nx_ws_cas.nx

nx_ws_cas.nx -- WMS-R8: CONCURRENT-SSOT-SAFE registry write (advisory-lock serialized). module: nishi-core.wms.ws_cas capability: CORE_COMPUTE (the registry's concurrent-writer durability floor) ROOT CAUSE this closes: ws_put_p (nx_workstream_store) is an UNGUARDED read-modify-write -- ss_get (idempotency probe) -> ss_begin/ss_add -> ws_seg_next (= 1 + ss_manifest line count) -> ss_commit (writes the seg files, then RMW-appends "seg-<id>" to manifest.txt via tmp+rename). TWO concurrent ws_put_p calls race on BOTH the segid AND manifest.txt: each reads the SAME manifest line count -> computes the SAME segid -> ss_write_seg clobbers the other's segment; and each reads the SAME old manifest.txt, appends ITS one line, renames -> last-writer-wins, so all but one concurrent manifest append is LOST. Net: committed records become UNRETRIEVABLE (the classic lost update) even though each ss_commit's own tmp+rename is atomic. ss_commit gives crash-atomicity, NOT inter-writer mutual exclusion -- the registry RMW needs a lock the substrate never applied to it (the audit said the locking primitive was ABSENT; R0b added sys_flock). THE FIX (one capability): serialize the WHOLE ws_put_p RMW under an EXCLUSIVE advisory lock (flock LOCK_EX) on a per-prefix lock file <prefix>wlock -- mirroring the WMS-R0b framed-append lock frame. Two writers can no longer both be inside the manifest RMW window -> every commit gets a distinct increasing segid and a non-clobbered manifest line -> ZERO lost updates. REUSE (rule 15): the lock frame is the proven nx_framed_append pattern (sys_flock LOCK_EX/UN from nx_syscalls); the write itself REUSES ws_put_p UNCHANGED (additive -- the unlocked path stays for genuine single-writer callers). Sovereign: nx_workstream_store + nx_syscalls only. license_tier: ORIGINAL