code wiki / (root) / nx_content_put.nx
`nx_content_put.nx` source

↩ module page · 1593 lines · 82931 B
1// nx_content_put.nx -- CHUNKED CONTENT UPLOAD RECEIVER: the sovereign door for laptop->NAS bytes.
2//
3// WHY THIS EXISTS: two same-day break-glass scp transfers (94 MB of donor FBX, 389 MB of authored
4// textures) because the estate had NO upload organ and the MCP tools/call body is capped -- measured
5// twice independently 2026-08-23: the edge answers a clean 413 for any body >= 64 KiB, and
6// tsv_serve_one performs ONE sys_read(65536). This organ turns that cap into a chunk protocol:
7// the client splits, every chunk is sha-receipted (CAS), commit reassembles ATOMICALLY and verifies
8// the WHOLE-FILE sha against the one declared at begin. scp for content transfer is retired.
9//
10//   nx_content_put begin  <dest> <total_bytes> <sha256hex>   -> CP-BEGIN id=... chunk_raw=...
11//   nx_content_put chunk  <id> <index> <base64>              -> CP-CHUNK OK ... chunk_sha256=...
12//   nx_content_put commit <id>                               -> CP-COMMIT OK dest=... sha256=...
13//   nx_content_put status <id>                               -> received/missing map (resume source)
14//   nx_content_put abort  <id>                               -> staging removed
15//
16// DESIGN LAWS APPLIED:
17//  - chunk size is DERIVED, one owner (this organ), returned in the begin receipt; the client reads
18//    it from there. Components: the wire body cap (65536, measured), the JSON-RPC skeleton length
19//    MEASURED FROM THE LITERAL AT RUNTIME (a hand-counted length beside a literal is the defect that
20//    put 112 beside a 120-byte struct the same day this was written), the largest capability token
21//    observed in the estate's cap store (831 B, measured 2026-08-23), and the i64 digit bound (19,
22//    from the type). The reserve is a THROUGHPUT choice, never a correctness bound: an oversized
23//    call fails LOUD at the edge (413) and per-chunk sha CAS means corruption cannot land silently.
24//  - destination allowlist BY NAME: world/ knowledge/rigcorpus/ knowledge/fetched/ knowledge/library/
25//    plus /tmp/ (the gate-fixture lane, the same safe-root set nx_mkdirp enforces). No '..' ever.
26//  - assembly is staged BESIDE the destination (<dest>.cptmp) then renamed: rename is atomic only
27//    within a device; staging->dest across volumes would EXDEV-fail exactly when it mattered.
28//  - chunks are idempotent: an identical re-send is a receipted no-op; a DIFFERENT body for an index
29//    that already landed is REFUSED (CAS) -- a blind retry can never double-apply or corrupt.
30//  - stale staging is reaped at begin: age bound = nchunks * CP_WORST_CALL_MS * CP_RESUME_ALLOWANCE,
31//    i.e. the time the transfer would take at the estate's measured WORST per-call latency, times a
32//    declared crash-resume policy allowance. Both factors named below.
33//  - partition law: commit prints received/declared and bytes/total, and they must SUM.
34//
35// exit: 0 ok | 2 io | 3 usage | 4 refused-dest | 5 refused-cas | 6 missing-chunks | 7 sha-mismatch
36// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
37import "nx_syscalls.nx"
38import "nx_base64.nx"
39import "nx_sha256.nx"
40import "nx_cdc_lib.nx"   // cdc_plan / cdc_gear_table -- content-defined chunking (dataio DI5, 2026-09-05)
41
42// -- measured wire facts (see header) ---------------------------------------------------------
43const CP_WIRE_BODY_CAP: i64 = 65536
44const CP_CAP_OBSERVED_MAX: i64 = 831
45const CP_I64_DIGITS: i64 = 19
46// the exact request skeleton a chunk call rides in; its length is MEASURED at runtime, never counted
47const CP_SKEL: *u8 = "{\x22jsonrpc\x22:\x222.0\x22,\x22id\x22:1,\x22method\x22:\x22tools/call\x22,\x22params\x22:{\x22name\x22:\x22nx_content_put\x22,\x22arguments\x22:{\x22argv\x22:[\x22chunk\x22,\x22\x22,\x22\x22,\x22\x22],\x22_cap\x22:\x22\x22}}}" as *u8
48// worst observed per-call wall for a write-class tool: nx_toolatency census 2026-08-22, nx_fs_write
49// avg 7540 ms under load. The reap bound uses the WORST so a slow box never reaps a live transfer.
50const CP_WORST_CALL_MS: i64 = 7540
51// declared POLICY (not a tuning constant): a transfer may be crash-resumed up to three times before
52// it is presumed abandoned -- allowance = 1 original pass + 3 resumes.
53const CP_RESUME_ALLOWANCE: i64 = 4
54
55const CP_DIR: *u8 = "knowledge/contentput" as *u8
56const CP_INDEX: *u8 = "knowledge/contentput/index.txt" as *u8
57const CP_INDEX_TMP: *u8 = "knowledge/contentput/index.tmp" as *u8
58const CP_PATHCAP: i64 = 1024
59const CP_SHAHEX: i64 = 64
60const CP_DIGEST: i64 = 32
61
62const CP_EXIT_IO: i64 = 2
63const CP_EXIT_USAGE: i64 = 3
64const CP_EXIT_DEST: i64 = 4
65const CP_EXIT_CAS: i64 = 5
66const CP_EXIT_MISSING: i64 = 6
67const CP_EXIT_SHA: i64 = 7
68
69func cp_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
70func cp_out(s: *u8) -> i64 { sys_write(1, s, cp_slen(s)); return 0 }
71func cp_eo(s: *u8) -> i64 { sys_write(2, s, cp_slen(s)); return 0 }
72func cp_itoa(v: i64, out: *u8) -> i64 {
  var m: i64 = v
  var k: i64 = 0
  if m < 0 { out[0] = 45 as u8; k = 1; m = 0 - m }
  let t: *u8 = sys_mmap(24)
  var d: i64 = 0
  if m == 0 { t[0] = 48 as u8; d = 1 }
  while m > 0 { t[d] = (48 + (m % 10)) as u8; m = m / 10; d = d + 1 }
  var i: i64 = 0
  while i < d { out[k + i] = t[d - 1 - i]; i = i + 1 }
  return k + d
83}
84func cp_num(v: i64) -> i64 { let b: *u8 = sys_mmap(32); let n: i64 = cp_itoa(v, b); sys_write(1, b, n); return 0 }
85func cp_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
90}
91func cp_starts(p: *u8, pre: *u8) -> i64 {
  var i: i64 = 0
  while pre[i] != (0 as u8) { if p[i] != pre[i] { return 0 } i = i + 1 }
  return 1
95}
96func cp_dotdot(p: *u8) -> i64 {
  var i: i64 = 0
  while p[i] != (0 as u8) { if p[i] == (46 as u8) { if p[i + 1] == (46 as u8) { return 1 } } i = i + 1 }
  return 0
100}
101func cp_append(dst: *u8, pos: i64, src: *u8) -> i64 {
  var i: i64 = 0
  while src[i] != (0 as u8) { dst[pos + i] = src[i]; i = i + 1 }
  dst[pos + i] = 0 as u8
  return pos + i
106}
107func cp_append_num(dst: *u8, pos: i64, v: i64) -> i64 {
  let n: i64 = cp_itoa(v, ((dst as i64) + pos) as *u8)
  dst[pos + n] = 0 as u8
  return pos + n
111}
112// decimal parse; returns value, advances pos past digits
113func cp_parse(s: *u8, pos: *i64) -> i64 {
  var v: i64 = 0
  var i: i64 = pos[0]
  while s[i] >= (48 as u8) { if s[i] > (57 as u8) { break } v = v * 10 + ((s[i] as i64) - 48); i = i + 1 }
  pos[0] = i
  return v
119}
120func cp_hex_into(d: *u8, out: *u8) -> i64 {
  var i: i64 = 0
  while i < CP_DIGEST {
      let v: i64 = d[i] as i64
      let hi: i64 = (v >> 4) & 15
      let lo: i64 = v & 15
      if hi < 10 { out[i * 2] = (48 + hi) as u8 } else { out[i * 2] = (87 + hi) as u8 }
      if lo < 10 { out[i * 2 + 1] = (48 + lo) as u8 } else { out[i * 2 + 1] = (87 + lo) as u8 }
      i = i + 1
  }
  out[CP_SHAHEX] = 0 as u8
  return 0
132}
133func cp_sha_hex_of(buf: *u8, n: i64, outhex: *u8) -> i64 {
  let d: *u8 = sys_mmap(CP_DIGEST + 8)
  sha256_digest(buf, n, d)
  cp_hex_into(d, outhex)
  return 0
138}
139// mkdir with the runtime-computed syscall number (the constant-translate escape hatch nx_mkdirp uses)
140func cp_mkdir(path: *u8) -> i64 {
  let nbox: *i64 = sys_mmap(16) as *i64
  nbox[0] = 258
  let rc: i64 = __syscall(nbox[0], 0 - 100, path as i64, 0x1ed, 0, 0, 0)
  sys_munmap(nbox as *u8, 16)
  return rc
146}
147func cp_exists(path: *u8) -> i64 { let fd: i64 = sys_openat_rd(path); if fd < 0 { return 0 } sys_close(fd); return 1 }
148
149// ---- DESTINATION ALLOWLIST -------------------------------------------------------------------
150// knowledge/status/ IS DELIBERATELY *NOT* ALLOWED -- decision taken 2026-08-23 after a consumer hit
151// this refusal and asked whether it should be widened. IT SHOULD NOT. knowledge/status/ is
152// control-plane state, not content: organ_kind.conf (the SSOT /api/promote reads to decide what may
153// be promoted), gateroster.stamp, beat heartbeats and ratchet baselines all live there. A client
154// that can write it can forge a production heartbeat or edit a safety declaration -- precisely the
155// banked defect that a constant stamp path lets any non-production run write the watched signal.
156// An upload door is the LAST place that authority belongs. Capture artifacts have a home already:
157// knowledge/fetched/ (the durable evidence store, allowlisted below). If some future lane genuinely
158// needs a status-adjacent upload target, it gets its OWN content prefix with its own reasoning --
159// never this one, and never by a scp bypass, which is how that path was reachable earlier today.
160// EC24 (2026-09-02): the PROMOTE STAGE SLOT -- a bare `<target>.sov.elf.new` in the serving root, the exact
161// file /api/promote reads and then judges by contentdiff, behaveprobe and expect_sha256. It lets a host
162// that built an organ from identical sources STAGE it while the NAS admission governor refuses every
163// build (measured 2026-09-02: six targets queued for hours). Bare on purpose: no directory component,
164// so no other root is reachable through this rule, and the promote ladder stays the only door to live.
165func cp_stage_dest(p: *u8) -> i64 {
  let n: i64 = cp_slen(p)
  if n <= 12 { return 0 }
  var i: i64 = 0
  while i < n { if (p[i] & 0xff) == 47 { return 0 } i = i + 1 }
  let suf: *u8 = ".sov.elf.new" as *u8
  var k: i64 = 0
  while k < 12 { if (p[n - 12 + k] & 0xff) != (suf[k] & 0xff) { return 0 } k = k + 1 }
  return 1
174}
175// EC26 (2026-09-02): the SOURCE ROOTS. A destination here is accepted only under an expect token that names
176// the sha256 of the file it replaces (or "absent"), re-checked at commit -- the CAS discipline nx_fs_write
177// already enforces, now for a whole file of any size. Never reachable without the token.
