nx_store_compact.nx

nx_store_compact.nx -- collapse a quadratic seg-store plane back to O(rows). RK013 sev9 / F829. THE DEFECT (measured 2026-07-20, root-caused from source, not theorised): sts_seed commits the WHOLE plane as a NEW segment on EVERY write (nx_store_seed_lib:45/65), sts_load does one ss_get PER ROW (:70), and ss_scan_seglist walks ALL segments chronologically for each key (nx_seg_store:1136). So a load costs O(rows x segments). Live numbers: debt- had 464 segments / 42MB of .docs for ~200KB of actual rows (~210x amplification), ~124k segment-key scans per load, one nx_debt add took >15min then FAILED, nx_debt page was OOM-KILLED, and the store reached 15,024 files. The NAS went down under that load the same afternoon. THE INSIGHT THAT MAKES THE FIX SAFE AND CHEAP: because every segment is ALREADY a complete plane snapshot, and ss_scan_seglist resolves each key to its LAST (newest) version, the NEWEST SEGMENT ALONE IS A SEMANTICALLY COMPLETE PLANE -- including tombstones. So compaction does not merge, copy or rewrite any record: it rewrites ONLY THE MANIFEST to reference the newest segment. - The superseded .docs/.idx files are LEFT ON DISK, untouched (rule 13 additive-only). Nothing is deleted; the manifest is the only mutation, and it is backed up first. - Therefore ROLLBACK IS ONE FILE COPY: restore <prefix>manifest.txt.bak-precompact. PROOF, NOT ASSERTION: apply loads the plane BEFORE, rewrites the manifest, loads AFTER, and compares the two buffers BYTE-FOR-BYTE. Any difference -> the manifest is RESTORED and the organ REFUSES (exit 3). A caller can never be left with a silently-lossy plane. nx_store_compact <prefix> check -> segment count + newest segid (CHEAP: manifest only, no load) nx_store_compact <prefix> apply -> the verified rewrite above (sts planes ONLY: every segment is a whole-plane snapshot there) nx_store_compact <prefix> fold -> GENERIC merge compaction via the store's own ss_compact_cap (latest entry per key, tombstones kept, O(data) single pass). REQUIRED for reg planes (nx_registry: one record + index per segment -- newest segment is NOT a complete plane, so apply's manifest re-point would lose every other key). Verified by a pre-fold logical snapshot re-read AFTER through production ss_get; mismatch -> manifest restored, REFUSE (exit 3). FAIL-CLOSED: missing/empty manifest, a load that fills the buffer (cannot verify a truncated view), or a byte-mismatch all refuse without leaving the plane changed. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0