nx_arena_scope.nx

nx_arena_scope.nx -- mark/reset-to-mark wrapper for nx_arena. First substrate primitive shipped under NISHI_PREEMPTIVE_BUG_ ABSORPTION.md. Closes the arena-daemon-memory-growth issue named in NISHI_HONEST_TRADE_OFFS.md section 2. Why this primitive exists: nx_arena already ships full-reset via nx_arena_reset(a). That's sufficient for batch programs (parse pass + reset at end of pass). Long-running daemons (the IoT hub, the video-call server, the browser tab) need SCOPED reset -- a tick of the loop should release everything allocated DURING the tick, but preserve the daemon's long-lived state. Scope pattern (replaces full-reset for nested workloads): let mark: i64 = nx_arena_mark(arena) do_work(arena, ...) // many arena_allocs nx_arena_reset_to_mark(arena, mark) // rewinds to mark Reset-to-mark is O(1) (just rewinds the bump pointer). Caller's stack-discipline determines nesting depth. Sealed-enum verdict for the ceiling-aware variant: NX_ARENA_OK allocation succeeded NX_ARENA_OOM_CEILING refused because would exceed ceiling NX_ARENA_OOM_CAP refused because would exceed arena cap NX_ARENA_BAD_MARK reset-to-mark called with invalid mark NX_ARENA_BAD_ARG null pointer / negative size nx_capability_claims: needs: [pointer_arithmetic] provides: [arena_mark, arena_reset_to_mark, arena_ceiling_check] safety: [no_unchecked_deref, no_floating_point, no_syscall, bit_equal_reproducible, kind_isolated] verdict: [sealed_enum_5_state, no_silent_failure] license: ORIGINAL kind: racing_crew_specialist sss: [S0, S6, S7] (closes arena issue in SSS table row 1)