[P1][dst] Add IO-error fault injection profiles to SimFS and DST

[cevheri]

Summary

SimFS/DST excellently models crash + torn tail but never throws on append/fsync failure. Cannot prove fixes for B3 (fsyncgate), partial writes, or phantom-commit scenarios.

Audit ID: Section 3 High — Wave 2
Extends: #9 DST direction with concrete ship requirements

Gap

src/sim/simfs.ts:60-66 — append/fsync always succeed. No armAppendError, armFsyncError, or partial-byte append.

Required fault profiles (minimum)

Profile	Purpose
armAppendError(partialBytes?)	B3 torn mid-record
armFsyncError()	B3 latch after failed durability point
error-then-continue schedule	Ensure DB does not accept writes after fault
N× crash-recover-write loops	Durability lower bound: all fsync'd commits before fault survive

Integrate into src/sim/dst.ts seeded matrix alongside existing crash profiles.

Agent implementation guide

1. Extend SimFS with arm/disarm flags (mirror armShortRead).
2. On armed append: write partialBytes, throw Error with code property simulating EIO/ENOSPC.
3. DST seeds: for each profile, assert invariant stated in B3 issue.
4. Keep deterministic via mulberry32 — no real randomness.

Related issues

• B3 — kernel latch (implement together or kernel first with minimal SimFS hook)
• Explore kernel durability hardening (WAL record headers, fsync-batching mode, expanded DST fault profiles) #9 — exploratory umbrella
• B10 — short-read profile behavior change

Acceptance criteria

• SimFS can simulate append and fsync failures deterministically.
• DST seeds cover B3 acceptance scenarios.
• bun run gate green; 100% coverage.
• No changeset (harness not published) unless types leak — unlikely.

Verification

bun run gate

[cevheri]

Pairs with kernel fix #19. Extends #9 DST direction with concrete fault profiles required before announcement confidence.

[cevheri]

Implemented and shipped in PR #43 (merge commit 69f7161), released as v0.2.0. The PR description's comma-separated Closes list only auto-closed the first reference — closing manually. For #39/#28-style partials: the shipped scope is done; the real-browser verification half of #39 continues under #10, and the typed-error contract (#28) shipped as LibreDbError with stable codes across kernel, adapters, lenses, and CLI.