178func cp_is_source_dest(p: *u8) -> i64 {
  if cp_dotdot(p) == 1 { return 0 }
  if cp_starts(p, "buildroot/runtime/" as *u8) == 1 { return 1 }
  return 0
182}
183// sha256 hex of the file at path, or the literal "absent" when it cannot be opened
184func cp_current_sha(path: *u8, outhex: *u8) -> i64 {
  let lp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(path, lp)
  if (b as i64) == 0 { cp_append(outhex, 0, "absent" as *u8); return 0 }
  cp_sha_hex_of(b, lp[0], outhex)
  sys_free_file(b, lp[0])
  return 1
191}
192// the expect argument, with or without its expect_sha256= prefix; 0 length = none given
193func cp_expect_value(arg: *u8, out: *u8) -> i64 {
  if (arg as i64) == 0 { out[0] = 0 as u8; return 0 }
  var a: *u8 = arg
  if cp_starts(arg, "expect_sha256=" as *u8) == 1 { a = ((arg as i64) + 14) as *u8 }
  // the sovereign clients spell the same token `expect=<hex|absent>` (their published grammar); one door, both
  // spellings -- a bare hex can never start with either prefix, so nothing is ambiguous. MEASURED 2026-09-05: the
  // put client forwarded `expect=<hex>` verbatim, this parse read it as a BARE token, and the door refused it as
  // STALE-EXPECT -- a wrong-subject refusal (the file was exactly the one expected; the token's spelling was off).
  if cp_starts(arg, "expect=" as *u8) == 1 { a = ((arg as i64) + 7) as *u8 }
  let n: i64 = cp_append(out, 0, a)
  return n
204}
205// a CAS token is 64 hex characters or the word absent; anything else is a CALLER defect and must be named as such,
206// never reported as a stale file
207func cp_expect_wellformed(v: *u8, n: i64) -> i64 {
  if n == 6 { if cp_streq(v, "absent" as *u8) == 1 { return 1 } }
  if n != CP_SHAHEX { return 0 }
  var i: i64 = 0
  while i < n {
      let c: i64 = v[i] as i64
      var ok: i64 = 0
      if c >= 48 { if c <= 57 { ok = 1 } }
      if c >= 97 { if c <= 102 { ok = 1 } }
      if c >= 65 { if c <= 70 { ok = 1 } }
      if ok == 0 { return 0 }
      i = i + 1
  }
  return 1
221}
222// ---- DI10 REFUSE ON ARRIVAL (2026-09-05): the client may declare each chunk's digest WITH the chunk
223// (`chunk <id> <index> <b64> sha256=<hex>`). The receiver compares it with the digest of what ARRIVED before
224// anything is written to staging, so a corrupted or truncated chunk is refused at the first bad chunk and is
225// never staged -- the DI6 commit re-verify stays as defence in depth. Returns 1 match, 0 mismatch,
226// -1 no declaration (a legacy caller: nothing changes for it), -2 malformed declaration (a caller defect,
227// named as such).
228func cp_chunk_expect(arg: *u8, arrived_hex: *u8) -> i64 {
  if (arg as i64) == 0 { return 0 - 1 }
  var a: *u8 = arg
  if cp_starts(arg, "sha256=" as *u8) == 1 { a = ((arg as i64) + 7) as *u8 }
  let n: i64 = cp_slen(a)
  if n == 0 { return 0 - 1 }
  if n != CP_SHAHEX { return 0 - 2 }
  if cp_expect_wellformed(a, n) == 0 { return 0 - 2 }
  return cp_streq(a, arrived_hex)
237}
238// the trailing expect field of a transfer meta line (7th field), 0 length when the transfer carried none
239func cp_read_meta_expect(id: i64, out: *u8) -> i64 {
  let pb: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_meta(pb, id)
  let lp: *i64 = sys_mmap(16) as *i64
  let buf: *u8 = sys_read_file(pb, lp)
  out[0] = 0 as u8
  if (buf as i64) == 0 { return 0 }
  let n: i64 = lp[0]
  var i: i64 = 0
  var spaces: i64 = 0
  while i < n { if buf[i] == (32 as u8) { spaces = spaces + 1 } if spaces == 6 { i = i + 1; break } i = i + 1 }
  var o: i64 = 0
  if spaces == 6 { while i < n { if buf[i] == (10 as u8) { break } out[o] = buf[i]; o = o + 1; i = i + 1 } }
  out[o] = 0 as u8
  sys_free_file(buf, n)
  return o
255}
256func cp_dest_ok(p: *u8) -> i64 {
  if cp_dotdot(p) == 1 { return 0 }
  if cp_stage_dest(p) == 1 { return 1 }
  if cp_starts(p, "world/" as *u8) == 1 { return 1 }
  if cp_starts(p, "knowledge/rigcorpus/" as *u8) == 1 { return 1 }
  if cp_starts(p, "knowledge/fetched/" as *u8) == 1 { return 1 }
  if cp_starts(p, "knowledge/library/" as *u8) == 1 { return 1 }
  if cp_starts(p, "/tmp/" as *u8) == 1 { return 1 }
  return 0
265}
266// staging paths: knowledge/contentput/<id>.meta | .c<idx> | .t<idx> | .shas
267func cp_path_meta(out: *u8, id: i64) -> i64 { var p: i64 = cp_append(out, 0, CP_DIR); p = cp_append(out, p, "/" as *u8); p = cp_append_num(out, p, id); p = cp_append(out, p, ".meta" as *u8); return p }
268func cp_path_shas(out: *u8, id: i64) -> i64 { var p: i64 = cp_append(out, 0, CP_DIR); p = cp_append(out, p, "/" as *u8); p = cp_append_num(out, p, id); p = cp_append(out, p, ".shas" as *u8); return p }
269func cp_path_chunk(out: *u8, id: i64, idx: i64) -> i64 { var p: i64 = cp_append(out, 0, CP_DIR); p = cp_append(out, p, "/" as *u8); p = cp_append_num(out, p, id); p = cp_append(out, p, ".c" as *u8); p = cp_append_num(out, p, idx); return p }
270// ---- DI9 PLAN-ADDRESSED TRANSFERS (2026-09-06): `plan <id> <count>` switches an open transfer to VARIABLE-LENGTH
271// content-defined chunks (each still within the wire chunk) addressed by plan index. The marker <id>.cdc holds the
272// declared count and cp_read_meta reads it back as nchunks, so every consumer sees ONE count.
273func cp_path_cdc(out: *u8, id: i64) -> i64 { var p: i64 = cp_append(out, 0, CP_DIR); p = cp_append(out, p, "/" as *u8); p = cp_append_num(out, p, id); p = cp_append(out, p, ".cdc" as *u8); return p }
274// DI17: the reuse ledger `<id>.rl` -- one row `k off len` per chunk staged FROM the incumbent, so commit knows which
275// chunks keep their incumbent offset (the only chunks a reflink can ever serve)
276func cp_path_rl(out: *u8, id: i64) -> i64 { var p: i64 = cp_append(out, 0, CP_DIR); p = cp_append(out, p, "/" as *u8); p = cp_append_num(out, p, id); p = cp_append(out, p, ".rl" as *u8); return p }
277// the declared plan count, or 0 when the transfer is fixed-size
278func cp_cdc_count(id: i64) -> i64 {
  let pb: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_cdc(pb, id)
  let lp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(pb, lp)
  if (b as i64) == 0 { return 0 }
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let v: i64 = cp_parse(b, pp)
  sys_free_file(b, lp[0])
  if v < 0 { return 0 }
  return v
290}
291// the size of a file without reading it (lseek END); -1 when absent
292func cp_file_size(path: *u8) -> i64 {
  let fd: i64 = sys_openat_rd(path)
  if fd < 0 { return 0 - 1 }
  let sz: i64 = sys_lseek(fd, 0, 2)
  sys_close(fd)
  return sz
298}
299func cp_path_tchunk(out: *u8, id: i64, idx: i64) -> i64 { var p: i64 = cp_append(out, 0, CP_DIR); p = cp_append(out, p, "/" as *u8); p = cp_append_num(out, p, id); p = cp_append(out, p, ".t" as *u8); p = cp_append_num(out, p, idx); return p }
300
301// atomic write: tmp + fsync + rename
302// sync=1: the file's bytes are fsynced before the rename -- kept for the META and PLAN markers and the index, whose
303// loss would orphan a transfer. sync=0: no per-file fsync -- every STAGED CHUNK (chunk post, append, reuse row): the
304// durability point is commit, which re-hashes every chunk against its declared digest and fsyncs the assembled
305// destination, so a torn or empty post-crash chunk is refused by index and re-sent after `status`, never assembled.
306// MEASURED 2026-09-06: one fsync per 48 KB row cost 8.5 s/row on the storming array (95 reuse rows = 804 s, and the
307// same fsync sat under every chunk post of every push), i.e. dedupe saved the wire and lost the wall clock -- the
308// fsync WAS the cost. A reuse batch still fsyncs the staging DIRECTORY once so its renames are durable together.
309func cp_write_atomic_x(tmppath: *u8, finalpath: *u8, buf: *u8, n: i64, sync: i64) -> i64 {
  let fd: i64 = sys_openat_wr(tmppath, MODE_0644)
  if fd < 0 { return 0 - 1 }
  var w: i64 = 0
  while w < n {
      let r: i64 = sys_write(fd, ((buf as i64) + w) as *u8, n - w)
      if r <= 0 { sys_close(fd); sys_unlinkat(tmppath); return 0 - 1 }
      w = w + r
  }
  if sync == 1 { sys_fsync(fd) }
  sys_close(fd)
  if sys_renameat(tmppath, finalpath) < 0 { sys_unlinkat(tmppath); return 0 - 1 }
  return n
322}
323func cp_write_atomic(tmppath: *u8, finalpath: *u8, buf: *u8, n: i64) -> i64 { return cp_write_atomic_x(tmppath, finalpath, buf, n, 1) }
324// fsync the staging directory once: every rename landed in it is durable after this returns
325func cp_dir_sync() -> i64 {
  let dfd: i64 = sys_openat_rd(CP_DIR)
  if dfd < 0 { return dfd }
  let rc: i64 = sys_fsync(dfd)
  sys_close(dfd)
  return rc
331}
332func cp_append_line(path: *u8, line: *u8) -> i64 {
  let fd: i64 = sys_openat_append(path, MODE_0644)
  if fd < 0 { return 0 - 1 }
  let n: i64 = cp_slen(line)
  sys_write(fd, line, n)
  sys_close(fd)
  return n
339}
340
341// derived chunk sizes; prints nothing (callers print)
342func cp_chunk_b64() -> i64 {
  let skel: i64 = cp_slen(CP_SKEL)
  var b: i64 = CP_WIRE_BODY_CAP - skel - CP_CAP_OBSERVED_MAX - CP_I64_DIGITS - CP_I64_DIGITS
  b = (b / 4) * 4
  return b
347}
348func cp_chunk_raw() -> i64 { return cp_chunk_b64() / 4 * 3 }
349
350// ---- DI5 CONTENT-DEFINED CHUNKING (2026-09-05) --------------------------------------------------------------
351// A plan of content-defined chunk boundaries over a buffer, so a receiver holding the previous generation of an
352// artifact needs only the chunks whose digests it lacks (an insertion no longer re-keys every following chunk).
353// Every parameter is DERIVED from the one wire constant this organ already owns: max = chunk_raw (a content-defined
354// chunk must still fit one call), avg = max / 2, min = max / 8 -- the FastCDC ratios expressed as divisors of the
355// wire chunk rather than as fresh numbers. The gear table is built per call from nx_cdc_lib's named seed (256
356// sha256s, 2 KB): cheaper than shipping a table that could drift. Returns the chunk count and fills offs[0..count],
357// or -1 when the plan table is too small (never a truncated plan).
358const CP_CDC_AVG_DIV: i64 = 2
359const CP_CDC_MIN_DIV: i64 = 8
360func cp_cdc_gear(buf: *u8, n: i64, offs: *i64, cap: i64) -> i64 {
  let tbl: *u8 = sys_mmap(CDC_GEAR_BYTES)
  cdc_gear_table(tbl)
  let mx: i64 = cp_chunk_raw()
  return cdc_plan(tbl, buf, n, mx / CP_CDC_MIN_DIV, mx / CP_CDC_AVG_DIV, mx, offs, cap)
365}
366
367// meta line: "<dest> <total> <sha64> <chunk_raw> <nchunks> <created>\n"
368// returns 1 ok, 0 absent/malformed; outputs via pointers
369func cp_read_meta(id: i64, dest: *u8, nums: *i64, sha: *u8) -> i64 {
  let pb: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_meta(pb, id)
  let lp: *i64 = sys_mmap(16) as *i64
  let buf: *u8 = sys_read_file(pb, lp)
  if (buf as i64) == 0 { return 0 }
  let n: i64 = lp[0]
  var i: i64 = 0
  var d: i64 = 0
  while i < n { if buf[i] == (32 as u8) { break } dest[d] = buf[i]; d = d + 1; i = i + 1 }
  dest[d] = 0 as u8
  if i >= n { sys_free_file(buf, n); return 0 }
  i = i + 1
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = i
  nums[0] = cp_parse(buf, pp)            // total
  i = pp[0] + 1
  var s: i64 = 0
  while s < CP_SHAHEX { if i + s >= n { sys_free_file(buf, n); return 0 } sha[s] = buf[i + s]; s = s + 1 }
  sha[CP_SHAHEX] = 0 as u8
  i = i + CP_SHAHEX + 1
  pp[0] = i
  nums[1] = cp_parse(buf, pp)            // chunk_raw
  pp[0] = pp[0] + 1
  nums[2] = cp_parse(buf, pp)            // nchunks
  pp[0] = pp[0] + 1
  nums[3] = cp_parse(buf, pp)            // created epoch sec
  sys_free_file(buf, n)
  // DI9: a plan-addressed transfer's chunk count is the declared plan length (ONE reader for both shapes)
  let cdcn: i64 = cp_cdc_count(id)
  if cdcn > 0 { nums[2] = cdcn }
  if nums[0] <= 0 { return 0 }
  if nums[1] <= 0 { return 0 }
  if nums[2] <= 0 { return 0 }
  return 1
404}
405func cp_unlink_transfer(id: i64, nchunks: i64) -> i64 {
  let pb: *u8 = sys_mmap(CP_PATHCAP)
  var i: i64 = 0
  while i < nchunks {
      cp_path_chunk(pb, id, i)
      sys_unlinkat(pb)
      cp_path_tchunk(pb, id, i)
      sys_unlinkat(pb)
      i = i + 1
  }
  cp_path_shas(pb, id)
  sys_unlinkat(pb)
  cp_path_meta(pb, id)
  sys_unlinkat(pb)
  cp_path_cdc(pb, id)
  sys_unlinkat(pb)
  cp_path_rl(pb, id)
  sys_unlinkat(pb)
  return 0
424}
425
426// reap stale transfers listed in the index; rewrite the index with survivors. Announces every reap.
