Ship a repair command and a container

verify reports integrity problems and repair rebuilds derivatives from the
Originals, which is what makes the file layout trustworthy without a database.
The image runs TypeScript on Node 24 with no build step, writes only under
MENU_ROOT, and the provision script writes the untracked site.env using the
image's own hasher so the server needs no Node.

test/repair.test.ts

@@ -0,0 +1,95 @@
+import { strict as assert } from 'node:assert';
+import { readdir, readFile, rm, unlink, writeFile } from 'node:fs/promises';
+import path from 'node:path';
+import { afterEach, beforeEach, describe, it } from 'node:test';
+import { sitePaths } from '../src/storage/sets.ts';
+import { repairSite } from '../src/storage/repair.ts';
+import { hasFatal, validateSite } from '../src/storage/validate.ts';
+import { FakePipeline, SECTIONS, makeStore, pngBytes, tempDir } from './support/harness.ts';
+
+let dataDir: string;
+
+beforeEach(async () => {
+  dataDir = await tempDir('repair');
+});
+
+afterEach(async () => {
+  await rm(dataDir, { recursive: true, force: true });
+});
+
+async function publishedSetWithPages(count = 2) {
+  const { store } = makeStore(dataDir);
+  const set = await store.create('bar', { label: 'Bar Menu', validUntil: '2026-06-26' });
+  for (let index = 0; index < count; index += 1) {
+    await store.addPage(set.id, { data: pngBytes(`page-${index}`), originalName: `${index}.jpg` });
+  }
+  const published = await store.publish(set.id);
+  return { store, set: published };
+}
+
+function validate() {
+  return validateSite({ dataDir, sections: [...SECTIONS] });
+}
+
+describe('repairSite', () => {
+  it('reports nothing to do on a healthy Site', async () => {
+    await publishedSetWithPages();
+    const report = await repairSite({ dataDir, pipeline: new FakePipeline() });
+    assert.deepEqual(report, { fixed: [], unresolved: [] });
+  });
+
+  it('rebuilds a missing Thumbnail and a missing Viewing image from the Original', async () => {
+    const { set } = await publishedSetWithPages(1);
+    const page = set.manifest.pages[0]!;
+    const thumbnail = (await readdir(set.dir)).find((name) => name.startsWith('thumb-'))!;
+    const webp = (await readdir(set.dir)).find(
+      (name) => name.endsWith('.webp') && !name.startsWith('thumb-'),
+    )!;
+    const thumbBytes = await readFile(path.join(set.dir, thumbnail));
+    await unlink(path.join(set.dir, thumbnail));
+    await unlink(path.join(set.dir, webp));
+
+    assert.equal(hasFatal(await validate()), true);
+
+    const report = await repairSite({ dataDir, pipeline: new FakePipeline() });
+    assert.equal(report.fixed.length, 2);
+    assert.deepEqual(report.unresolved, []);
+    assert.deepEqual(await validate(), []);
+
+    assert.deepEqual(await readFile(path.join(set.dir, thumbnail)), thumbBytes);
+    assert.equal(page.hash.length > 0, true);
+  });
+
+  it('leaves a Page unresolved when its Original is gone', async () => {
+    const { set } = await publishedSetWithPages(1);
+    const page = set.manifest.pages[0]!;
+    const originals = path.join(sitePaths(dataDir).originals, 'bar', set.manifest.id);
+    const original = (await readdir(originals))[0]!;
+    await unlink(path.join(originals, original));
+    const thumbnail = (await readdir(set.dir)).find((name) => name.startsWith('thumb-'))!;
+    await unlink(path.join(set.dir, thumbnail));
+
+    const report = await repairSite({ dataDir, pipeline: new FakePipeline() });
+    assert.equal(report.fixed.length, 0);
+    assert.equal(report.unresolved.length, 1);
+    assert.match(report.unresolved[0] ?? '', /Original is gone/);
+    assert.match(report.unresolved[0] ?? '', new RegExp(page.id));
+  });
+
+  it('notices when an Original no longer matches its recorded hash', async () => {
+    const { set } = await publishedSetWithPages(1);
+    const originals = path.join(sitePaths(dataDir).originals, 'bar', set.manifest.id);
+    const original = (await readdir(originals))[0]!;
+    await rm(path.join(originals, original));
+    const page = set.manifest.pages[0]!;
+    await writeFile(path.join(originals, original), pngBytes('swapped'));
+    const thumbnail = (await readdir(set.dir)).find((name) => name.startsWith('thumb-'))!;
+    await unlink(path.join(set.dir, thumbnail));
+
+    const report = await repairSite({ dataDir, pipeline: new FakePipeline() });
+    assert.equal(report.fixed.length, 0);
+    assert.equal(report.unresolved.length, 1);
+    assert.match(report.unresolved[0] ?? '', /no longer matches/);
+    assert.equal(page.hash.length > 0, true);
+  });
+});