nx_share_plane.nx

⚠⚠ SUPERSEDED 2026-07-25 -- DO NOT BUILD ON THIS. Use `nx_suite_share.nx`. This organ was a SECOND implementation of a rule the estate already had. `runtime/nx_rebac.nx` is the one authorization plane -- a sovereign Zanzibar/ReBAC tuple model, deny-by-default, additive tombstones with latest-wins -- and its own header says it exists because the ecosystem once carried three incompatible authz philosophies. This file was quietly becoming the fourth. It was retired the way the estate requires: by PROOF, not assertion. * `nx_share_convergence_gate` ran the same nine scenarios through both planes: 7 AGREE, 2 declared divergences, 0 silent ones -- so the grant/revoke/check half was measurably redundant. * `nx_suite_share` now speaks the suite's vocabulary over nx_rebac, and `nx_suite_share_gate` re-aims all fifteen of the attacks below at it: 15/15 GREEN. Nothing this file protected went unprotected. * The two divergences became work rather than losses: claim-before-share is kept as a facade-level tightening, and delegated re-sharing moved onto the shared plane as a rewrite-table ROW (the new `album` object type with its `curator` relation) instead of a capability bit only this file knew about. KEPT, not deleted, because the convergence gate imports it -- the evidence for the retirement has to keep compiling, or the retirement becomes a claim again. That gate is its only remaining consumer. ---- original header, for the record ---- nx_share_plane.nx -- THE SHARE PLANE. One identity-keyed answer to "who may see what", so that shared gallery, shared contact directory and digital gifts are three thin surfaces over one rule instead of three copies of it. WHY THIS IS RUNG 1 AND NOT A SHARED-GALLERY PAGE. The ruler's gap_queue put D2 (shared gallery), E3 (shared contact info) and F1 (digital gifts) in its top four, all at rank 9. Three of the top four are the SAME primitive wearing different clothes. Building them one page at a time would produce three who-may-see-what implementations that drift apart, and the one that drifts is a privacy bug. So the measurement chose the rung; the composition is just rule 15 applied to what the measurement found. SHAPE: a caller-supplied arena, no syscalls, no main -> the live daemon composes it per request AND a gate imports it standalone, exactly like nx_connect_ui. The log is APPEND-ONLY (rule 13): revoking appends a revocation, it never erases the grant that existed. History is what makes "who could see this last March" answerable, and a sharing plane that cannot answer that is not auditable. THE INVARIANTS (each one is a gate tooth, not a promise in a comment): * DENY BY DEFAULT -- no matching live grant means no. * ONLY THE OWNER GRANTS -- a subject cannot grant themselves, and holding VIEW never lets you pass VIEW to someone else. No transitive escalation without an explicit ADMIN bit. * REVOCATION IS TOTAL AND IMMEDIATE -- after a revoke every capability answers no, on the next call. * SELF-GRANT IS REFUSED -- an owner already has their own resource; letting a self-grant exist would