427func cp_reap(now_s: i64) -> i64 {
  let lp: *i64 = sys_mmap(16) as *i64
  let buf: *u8 = sys_read_file(CP_INDEX, lp)
  if (buf as i64) == 0 { return 0 }
  let n: i64 = lp[0]
  let keep: *u8 = sys_mmap(n + 64)
  var kp: i64 = 0
  let dest: *u8 = sys_mmap(CP_PATHCAP)
  let sha: *u8 = sys_mmap(CP_SHAHEX + 8)
  let nums: *i64 = sys_mmap(64) as *i64
  let pp: *i64 = sys_mmap(16) as *i64
  var i: i64 = 0
  while i < n {
      pp[0] = i
      let id: i64 = cp_parse(buf, pp)
      i = pp[0]
      while i < n { if buf[i] == (10 as u8) { break } i = i + 1 }
      i = i + 1
      if id > 0 {
          if cp_read_meta(id, dest, nums, sha) == 1 {
              let age: i64 = now_s - nums[3]
              let bound: i64 = nums[2] * CP_WORST_CALL_MS * CP_RESUME_ALLOWANCE / 1000
              // AN UNKNOWN AGE MUST NEVER AUTHORISE A DELETION. Two ways this arithmetic can call a
              // LIVE transfer stale: an unreadable/zero created stamp makes age enormous, and a
              // skewed clock makes it negative. Both previously reaped. This is the estate's
              // abstain law pointed at a destructive action: when the measurement is not
              // trustworthy, do nothing -- and SAY so, because a silent abstention is a leak
              // nobody can see.
              var reapable: i64 = 0
              if nums[3] > 0 { if age >= 0 { if age > bound { reapable = 1 } } }
              if nums[3] <= 0 {
                  cp_out("CP-REAP-ABSTAIN id=" as *u8); cp_num(id)
                  cp_out(" reason=created-stamp-unreadable (staging kept)\n" as *u8)
              }
              if age < 0 {
                  cp_out("CP-REAP-ABSTAIN id=" as *u8); cp_num(id)
                  cp_out(" reason=negative-age-clock-skew (staging kept)\n" as *u8)
              }
              if reapable == 1 {
                  cp_out("CP-REAP id=" as *u8); cp_num(id)
                  cp_out(" age_s=" as *u8); cp_num(age)
                  cp_out(" bound_s=" as *u8); cp_num(bound)
                  cp_out(" (nchunks x worst_call_ms x resume_allowance)\n" as *u8)
                  cp_unlink_transfer(id, nums[2])
              } else {
                  kp = cp_append_num(keep, kp, id)
                  keep[kp] = 10 as u8
                  kp = kp + 1
                  keep[kp] = 0 as u8
              }
          }
      }
  }
  sys_free_file(buf, n)
  cp_write_atomic(CP_INDEX_TMP, CP_INDEX, keep, kp)
  return 0
483}
484
485func v_begin(dest: *u8, total_s: *u8, sha: *u8, expect_arg: *u8) -> i64 {
  let expect: *u8 = sys_mmap(CP_SHAHEX + 16)
  let xn: i64 = cp_expect_value(expect_arg, expect)
  if xn > 0 { if cp_expect_wellformed(expect, xn) == 0 {
      cp_eo("CP-REFUSED-EXPECT-MALFORMED: the CAS token must be 64 hex characters or the word absent (with or without an expect_sha256= or expect= prefix) -- got: " as *u8)
      cp_eo(expect); cp_eo(" (nothing written; a malformed token is a caller defect, not a stale file)\n" as *u8)
      return CP_EXIT_USAGE
  } }
  if cp_is_source_dest(dest) == 1 {
      if xn == 0 {
          cp_eo("CP-REFUSED-SOURCE-NEEDS-EXPECT: a destination under buildroot/runtime/ is a SOURCE and lands only under a CAS token -- pass expect_sha256=<sha256 of the file it replaces> (or absent) as the 5th argument; the token is re-checked at commit: " as *u8)
          cp_eo(dest); cp_eo("\n" as *u8)
          return CP_EXIT_DEST
      }
  } else { if cp_dest_ok(dest) == 0 {
      cp_eo("CP-REFUSED-DEST: destination must start world/ knowledge/rigcorpus/ knowledge/fetched/ knowledge/library/ /tmp/ and carry no '..' -- got: " as *u8)
      cp_eo(dest); cp_eo("\n" as *u8)
      return CP_EXIT_DEST
  } }
  if xn > 0 {
      let cur: *u8 = sys_mmap(CP_SHAHEX + 16)
      cp_current_sha(dest, cur)
      if cp_streq(cur, expect) == 0 {
          cp_eo("CP-REFUSED-STALE-EXPECT: the file at the destination is not the one you expected -- current sha256=" as *u8)
          cp_eo(cur); cp_eo(" expected=" as *u8); cp_eo(expect); cp_eo(" (nothing written; re-read the file, then begin again with its current sha)\n" as *u8)
          return CP_EXIT_CAS
      }
  }
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let total: i64 = cp_parse(total_s, pp)
  if total <= 0 { cp_eo("CP-REFUSED: total_bytes must be a positive integer\n" as *u8); return CP_EXIT_USAGE }
  if cp_slen(sha) != CP_SHAHEX { cp_eo("CP-REFUSED: sha256 must be exactly 64 hex chars\n" as *u8); return CP_EXIT_USAGE }
  cp_mkdir(CP_DIR)
  let now: i64 = sys_now_realtime_sec()
  // ---- 2026-08-23 ROOT FIX: BEGIN NO LONGER REAPS (field report, first production consumer) ----
  // OBSERVED: two back-to-back transfers; the second receipted 12/12 chunks and then met
  // "unknown transfer id" at COMMIT, 67.9 s into its own 362 s bound -- nowhere near stale.
  // MEASURED IN THIS SOURCE: cp_reap was the ONLY code path that deletes a transfer belonging to
  // SOMEONE ELSE, and it ran here, as a side effect of an unrelated caller's begin.
  // *A CLEANUP THAT RUNS ON A SIBLING'S CODE PATH IS INVISIBLE WHILE TRANSFERS ARE SERIAL AND
  // DESTRUCTIVE EXACTLY WHEN THEY OVERLAP* -- so it cannot be fixed by tuning the bound, only by
  // taking it off this path. (The consumer read the trigger as COMPLETION cleanup; it is BEGIN
  // cleanup. Recorded because the difference decides the remedy: hardening commit fixes nothing.)
  // Reaping is still wanted, so it is now an EXPLICIT VERB (`reap`) that an operator or a beat
  // calls deliberately -- never a hidden consequence of starting a transfer.
  let id: i64 = sys_now_realtime_us()
  let craw: i64 = cp_chunk_raw()
  let nch: i64 = (total + craw - 1) / craw
  // meta
  let mb: *u8 = sys_mmap(CP_PATHCAP + 256)
  var mp: i64 = cp_append(mb, 0, dest)
  mp = cp_append(mb, mp, " " as *u8)
  mp = cp_append_num(mb, mp, total)
  mp = cp_append(mb, mp, " " as *u8)
  mp = cp_append(mb, mp, sha)
  mp = cp_append(mb, mp, " " as *u8)
  mp = cp_append_num(mb, mp, craw)
  mp = cp_append(mb, mp, " " as *u8)
  mp = cp_append_num(mb, mp, nch)
  mp = cp_append(mb, mp, " " as *u8)
  mp = cp_append_num(mb, mp, now)
  if xn > 0 { mp = cp_append(mb, mp, " " as *u8); mp = cp_append(mb, mp, expect) }   // EC26: 7th field, re-checked at commit
  mb[mp] = 10 as u8
  mp = mp + 1
  let metap: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_meta(metap, id)
  let tmpp: *u8 = sys_mmap(CP_PATHCAP)
  var tp: i64 = cp_append(tmpp, 0, CP_DIR)
  tp = cp_append(tmpp, tp, "/" as *u8)
  tp = cp_append_num(tmpp, tp, id)
  tp = cp_append(tmpp, tp, ".mtmp" as *u8)
  if cp_write_atomic(tmpp, metap, mb, mp) < 0 { cp_eo("CP-IO: cannot write meta\n" as *u8); return CP_EXIT_IO }
  let il: *u8 = sys_mmap(48)
  var ip: i64 = cp_append_num(il, 0, id)
  il[ip] = 10 as u8
  il[ip + 1] = 0 as u8
  cp_append_line(CP_INDEX, il)
  cp_out("CP-BEGIN id=" as *u8); cp_num(id)
  cp_out(" dest=" as *u8); cp_out(dest)
  cp_out(" total=" as *u8); cp_num(total)
  cp_out(" chunk_raw=" as *u8); cp_num(craw)
  cp_out(" chunk_b64=" as *u8); cp_num(cp_chunk_b64())
  cp_out(" nchunks=" as *u8); cp_num(nch)
  // DI9: the server OWNS the content-defined parameters (derived from the wire chunk); a client that wants to dedupe
  // reads them here so its plan and the incumbent's plan (`have`) are cut by the same rule
  cp_out(" cdc_min=" as *u8); cp_num(craw / CP_CDC_MIN_DIV)
  cp_out(" cdc_avg=" as *u8); cp_num(craw / CP_CDC_AVG_DIV)
  cp_out(" cdc_max=" as *u8); cp_num(craw)
  cp_out(" derivation=(body_cap " as *u8); cp_num(CP_WIRE_BODY_CAP)
  cp_out(" - skel " as *u8); cp_num(cp_slen(CP_SKEL))
  cp_out(" - cap_max " as *u8); cp_num(CP_CAP_OBSERVED_MAX)
  cp_out(" - 2xi64_digits " as *u8); cp_num(CP_I64_DIGITS + CP_I64_DIGITS)
  cp_out(") down4 then x3/4\n" as *u8)
  return 0
580}
581
582// stage one chunk's bytes atomically and record its receipt in the sidecar: ONE writer for `chunk` and `reuse`
583// the ONE sidecar row every staged chunk leaves behind (`idx hex`), whichever writer staged it
584func cp_shas_append(id: i64, idx: i64, hex: *u8) -> i64 {
  let spath: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_shas(spath, id)
  let sl: *u8 = sys_mmap(CP_SHAHEX + 40)
  var sp: i64 = cp_append_num(sl, 0, idx)
  sp = cp_append(sl, sp, " " as *u8)
  sp = cp_append(sl, sp, hex)
  sl[sp] = 10 as u8
  sl[sp + 1] = 0 as u8
  cp_append_line(spath, sl)
  return 0
595}
596// DI17: record that plan chunk k was staged from incumbent bytes [off, off+len) (a re-issued batch appends the same
597// row again; the loader keeps the LAST row per k, so a replay changes nothing)
598func cp_rl_append(id: i64, k: i64, off: i64, len: i64) -> i64 {
  let rpath: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_rl(rpath, id)
  let rl: *u8 = sys_mmap(3 * CP_I64_DIGITS + 8)
  var rp: i64 = cp_append_num(rl, 0, k)
  rp = cp_append(rl, rp, " " as *u8)
  rp = cp_append_num(rl, rp, off)
  rp = cp_append(rl, rp, " " as *u8)
  rp = cp_append_num(rl, rp, len)
  rl[rp] = 10 as u8
  rl[rp + 1] = 0 as u8
  cp_append_line(rpath, rl)
  return 0
611}
612// load the reuse ledger into offs[k] (-1 = not reused) / lens[k] (0); returns the number of rows read
613func cp_rl_load(id: i64, nch: i64, offs: *i64, lens: *i64) -> i64 {
  var k0: i64 = 0
  while k0 < nch { offs[k0] = 0 - 1; lens[k0] = 0; k0 = k0 + 1 }
  let rpath: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_rl(rpath, id)
  let lp: *i64 = sys_mmap(16) as *i64
  let b: *u8 = sys_read_file(rpath, lp)
  if (b as i64) == 0 { return 0 }
  let n: i64 = lp[0]
  let pp: *i64 = sys_mmap(16) as *i64
  var rows: i64 = 0
  var i: i64 = 0
  while i < n {
      pp[0] = i
      let k: i64 = cp_parse(b, pp)
      pp[0] = pp[0] + 1
      let off: i64 = cp_parse(b, pp)
      pp[0] = pp[0] + 1
      let len: i64 = cp_parse(b, pp)
      var e: i64 = pp[0]
      while e < n { if b[e] == (10 as u8) { break } e = e + 1 }
      if k >= 0 { if k < nch { if off >= 0 { if len > 0 { offs[k] = off; lens[k] = len; rows = rows + 1 } } } }
      i = e + 1
  }
  sys_free_file(b, n)
  return rows
639}
640func cp_stage_write_x(id: i64, idx: i64, cpath: *u8, raw: *u8, dn: i64, hex: *u8, sync: i64) -> i64 {
  let tpath: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_tchunk(tpath, id, idx)
  if cp_write_atomic_x(tpath, cpath, raw, dn, sync) < 0 { return 0 - 1 }
  cp_shas_append(id, idx, hex)
  return 0
646}
647func cp_stage_write(id: i64, idx: i64, cpath: *u8, raw: *u8, dn: i64, hex: *u8) -> i64 { return cp_stage_write_x(id, idx, cpath, raw, dn, hex, 1) }
648// DI14 (2026-09-06): STAGE A REUSE ROW BY CLONING THE INCUMBENT'S BYTE RANGE, NEVER BY COPYING IT. MEASURED before this:
649// a 122-row reuse batch cost the door 122 copied 48 KB writes at 5-10 s each on a storming array, so dedupe saved the
650// wire and not the wall clock. FICLONERANGE shares the incumbent's extents with the slot (btrfs, xfs; same filesystem)
651// and writes nothing. The kernel refuses it across devices (EXDEV), on a filesystem without reflink (EOPNOTSUPP) or
652// on an unaligned range (EINVAL); every refusal falls back to the copy writer and is NAMED in the batch receipt, so the
653// receipt says which path staged each batch rather than letting a silent fallback read as a clone.
