nx_buf.nx

nx_buf.nx -- bounded append-only byte buffer with overflow detection. Why this exists: Every diagnostic emitter (nx_log, nx_panic, nx_hex, nx_metrics) currently calls sys_write directly multiple times per record. Three problems with that: 1. Records can be interleaved by other writers between the first and last sys_write of a single logical record. On a single-threaded process today this is rare; on a multi-threaded NishiOS userspace tomorrow, every writer racing to fd=2 will produce shredded log lines. 2. Every sys_write is a syscall. For a hot path (parser guard fires, every fuzz iteration crashing) we pay thousands of context switches that we could batch. 3. There is no centralised "did this record fit?" check. Truncated diagnostic output is worse than dropped -- truncated misleads. nx_buf solves all three: build the record in a fixed-capacity byte buffer, hit overflow visibly (length > cap sets `overflow=1` and stops appending), then flush atomically with one sys_write. Design references: Rust std::io::BufWriter Linux pr_cont() vs pr_info() -- per-record buffering Go bytes.Buffer C stdio fwrite-then-fflush pattern Discipline: * caller picks capacity; nx_buf never reallocates (predictable) * overflow is sticky -- once tripped, stays tripped until clear() * never returns a partial write -- flush is all-or-nothing * append family is intentionally minimal (bytes / cstr / int / hex8); higher-level formatters compose from these.