The --repair code deletes documents that it finds as corrupt. This code is shared with startup recovery when we rebuild unfinished indexes.
We should not delete corrupt document unless we are actively in --repair. We should fassert and crash immediately.
Building indexes for startup recovery uses unowned RecordData after yielding its cursor