nx_plane_append.nx

nx_plane_append.nx -- SAFE APPEND OF ONE ROW TO A SOVEREIGN SEG-STORE PLANE. WHY THIS EXISTS (proved by experiment 2026-07-26, debt seq1067). `sts_seed` REPLACES a plane; it does not append. Seeding the same 2-row fixture twice into a throwaway prefix left 2 rows, not 4. So the obvious way to "add one row" to a shared catalog -- call the seeder with your row -- DESTROYS every row already there. Adding one row to knowledge/store/commontask- that way would have turned its 42 rows into 1. Two unrelated pieces of work were blocked on this single missing primitive: registering an organ in the capability catalog, and adding the additive KIND column the atlas measure-gap axis needs (seq1046). It was never a catalog problem. It was a WRITE-API problem. FAIL-SAFE BY CONSTRUCTION, not by promise (Rule 13 / Rule 26 spirit): * the ORIGINAL bytes are held in memory for the whole operation, so a restore is always possible; * an absent or empty plane is REFUSED, never silently created -- a typo in a prefix must not conjure a new plane that later reads as authoritative; * the new buffer must be strictly LONGER than the old one AND must still start with the old bytes, checked before the commit -- an append that does not preserve its input is not an append; * after the commit the plane is RE-LOADED and the row count verified; on any mismatch the original buffer is written back and the tool reports RED rather than leaving a mangled registry. HONEST LIMIT, stated because it matters: the lock serialises appends made THROUGH THIS ORGAN. Any other writer calling sts_seed directly bypasses it. This is the one correct path, not a guarantee about every path, and it cannot become one until the other writers route through here. nx_plane_append <prefix> <row> nx_plane_append selftest expect_exit: 0 license_tier: ORIGINAL No hw writes (Rule 26).