feat(strategy): fail loudly on invalid store topology; merge adjacency in store order

[antra-tess]

Problem

Two ways a crossed node (a summary whose leaves are not contiguous among owned messages) got minted, and nothing that said so afterwards:

• Head window ratchet: calibration rises peel the head into late, out-of-order L1s that merge across eras #122 (merged as fix(strategy): stop the head window ratcheting down under calibration drift (#122) #123): the head ratchet peeled opening messages into late one-message L1s. fix(strategy): stop the head window ratcheting down under calibration drift (#122) #123 stops the peel, but the second half of the mechanism was still open: contiguousMergeCandidates judged adjacency in chunk-record order, where a chunk minted late over an early message sits next to the open frontier. One production store has exactly this — five single-message L1s over the opening messages, minted weeks later in reverse sequence order, merged into cross-era L2s → L3s → an L4 covering thousands of leaves. The kv-unified forest rejects the store; on preserveGapBearingSummaries:true the packed solver goes into buffered mode and runs away (exceeded ceiling 100000 at 135238, ~1.35× any ceiling) — a hard-down.
• Demand-path merges (enqueueMergeForRange, produce level ≥ 2) still bypass the strict-adjacency grammar — can mint a non-contiguous L2 that kv-unified then rejects forever #95: enqueueMergeForRange took every unmerged source inside the range, holes included.

A second large production store carries 7 crossed L2/L3s of the #95 shape. Nothing at load or compile time reported either.

Changes

Fail loudly at load. initialize audits every summary: leaves (via chunk-linked L1s — superseded legacy generations own nothing) positioned among owned messages in store order; a hole is always another live representation, never-chunked messages occupy no position. topologyPolicy: 'reject' (default) throws StoreTopologyError naming the summaries, spans, hole counts and the interleaved owners, so ContextManager.open refuses the store. 'report' logs the same at error level and surfaces getCompressionDebt().topologyViolations (state critical). A kv-unified config that explicitly opts into gap handling (preserveGapBearingSummaries / treeifyNonContiguousSummaries) defaults to 'report' — those stores are known to carry gaps. ContextManager.open now releases a store it opened when initialize rejects (it leaked the lock behind the rejected promise). scripts/audit-topology.ts <store> [--namespace ns] [--json] runs the audit read-only, exit 2 on violations.

Never mint a crossed node. One position index (mergePositionIndex: chunk members ∪ live L1 sourceIds, store order; chunk members appended since the last listing go after it; hidden/pruned L1 sources occupy no position) drives contiguousMergeCandidates, enqueueMergeForRange (now split into strictly adjacent runs, longest run enqueued, the rest logged) and a new gate in executeMerge: sources must be one level below the target, resolvable, and strictly adjacent. A failing group is refused before any model call — dequeued into the merge quarantine with outcome topology_violation, console.error, merge:topology-refused in the compression log, getCompressionDebt().topologyRefusals and state critical.

Validation

• npm test: 877/877.
• Production store A (8.9k messages): the audit reports exactly the 7 summaries the kv-unified canonical forest rejects.
• Production store B (75.7k messages): 7 violations, each a late-landing L1 inside an L2's span (Demand-path merges (enqueueMergeForRange, produce level ≥ 2) still bypass the strict-adjacency grammar — can mint a non-contiguous L2 that kv-unified then rejects forever #95 shape).
• Across 13 production stores: crossed ownership in 9, all real on inspection, all dating from July (including L1-level cases where a peeled opening message shares a chunk with frontier messages).
• New test/topology-guard.test.ts (11 tests): store-order adjacency vs record order, degrade without a listing, demand-path hole split, mint-time refusal (no model call, quarantined, critical), adjacent pass-through, audit (crossed / clean / never-chunked gap / reject vs report / kv-unified gap opt-in), and ContextManager.open rejecting a persisted crossed L2 then opening under 'report'.

⚠️ Deploy note

This is fail-closed by default: a store that already carries crossed ownership refuses to open on this CM until it is repaired or its config sets topologyPolicy: 'report'. Run node dist/scripts/audit-topology.js on a copy of every store before deploying. A general repair tool follows in a separate PR.

🤖 Generated with Claude Code