654// The cloned slot is RE-HASHED before it is renamed into place: the receipt never trusts the ioctl's return code alone.
655// Returns 1 CLONED, 0 COPIED, -1 failed (nothing staged). why[0] carries the ioctl's rc when the clone was refused.
656const CP_FICLONERANGE: i64 = 1075876877   // _IOW(0x94, 13, struct file_clone_range{s64 src_fd; u64 src_off; u64 src_len; u64 dst_off}) = (1<<30)|(32<<16)|(0x94<<8)|13 = 0x4020940D, derived from the ioctl encoding, not picked
657const CP_CLONE_RANGE_WORDS: i64 = 4
658// DI17 commit-clone (2026-09-06). FICLONERANGE accepts a range only when src_off, dst_off and len are all multiples of
659// the filesystem block (the final block may run to EOF). A STAGED chunk file has dst_off 0, so it could clone only when
660// its SOURCE offset was aligned -- 1 in blk of content-defined chunks, which is why DI14 measured -22 on every row.
661// Equal offsets are the only place a clone can happen: at COMMIT, a run of reused chunks whose incumbent offsets equal
662// their new offsets (everything before an insertion point; the whole incumbent on an append) is reflinked from the
663// incumbent over its block-aligned interior, and only the two edges are copied. The block size is READ from the
664// incumbent's stat (st_blksize), never assumed.
665const CP_STAT_BLKSIZE_OFF: i64 = 56   // x86-64 struct stat: st_size at 48, st_blksize at 56, st_blocks at 64 (nx_artifactdrift reads st_mode from the same layout at 24)
666const CP_STAT_CAP: i64 = 256
667const CP_SEEK_SET: i64 = 0
668// [ws, we) = the block-aligned interior of [rs, re); 1 when it holds at least one whole block, else 0 (out untouched)
669func cp_clone_window(rs: i64, re: i64, blk: i64, out: *i64) -> i64 {
  if blk <= 0 { return 0 }
  if re <= rs { return 0 }
  let ws: i64 = ((rs + blk - 1) / blk) * blk
  let we: i64 = (re / blk) * blk
  if we - ws < blk { return 0 }
  out[0] = ws
  out[1] = we
  return 1
678}
679// the preferred block size of the filesystem holding path, or 0 when it cannot be stat'd (0 = never attempt a clone)
680func cp_blksize_of(path: *u8) -> i64 {
  let sb: *u8 = sys_mmap(CP_STAT_CAP)
  if sys_fstatat(path, sb) < 0 { return 0 }
  let bp: *i64 = ((sb as i64) + CP_STAT_BLKSIZE_OFF) as *i64
  let b: i64 = bp[0]
  if b <= 0 { return 0 }
  return b
687}
688// copy [off, off+len) of src_fd to the CURRENT position of dst_fd through buf[cap]; 1 = every byte written, 0 = short
689func cp_copy_range(src_fd: i64, dst_fd: i64, off: i64, len: i64, buf: *u8, cap: i64) -> i64 {
  if len <= 0 { return 1 }
  if sys_lseek(src_fd, off, CP_SEEK_SET) != off { return 0 }
  var left: i64 = len
  while left > 0 {
      var want: i64 = left
      if want > cap { want = cap }
      let r: i64 = sys_read(src_fd, buf, want)
      if r <= 0 { return 0 }
      var w: i64 = 0
      while w < r {
          let k: i64 = sys_write(dst_fd, ((buf as i64) + w) as *u8, r - w)
          if k <= 0 { return 0 }
          w = w + k
      }
      left = left - r
  }
  return 1
707}
708func cp_hex_eq(a: *u8, b: *u8) -> i64 { var t: i64 = 0; while t < CP_SHAHEX { if a[t] != b[t] { return 0 } t = t + 1 } return 1 }
709func cp_stage_clone(id: i64, idx: i64, cpath: *u8, inc_fd: i64, inc: *u8, off: i64, len: i64, hex: *u8, why: *i64) -> i64 {
  why[0] = 0
  var cloned: i64 = 0
  if inc_fd >= 0 {
      let tpath: *u8 = sys_mmap(CP_PATHCAP)
      cp_path_tchunk(tpath, id, idx)
      let fd: i64 = sys_openat_wr(tpath, MODE_0644)
      if fd >= 0 {
          let rng: *i64 = sys_mmap(CP_CLONE_RANGE_WORDS * 8) as *i64
          rng[0] = inc_fd
          rng[1] = off
          rng[2] = len
          rng[3] = 0
          let rc: i64 = sys_ioctl(fd, CP_FICLONERANGE, rng as i64)
          sys_close(fd)
          // the FIRST refusal of a batch is announced with every input the kernel saw -- a bare rc names the
          // wrong subject (the fs) when the defect is the call (why[1] is the once-per-batch latch)
          if rc != 0 { if why[1] == 0 {
              why[1] = 1
              why[2] = inc_fd; why[3] = fd; why[4] = off; why[5] = len
              cp_eo("CP-CLONE-REFUSED rc=" as *u8); let nb: *u8 = sys_mmap(32); var nl: i64 = cp_itoa(rc, nb); sys_write(2, nb, nl)
              cp_eo(" inc_fd=" as *u8); nl = cp_itoa(inc_fd, nb); sys_write(2, nb, nl)
              cp_eo(" dst_fd=" as *u8); nl = cp_itoa(fd, nb); sys_write(2, nb, nl)
              cp_eo(" off=" as *u8); nl = cp_itoa(off, nb); sys_write(2, nb, nl)
              cp_eo(" len=" as *u8); nl = cp_itoa(len, nb); sys_write(2, nb, nl)
              cp_eo(" tmp=" as *u8); cp_eo(tpath); cp_eo(" (copy fallback follows; -18 EXDEV cross-device, -95 EOPNOTSUPP no reflink, -22 EINVAL alignment)\n" as *u8)
          } }
          if rc == 0 {
              let vl: *i64 = sys_mmap(16) as *i64
              let vb: *u8 = sys_read_file(tpath, vl)
              var ok: i64 = 0
              if (vb as i64) != 0 {
                  if vl[0] == len { let vh: *u8 = sys_mmap(CP_SHAHEX + 8); cp_sha_hex_of(vb, len, vh); ok = cp_hex_eq(vh, hex) }
                  sys_free_file(vb, vl[0])
              }
              if ok == 1 { if sys_renameat(tpath, cpath) >= 0 { cloned = 1 } }
          } else { why[0] = rc }
          if cloned == 0 { sys_unlinkat(tpath) }
      }
  }
  if cloned == 1 { cp_shas_append(id, idx, hex); return 1 }
  if cp_stage_write_x(id, idx, cpath, ((inc as i64) + off) as *u8, len, hex, 0) < 0 { return 0 - 1 }
  return 0
752}
753
754func v_chunk(id_s: *u8, idx_s: *u8, b64: *u8, decl: *u8) -> i64 {
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let id: i64 = cp_parse(id_s, pp)
  pp[0] = 0
  let idx: i64 = cp_parse(idx_s, pp)
  let dest: *u8 = sys_mmap(CP_PATHCAP)
  let sha: *u8 = sys_mmap(CP_SHAHEX + 8)
  let nums: *i64 = sys_mmap(64) as *i64
  if cp_read_meta(id, dest, nums, sha) == 0 { cp_eo("CP-REFUSED: unknown transfer id (never begun, committed, aborted, or reaped) -- run begin\n" as *u8); return CP_EXIT_USAGE }
  let total: i64 = nums[0]
  let craw: i64 = nums[1]
  let nch: i64 = nums[2]
  if idx < 0 { cp_eo("CP-REFUSED: index out of range\n" as *u8); return CP_EXIT_USAGE }
  if idx >= nch { cp_eo("CP-REFUSED: index out of range (nchunks bound)\n" as *u8); return CP_EXIT_USAGE }
  var expect: i64 = craw
  if idx == nch - 1 { expect = total - (nch - 1) * craw }
  let bn: i64 = cp_slen(b64)
  let ocap: i64 = (bn / 4) * 3 + 8
  let raw: *u8 = sys_mmap(ocap)
  let dn: i64 = b64_decode(b64, bn, raw)
  if dn <= 0 { cp_eo("CP-REFUSED: body is not decodable base64\n" as *u8); return CP_EXIT_USAGE }
  // DI9: a plan-addressed transfer stages variable-length chunks, each still within the wire chunk
  let cdcmode: i64 = (cp_cdc_count(id) > 0) as i64
  var sizeok: i64 = (dn == expect) as i64
  if cdcmode == 1 { expect = craw; sizeok = ((dn > 0) as i64) * ((dn <= craw) as i64) }
  if sizeok == 0 {
      cp_eo("CP-REFUSED: chunk size mismatch expected=" as *u8)
      let eb: *u8 = sys_mmap(32); let el: i64 = cp_itoa(expect, eb); sys_write(2, eb, el)
      cp_eo(" got=" as *u8)
      let gb: *u8 = sys_mmap(32); let gl: i64 = cp_itoa(dn, gb); sys_write(2, gb, gl)
      // DI10: the refusal NAMES the chunk, so a truncated final chunk is refused on arrival with its index
      cp_eo(" index=" as *u8)
      let ib: *u8 = sys_mmap(32); let il: i64 = cp_itoa(idx, ib); sys_write(2, ib, il)
      cp_eo(" -- refused ON ARRIVAL, nothing written to staging\n" as *u8)
      return CP_EXIT_USAGE
  }
  let hex: *u8 = sys_mmap(CP_SHAHEX + 8)
  cp_sha_hex_of(raw, dn, hex)
  // DI10: a declared digest is checked against what ARRIVED before any byte reaches staging
  let ce: i64 = cp_chunk_expect(decl, hex)
  if ce == 0 - 2 {
      cp_eo("CP-REFUSED-CHUNK-DIGEST-MALFORMED index=" as *u8)
      let mb: *u8 = sys_mmap(32); let ml: i64 = cp_itoa(idx, mb); sys_write(2, mb, ml)
      cp_eo(": the declared chunk digest must be sha256=<64 hex characters>; nothing written (a caller defect, not a bad chunk)\n" as *u8)
      return CP_EXIT_USAGE
  }
  if ce == 0 {
      cp_eo("CP-REFUSED-CHUNK-DIGEST index=" as *u8)
      let db: *u8 = sys_mmap(32); let dl: i64 = cp_itoa(idx, db); sys_write(2, db, dl)
      cp_eo(" declared=" as *u8); cp_eo(decl)
      cp_eo(" arrived=" as *u8); cp_eo(hex)
      cp_eo(" -- refused ON ARRIVAL, nothing written to staging: the chunk was corrupted or truncated in flight; re-send that index\n" as *u8)
      return CP_EXIT_SHA
  }
  let cpath: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_chunk(cpath, id, idx)
  let lp: *i64 = sys_mmap(16) as *i64
  let old: *u8 = sys_read_file(cpath, lp)
  if (old as i64) != 0 {
      let on: i64 = lp[0]
      var same: i64 = 0
      if on == dn {
          same = 1
          var i: i64 = 0
          while i < on { if old[i] != raw[i] { same = 0; i = on } else { i = i + 1 } }
      }
      sys_free_file(old, on)
      if same == 1 {
          cp_out("CP-CHUNK DUPLICATE-IDENTICAL id=" as *u8); cp_num(id)
          cp_out(" index=" as *u8); cp_num(idx)
          cp_out(" noop=1 chunk_sha256=" as *u8); cp_out(hex); cp_out("\n" as *u8)
          return 0
      }
      cp_eo("CP-REFUSED-CHUNK-CAS: index " as *u8)
      let xb: *u8 = sys_mmap(32); let xl: i64 = cp_itoa(idx, xb); sys_write(2, xb, xl)
      cp_eo(" already landed with DIFFERENT bytes -- a blind resend of changed content; abort and re-begin if the source changed\n" as *u8)
      return CP_EXIT_CAS
  }
  // DURABILITY CONTRACT (2026-09-06): a chunk post is NOT fsynced. The staged copy is re-hashed by commit against
  // its declared digest, so a torn or empty post-crash chunk is refused BY INDEX and the client re-sends it after
  // `status` -- the resumable-upload contract. The destination is fsynced ONCE at commit. MEASURED before this: the
  // per-post fsync cost 5-10 s per 48 KB chunk on the storming array and was the whole latency of every push.
