nx_msg_sync.nx

nx_msg_sync.nx -- C2 of the comms lane: MULTI-DEVICE SYNC for nx_chat_store rooms. Contract symbol msy_devsync == the /compare/comms C2 watch contract. DONE-RULE (pre-declared in comms.plan before this organ existed): "The same history converges on a second device; a partition-printed reconcile measures zero divergence." REFEREE: nx_msg_sync_gate. MODEL: the SERVER plane (store_root from the shared chatstore.conf) is authoritative; a DEVICE holds a replica plane under its own root with the SAME layout, readable by nx_chat_store itself via a conf whose store_root names the device root -- one format, one ruler, no translation layer. The gate exploits exactly that: convergence is verified through the CONSUMER (nx_chat_store fetch on both roots, byte-compared), never self-certified by this syncer. SYNC IS A PULL (Telegram-cloud-sync class): devices SEND by appending at the server (C1); devices RECEIVE by pulling. Overlap rows are BYTE-COMPARED before anything is written: a replica that disagrees with the server on a row it already holds is SPLIT-BRAIN and the sync REFUSES LOUDLY -- it never merges, never overwrites, wrong in the direction of doing nothing. A replica holding MORE rows than the server likewise REFUSES (device-ahead). Missing rows land in ONE commit -- O(missing), the sts_append_fast shape batched -- never a whole-plane rewrite (the seq724 amplification law), and reads go through ss_open_cached + ss_hget (the seq356 law). SCOPE, stated so the next reader trusts nothing by accident: messages and del:<seq> tombstones sync; cur:<member> cursors are DEVICE-LOCAL BY DESIGN (each device owns its read state -- syncing them would make two phones share one unread badge); meta:bytes copies from the server. The full population is always reconciled: NO batch cap, NO sampling -- sync has no tunable numbers at all, and the only conf it reads is C1's store_root. license_tier: ORIGINAL No hw writes (Rule 26).