nx_plane_repair.nx

nx_plane_repair.nx -- the MISSING RECOVERY VERB for a lossy seg-store plane. THE HOLE THIS FILLS. When a plane's declared `q:n` exceeds what the loader can reach, every writer correctly refuses: *"lossy load ... committing would BAKE the loss into the next generation. NOTHING COMMITTED."* nx_plane_migrate says **REPAIR-FIRST**. Nothing repairs. So the plane is write-blocked forever — measured live 2026-07-30 on the debt- plane, the ecosystem's own ledger of what is broken: it could not record that it was broken. ★★A GUARD THAT IS FAIL-SAFE BUT HAS NO RECOVERY VERB IS A PERMANENT DENIAL OF SERVICE ON ITSELF. The refusal is right. The missing half is a deliberate, loss-RECORDING reconciliation. ★IT DOES NOT HIDE THE DAMAGE — that is the whole difference between this and a migrator that "fixes" a plane by making it self-consistent. A sibling shipped exactly that mistake and wrote the law: *"A MIGRATOR MUST NEVER MAKE A DAMAGED PLANE LOOK HEALTHY. The rows were unreachable either way; what I removed was the ALARM."* So this writes a durable RECEIPT (declared/loaded/lost/epoch/prefix) BEFORE it rewrites anything. The alarm is not deleted; it is PROMOTED from "everything is blocked forever" into "here is exactly what was lost, recorded permanently, and writes work again". ★THE LOST ROWS ARE NOT RECOVERABLE. Their keys are absent from every segment — sts_seed reassigns q:<i> each generation, so the old rows are not merely unindexed, they are gone. This organ makes that fact explicit and permanent rather than pretending a repair restored them. ---- REFUSALS (each one is a way this could destroy data, so each is checked BEFORE any write) ---- 1. NOT-LOSSY declared <= loaded ⇒ nothing to repair. Idempotent: safe to re-run. 2. READ-TRUNCATED rows counted in the BUFFER != flags[1]. ★THE LETHAL ONE: sts_load_honest increments flags[1] for every row it FINDS, but sts_emit_row is bounded by `cap` — so an undersized buffer silently drops rows the counter still counted. Reseeding from that buffer would DESTROY the tail, turning a recoverable index problem into real data loss. Refuse unless the two agree exactly. 3. ROWS-BEYOND-QN flags[2] > 0 ⇒ rows exist past the declared count. That is a DIFFERENT defect (an older seeding generation) and reconciling it needs a generation diff, not a reseed. 4. NO-CONFIRM acknowledging permanent loss is an operator act, never a side effect. usage: nx_plane_repair <store-prefix> [confirm=yes] (CWD = the store's root) exit 0 = repaired (or nothing to repair) · 2 = refused, nothing written · 3 = verify failed after write license_tier: ORIGINAL