nx_content_put.nx

nx_content_put.nx -- CHUNKED CONTENT UPLOAD RECEIVER: the sovereign door for laptop->NAS bytes. WHY THIS EXISTS: two same-day break-glass scp transfers (94 MB of donor FBX, 389 MB of authored textures) because the estate had NO upload organ and the MCP tools/call body is capped -- measured twice independently 2026-08-23: the edge answers a clean 413 for any body >= 64 KiB, and tsv_serve_one performs ONE sys_read(65536). This organ turns that cap into a chunk protocol: the client splits, every chunk is sha-receipted (CAS), commit reassembles ATOMICALLY and verifies the WHOLE-FILE sha against the one declared at begin. scp for content transfer is retired. nx_content_put begin <dest> <total_bytes> <sha256hex> -> CP-BEGIN id=... chunk_raw=... nx_content_put chunk <id> <index> <base64> -> CP-CHUNK OK ... chunk_sha256=... nx_content_put commit <id> -> CP-COMMIT OK dest=... sha256=... nx_content_put status <id> -> received/missing map (resume source) nx_content_put abort <id> -> staging removed DESIGN LAWS APPLIED: - chunk size is DERIVED, one owner (this organ), returned in the begin receipt; the client reads it from there. Components: the wire body cap (65536, measured), the JSON-RPC skeleton length MEASURED FROM THE LITERAL AT RUNTIME (a hand-counted length beside a literal is the defect that put 112 beside a 120-byte struct the same day this was written), the largest capability token observed in the estate's cap store (831 B, measured 2026-08-23), and the i64 digit bound (19, from the type). The reserve is a THROUGHPUT choice, never a correctness bound: an oversized call fails LOUD at the edge (413) and per-chunk sha CAS means corruption cannot land silently. - destination allowlist BY NAME: world/ knowledge/rigcorpus/ knowledge/fetched/ knowledge/library/ plus /tmp/ (the gate-fixture lane, the same safe-root set nx_mkdirp enforces). No '..' ever. - assembly is staged BESIDE the destination (<dest>.cptmp) then renamed: rename is atomic only within a device; staging->dest across volumes would EXDEV-fail exactly when it mattered. - chunks are idempotent: an identical re-send is a receipted no-op; a DIFFERENT body for an index that already landed is REFUSED (CAS) -- a blind retry can never double-apply or corrupt. - stale staging is reaped at begin: age bound = nchunks * CP_WORST_CALL_MS * CP_RESUME_ALLOWANCE, i.e. the time the transfer would take at the estate's measured WORST per-call latency, times a declared crash-resume policy allowance. Both factors named below. - partition law: commit prints received/declared and bytes/total, and they must SUM. exit: 0 ok | 2 io | 3 usage | 4 refused-dest | 5 refused-cas | 6 missing-chunks | 7 sha-mismatch license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0