nx_jobclaim_lib.nx

nx_jobclaim_lib.nx -- ONE CONTRACT shared by the _jobs claim WRITER and the _jobs claim READER. WHY THIS IS A LIB AND NOT TWO ORGANS THAT EACH KNOW THE FORMAT. nx_jobclaim_reap marks a dead job claim by APPENDING a tombstone. nx_joblost_gate decides what a claim IS by looking for markers inside it. Those two are a PRODUCER and a CONSUMER of one wire, and this estate has already measured what that costs when each is written separately: a producer and a consumer each correct in isolation can still disagree on the wire. THE SPECIFIC TRAP THIS FILE MAKES IMPOSSIBLE. History here is additive (rule 13): the tombstone is APPENDED, so a reaped claim STILL CONTAINS its original `state=CLAIMED` line. The census classified by substring over the whole file and tested CLAIMED before anything else -- so a reader written on its own sees every reaped claim as still pending. The tombstone lands, the count does not move, the partition tooth breaks, and the reaper reads as a fix while being a no-op. A REAPER SHIPPED ALONE IS A NO-OP THAT LOOKS LIKE A FIX. The ORDER is therefore not each organ's private business. There is ONE classifier -- jr_state_of -- and both organs import it, so the ordering cannot be right in one and wrong in the other. WHY A TOMBSTONE AND NOT AN UNLINK. The claims store is a DIRECTORY OF FILES, not a last-wins seg-store, so the clock-plane's tombstone-row pattern does not transfer unchanged. `sys_unlinkat` exists and would work -- and it would also destroy the only record that the job was ever claimed, which is the evidence any later investigation of the loss needs. Rule 13: soft-delete, never DELETE. The precedent is nx_claims' own `reap` verb: release ONLY provably-expired claims, leave an audit note, additive-only, idempotent. This is that shape applied to a different store. license_tier: ORIGINAL