nx_capture_owned_gate_expanded_t218.nx

nx_tool_run.nx -- R0 of the EXECUTABLE-API rung: the sovereign exec+capture primitive the ecosystem is missing. Today nishifamily.com/api/tools + /mcp only LIST tools (a read-only registry) and MCP tools/call returns a SAFE STUB ("invoked X (capability-authorized)") -- there is NO way to actually RUN an organ and hand back its real stdout. This organ is that missing capability, built hardware-up from raw syscalls (fork/pipe/dup3/execve/wait4), reusing the EXACT proven wrappers from nx_hostctl's hc_dfork_exec so it inherits the same never-brick discipline. NO /bin/sh, NO shell string, NO PATH search -- callers pass an ABSOLUTE ELF path (the allowlist layer that maps tool-name -> path is R1, nx_tool_registry). Synchronous (wait4), unlike hc_dfork_exec's detach -- because an API tools/call needs the child's OUTPUT and EXIT CODE, not a fire-and-forget daemon. license_tier: ORIGINAL syscalls.nx -- thin __syscall wrappers used across modules. Sovereign path: no libc. Every memory allocation, file op, and clock read in the rest of the runtime routes through one of these helpers. Numbers match Linux RV64; NishiOS uses the same set. Extracted from runtime.nx and ir.nx's copy-pasted helpers so the module-import build doesn't produce duplicate symbols.