  if cp_stage_write_x(id, idx, cpath, raw, dn, hex, 0) < 0 { cp_eo("CP-IO: cannot write chunk\n" as *u8); return CP_EXIT_IO }
  cp_out("CP-CHUNK OK id=" as *u8); cp_num(id)
  cp_out(" index=" as *u8); cp_num(idx)
  cp_out(" raw=" as *u8); cp_num(dn)
  cp_out(" chunk_sha256=" as *u8); cp_out(hex)
  cp_out(" durable=at-commit" as *u8)
  cp_out("\n" as *u8)
  return 0
845}
846
847// find recorded sha for idx in the sidecar; returns 1 and fills out, else 0. LAST occurrence wins.
848func cp_sidecar_sha(id: i64, idx: i64, out: *u8) -> i64 {
  let spath: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_shas(spath, id)
  let lp: *i64 = sys_mmap(16) as *i64
  let buf: *u8 = sys_read_file(spath, lp)
  if (buf as i64) == 0 { return 0 }
  let n: i64 = lp[0]
  var found: i64 = 0
  let pp: *i64 = sys_mmap(16) as *i64
  var i: i64 = 0
  while i < n {
      pp[0] = i
      let v: i64 = cp_parse(buf, pp)
      var j: i64 = pp[0] + 1
      if v == idx {
          var s: i64 = 0
          var ok: i64 = 1
          while s < CP_SHAHEX { if j + s >= n { ok = 0; s = CP_SHAHEX } else { out[s] = buf[j + s]; s = s + 1 } }
          if ok == 1 { out[CP_SHAHEX] = 0 as u8; found = 1 }
      }
      i = j
      while i < n { if buf[i] == (10 as u8) { break } i = i + 1 }
      i = i + 1
  }
  sys_free_file(buf, n)
  return found
874}
875
876// ---- DI7 THE RESUME OFFSET (2026-09-05): the IETF resumable-upload draft's Upload-Offset -- bytes stored CONTIGUOUSLY
877// from index 0. The first missing index bounds it. The index-based missing list stays the richer resume source for this
878// door; the offset is the interoperable one, so a client that knows only offsets can still resume.
879func cp_resume_offset(id: i64, nch: i64, craw: i64, total: i64) -> i64 {
  let cpath: *u8 = sys_mmap(CP_PATHCAP)
  let cdcmode: i64 = (cp_cdc_count(id) > 0) as i64
  var i: i64 = 0
  var acc: i64 = 0
  var go: i64 = 1
  while go == 1 { if i >= nch { go = 0 } else { cp_path_chunk(cpath, id, i); let sz: i64 = cp_file_size(cpath); if sz < 0 { go = 0 } else { acc = acc + sz; i = i + 1 } } }
  var off: i64 = i * craw
  // DI9: plan-addressed chunks have their own lengths, so the contiguous prefix is the SUM of what is staged
  if cdcmode == 1 { off = acc }
  if off > total { off = total }
  return off
891}
892// ---- DI6 VERIFIED STREAMING (2026-09-05): a stored chunk is re-hashed against the receipt it was accepted under
893// BEFORE its bytes join the assembly, so a corrupt staging file is NAMED at commit and never assembled. Returns 1 on
894// a match, 0 on a mismatch, -1 when no receipt was recorded for that index (the whole-file check still rules).
895func cp_stream_verify(id: i64, idx: i64, buf: *u8, n: i64) -> i64 {
  let shex: *u8 = sys_mmap(CP_SHAHEX + 8)
  if cp_sidecar_sha(id, idx, shex) == 0 { return 0 - 1 }
  let hex: *u8 = sys_mmap(CP_SHAHEX + 8)
  cp_sha_hex_of(buf, n, hex)
  return cp_streq(hex, shex)
901}
902
903func v_commit(id_s: *u8) -> i64 {
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let id: i64 = cp_parse(id_s, pp)
  let dest: *u8 = sys_mmap(CP_PATHCAP)
  let sha: *u8 = sys_mmap(CP_SHAHEX + 8)
  let nums: *i64 = sys_mmap(64) as *i64
  if cp_read_meta(id, dest, nums, sha) == 0 { cp_eo("CP-REFUSED: unknown transfer id\n" as *u8); return CP_EXIT_USAGE }
  // EC26: the expect token is re-checked HERE, before any presence pass or rename -- the file may have changed
  // between begin and commit, and a stale token must refuse the whole commit, never a prefix.
  let xpk: *u8 = sys_mmap(CP_SHAHEX + 16)
  if cp_read_meta_expect(id, xpk) > 0 {
      let curk: *u8 = sys_mmap(CP_SHAHEX + 16)
      cp_current_sha(dest, curk)
      if cp_streq(curk, xpk) == 0 {
          cp_eo("CP-REFUSED-CHANGED-UNDER-YOU: the destination changed after begin -- current sha256=" as *u8)
          cp_eo(curk); cp_eo(" expected=" as *u8); cp_eo(xpk); cp_eo(" (nothing written; staging kept; abort and begin again against the current file)\n" as *u8)
          return CP_EXIT_CAS
      }
  }
  let total: i64 = nums[0]
  let craw: i64 = nums[1]
  let nch: i64 = nums[2]
  // presence pass: name EVERY missing index before touching anything
  let cpath: *u8 = sys_mmap(CP_PATHCAP)
  var missing: i64 = 0
  var i: i64 = 0
  while i < nch {
      cp_path_chunk(cpath, id, i)
      if cp_exists(cpath) == 0 {
          if missing == 0 { cp_eo("CP-REFUSED-MISSING-CHUNKS id missing indices:" as *u8) }
          cp_eo(" " as *u8)
          let xb: *u8 = sys_mmap(32); let xl: i64 = cp_itoa(i, xb); sys_write(2, xb, xl)
          missing = missing + 1
      }
      i = i + 1
  }
  if missing > 0 {
      cp_eo(" -- resume with status then re-send those chunks; nothing was assembled\n" as *u8)
      return CP_EXIT_MISSING
  }
  // assemble beside the destination (same device -> rename stays atomic)
  let asmp: *u8 = sys_mmap(CP_PATHCAP)
  var ap: i64 = cp_append(asmp, 0, dest)
  ap = cp_append(asmp, ap, ".cptmp" as *u8)
  let fd: i64 = sys_openat_wr(asmp, MODE_0644)
  if fd < 0 { cp_eo("CP-REFUSED-DEST-PARENT: cannot open assembly file beside destination (parent dir missing) -- create it with nx_mkdirp first\n" as *u8); return CP_EXIT_IO }
  var wrote: i64 = 0
  var received: i64 = 0
  let lp: *i64 = sys_mmap(16) as *i64
  i = 0
  var ioerr: i64 = 0
  var corrupt: i64 = 0 - 1
  var verified: i64 = 0
  // DI17 commit-clone: a run of consecutive reused chunks whose incumbent offsets EQUAL their new offsets is
  // offset-preserving, and its block-aligned interior is reflinked from the incumbent; the run's two edges and
  // every other chunk are copied. The whole-file re-read below judges all of it, so a clone that produced wrong
  // bytes refuses the commit exactly as a corrupt chunk would. Chunks sourced from the incumbent were re-hashed
  // against their declared digests when the reuse row was accepted (cp_stage_clone / the copy fallback).
