })
       }
-      const next = await this.verifyLogAuthority()
-      if (
-        next.verdict === 'red' &&
-        next.mismatches.length >= report.mismatches.length &&
-        !report.mismatchListTruncated
-      ) {
+      const next = await this.runOracle({ listAll: true })
+      // THE ONLY STOP: no progress. With uncapped listings both counts are
+      // exact, so "not fewer mismatches than before" means the cure could
+      // not express this divergence — refuse to spin, name it.
+      if (next.verdict === 'red' && next.mismatches.length >= report.mismatches.length) {
         throw new Error(
           `adoptLogAuthority(): baseline backfill made no progress ` +
             `(${report.mismatches.length} → ${next.mismatches.length} mismatches; first: ` +
@@ -8345,6 +8374,12 @@ export class Brainy<T = any> implements BrainyInterface<T> {
       }
       report = next
     }
+    if (passes > 0) {
+      prodLog.info(
+        `[Brainy] adoptLogAuthority: baseline backfill complete in ${passes} pass(es) — ` +
+          `oracle ${report.verdict}, ${report.nounsChecked} noun(s) checked`
+      )
+    }
 
     this._logAuthority = await flipToLogAuthority(
       this.storage as unknown as LogAuthorityStorage,

src/db/logAuthority.ts

@@ -165,7 +165,16 @@ export async function runLogCompletenessOracle(args: {
   getVerbs?: (opts: {
     pagination: { limit: number; offset?: number; cursor?: string }
   }) => Promise<{ items: unknown[]; hasMore?: boolean; nextCursor?: string }>
+  /**
+   * Cap on the LISTED mismatches (counts are always complete). Defaults to
+   * the wire-friendly {@link MISMATCH_LIST_CAP}; the adoption backfill passes
+   * `Infinity` so ONE scan yields the ENTIRE curable set — a production
+   * brain with a 12.7k-row pre-log baseline once advanced only 800 rows per
+   * adoption call because each pass could see (and cure) at most 200.
+   */
+  mismatchListCap?: number
 }): Promise<OracleReport> {
+  const listCap = args.mismatchListCap ?? MISMATCH_LIST_CAP
   const report: OracleReport = {
     verdict: 'red',
     generationsScanned: 0,
@@ -176,7 +185,7 @@ export async function runLogCompletenessOracle(args: {
     mismatchListTruncated: false
   }
   const addMismatch = (m: OracleMismatch): void => {
-    if (report.mismatches.length < MISMATCH_LIST_CAP) report.mismatches.push(m)
+    if (report.mismatches.length < listCap) report.mismatches.push(m)
     else report.mismatchListTruncated = true
   }