feat(recovery): the fold-checkpoint bound — crash folds (checkpoint, head], never the whole log twice

The fold checkpoint (_system/fold-checkpoint.json) is stamped strictly after
a canonical-sync barrier over every live entity touched since the last stamp
(syncEntityCanonical: ids → canonical paths → fsync; an absent file fsyncs
its parent directory so deletes are as durable as writes). An unclean open
under log authority now folds only (checkpoint, head]; the chain bootstraps
at an empty brain's adoption (three-phase hooks around adoptLogAuthority) or
at a brain's first whole-log fold — existing brains converge at their first
crash with zero regression. Rollback restores sync immediately; abort paths
feed the barrier; a failed barrier retains the old bound (bigger fold later,
never a lost write). Five structural pins including boundedness itself.

Also: the production-shaped write-flow gate leg (mixed traffic racing
flushes, crash mid-traffic, every ack survives — from a consumer-reported
gate miss), and two release-ceremony cures (tag-first push so the publish
never queues behind the release commit's CI run; raw-curl npmjs shasum
probe with propagation grace instead of a one-shot false divergence).

src/brainy.ts

@@ -8239,6 +8239,23 @@ export class Brainy<T = any> implements BrainyInterface<T> {
   async adoptLogAuthority(): Promise<OracleReport> {
     await this.ensureInitialized()
     this.assertWritable('adoptLogAuthority')
+    // Fold-checkpoint chain, phase 1: a FRESH brain (no committed
+    // generations) arms the chain now so the backfill's re-commits below
+    // feed the canonical-sync accumulator — its first stamp is then total.
+    // A non-fresh flip skips (the store refuses the arm); its chain starts
+    // at the first recovery fold instead. Disarmed on any failure below.
+    this.generationStore.beginFoldCheckpointBootstrap()
+    try {
+      return await this.adoptLogAuthorityInner()
+    } catch (err) {
+      this.generationStore.abandonFoldCheckpointBootstrap()
+      throw err
+    }
+  }
+
+  /** The adoption body — see {@link Brainy.adoptLogAuthority} (which owns the
+   *  fold-checkpoint bootstrap arm/disarm around it). */
+  private async adoptLogAuthorityInner(): Promise<OracleReport> {
     let report = await this.verifyLogAuthority()
 
     // BASELINE BACKFILL: curable divergences are rows whose CANONICAL truth
@@ -8334,6 +8351,9 @@ export class Brainy<T = any> implements BrainyInterface<T> {
       report
     )
     this.generationStore.setLogDurability('at-ack')
+    // Fold-checkpoint chain, phase 2: the flip is recorded — open the stamp
+    // gate so the next flush/close barrier writes the first checkpoint.
+    this.generationStore.completeFoldCheckpointBootstrap()
     return report
   }