nx_chat_store.nx

nx_chat_store.nx -- C1 of the comms lane: durable STORE-AND-FORWARD chat history on the sovereign seg-store plane. Contract symbol cs_store_forward == the /compare/comms C1 watch contract. DONE-RULE (pre-declared in comms.plan before this organ existed): a message sent to an offline member is delivered on reconnect byte-identical and in order; history survives room close; the store is additive-only with soft-delete and REFUSES loudly at its conf-named size budget instead of silently dropping. REFEREE: nx_chat_store_gate (the flip is the receipt, the gate is the proof). WHY: the live room chat is nx_chat_ring -- bounded, in-memory, gone when the room closes. Its own header declares persistence as pluggable (disk / memory / future MLS-encrypted); this organ is the disk layer, pure COMPOSITION of incumbents, no second ruler: nx_store_seed_lib sts_lock/sts_unlock (the shared <prefix>plock domain) + sts_seed (explicit room creation ONLY) + sts_atoi/sts_rowkey/sts_mm nx_seg_store ss_open_cached + ss_hget (the amplification-safe read path, seq356) + ss_begin_cap/ss_add/ss_commit_cas (O(1) append; CAS turns a lost update into a loud CHAT-RETRY -- backpressure, never corruption) nx_chatmsg cm_advance -- the monotonic receipt ladder; a delivery cursor NEVER regresses MODEL: one plane per room at <store_root>chat_<room>- . q:<i> message row m|<seq>|<epoch_ms>|<kind>|<sender>|<hexbody> (seq == i+1, ASSERTED at read) q:n row count (the store's own counter -- two counters of one population, free audit) meta:bytes cumulative DECODED body bytes (the budget ruler: cumulative, not a ring) cur:<member> per-member delivery cursor (store-and-forward: reconnect = fetch since cursor) del:<seq> soft-delete tombstone (additive-only, rule 13; history is never rewritten) BODIES ARE HEX-ARMORED: plane rows are newline-framed text and chat bodies are arbitrary bytes (tomorrow: MLS ciphertext), so rows carry lowercase hex and the BUDGET COUNTS DECODED BYTES -- the armor never distorts the policy. Byte-identity round-trip is a gate tooth, not a promise. KINDS are nx_chat_ring's SEALED wire constants, validated as the range 1..6 BY CITATION: a cross-import is refused by the import graph (the ring pins nx_syscalls_x86_64, the seg-store pins nx_syscalls; importing both duplicates the syscall layer and the duplicate guard fails the build). If the ring grows a kind, NX_CHAT_KIND_N moves and CS_KIND_MAX here must follow. EVERY POLICY NUMBER LIVES IN THE CONF (rule 11): knowledge/comms/chatstore.conf rows store_root| room_bytes_cliff| room_msgs_cliff| body_bytes_max| A missing conf row REFUSES BY NAME -- no silent code default. FAIL-CLOSED: appending to an unopened room is REFUSED (a typo must not conjure a plane -- the nx_plane_append law); open of an existing room is REFUSED (create-only, idempotent-safe, rule 10); every refusal ANNOUNCES its reason and writes NOTHING. license_tier: ORIGINAL No hw writes (Rule 26).