Repair Catalog

Every repair this deployment can run, from the registry's own walk.

⛔WITHOUT THIS THERE IS NO DOOR. A repair module lands in tools/repairs/ green and merged, and the only way to ask for it is to POST this router by hand with an agent's bearer token -- so a repair Frederick approved the idea of can sit in the codebase indefinitely while the thing it fixes stays broken. It happened twice in one day: the overseas onboarding and the duplicate issue rows.

The approval gate is untouched. This lists what CAN be asked for; asking still runs plan() read-only against production and still raises the card that only production:data_repair:approve can settle.

Behind SUBMIT_DATA_REPAIR rather than open, because the list of things that can rewrite production data is itself a map of where the soft spots are -- and it is exactly the set of people who may ask.

name is the module's own NAME, which is what POST /api/repairs takes as repair_name: one fact, so a screen cannot offer a name the router would refuse.