  let rl_off: *i64 = sys_mmap(nch * 8 + 8) as *i64
  let rl_len: *i64 = sys_mmap(nch * 8 + 8) as *i64
  let rl_rows: i64 = cp_rl_load(id, nch, rl_off, rl_len)
  var inc_fd: i64 = 0 - 1
  var blk: i64 = 0
  if rl_rows > 0 { inc_fd = sys_openat_rd(dest); if inc_fd >= 0 { blk = cp_blksize_of(dest) } }
  let win: *i64 = sys_mmap(16) as *i64
  let cwhy: *i64 = sys_mmap(64) as *i64
  var clone_runs: i64 = 0
  var cloned_bytes: i64 = 0
  var inc_copied: i64 = 0
  var from_inc: i64 = 0
  var clone_rc: i64 = 0
  var ebuf_cap: i64 = craw
  if ebuf_cap < blk { ebuf_cap = blk }
  let ebuf: *u8 = sys_mmap(ebuf_cap + 8)
  while i < nch {
      // the longest offset-preserving run of reused chunks starting at chunk i, from the ledger's own lengths
      var j: i64 = i
      var cur: i64 = wrote
      var runok: i64 = 1
      while runok == 1 { if j >= nch { runok = 0 } else { if rl_off[j] == cur { if rl_len[j] > 0 { cur = cur + rl_len[j]; j = j + 1 } else { runok = 0 } } else { runok = 0 } } }
      var take: i64 = 0
      if j > i { if inc_fd >= 0 { if blk > 0 { if cp_clone_window(wrote, cur, blk, win) == 1 { take = 1 } } } }
      if take == 1 {
          let rs: i64 = wrote
          let re: i64 = cur
          let ws: i64 = win[0]
          let we: i64 = win[1]
          var okr: i64 = cp_copy_range(inc_fd, fd, rs, ws - rs, ebuf, ebuf_cap)
          if okr == 1 {
              let rng: *i64 = sys_mmap(CP_CLONE_RANGE_WORDS * 8) as *i64
              rng[0] = inc_fd
              rng[1] = ws
              rng[2] = we - ws
              rng[3] = ws
              let rc: i64 = sys_ioctl(fd, CP_FICLONERANGE, rng as i64)
              if rc == 0 {
                  clone_runs = clone_runs + 1
                  cloned_bytes = cloned_bytes + (we - ws)
                  if sys_lseek(fd, we, CP_SEEK_SET) != we { okr = 0 }
                  if okr == 1 { okr = cp_copy_range(inc_fd, fd, we, re - we, ebuf, ebuf_cap) }
                  inc_copied = inc_copied + (ws - rs) + (re - we)
              } else {
                  clone_rc = rc
                  if cwhy[1] == 0 { cwhy[1] = 1; cwhy[2] = inc_fd; cwhy[3] = fd; cwhy[4] = ws; cwhy[5] = we - ws }
                  okr = cp_copy_range(inc_fd, fd, ws, re - ws, ebuf, ebuf_cap)
                  inc_copied = inc_copied + (re - rs)
              }
          }
          if okr == 0 { ioerr = 1; i = nch } else {
              wrote = re
              received = received + (j - i)
              from_inc = from_inc + (j - i)
              i = j
          }
      } else {
          cp_path_chunk(cpath, id, i)
          let cb: *u8 = sys_read_file(cpath, lp)
          if (cb as i64) == 0 { ioerr = 1; i = nch } else {
              let cn: i64 = lp[0]
              // DI6 verified streaming: the chunk is checked against its receipt BEFORE its bytes join the assembly
              let sv: i64 = cp_stream_verify(id, i, cb, cn)
              if sv == 0 { corrupt = i; ioerr = 2; sys_free_file(cb, cn); i = nch } else {
                  if sv == 1 { verified = verified + 1 }
                  var w: i64 = 0
                  while w < cn {
                      let r: i64 = sys_write(fd, ((cb as i64) + w) as *u8, cn - w)
                      if r <= 0 { ioerr = 1; w = cn; i = nch } else { w = w + r }
                  }
                  wrote = wrote + cn
                  received = received + 1
                  sys_free_file(cb, cn)
                  i = i + 1
              }
          }
      }
  }
  if inc_fd >= 0 { sys_close(inc_fd) }
  sys_fsync(fd)
  sys_close(fd)
  if ioerr == 2 {
      sys_unlinkat(asmp)
      cp_eo("CP-REFUSED-CHUNK-CORRUPT index=" as *u8)
      let kb: *u8 = sys_mmap(32); let kl: i64 = cp_itoa(corrupt, kb); sys_write(2, kb, kl)
      cp_eo(" -- the stored chunk no longer hashes to the receipt it was accepted under (staging corruption); nothing was assembled, staging kept: re-send that index\n" as *u8)
      return CP_EXIT_SHA
  }
  if ioerr == 1 { sys_unlinkat(asmp); cp_eo("CP-IO: assembly failed mid-write; staging kept, assembly removed\n" as *u8); return CP_EXIT_IO }
  // partition: received == declared AND bytes == total, printed; stream_verified = chunks checked against a receipt before assembly
  cp_out("CP-ASSEMBLE received=" as *u8); cp_num(received)
  cp_out("/" as *u8); cp_num(nch)
  cp_out(" bytes=" as *u8); cp_num(wrote)
  cp_out("/" as *u8); cp_num(total)
  cp_out(" stream_verified=" as *u8); cp_num(verified)
  // DI17: how the assembled bytes were sourced -- cloned (reflinked, wrote nothing) + incumbent_copied (run edges,
  // or a whole run whose clone the kernel refused) + chunk_copied (staged chunk files) partition the total
  cp_out(" from_incumbent=" as *u8); cp_num(from_inc)
  cp_out(" clone_runs=" as *u8); cp_num(clone_runs)
  cp_out(" cloned_bytes=" as *u8); cp_num(cloned_bytes)
  cp_out(" incumbent_copied_bytes=" as *u8); cp_num(inc_copied)
  cp_out(" chunk_copied_bytes=" as *u8); cp_num(wrote - cloned_bytes - inc_copied)
  cp_out(" clone_rc=" as *u8); cp_num(clone_rc)
  cp_out(" blk=" as *u8); cp_num(blk)
  if cwhy[1] == 1 { cp_out(" clone_first_refusal=inc_fd:" as *u8); cp_num(cwhy[2]); cp_out(",dst_fd:" as *u8); cp_num(cwhy[3]); cp_out(",off:" as *u8); cp_num(cwhy[4]); cp_out(",len:" as *u8); cp_num(cwhy[5]) }
  cp_out("\n" as *u8)
  if wrote != total { sys_unlinkat(asmp); cp_eo("CP-REFUSED: assembled bytes do not sum to declared total\n" as *u8); return CP_EXIT_SHA }
  // independent whole-file verify: RE-READ the assembled artifact and hash what is on disk
  let ab: *u8 = sys_read_file(asmp, lp)
  if (ab as i64) == 0 { cp_eo("CP-IO: cannot re-read assembly\n" as *u8); return CP_EXIT_IO }
  let an: i64 = lp[0]
  let hex: *u8 = sys_mmap(CP_SHAHEX + 8)
  cp_sha_hex_of(ab, an, hex)
  sys_free_file(ab, an)
  if cp_streq(hex, sha) == 0 {
      cp_eo("CP-REFUSED-SHA-MISMATCH declared=" as *u8); sys_write(2, sha, CP_SHAHEX)
      cp_eo(" assembled=" as *u8); sys_write(2, hex, CP_SHAHEX)
      cp_eo(" -- localizing against per-chunk receipts:" as *u8)
      let rhex: *u8 = sys_mmap(CP_SHAHEX + 8)
      let shex: *u8 = sys_mmap(CP_SHAHEX + 8)
      var bad: i64 = 0
      i = 0
      while i < nch {
          cp_path_chunk(cpath, id, i)
          let cb2: *u8 = sys_read_file(cpath, lp)
          if (cb2 as i64) != 0 {
              cp_sha_hex_of(cb2, lp[0], rhex)
              sys_free_file(cb2, lp[0])
              if cp_sidecar_sha(id, i, shex) == 1 {
                  if cp_streq(rhex, shex) == 0 {
                      cp_eo(" disk-corrupt-index=" as *u8)
                      let xb: *u8 = sys_mmap(32); let xl: i64 = cp_itoa(i, xb); sys_write(2, xb, xl)
                      bad = bad + 1
                  }
              }
          }
          i = i + 1
      }
      if bad == 0 { cp_eo(" every chunk matches its receipt -- the DECLARED sha or the sent content is wrong at the source" as *u8) }
      cp_eo("; staging kept for repair\n" as *u8)
      sys_unlinkat(asmp)
      return CP_EXIT_SHA
  }
  if sys_renameat(asmp, dest) < 0 { cp_eo("CP-IO: rename to destination failed\n" as *u8); return CP_EXIT_IO }
  cp_unlink_transfer(id, nch)
  cp_out("CP-COMMIT OK id=" as *u8); cp_num(id)
  cp_out(" dest=" as *u8); cp_out(dest)
  cp_out(" bytes=" as *u8); cp_num(total)
  cp_out(" chunks=" as *u8); cp_num(nch)
  cp_out(" sha256=" as *u8); cp_out(hex)
  cp_out(" (verified by independent re-read of the assembled artifact)\n" as *u8)
  return 0
1114}
1115
1116func v_status(id_s: *u8) -> i64 {
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let id: i64 = cp_parse(id_s, pp)
  let dest: *u8 = sys_mmap(CP_PATHCAP)
  let sha: *u8 = sys_mmap(CP_SHAHEX + 8)
  let nums: *i64 = sys_mmap(64) as *i64
  if cp_read_meta(id, dest, nums, sha) == 0 { cp_eo("CP-STATUS: unknown transfer id (never begun, committed, aborted, or reaped)\n" as *u8); return CP_EXIT_USAGE }
  let cpath: *u8 = sys_mmap(CP_PATHCAP)
  var have: i64 = 0
  cp_out("CP-STATUS id=" as *u8); cp_num(id)
  cp_out(" dest=" as *u8); cp_out(dest)
  cp_out(" total=" as *u8); cp_num(nums[0])
  // chunk_raw travels in status ON PURPOSE: a resuming client cannot derive it from total/nchunks
  // (ceil(total/nchunks) != chunk_raw whenever the last chunk is small), and a resume contract
  // that depends on the client remembering a number is a crash away from useless.
  cp_out(" chunk_raw=" as *u8); cp_num(nums[1])
  cp_out(" nchunks=" as *u8); cp_num(nums[2])
  if cp_cdc_count(id) > 0 { cp_out(" mode=cdc" as *u8) }
  cp_out(" missing:" as *u8)
  var i: i64 = 0
  var anymiss: i64 = 0
  while i < nums[2] {
      cp_path_chunk(cpath, id, i)
      if cp_exists(cpath) == 1 { have = have + 1 } else {
          cp_out(" " as *u8); cp_num(i)
          anymiss = anymiss + 1
      }
      i = i + 1
  }
  if anymiss == 0 { cp_out(" none" as *u8) }
  cp_out(" received=" as *u8); cp_num(have)
  cp_out("/" as *u8); cp_num(nums[2])
  // DI7: the Upload-Offset shape -- bytes stored contiguously from 0 -- beside the index-based missing list
  let roff: i64 = cp_resume_offset(id, nums[2], nums[1], nums[0])
  cp_out(" resume_offset=" as *u8); cp_num(roff)
  // DI11: the IETF draft's name for the same number, so an offset-driven client reads it under its own vocabulary
  cp_out(" upload_offset=" as *u8); cp_num(roff)
  cp_out("\n" as *u8)
  return 0
1156}
1157
1158func v_abort(id_s: *u8) -> i64 {
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let id: i64 = cp_parse(id_s, pp)
  let dest: *u8 = sys_mmap(CP_PATHCAP)
  let sha: *u8 = sys_mmap(CP_SHAHEX + 8)
  let nums: *i64 = sys_mmap(64) as *i64
  if cp_read_meta(id, dest, nums, sha) == 0 { cp_eo("CP-ABORT: unknown transfer id (already gone)\n" as *u8); return CP_EXIT_USAGE }
  cp_unlink_transfer(id, nums[2])
  cp_out("CP-ABORT OK id=" as *u8); cp_num(id)
  cp_out(" staging removed (chunks, sidecar, meta)\n" as *u8)
  return 0
1170}
1171
1172// The reap capability kept, moved off every transfer's path: deliberate, announced, and the ONLY
1173// verb that may touch a transfer other than its own argument's.
1174func v_reap() -> i64 {
  let now: i64 = sys_now_realtime_sec()
  cp_out("CP-REAP-RUN now=" as *u8); cp_num(now)
  cp_out(" (removes ONLY rows past their own derived bound; abstains on an untrustworthy age)\n" as *u8)
  cp_reap(now)
  cp_out("CP-REAP-DONE\n" as *u8)
  return 0
1181}
1182
1183// ---- DI5 VERB: the content-defined chunk plan for a readable source, printed as DATA a client can diff against a
1184// previous generation's plan (chunks whose sha256 the receiver already holds need not be sent again). Sources are read
1185// under the same prefixes nx_content_get serves; no '..'.
1186func cp_src_ok(p: *u8) -> i64 {
  if cp_dotdot(p) == 1 { return 0 }
  if cp_starts(p, "buildroot/runtime/" as *u8) == 1 { return 1 }
  if cp_starts(p, "buildroot/knowledge/" as *u8) == 1 { return 1 }
  if cp_starts(p, "runtime/" as *u8) == 1 { return 1 }
  if cp_starts(p, "knowledge/" as *u8) == 1 { return 1 }
  if cp_starts(p, "/tmp/" as *u8) == 1 { return 1 }
  return 0
1194}
1195// ---- DI11 BYTE-OFFSET APPEND (2026-09-06): the IETF resumable-upload draft's shape -- a client that knows only the
1196// server's Upload-Offset appends bytes AT that offset. This door's offset is the contiguous staged prefix (status
1197// prints it as resume_offset and upload_offset), so an append is accepted iff it starts exactly there; a stale or
1198// future offset is refused NAMING the current offset, never silently re-based. The bytes land in the chunk slot the
1199// offset addresses (fixed transfers: offset/chunk_raw; a plan-addressed transfer: the next index), so `append` and
1200// `chunk` are two spellings of one staging write and the commit verify is unchanged.
