nx_content_put_client.nx

nx_content_put_client.nx -- THE SOVEREIGN laptop->NAS UPLOAD CLIENT. Retires nx_content_put_client.py. WHY THIS EXISTS (operator standing order 2026-09-03: "i dont want py or js or sh or anything else in the build lanes i want us nishilang soverign", and again "dont build python wtf build nishi"). nx_content_put has been the sovereign RECEIVER since 2026-08-23; its only driver was an 8,525-byte Python script shelling out to a Python MCP wire. This is the NishiLang driver. IT WAS BLOCKED ON ONE MISSING PRIMITIVE, NOW BUILT. Driving the receiver needs POST-a-body-to-a-URL. The estate had no such thing: nx_https_post_json took a URL and a body and issued a GET (corrected to refuse, 2026-09-03), and nx_https_post_complete_xhdr needs an already-established session. hp_post_json (nx_https_post_lib.nx) is the glue, and this file is its first consumer. nx_content_put_client [dryrun] <local_path> <dest> <capfile> <url> [expect=<sha256hex>] IT REFUSES TO ESCAPE JSON RATHER THAN ESCAPING IT BADLY. Every value this client puts on the wire comes from a KNOWN-SAFE alphabet: a destination path, decimal digits, lowercase hex, base64 (A-Za-z0-9+/=) and a capability token. None of them can contain a quote, a backslash or a control byte. So instead of hand-rolling a JSON escaper -- a defect generator that is wrong in exactly the cases nobody tests -- cc_json_safe() REFUSES any argument carrying a character that would need escaping. A hand-rolled escaper fails SILENTLY and produces a malformed request the server rejects for the wrong reason; a refusal names the offending byte and stops. THE CHUNK SIZE IS THE SERVER'S, READ FROM ITS OWN RECEIPT -- NEVER COMPUTED HERE. nx_content_put derives chunk_raw from the wire body cap, the request skeleton measured at runtime, the largest observed capability token and the i64 digit bound. Recomputing that here would install a second ruler that drifts the moment the server's reserve changes, and the drift would show up as truncated uploads. The client reads chunk_raw= out of the begin receipt and uses it verbatim. A CHUNK RE-SEND IS SAFE; A COMMIT RETRY IS NOT DECIDABLE FROM HERE. The receiver treats an identical re-send as a receipted no-op and REFUSES a different body for an index that already landed (CAS), so a chunk retry can never double-apply. A lost COMMIT response is genuinely UNKNOWN -- the transfer id may be gone because it committed. This client says so and tells the caller to verify by hash rather than guessing; it does not retry commit. STATUS 2026-09-04: THE ROUND TRIP IS NOW PROVEN AND THIS ORGAN IS LIVE. It had never completed a transfer before today and had never been promoted at all -- no nx_content_put_client.elf existed in the serving root -- so the Python it claims to retire was in fact the only working shipper. Two defects stood between the two facts: this client did not follow the edge's JOB-STARTED promotion (it read the JOB id as the transfer id, both being spelled `id=`), and the shared TLS transport wrote every request as ONE record, capping a body at 8 KB against the 48,402-byte chunks the server offers.