nx_docportal_lib.nx

nx_docportal_lib.nx -- shared core for the PER-DOMAIN DOCUMENT PORTAL (operator 2026-06-28: "a document portal to upload documents for their onsite search ... all our sites sharded off per domain ... public and private"). The s-class substrate is the SOVEREIGN seg_store (immutable append-only segments + content-addressed values + never-delete) -- NOT a new TSV database (operator: get off TSV). ONE call ingests a document into the domain's PUBLIC store (also emitted to the domain's derived BM25 search source so it is findable on <domain>/search) or PRIVATE store (the client vault, NEVER emitted to the public search source). THE PUBLIC/PRIVATE SPLIT IS BY CONSTRUCTION: public and private are DIFFERENT store prefixes => DIFFERENT physical segment files => a public search query cannot read the private shard (it never opens those files). THE PER-DOMAIN SHARD is the domain: prefix carries <domain>, so a query scoped to domain A cannot read domain B's segments the same way. This is the records-management "balance of confidentiality, data privacy, and public access" (ldm_records_mgmt) enforced mechanically, not by an ACL check that can be misconfigured. CID = deterministic content id (FNV-1a, folded positive): same bytes -> same CID (exceed dimension #8); used as the segid so distinct content never overwrites a prior doc's segment (never-delete) and identical re-ingest is idempotent. The cryptographic seal (sha256 via nx_doc_seal) is a later rung. Composes nx_seg_store + nx_fnv. license_tier: ORIGINAL