feat(engine): the wiring wave — stamps ride every flush, provider generations, waitForIndexed, adopt-backfill, match-all serves

- Watermark stamping fans out at flush: all three projections stamped
  with the committed generation before their flushes persist.
- waitForIndexed(path?, {generation, timeoutMs}) — the one honest read
  barrier for write-then-recall consumers; typed timeout error carries
  the pending count and names the gauge; getIndexStatus() gains
  per-projection gauges. awaitPendingEmbeds() unchanged underneath.
- adoptLogAuthority() self-backfills curable divergences (pre-log
  records, witness drift) by identity re-commit before flipping — a
  fresh brain flips clean; log-ahead divergences still refuse loudly.
- The verification oracle gains VERB legs (all four divergence classes;
  unwired = honest verbsChecked: 0, never a scope claim).
- find({where: {}}) match-all serves (was silent-empty, warm AND cold;
  same fix in count/streaming/subgraph seeding); removeMany({where:{}})
  refuses typed — a match-all bulk delete must be explicit.
- Aggregation native envelope stamped via noteSourceGeneration before
  serializeState; the native-blob restore gates through the same
  adoption verdict as caller-side state (the unconditional adopt dies).
- LC8 pinned: a wholesale directory move opens and serves identically
  across all three intelligences, with history traveling.

Gates: unit 2031/2031 (156 files) · integration 812 (91 files) ·
conformance 27/27.

src/db/logAuthority.ts

@@ -128,6 +128,16 @@ export async function runLogCompletenessOracle(args: {
   canonicalNounDigest: (id: string) => Promise<string | null>
   /** Digest a log after-image record's payload. */
   factRecordDigest: (record: unknown) => string
+  /**
+   * Verb legs (optional until every owner wires them): the canonical verb
+   * digest + the paged verb enumeration. When ABSENT, the oracle counts NO
+   * verbs and says so via verbsChecked = 0 — an honest partial verdict,
+   * never a silent full-pass claim.
+   */
+  canonicalVerbDigest?: (id: string) => Promise<string | null>
+  getVerbs?: (opts: {
+    pagination: { limit: number; offset?: number; cursor?: string }
+  }) => Promise<{ items: unknown[]; hasMore?: boolean; nextCursor?: string }>
 }): Promise<OracleReport> {
   const report: OracleReport = {
     verdict: 'red',
@@ -151,19 +161,17 @@ export async function runLogCompletenessOracle(args: {
     return report
   }
   const logState = new Map<string, { tombstoned: boolean; digest: string | null }>()
+  const verbLogState = new Map<string, { tombstoned: boolean; digest: string | null }>()
   for await (const batch of scan.batches()) {
     for (const fact of batch.facts) {
       report.generationsScanned++
       for (const op of fact.ops) {
-        if (op.kind !== 'noun') continue
-        if (op.record === null) {
-          logState.set(op.id, { tombstoned: true, digest: null })
-        } else {
-          logState.set(op.id, {
-            tombstoned: false,
-            digest: args.factRecordDigest(op.record)
-          })
-        }
+        const state =
+          op.record === null
+            ? { tombstoned: true, digest: null }
+            : { tombstoned: false, digest: args.factRecordDigest(op.record) }
+        if (op.kind === 'noun') logState.set(op.id, state)
+        else verbLogState.set(op.id, state)
       }
     }
   }
@@ -210,6 +218,48 @@ export async function runLogCompletenessOracle(args: {
     }
   }
 
+  // Verb passes — only when the owner wired the verb legs; otherwise the
+  // report says verbsChecked: 0, an honest partial scope, never a claim.
+  if (args.canonicalVerbDigest && args.getVerbs) {
+    const seenVerbs = new Set<string>()
+    let vOffset = 0
+    let vCursor: string | undefined
+    for (;;) {
+      const page = await args.getVerbs({
+        pagination: vCursor ? { limit: PAGE, cursor: vCursor } : { limit: PAGE, offset: vOffset }
+      })
+      for (const item of page.items) {
+        const id = (item as { id: string }).id
+        seenVerbs.add(id)
+        report.verbsChecked++
+        const inLog = verbLogState.get(id)
+        if (!inLog) {
+          addMismatch({ id, kind: 'verb', reason: 'pre-log-record' })
+          continue
+        }
+        if (inLog.tombstoned) {
+          addMismatch({ id, kind: 'verb', reason: 'log-tombstone-canonical-present' })
+          continue
+        }
+        const canonical = await args.canonicalVerbDigest(id)
+        if (canonical === null) {
+          addMismatch({ id, kind: 'verb', reason: 'pre-log-record' })
+          continue
+        }
+        if (canonical === inLog.digest) report.matched++
+        else addMismatch({ id, kind: 'verb', reason: 'state-differs' })
+      }
+      if (!page.hasMore || page.items.length === 0) break
+      if (page.nextCursor) vCursor = page.nextCursor
+      else vOffset += page.items.length
+    }
+    for (const [id, state] of verbLogState) {
+      if (!state.tombstoned && !seenVerbs.has(id)) {
+        addMismatch({ id, kind: 'verb', reason: 'log-live-canonical-absent' })
+      }
+    }
+  }
+
   const totalMismatches =
     report.mismatches.length + (report.mismatchListTruncated ? 1 : 0)
   report.verdict = totalMismatches === 0 ? 'green' : 'red'