1201func cp_append_at(id: i64, off: i64, raw: *u8, dn: i64, decl: *u8) -> i64 {
  let dest: *u8 = sys_mmap(CP_PATHCAP)
  let sha: *u8 = sys_mmap(CP_SHAHEX + 8)
  let nums: *i64 = sys_mmap(64) as *i64
  if cp_read_meta(id, dest, nums, sha) == 0 { cp_eo("CP-REFUSED: unknown transfer id\n" as *u8); return CP_EXIT_USAGE }
  let total: i64 = nums[0]
  let craw: i64 = nums[1]
  let nch: i64 = nums[2]
  let cur: i64 = cp_resume_offset(id, nch, craw, total)
  if off != cur {
      cp_eo("CP-REFUSED-OFFSET: append must start at the current upload offset -- current=" as *u8)
      let cb: *u8 = sys_mmap(32); let cl: i64 = cp_itoa(cur, cb); sys_write(2, cb, cl)
      cp_eo(" requested=" as *u8)
      let rb: *u8 = sys_mmap(32); let rl: i64 = cp_itoa(off, rb); sys_write(2, rb, rl)
      cp_eo(" (nothing written; query status for upload_offset and append from there)\n" as *u8)
      return CP_EXIT_CAS
  }
  if cur >= total { cp_eo("CP-REFUSED-OFFSET: the upload is already complete at this offset; commit it\n" as *u8); return CP_EXIT_CAS }
  if dn <= 0 { cp_eo("CP-REFUSED: append body is empty\n" as *u8); return CP_EXIT_USAGE }
  if dn > craw { cp_eo("CP-REFUSED: append body exceeds chunk_raw (one call carries at most one chunk)\n" as *u8); return CP_EXIT_USAGE }
  if off + dn > total { cp_eo("CP-REFUSED: append would exceed the declared total\n" as *u8); return CP_EXIT_USAGE }
  // the slot this offset addresses
  let cdcmode: i64 = (cp_cdc_count(id) > 0) as i64
  var idx: i64 = off / craw
  if cdcmode == 1 {
      // plan-addressed: the next unstaged index
      let cp2: *u8 = sys_mmap(CP_PATHCAP)
      var k: i64 = 0
      var go: i64 = 1
      while go == 1 { if k >= nch { go = 0 } else { cp_path_chunk(cp2, id, k); if cp_exists(cp2) == 0 { go = 0 } else { k = k + 1 } } }
      idx = k
  } else {
      if off - idx * craw != 0 { cp_eo("CP-REFUSED-OFFSET: on a fixed-size transfer the current offset is always chunk-aligned; this is not (staging is inconsistent)\n" as *u8); return CP_EXIT_IO }
      var expect: i64 = craw
      if idx == nch - 1 { expect = total - (nch - 1) * craw }
      if dn != expect { cp_eo("CP-REFUSED: an append on a fixed-size transfer carries exactly one chunk (the last may be shorter); expected=" as *u8); let eb: *u8 = sys_mmap(32); let el: i64 = cp_itoa(expect, eb); sys_write(2, eb, el); cp_eo("\n" as *u8); return CP_EXIT_USAGE }
  }
  if idx >= nch { cp_eo("CP-REFUSED: no slot left for this append\n" as *u8); return CP_EXIT_USAGE }
  let hex: *u8 = sys_mmap(CP_SHAHEX + 8)
  cp_sha_hex_of(raw, dn, hex)
  let ce: i64 = cp_chunk_expect(decl, hex)
  if ce == 0 - 2 { cp_eo("CP-REFUSED-CHUNK-DIGEST-MALFORMED: the declared digest must be sha256=<64 hex characters>\n" as *u8); return CP_EXIT_USAGE }
  if ce == 0 { cp_eo("CP-REFUSED-CHUNK-DIGEST: the bytes that arrived do not hash to the declared digest -- refused ON ARRIVAL, nothing written\n" as *u8); return CP_EXIT_SHA }
  let cpath: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_chunk(cpath, id, idx)
  if cp_stage_write_x(id, idx, cpath, raw, dn, hex, 0) < 0 { cp_eo("CP-IO: cannot write appended chunk\n" as *u8); return CP_EXIT_IO }
  cp_out("CP-APPEND OK id=" as *u8); cp_num(id)
  cp_out(" offset=" as *u8); cp_num(off)
  cp_out(" bytes=" as *u8); cp_num(dn)
  cp_out(" slot=" as *u8); cp_num(idx)
  cp_out(" upload_offset=" as *u8); cp_num(off + dn)
  cp_out(" chunk_sha256=" as *u8); cp_out(hex)
  cp_out(" durable=at-commit" as *u8)
  cp_out("\n" as *u8)
  return 0
1256}
1257func v_append(id_s: *u8, off_s: *u8, b64: *u8, decl: *u8) -> i64 {
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let id: i64 = cp_parse(id_s, pp)
  pp[0] = 0
  let off: i64 = cp_parse(off_s, pp)
  if off < 0 { cp_eo("CP-REFUSED: offset must be a non-negative integer\n" as *u8); return CP_EXIT_USAGE }
  let bn: i64 = cp_slen(b64)
  let raw: *u8 = sys_mmap((bn / 4) * 3 + 8)
  let dn: i64 = b64_decode(b64, bn, raw)
  if dn <= 0 { cp_eo("CP-REFUSED: body is not decodable base64\n" as *u8); return CP_EXIT_USAGE }
  return cp_append_at(id, off, raw, dn, decl)
1269}
1270
1271// ---- DI9 VERBS (2026-09-06): dedupe on the wire ------------------------------------------------------------------
1272// plan <id> <count>: switch an open transfer to plan-addressed chunks (count = the client's content-defined plan length,
1273// cut by the parameters the begin receipt published). Refused once chunk 0 is staged: a transfer cannot change shape
1274// under its own bytes.
1275func v_plan(id_s: *u8, count_s: *u8) -> i64 {
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let id: i64 = cp_parse(id_s, pp)
  pp[0] = 0
  let count: i64 = cp_parse(count_s, pp)
  let dest: *u8 = sys_mmap(CP_PATHCAP)
  let sha: *u8 = sys_mmap(CP_SHAHEX + 8)
  let nums: *i64 = sys_mmap(64) as *i64
  if cp_read_meta(id, dest, nums, sha) == 0 { cp_eo("CP-REFUSED: unknown transfer id\n" as *u8); return CP_EXIT_USAGE }
  if count <= 0 { cp_eo("CP-REFUSED: plan count must be a positive integer\n" as *u8); return CP_EXIT_USAGE }
  let cpath: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_chunk(cpath, id, 0)
  if cp_exists(cpath) == 1 { cp_eo("CP-REFUSED-PLAN-LATE: chunk 0 is already staged; a transfer cannot change shape under its own bytes -- abort and begin again\n" as *u8); return CP_EXIT_CAS }
  let mb: *u8 = sys_mmap(32)
  var mp: i64 = cp_append_num(mb, 0, count)
  mb[mp] = 10 as u8
  mp = mp + 1
  let cpp: *u8 = sys_mmap(CP_PATHCAP)
  cp_path_cdc(cpp, id)
  let tmpp: *u8 = sys_mmap(CP_PATHCAP)
  var tp: i64 = cp_append(tmpp, 0, CP_DIR)
  tp = cp_append(tmpp, tp, "/" as *u8)
  tp = cp_append_num(tmpp, tp, id)
  tp = cp_append(tmpp, tp, ".ctmp" as *u8)
  if cp_write_atomic(tmpp, cpp, mb, mp) < 0 { cp_eo("CP-IO: cannot write plan marker\n" as *u8); return CP_EXIT_IO }
  cp_out("CP-PLAN OK id=" as *u8); cp_num(id)
  cp_out(" mode=cdc nchunks=" as *u8); cp_num(count)
  cp_out(" (chunks are plan-addressed: any length up to chunk_raw, each verified by its declared digest on arrival)\n" as *u8)
  return 0
1305}
1306// have <id> [from=<k>]: the content-defined digests of the INCUMBENT at the transfer's destination, so a client sends
1307// only what the receiver lacks. Paginated within the wire body cap (the reply crosses the same wire the requests do):
1308// next=<k> says where to continue, next=-1 says the list is complete. A row's width is DERIVED from the widths of
1309// what it prints, never counted by hand.
1310func v_have(id_s: *u8, from_arg: *u8) -> i64 {
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let id: i64 = cp_parse(id_s, pp)
  var from: i64 = 0
  if (from_arg as i64) != 0 { if cp_starts(from_arg, "from=" as *u8) == 1 { pp[0] = cp_slen("from=" as *u8); from = cp_parse(from_arg, pp) } }
  if from < 0 { from = 0 }
  let dest: *u8 = sys_mmap(CP_PATHCAP)
  let sha: *u8 = sys_mmap(CP_SHAHEX + 8)
  let nums: *i64 = sys_mmap(64) as *i64
  if cp_read_meta(id, dest, nums, sha) == 0 { cp_eo("CP-REFUSED: unknown transfer id\n" as *u8); return CP_EXIT_USAGE }
  let lp: *i64 = sys_mmap(16) as *i64
  let buf: *u8 = sys_read_file(dest, lp)
  if (buf as i64) == 0 { cp_out("CP-HAVE id=" as *u8); cp_num(id); cp_out(" incumbent=absent incumbent_bytes=0 chunks=0 from=0 next=-1\n" as *u8); return 0 }
  let n: i64 = lp[0]
  let mx: i64 = cp_chunk_raw()
  let mn: i64 = mx / CP_CDC_MIN_DIV
  let cap: i64 = n / mn + 2
  let offs: *i64 = sys_mmap(cap * 8) as *i64
  let count: i64 = cp_cdc_gear(buf, n, offs, cap)
  if count < 0 { cp_eo("CP-IO: the incumbent could not be planned\n" as *u8); sys_free_file(buf, n); return CP_EXIT_IO }
  let rowmax: i64 = 1 + CP_I64_DIGITS + cp_slen(" off=" as *u8) + CP_I64_DIGITS + cp_slen(" len=" as *u8) + CP_I64_DIGITS + cp_slen(" sha256=" as *u8) + CP_SHAHEX + 1
  let per_page: i64 = CP_WIRE_BODY_CAP / rowmax
  var next: i64 = 0 - 1
  if from < count { if count - from > per_page { next = from + per_page } }
  cp_out("CP-HAVE id=" as *u8); cp_num(id)
  cp_out(" incumbent_bytes=" as *u8); cp_num(n)
  cp_out(" chunks=" as *u8); cp_num(count)
  cp_out(" from=" as *u8); cp_num(from)
  cp_out(" next=" as *u8); cp_num(next)
  cp_out("\n" as *u8)
  let hex: *u8 = sys_mmap(CP_SHAHEX + 8)
  var k: i64 = from
  var emitted: i64 = 0
  while k < count {
      if emitted >= per_page { k = count } else {
          let a: i64 = offs[k]
          let b: i64 = offs[k + 1]
          cp_sha_hex_of(((buf as i64) + a) as *u8, b - a, hex)
          cp_out("h" as *u8); cp_num(k); cp_out(" off=" as *u8); cp_num(a); cp_out(" len=" as *u8); cp_num(b - a); cp_out(" sha256=" as *u8); cp_out(hex); cp_out("\n" as *u8)
          emitted = emitted + 1
          k = k + 1
      }
  }
  sys_free_file(buf, n)
  return 0
1356}
1357// reuse <id> <b64 rows>: rows `k off len sha256hex` (newline-separated, base64 on the wire). Each row stages plan
1358// chunk k from the INCUMBENT's bytes [off, off+len) after re-hashing them against the declared digest, so a changed
1359// incumbent or a stale have-list can never be spliced in. A batch carries as many rows as one wire call holds; the
1360// first refused row stops the batch and the client sends that chunk's bytes instead.
