nx_wiki_restore.nx

nx_wiki_restore.nx -- A4a: FULL RESTORE to ANY retained rollback point. THE OPERATOR PRECONDITION (verbatim intent): roll back "not just to another broken one but have FULL RESTORE via MULTIPLE rollback points." restore(slug, v#) makes the LIVE page byte-exact the content of version v# -- ANY v#, not just the last. The bytes come from the content-addressed archive by CID, so what gets republished is GUARANTEED identical to what was captured (a CID names exactly one byte string). COMPOSITION (no storage/crypto reinvented): nx_wiki_versioned_publish vp_cid_of_version (resolve v# -> CID from the durable version index) nx_wiki_archive war_get_by_cid (no-loss retrieval of the EXACT bytes by CID) nx_wiki_publish pub_publish_ex (A3 GUARDED re-publish -- the restore goes live ONLY if the A2 guard re-ALLOWs it; a restore is itself a guarded publish) nx_seg_store (transitively, via the archive store) ADDITIVE: a restore writes NOTHING destructive. It reads an immutable blob and re-publishes it; the version index is unchanged (the restored content already has its own retained v#). It is also safe to pair with vpub -- a caller that wants the restore itself recorded as a NEW head simply vpub's the restored bytes afterward (the live-proof runner does exactly this is NOT required: restore re-pushes the exact old bytes; re-capturing is optional and additive). REFUSAL (liar-kill): an unknown v# returns VR_NOT_FOUND and the push path is NEVER reached -- a restore cannot silently push garbage for a version that was never retained. Pure NishiLang, NO sql/.sh/.py/.js, no new .tsv/.conf. license_tier: ORIGINAL