nx_doc_at_rest.nx

nx_doc_at_rest.nx -- AT-REST WIRING: the thin store layer that seals CONFIDENTIAL docs with the crypto core (nx_doc_crypto) and reads plaintext + encrypted TRANSPARENTLY, so existing plaintext confidential docs never break. Composes the sovereign seg_store (dp_prefix/dp_key, ss_begin/ss_add/ss_commit/ss_open/ss_hget) exactly like dp_set_policy / the reclassify organ -- NO daemon edit; the future docportal change is a call-swap (dp_ingest's ss_add -> doc_put ; dp_read -> doc_get) the operator approves later. FORMAT: an 8-byte magic "NXENC1\0\0" prefixes an encrypted value. Encrypted stored value = magic(8) || nonce(12) || ciphertext || tag(16) (the nonce||ct||tag is doc_encrypt's envelope) A value WITHOUT the magic is LEGACY plaintext -> passed through verbatim on read. Plaintext + encrypted coexist. SCOPE: confidential shards only (DP_VIS_PRIVATE and any non-public class); the PUBLIC corpus path is unchanged. license_tier: ORIGINAL