nx_pe_compile_win_nishi.nx

nx_pe_compile_win_nish.nx -- W-NISH: the SOVEREIGN NISHI BROWSER (nish), native Windows PE. Keystone-linker: takes nxc2-compiled nish (runtime/_hdl_build/nish.nx -> /tmp/nxwin.s via nx_compile_x86_native) and emits a NATIVE Windows .exe whose Linux syscalls are redirected to Win32 (kernel32 + ws2_32) thunks -- no WSL, no gcc, no curl/openssl/zlib. Mirrors the proven nx_pe_compile_win_uiserve.nx pattern, sized for nish's ~0.8MB position-independent .text. STAGE 3 (live): real thunks for the whole reached syscall surface so nish performs a live HTTPS fetch + render natively. WSAStartup is injected into the entry stub (nish never calls it -- it is a Linux program). Stage 2a (kernel32-only, network neutralized) already proved the PE layout + 1.34MB CA-bundle read + clock + console on the real nish; this stage adds the network layer. nish's reached syscall surface (measured from its .s, call-site counts): sys_mmap x471 -> HeapAlloc; sys_write x14 -> WriteFile(fd<=2) | send(socket); sys_read x7 -> stdin ReadFile(fd==0) | recv(socket); sys_close x12 -> closesocket; sys_exit x4 -> ExitProcess; sys_socket x3 -> socket(honor args, TCP+UDP); sys_connect x2 -> connect; sys_sendto/sys_recvfrom -> UDP DNS; sys_openat_rd x2 -> CreateFileA (/dev/urandom -> fail -> deterministic entropy fallback); sys_read_file -> CA bundle; sys_now_realtime_sec -> GetSystemTimeAsFileTime; sys_setsockopt x2 -> 0 (blocking sockets). Everything else compiled-in but never called. ABI bridge: compiled nish is SysV; Win32 callees are MS-x64. The intersection of registers a SysV caller assumes survive a call {rbx,rbp,rsp,r12-r15} is preserved by every Win64 callee, so the thunks just remap args (rdi/rsi/rdx/rcx/r8/r9 -> rcx/rdx/r8/r9/[rsp+20]/[rsp+28]) and return in rax. Image has no .reloc -> loads at preferred base 0x140000000, so absolute VAs in the url/argv blob are computable; the compiled code itself is fully RIP-relative (75 leaq .L..(%rip), 0 absolute). lineage_id: substrate_pe_compile_win_nish_v2 (tutor-scaffold; back-fill = data-driven N-from-spec).