A frame nothing witnesses (plan), and a test that only passed here

[torstei]

Two things: the design note for the crash-recovery defect the release-day fuzz
found, and a fix for a test of mine that was measuring the host rather than the
code.

The plan — docs/plans/frame-witness.md

A chunk reaches disk as two writes: the compressed frame into the .trunk,
then its 56-byte record into the .rings. Data first, always. A crash between
them leaves a frame no record describes.

The note records the append ordering, where the write window actually lives,
and the four cells that matter:

	killed flush	crashed stage
wal store	recovered, window and all	orphan, no witness
non-wal store	orphan, window unrecoverable	orphan, no witness

Three are broken and on disk they are indistinguishable — which is the
actual defect. Not "the index disagrees with the trunk", but that the stage path
and the non-wal flush path write a frame with no durable witness of what it is,
where the wal path writes one first (.sap.seal, holding exactly that frame's
entries with their wf/wl) and recovers correctly.

Adopting is right for a killed flush and wrong for a crashed stage, which
abort_stage would have discarded — and stage() records its baseline in
memory only, so recovery cannot tell which happened.

Why it is not cosmetic. Left alone, the next append writes at comp_size;
if that frame is shorter than the orphan, the orphan's tail survives spliced
after it and zstd -dc fails on the whole trunk — revoking a documented
recovery path (collapse: stock zstd -dc still recovers the whole survivor)
while timberfs itself reads the store correctly and reports nothing.

The proposal: an on-disk stage marker as the one required change, keep adopting
for wal stores, discard-and-announce for non-wal (a chunk needs a write window,
its only copy died with the process, and a fabricated one poisons the index that
chunk selection, age retention and cursors all run on — while the loss itself is
inside the flush_age contract sap.rs already states). Plus one deterministic
test per cell, keeping the fuzz that found it.

Also written down: why the non-wal path stays (the wal writes every entry twice
— 1.60 GiB of writes becomes 12.8 GiB on a store compressing 7.0×, measured —
and for the file-tailing intakes the source file is still the durable copy), and
that for those intakes the wal is a visibility switch rather than a
durability one, since query --follow tails the sap.

The test fix

a_name_that_resolves_nowhere_says_where_it_looked, from #174, derived the
reading directories — so it exercised the empty-list branch only on a host
without the timberfs package. It passed in CI and locally until 0.32.0 was
installed on the machine it was written on, at which point:

no extractor "nope" — neither a path that exists nor a document in
/usr/lib/timberfs/tally.extractors.d, /tmp/timberfs-tally-…/tally.extractors.d,
which hold timberfs-apache-combined, …, x (the document "t")

The message construction is now no_such_extractor(name, dirs, etc) and the
test passes the directories, so it states its own world. Same flaw I fixed in
the timbergraph twin in #173 (test_a_name_that_resolves_nowhere_says_where_it_looked
replaces the directory list rather than skipping) — the Rust one was left
behind.

No behaviour change: the messages are byte-identical, only their construction
moved.