nx_wiki_versioned_publish.nx

nx_wiki_versioned_publish.nx -- A4a: VERSIONED-PUBLISH + the multi-point rollback INDEX. THE OPERATOR PRECONDITION (verbatim intent): "ability to revert via versions held so we can roll back not just to another broken one but have FULL RESTORE via MULTIPLE rollback points." This is the safety net that must exist BEFORE any full-auto re-publishing: every time a page goes live we FIRST capture the exact bytes as a RETAINED, content-addressed version record, so a later restore can land the LIVE page byte-exact on ANY prior version -- not just the last one, not just a different broken one. COMPOSITION (no storage/crypto reinvented -- every line below routes through a proven organ): nx_wiki_archive war_archive_page / war_get_by_cid / war_cid_of_body (content-addressed blob = the no-rot anchor; the SAME WAR_PREFIX store A2's guard resolves citations from, so a version blob survives across runs / is durable by construction). nx_seg_store ss_begin / ss_add / ss_commit / ss_get_cap (append-only durable KV: a new record is a NEW segment, never an in-place overwrite -- the additive-data law #13). nx_canon_cid cid_of (via war_cid_of_body) (CID = nxc1-+sha256(bytes)). nx_wiki_publish pub_publish_ex (A3 GUARDED publish -- the SOLE enforcement point; EVERY live write here flows through the A2 guard, fail-closed). THE VERSION INDEX (a SEPARATE key family in the SAME durable store; never collides with wikiblob:/wikicid: which the archive owns): wpv:cnt:<slug> -> decimal version COUNT for the slug (a latest-wins pointer; seg_store keeps every prior value in history too, so even this is additive, never destroyed) wpv:ver:<slug>:<v#> -> the content CID of version v# (written EXACTLY ONCE per (slug,v#); a new publish appends a NEW v#, it NEVER rewrites an existing wpv:ver key -- this is the append-only, multi-rollback-point guarantee, mechanical not promised) wpv:ep:<slug>:<v#> -> the fixed epoch stamped for v# (written once; NO wall-clock call -- the caller passes a fixed epoch so the record is deterministic/reproducible) Because v# is monotonic and each wpv:ver:<slug>:<v#> key is unique, publishing v2/v3 can NEVER mutate or delete the v1 record. The blob itself is content-addressed, so even dropping a pointer cannot lose bytes. Pure NishiLang, NO sql/.sh/.py/.js, no new .tsv/.conf. license_tier: ORIGINAL