upgrade logger error

Author: icecrasher321

apps/sim/lib/execution/durable-secret-provenance-enforcement.test.ts

@@ -69,15 +69,16 @@ describe('durable secret provenance enforcement', () => {
     )
   })
 
-  it('warns with the surface, cause, and affected count so a surface can be measured', () => {
+  it('reports at error with the surface, cause, and affected count so it survives every LOG_LEVEL default', () => {
     reportUnrecordedDurableProvenance({
       surface: 'table-row',
       cause: 'row-sidecar-not-exact',
       affectedCount: 8,
       workspaceId: 'workspace-1',
     })
 
-    expect(mockLogger.warn).toHaveBeenCalledWith(
+    expect(mockLogger.warn).not.toHaveBeenCalled()
+    expect(mockLogger.error).toHaveBeenCalledWith(
       'Proceeding on unrecorded durable secret provenance',
       {
         surface: 'table-row',

apps/sim/lib/execution/durable-secret-provenance-enforcement.ts

@@ -84,12 +84,14 @@ export interface UnrecordedDurableProvenanceReport {
 /**
  * Records that a read proceeded on provenance nobody wrote down.
  *
- * Warn, not error: on an unenforced surface this is the expected state for legacy data, and it sits
- * on a per-block read path. The count is what tells you whether a surface is ready to close — it
- * should fall to zero once its writers stop losing provenance.
+ * Error, not warn, for the same reason the originating-fault reasons use it: error is the only
+ * level that survives every default the logger falls back to — production, test, and a self-hosted
+ * chart that sets no `LOG_LEVEL`. A surface stays open on the strength of this line being visible
+ * and trending to zero, so a level that a deployment can silently filter would leave the posture
+ * unmeasured. It is deliberately noisy on an affected workspace; that is the signal.
  */
 export function reportUnrecordedDurableProvenance(report: UnrecordedDurableProvenanceReport): void {
-  logger.warn('Proceeding on unrecorded durable secret provenance', {
+  logger.error('Proceeding on unrecorded durable secret provenance', {
     surface: report.surface,
     cause: report.cause,
     enforced: false,