feat(engine): the wiring wave — stamps ride every flush, provider generations, waitForIndexed, adopt-backfill, match-all serves

- Watermark stamping fans out at flush: all three projections stamped
  with the committed generation before their flushes persist.
- waitForIndexed(path?, {generation, timeoutMs}) — the one honest read
  barrier for write-then-recall consumers; typed timeout error carries
  the pending count and names the gauge; getIndexStatus() gains
  per-projection gauges. awaitPendingEmbeds() unchanged underneath.
- adoptLogAuthority() self-backfills curable divergences (pre-log
  records, witness drift) by identity re-commit before flipping — a
  fresh brain flips clean; log-ahead divergences still refuse loudly.
- The verification oracle gains VERB legs (all four divergence classes;
  unwired = honest verbsChecked: 0, never a scope claim).
- find({where: {}}) match-all serves (was silent-empty, warm AND cold;
  same fix in count/streaming/subgraph seeding); removeMany({where:{}})
  refuses typed — a match-all bulk delete must be explicit.
- Aggregation native envelope stamped via noteSourceGeneration before
  serializeState; the native-blob restore gates through the same
  adoption verdict as caller-side state (the unconditional adopt dies).
- LC8 pinned: a wholesale directory move opens and serves identically
  across all three intelligences, with history traveling.

Gates: unit 2031/2031 (156 files) · integration 812 (91 files) ·
conformance 27/27.

tests/integration/log-authority-adopt.test.ts

@@ -0,0 +1,83 @@
+/**
+ * @module tests/integration/log-authority-adopt
+ * @description THE SANCTIONED FLIP, END TO END: adoptLogAuthority() cures
+ * its own curable divergences by baseline backfill — a FRESH brain (whose
+ * generation-0 VFS root never entered the log) flips WITHOUT any manual
+ * white-box backfill. Before this, no fresh brain could ever flip: the
+ * oracle reported the bootstrap row as pre-log-record and the flip refused.
+ * Log-AHEAD divergences stay incurable and refuse loudly (witness wins).
+ */
+import { describe, it, expect, afterEach } from 'vitest'
+import { mkdtempSync, rmSync } from 'node:fs'
+import { tmpdir } from 'node:os'
+import { join } from 'node:path'
+import { Brainy } from '../../src/index.js'
+import { NounType } from '../../src/types/graphTypes.js'
+
+const dirs: string[] = []
+const brains: Brainy[] = []
+
+afterEach(async () => {
+  for (const b of brains.splice(0)) await b.close().catch(() => {})
+  for (const d of dirs.splice(0)) rmSync(d, { recursive: true, force: true })
+})
+
+async function open(dir: string): Promise<Brainy> {
+  const b = new Brainy({ storage: { type: 'filesystem', path: dir }, requireSubtype: false })
+  await b.init()
+  brains.push(b)
+  return b
+}
+
+describe('adoptLogAuthority — the sanctioned flip with self-backfill', () => {
+  it('a fresh brain flips directly: the backfill cures the generation-0 baseline', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'brainy-adopt-'))
+    dirs.push(dir)
+    const brain = await open(dir)
+    const idA = await brain.add({ data: 'first row', type: NounType.Document, metadata: { n: 1 } })
+    await brain.add({ data: 'second row', type: NounType.Document, metadata: { n: 2 } })
+    await brain.flush()
+
+    const report = await brain.adoptLogAuthority()
+    expect(report.verdict, 'the flip receipt is a green oracle').toBe('green')
+    expect(brain.logAuthority().authority).toBe('log')
+
+    // The switch survives reopen; the brain keeps serving identically.
+    await brain.close()
+    brains.pop()
+    const reopened = await open(dir)
+    expect(reopened.logAuthority().authority).toBe('log')
+    expect(await reopened.get(idA), 'records serve at reopen').toBeTruthy()
+    const rows = await reopened.find({ where: {}, limit: 10 })
+    expect(rows.length, 'match-all serves on the reopened flipped brain').toBeGreaterThanOrEqual(2)
+    // And a fresh oracle run on the flipped brain stays green.
+    expect((await reopened.verifyLogAuthority()).verdict).toBe('green')
+  }, 120000)
+
+  it('witness drift (out-of-generation canonical rewrite) is cured by the backfill, then flips', async () => {
+    const dir = mkdtempSync(join(tmpdir(), 'brainy-adopt-drift-'))
+    dirs.push(dir)
+    const brain = await open(dir)
+    const id = await brain.add({ data: 'drifter', type: NounType.Document, metadata: { v: 1 } })
+    await brain.flush()
+
+    // Simulate maintenance rewriting canonical OUTSIDE a generation (the
+    // witness-drift class): mutate the stored record directly.
+    const storage = (brain as unknown as {
+      storage: {
+        readNounRaw(id: string): Promise<{ metadata: unknown; vector: unknown }>
+        writeNounRaw(id: string, r: { metadata: unknown; vector: unknown }): Promise<void>
+      }
+    }).storage
+    const raw = await storage.readNounRaw(id)
+    await storage.writeNounRaw(id, {
+      metadata: { ...(raw.metadata as Record<string, unknown>), drifted: true },
+      vector: raw.vector
+    })
+    expect((await brain.verifyLogAuthority()).verdict, 'drift detected').toBe('red')
+
+    const report = await brain.adoptLogAuthority()
+    expect(report.verdict).toBe('green')
+    expect(brain.logAuthority().authority).toBe('log')
+  }, 120000)
+})