feat(repair): general-purpose repair for crossed summary ownership

[antra-tess]

Follow-up to #124, which refuses stores with crossed ownership but shipped no way to repair them.

What

planTopologyRepair (src/repair/topology.ts) is a pure planner over the persisted states (summaries, chunk records, resolutions, message listing); scripts/repair-topology.ts <store> --namespace <ns> [--apply] [--release-head] [--mode lossless|compact] [--json] applies it. Dry-run by default; --apply writes the three states and re-opens the store under topologyPolicy: 'reject', so the run fails if the audit still finds a crossed summary. No summary is regenerated and no model call is made.

Two modes, because the trade-off is real and belongs to the operator:

• lossless (default): a crossed summary keeps the run of children carrying the most leaves and detaches the rest as roots (they keep their prose and their leaves); a crossed L1 keeps its largest run and releases the stray messages from its record; single-source parents dissolve; touched ancestors get sourceRange recomputed; kv-stable resolutions are clamped to the leaf's remaining chain. An ancestor left with a hole is repaired the same way on the next pass, so the pyramid unravels around each fragment — no prose ever claims content it did not see, but those leaves render at a shallower level until the merge ladder folds them again. Reported as depthLostLeaves.
• compact: additionally, a summary whose holes are owned one level down by roots (the Demand-path merges (enqueueMergeForRange, produce level ≥ 2) still bypass the strict-adjacency grammar — can mint a non-contiguous L2 that kv-unified then rejects forever #95 shape) adopts them, and detached fragments are re-homed under an adjacent summary at the same level (preferring the same parent), iterating while progress is made. Depth is kept; the adopting prose never covered the moved content. Reported as proseGapLeaves. Adoption is chosen over detaching when it moves no more leaves, or when some fragment has no home.
• --release-head: detached opening L1s and uncompressed prefix records are removed with their records, so the head window takes those messages back verbatim (CM ≥ fix(strategy): stop the head window ratcheting down under calibration drift (#122) #123 anchors the head to coverage; bounded at 2× headWindowTokens).

scripts/audit-topology.ts now prints summary, chunk and chunk→L1 link counts and warns when it has nothing to audit (a copy that carries no state reads as clean otherwise).

Validation

• npm test: 884/884.
• Dry-runs on copies of nine production stores that feat(strategy): fail loudly on invalid store topology; merge adjacency in store order #124 refuses: every plan reaches a clean store (remaining: 0) in 1–5 passes; --apply on a copy re-opens under 'reject'. For the Head window ratchet: calibration rises peel the head into late, out-of-order L1s that merge across eras #122-shape store (five one-message L1s over the opening) lossless --release-head detaches the five, releases six records, and the host then renders the opening verbatim in the head. For the large stores the costs are large in either mode (thousands of leaves lose a fold level, or thousands sit under prose that never saw them) — regenerating the affected merges with the summarizer is the path that is both compact and faithful, and is not attempted here.

🤖 Generated with Claude Code