store: protected nodes, explicit provenance in mutations

- Add protected_nodes config list - blocks delete/rename of core nodes
- Remove current_provenance() env var lookup, pass provenance explicitly
- delete_node, rename_node, set_link_strength now take provenance param
- Fix new_relation calls in admin.rs to pass "system" provenance

Co-Authored-By: Proof of Concept <poc@bcachefs.org>

src/cli/admin.rs

@@ -56,8 +56,30 @@ pub async fn cmd_init() -> Result<()> {
 }
 
 pub async fn cmd_fsck() -> Result<()> {
-    // Check/repair capnp log integrity first
-    store::fsck()?;
+    // Full fsck: verify capnp logs and compare index with rebuilt
+    let report = store::fsck_full()?;
+
+    if report.capnp_repaired {
+        eprintln!("capnp log was repaired (corrupt messages truncated)");
+    }
+
+    if !report.zombies.is_empty() {
+        eprintln!("\nZOMBIE entries (in index but not in log):");
+        for key in &report.zombies {
+            eprintln!("  {}", key);
+        }
+    }
+
+    if !report.missing.is_empty() {
+        eprintln!("\nMISSING entries (in log but not in index):");
+        for key in &report.missing {
+            eprintln!("  {}", key);
+        }
+    }
+
+    if !report.is_clean() {
+        eprintln!("\nTo repair: poc-memory admin repair-index");
+    }
 
     let store = memory::access_local()?;
 
@@ -110,6 +132,12 @@ pub async fn cmd_fsck() -> Result<()> {
     Ok(())
 }
 
+pub async fn cmd_repair_index() -> Result<()> {
+    store::repair_index()?;
+    println!("Index repaired successfully.");
+    Ok(())
+}
+
 pub async fn cmd_dedup(apply: bool) -> Result<()> {
     use std::collections::HashMap;
 
@@ -255,6 +283,7 @@ pub async fn cmd_dedup(apply: bool) -> Result<()> {
                     store::RelationType::from_u8(rel_type), strength,
                     &uuid_to_key.get(&old_src).cloned().unwrap_or_default(),
                     &uuid_to_key.get(&old_tgt).cloned().unwrap_or_default(),
+                    "system",
                 );
                 tombstone.deleted = true;
                 tombstone.version = 2;
@@ -263,6 +292,7 @@ pub async fn cmd_dedup(apply: bool) -> Result<()> {
                     new_src, new_tgt,
                     store::RelationType::from_u8(rel_type), strength,
                     &src_key, &tgt_key,
+                    "system",
                 );
                 redirected.version = 2;
 
@@ -299,6 +329,7 @@ pub async fn cmd_dedup(apply: bool) -> Result<()> {
                     src, tgt,
                     store::RelationType::from_u8(rel_type), strength,
                     &src_key, &tgt_key,
+                    "system",
                 );
                 tombstone.deleted = true;
                 tombstone.version = 2;