nx_site_intake.nx

nx_site_intake.nx -- PUBLIC contact-intake route core for GENERATED SITES (uigen lane, debt 1785934266; the buildable half of R0a "a dead form is a fake"). PURE CORE, NO MAIN -- the nx_office_serve/ nx_survey_serve discipline: a host daemon mounts si_route behind the sovereign edge, and that mount + the edge route row are the coordinated deployment hook, NOT this file. Once mounted, a generated site's req names contact|action|/intake/<slug> and the T15 form goes live with ZERO emitter rebuild. PUBLIC + ANONYMOUS => hostile by default (rule 12): - SI_MAX_BODY cap at the door (the oversized-proxied-POST class that once destabilized sites.elf) - honeypot `website` field: a filled honeypot gets the SAME 303 as success and records NOTHING (a rejection a bot can measure is a rejection it can learn around) - plane-grammar defense: TAB/CR/LF in decoded fields become spaces BEFORE the append (the clockjobs writer-vs-plane lesson enforced at write time, gate-proven) - `back` redirect is PATH-ONLY (leading '/', no ':', no '//') so no open redirect; else "/" Rows land append-only on the caller-supplied plane as id<TAB>slug<TAB>name<TAB>email<TAB>message (nx_store_put-load readable; id=epoch-sec -- the BYTES are the ledger, a load view collapses same-second ids). Caller supplies plane + log paths: the gate passes per-run /tmp fixtures (idempotent-fixture law), the real host passes knowledge/store/siteintake- + knowledge/status/site_intake.log. A message longer than SI_MAX_MSG reads as absent (the form must carry maxlength); only RECORDED submissions write a log line, so a honeypot flood cannot grow the status log. No floats, no hardware writes, nothing here binds a socket. license_tier: ORIGINAL