1361func v_reuse(id_s: *u8, b64: *u8) -> i64 {
  let pp: *i64 = sys_mmap(16) as *i64
  pp[0] = 0
  let id: i64 = cp_parse(id_s, pp)
  let dest: *u8 = sys_mmap(CP_PATHCAP)
  let sha: *u8 = sys_mmap(CP_SHAHEX + 8)
  let nums: *i64 = sys_mmap(64) as *i64
  if cp_read_meta(id, dest, nums, sha) == 0 { cp_eo("CP-REFUSED: unknown transfer id\n" as *u8); return CP_EXIT_USAGE }
  if cp_cdc_count(id) <= 0 { cp_eo("CP-REFUSED-REUSE-MODE: reuse needs a plan-addressed transfer (call plan first)\n" as *u8); return CP_EXIT_USAGE }
  let craw: i64 = nums[1]
  let nch: i64 = nums[2]
  let bn: i64 = cp_slen(b64)
  let rows: *u8 = sys_mmap((bn / 4) * 3 + 8)
  let rn: i64 = b64_decode(b64, bn, rows)
  if rn <= 0 { cp_eo("CP-REFUSED: reuse rows are not decodable base64\n" as *u8); return CP_EXIT_USAGE }
  let lp: *i64 = sys_mmap(16) as *i64
  let inc: *u8 = sys_read_file(dest, lp)
  if (inc as i64) == 0 { cp_eo("CP-REFUSED-REUSE-ABSENT: no incumbent at the destination to reuse from\n" as *u8); return CP_EXIT_MISSING }
  let incn: i64 = lp[0]
  let hex: *u8 = sys_mmap(CP_SHAHEX + 8)
  let cpath: *u8 = sys_mmap(CP_PATHCAP)
  let lp2: *i64 = sys_mmap(16) as *i64
  // DI14: the incumbent is also opened once as a clone SOURCE; -1 (unopenable) only means every row copies
  let inc_fd: i64 = sys_openat_rd(dest)
  let t_batch0: i64 = sys_now_ms()
  let cwhy: *i64 = sys_mmap(64) as *i64   // [0] last clone rc, [1] announce latch, [2..5] first refusal's inc_fd/dst_fd/off/len
  var cloned: i64 = 0
  var copied: i64 = 0
  var clone_rc: i64 = 0
  var i: i64 = 0
  var staged: i64 = 0
  var noop: i64 = 0
  var refused: i64 = 0
  var nrows: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if i >= rn { go = 0 } else {
          pp[0] = i
          let k: i64 = cp_parse(rows, pp)
          pp[0] = pp[0] + 1
          let off: i64 = cp_parse(rows, pp)
          pp[0] = pp[0] + 1
          let len: i64 = cp_parse(rows, pp)
          pp[0] = pp[0] + 1
          let hs: i64 = pp[0]
          var he: i64 = hs
          while he < rn { if rows[he] == (10 as u8) { break } he = he + 1 }
          nrows = nrows + 1
          var bad: i64 = 0
          if k < 0 { bad = 1 }
          if k >= nch { bad = 1 }
          if off < 0 { bad = 1 }
          if len <= 0 { bad = 1 }
          if len > craw { bad = 1 }
          if off + len > incn { bad = 1 }
          if he - hs != CP_SHAHEX { bad = 1 }
          if bad == 1 {
              cp_eo("CP-REFUSED-REUSE-ROW index=" as *u8); let kb: *u8 = sys_mmap(32); let kl: i64 = cp_itoa(k, kb); sys_write(2, kb, kl)
              cp_eo(": out of range or malformed (index, offset, length or digest); batch stopped, nothing further staged\n" as *u8)
              refused = refused + 1
              go = 0
          } else {
              cp_sha_hex_of(((inc as i64) + off) as *u8, len, hex)
              var same: i64 = 1
              var t: i64 = 0
              while t < CP_SHAHEX { if hex[t] != rows[hs + t] { same = 0; t = CP_SHAHEX } else { t = t + 1 } }
              if same == 0 {
                  cp_eo("CP-REFUSED-REUSE-DIGEST index=" as *u8); let kb2: *u8 = sys_mmap(32); let kl2: i64 = cp_itoa(k, kb2); sys_write(2, kb2, kl2)
                  cp_eo(" -- the incumbent's bytes at that offset do not hash to the declared digest (the incumbent changed or the have-list is stale); batch stopped, send that chunk's bytes\n" as *u8)
                  refused = refused + 1
                  go = 0
              } else {
                  cp_path_chunk(cpath, id, k)
                  let old: *u8 = sys_read_file(cpath, lp2)
                  var had_old: i64 = 0
                  var dup: i64 = 0
                  if (old as i64) != 0 {
                      had_old = 1
                      if lp2[0] == len { dup = 1; var q: i64 = 0; while q < len { if old[q] != inc[off + q] { dup = 0; q = len } else { q = q + 1 } } }
                      sys_free_file(old, lp2[0])
                  }
                  if had_old == 1 {
                      if dup == 1 { noop = noop + 1; cp_rl_append(id, k, off, len) } else {
                          cp_eo("CP-REFUSED-CHUNK-CAS: index " as *u8); let kb3: *u8 = sys_mmap(32); let kl3: i64 = cp_itoa(k, kb3); sys_write(2, kb3, kl3)
                          cp_eo(" already landed with DIFFERENT bytes -- batch stopped; abort and re-begin if the source changed\n" as *u8)
                          refused = refused + 1
                          go = 0
                      }
                  } else {
                      let how: i64 = cp_stage_clone(id, k, cpath, inc_fd, inc, off, len, hex, cwhy)
                      if how < 0 { cp_eo("CP-IO: cannot stage reused chunk\n" as *u8); sys_free_file(inc, incn); if inc_fd >= 0 { sys_close(inc_fd) } return CP_EXIT_IO }
                      if how == 1 { cloned = cloned + 1 } else { copied = copied + 1; if cwhy[0] != 0 { clone_rc = cwhy[0] } }
                      staged = staged + 1
                      cp_rl_append(id, k, off, len)
                  }
              }
          }
          i = he + 1
      }
  }
  sys_free_file(inc, incn)
  if inc_fd >= 0 { sys_close(inc_fd) }
  cp_out("CP-REUSE-BATCH id=" as *u8); cp_num(id)
  cp_out(" rows=" as *u8); cp_num(nrows)
  cp_out(" staged=" as *u8); cp_num(staged)
  cp_out(" noop=" as *u8); cp_num(noop)
  cp_out(" refused=" as *u8); cp_num(refused)
  // DI14: how the staged rows landed -- cloned shares the incumbent's extents and wrote nothing; copied is the
  // fallback with the kernel's LAST refusal rc named (EXDEV cross-device, EOPNOTSUPP no reflink, EINVAL alignment)
  cp_out(" cloned=" as *u8); cp_num(cloned)
  cp_out(" copied=" as *u8); cp_num(copied)
  cp_out(" clone_rc=" as *u8); cp_num(clone_rc)
  if cwhy[1] == 1 { cp_out(" clone_first_refusal=inc_fd:" as *u8); cp_num(cwhy[2]); cp_out(",dst_fd:" as *u8); cp_num(cwhy[3]); cp_out(",off:" as *u8); cp_num(cwhy[4]); cp_out(",len:" as *u8); cp_num(cwhy[5]) }
  // the batch's durability point: ONE directory fsync makes every rename above durable (per-row fsync was the cost)
  let t_rows: i64 = sys_now_ms() - t_batch0
  let ds_rc: i64 = cp_dir_sync()
  let t_sync: i64 = sys_now_ms() - t_batch0 - t_rows
  cp_out(" ms_rows=" as *u8); cp_num(t_rows); cp_out(" ms_dirsync=" as *u8); cp_num(t_sync); cp_out(" dirsync_rc=" as *u8); cp_num(ds_rc)
  cp_out(" (partition: staged + noop + refused = rows and cloned + copied = staged; a refused row ends the batch)\n" as *u8)
  if refused > 0 { return CP_EXIT_SHA }
  return 0
1482}
1483
1484func v_cdcplan(src: *u8) -> i64 {
  if cp_src_ok(src) == 0 { cp_eo("CP-REFUSED-SRC: cdcplan reads only buildroot/runtime/ buildroot/knowledge/ runtime/ knowledge/ /tmp/ and never a path with '..'\n" as *u8); return CP_EXIT_DEST }
  let lp: *i64 = sys_mmap(16) as *i64
  let buf: *u8 = sys_read_file(src, lp)
  if (buf as i64) == 0 { cp_eo("CP-IO: cannot read cdcplan source\n" as *u8); return CP_EXIT_IO }
  let n: i64 = lp[0]
  let mx: i64 = cp_chunk_raw()
  let mn: i64 = mx / CP_CDC_MIN_DIV
  if mn <= 0 { cp_eo("CP-REFUSED: derived min chunk is not positive (wire chunk too small to chunk)\n" as *u8); return CP_EXIT_USAGE }
  // the plan table is DERIVED from the input: no chunk is shorter than min, so n/min + 2 slots always suffice
  let cap: i64 = n / mn + 2
  let offs: *i64 = sys_mmap(cap * 8) as *i64
  let count: i64 = cp_cdc_gear(buf, n, offs, cap)
  if count < 0 { cp_eo("CP-REFUSED: cdc_plan refused its parameters (not a chunking)\n" as *u8); return CP_EXIT_USAGE }
  cp_out("CDC-PLAN src=" as *u8); cp_out(src)
  cp_out(" total=" as *u8); cp_num(n)
  cp_out(" chunk_raw=" as *u8); cp_num(mx)
  cp_out(" min=" as *u8); cp_num(mn)
  cp_out(" avg=" as *u8); cp_num(mx / CP_CDC_AVG_DIV)
  cp_out(" max=" as *u8); cp_num(mx)
  cp_out(" chunks=" as *u8); cp_num(count)
  cp_out(" gear=sha256(nx-cdc-gear-v1 concat byte) normalized\n" as *u8)
  let hex: *u8 = sys_mmap(CP_SHAHEX + 8)
  var k: i64 = 0
  while k < count {
      let a: i64 = offs[k]
      let b: i64 = offs[k + 1]
      cp_sha_hex_of(((buf as i64) + a) as *u8, b - a, hex)
      cp_out("c" as *u8); cp_num(k)
      cp_out(" off=" as *u8); cp_num(a)
      cp_out(" len=" as *u8); cp_num(b - a)
      cp_out(" sha256=" as *u8); cp_out(hex)
      cp_out("\n" as *u8)
      k = k + 1
  }
  sys_free_file(buf, n)
  return 0
1521}
1522
1523func main(argc: i64, argv: *i64) -> i64 {
  if argc < 2 {
      cp_eo("usage: nx_content_put begin <dest> <total_bytes> <sha256hex> | chunk <id> <index> <b64> | commit <id> | status <id> | abort <id> | reap | cdcplan <src> | plan <id> <count> | have <id> [from=<k>] | reuse <id> <b64rows> | append <id> <offset> <b64> [sha256=<hex>]\n" as *u8)
      sys_exit(CP_EXIT_USAGE)
      return CP_EXIT_USAGE
  }
  let verb: *u8 = argv[1] as *u8
  var rc: i64 = CP_EXIT_USAGE
  var handled: i64 = 0
  if cp_streq(verb, "begin" as *u8) == 1 {
      handled = 1
      if argc < 5 { cp_eo("usage: nx_content_put begin <dest> <total_bytes> <sha256hex> [expect_sha256=<hex>|absent]\n" as *u8) } else {
          if argc >= 6 { rc = v_begin(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, argv[5] as *u8) } else { rc = v_begin(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, 0 as *u8) }
      }
  }
  if cp_streq(verb, "chunk" as *u8) == 1 {
      handled = 1
      if argc < 5 { cp_eo("usage: nx_content_put chunk <id> <index> <base64> [sha256=<hex>]\n" as *u8) } else {
          var decl: *u8 = 0 as *u8
          if argc > 5 { decl = argv[5] as *u8 }
          rc = v_chunk(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, decl)
      }
  }
  if cp_streq(verb, "commit" as *u8) == 1 {
      handled = 1
      if argc < 3 { cp_eo("usage: nx_content_put commit <id>\n" as *u8) } else { rc = v_commit(argv[2] as *u8) }
  }
  if cp_streq(verb, "status" as *u8) == 1 {
      handled = 1
      if argc < 3 { cp_eo("usage: nx_content_put status <id>\n" as *u8) } else { rc = v_status(argv[2] as *u8) }
  }
  if cp_streq(verb, "abort" as *u8) == 1 {
      handled = 1
      if argc < 3 { cp_eo("usage: nx_content_put abort <id>\n" as *u8) } else { rc = v_abort(argv[2] as *u8) }
  }
  if cp_streq(verb, "reap" as *u8) == 1 { handled = 1; rc = v_reap() }
  if cp_streq(verb, "append" as *u8) == 1 {
      handled = 1
      if argc < 5 { cp_eo("usage: nx_content_put append <id> <offset> <base64> [sha256=<hex>]\n" as *u8) } else {
          var adecl: *u8 = 0 as *u8
          if argc > 5 { adecl = argv[5] as *u8 }
          rc = v_append(argv[2] as *u8, argv[3] as *u8, argv[4] as *u8, adecl)
      }
  }
  if cp_streq(verb, "plan" as *u8) == 1 {
      handled = 1
      if argc < 4 { cp_eo("usage: nx_content_put plan <id> <count>\n" as *u8) } else { rc = v_plan(argv[2] as *u8, argv[3] as *u8) }
  }
  if cp_streq(verb, "have" as *u8) == 1 {
      handled = 1
      if argc < 3 { cp_eo("usage: nx_content_put have <id> [from=<k>]\n" as *u8) } else {
          var fa: *u8 = 0 as *u8
          if argc > 3 { fa = argv[3] as *u8 }
          rc = v_have(argv[2] as *u8, fa)
      }
  }
  if cp_streq(verb, "reuse" as *u8) == 1 {
      handled = 1
      if argc < 4 { cp_eo("usage: nx_content_put reuse <id> <base64 rows>\n" as *u8) } else { rc = v_reuse(argv[2] as *u8, argv[3] as *u8) }
  }
  if cp_streq(verb, "cdcplan" as *u8) == 1 {
      handled = 1
      if argc < 3 { cp_eo("usage: nx_content_put cdcplan <src>\n" as *u8) } else { rc = v_cdcplan(argv[2] as *u8) }
  }
  if handled == 0 {
      cp_eo("CP-REFUSED: unknown verb (an unrecognized verb must never fall into a known one)\n" as *u8)
      rc = CP_EXIT_USAGE
  }
  sys_exit(rc)
  return rc
1593}
nx_content_put.nx source

`nx_content_put.nx` source
