nx_ws_repair.nx

nx_ws_repair.nx -- WMS-R9: ledger->registry CRASH REPAIR (git's defining reflog-recovery trick). module: nishi-core.wms.ws_repair capability: CORE_COMPUTE (crash-recovery: rebuild the registry SSOT from the append-only reflog) WHAT THIS CLOSES: WMS-R4 (nx_workstream_audit) only DETECTS a lost/corrupt registry record; it does not REPAIR it. Git's defining trick is that the refs (where branches point) can be rebuilt from the reflog (the append-only history of every ref update) -- a corrupt/lost ref is not fatal because the log is the source of truth. THIS is that trick for the WMS: the WMS-R2 transition ledger (nx_ws_ledger) is the reflog; ledger_replay reconstructs the authoritative current state of every workstream; ledger_rebuild WRITES those states back into the registry store, so a wiped or stale registry is reconstructed from history rather than lost. HONEST SCOPE (rule 4, no fabrication): the reflog records the LEDGER's state vocabulary (integers; 0=TODO 1=WIP 2=VIEW 3=DONE 4=NOVEL per nx_ws_ledger_gate) and ONLY the state -- not empire/links/ deps. So a recovered record carries the reflog's NUMERIC state (not invented status labels) and is marked empire="E-RECOVERED" with "-" links (intentionally none -> never false-orphans in R4); the non-state metadata is re-enriched later from the census, exactly as git rebuilds where a ref points (the state) but not the unreachable objects. last_touched=0 ("unknown" per R1 schema) keeps rebuild IDEMPOTENT: re-running on the same reflog yields byte-identical records -> ws_put_p skips unchanged. REUSE (rule 15): ledger_replay (R2) for the authoritative state; ws_put_p (R1) for the writes (recovery is single-writer at boot -- fail-fast-on-startup means the system isn't serving yet, so the R8 inter-writer lock isn't needed here). Sovereign: nx_ws_ledger + nx_workstream_store + nx_syscalls. license_tier: ORIGINAL