Safely repair JSON payloads that fail a known schema. Deterministic repairs only. No semantic guessing. Returns exact change manifest and verifiable receipt. Refuses ambiguous repairs.