Implement partial-prefix migration recovery and the KEEP-CRASH-053..073 matrix

[flyingrobots]

Problem

A fresh version-1 to version-2 migration executes all 21 phases once under writer authority, but nothing resumes an interrupted one. migration-recovery.md specifies the seven-row recovery table and its ambiguity rules; migration-crash.md reserves KEEP-CRASH-053..073. Both remain unimplemented, so an interrupted migration waits for a human. This is the residual item 7 of #19 (PR #78 checklist), now unblocked by #97.

Scope

• Storage-independent recovery planner over the golden records, one law per table row.
• FilesystemStoreMigrationAuthority::recover reopening every stage by device and inode identity; every prefix 0 through 21 and each mid-write truncation recovers in-process to the documented state; every ambiguity row refuses before mutation with a typed value.
• cargo xtask durability-crash-matrix extended with the 21 migration boundaries (KEEP-CRASH-060 needs one case per admitted directory-prefix length), before/during/after, debug and optimized.
• Ledger rows KEEP-MIGRATION-001, -004, -005, -006, -007, -008 move to Implemented.

Acceptance criteria

• recover_store_migration and StoreMigrationRecoveryStorage with a receipt naming the observed prefix and every phase executed.
• Filesystem adapter; in-process prefix and truncation laws.
• conformance/segment-store/v2/transitions.tsv rows 053–073.
• Crash matrix green in CI for the migration sequence.
• README gap table row removed; migration-crash.md no longer says it does not claim crash recovery.

Roadmap: T-17.2 and T-17.3 in ROADMAP.md. Refs #19 #97.

🤖 Generated with Claude Code

[flyingrobots]

Audit follow-up for T-17.2 / T-17.3. Tracker: #132.

The recovery implementation and 68-case process-death matrix exist. Remaining acceptance work is split into #111 and #112; preserve this issue's full original requirements without duplicating implementation effort.

The audit source is docs/audits/completed-roadmap-2026-09-30.md on feature/roadmap-m4-tasks. Original acceptance criteria and definitions of done remain authoritative. This comment records remaining work and links existing ownership; it does not assert that the issue is complete or change its recorded dependencies.