nx_pub_lib.nx

nx_pub_lib.nx -- THE PUBLISHING PLANE CORE (multi-site, 2026-07-30). THE OPERATOR'S DIAGNOSIS: "how we publish in these workstreams to nishifamily.com is random and arbitrary -- we want nishifamily and all our client sites to have SOTA capabilities so we and the client can focus on work, not on where something was put." MEASURED FIRST (2026-07-30, nx_pub_desk census + live edge fetches), which is why this file exists: nishifamily: FOUR different answers to "what pages does this site have" -- the nav/sitemap page says 23 surfaces (hardcoded in nx_site_chrome), sitemap.xml says 96 urls, the registry says 157 rows, the docroot holds 135 pages (+61 .prev artifacts +11 debris). 54 pages are SERVED but in NO registry. andelinwest (a CLIENT): registry 0 rows, no sitemap.xml, no robots.txt (404), and https://andelinwest.com/index.html.bak-v1 returns 200 with a whole previous homepage. THE ELITE PATTERN (news-org + docs-as-code + headless-CMS sweep, July 2026): ONE machine-readable registry per site is the SSOT; every discovery artifact -- sitemap.xml, robots.txt, llms.txt, nav, hubs, feeds -- is DERIVED from it and never hand-curated; and content reaches the docroot only through a gate that maintains the registry. Astro content collections make it a build error, the NYT Gateway makes it a publish refusal. Same law: THE DERIVED ARTIFACT MUST NOT BE AUTHORABLE. THIS FILE is the derivation core, site-agnostic. It reads TWO data sources and writes NO policy: 1. the SITE TABLE (knowledge/pub_sites.conf, TSV): site <TAB> docroot <TAB> regprefix <TAB> baseurl <TAB> title <TAB> disallow-csv 2. the per-site REGISTRY plane at regprefix (the ecosystem row convention, status@col3): id <TAB> title <TAB> owner <TAB> status <TAB> section <TAB> path <TAB> note status vocabulary: live (indexable page) | asset (served, never in the sitemap) | draft | withdrawn | redirect | debris WHAT IT FIXES vs the pd_sitemap it supersedes (both stay until nx_pub_desk migrates, F-debt filed): * REAL XML ESCAPING. pd_esc maps & < > to '.' -- lossy by design for JSON/HTML attributes, but in a <loc> it silently CORRUPTS any URL carrying them. Here &amp; &lt; &gt; &quot; &apos; are emitted. * NO PER-ROW ALLOCATION. pd_sitemap calls sys_mmap INSIDE the row loop (a 512B path buffer per registry row). That is the exact per-call-alloc-in-a-primitive class that leaked 8KB/call through ss_hget across 205 sites. Every buffer here is hoisted above the loop. * HONEST LOAD. sts_load_honest, not sts_load: a stale q:n silently truncates a registry, and a truncated registry emits a SHORT SITEMAP that looks perfectly well-formed. Callers get the flags. * MULTI-SITE BY CONSTRUCTION. No docroot, prefix, domain or disallow rule is compiled in (rule 11). license_tier: ORIGINAL No hw writes (Rule 26). DEPENDENCIES ARE runtime/-ONLY ON PURPOSE (measured 2026-07-30): import resolution reaches _hdl_build/ -> runtime/ but NOT runtime/ -> _hdl_build/. This lib is imported by