code wiki / (root) / nx_content_put_client.nx
`nx_content_put_client.nx` source

↩ module page · 929 lines · 50154 B
1// nx_content_put_client.nx -- THE SOVEREIGN laptop->NAS UPLOAD CLIENT. Retires nx_content_put_client.py.
2//
3// WHY THIS EXISTS (operator standing order 2026-09-03: "i dont want py or js or sh or anything else in the
4// build lanes i want us nishilang soverign", and again "dont build python wtf build nishi").
5// nx_content_put has been the sovereign RECEIVER since 2026-08-23; its only driver was an 8,525-byte
6// Python script shelling out to a Python MCP wire. This is the NishiLang driver.
7//
8// IT WAS BLOCKED ON ONE MISSING PRIMITIVE, NOW BUILT. Driving the receiver needs POST-a-body-to-a-URL.
9// The estate had no such thing: nx_https_post_json took a URL and a body and issued a GET (corrected to
10// refuse, 2026-09-03), and nx_https_post_complete_xhdr needs an already-established session. hp_post_json
11// (nx_https_post_lib.nx) is the glue, and this file is its first consumer.
12//
13//   nx_content_put_client [dryrun] <local_path> <dest> <capfile> <url> [expect=<sha256hex>]
14//
15// IT REFUSES TO ESCAPE JSON RATHER THAN ESCAPING IT BADLY.
16// Every value this client puts on the wire comes from a KNOWN-SAFE alphabet: a destination path, decimal
17// digits, lowercase hex, base64 (A-Za-z0-9+/=) and a capability token. None of them can contain a quote,
18// a backslash or a control byte. So instead of hand-rolling a JSON escaper -- a defect generator that is
19// wrong in exactly the cases nobody tests -- cc_json_safe() REFUSES any argument carrying a character
20// that would need escaping. A hand-rolled escaper fails SILENTLY and produces a malformed request the
21// server rejects for the wrong reason; a refusal names the offending byte and stops.
22//
23// THE CHUNK SIZE IS THE SERVER'S, READ FROM ITS OWN RECEIPT -- NEVER COMPUTED HERE.
24// nx_content_put derives chunk_raw from the wire body cap, the request skeleton measured at runtime, the
25// largest observed capability token and the i64 digit bound. Recomputing that here would install a second
26// ruler that drifts the moment the server's reserve changes, and the drift would show up as truncated
27// uploads. The client reads chunk_raw= out of the begin receipt and uses it verbatim.
28//
29// A CHUNK RE-SEND IS SAFE; A COMMIT RETRY IS NOT DECIDABLE FROM HERE.
30// The receiver treats an identical re-send as a receipted no-op and REFUSES a different body for an index
31// that already landed (CAS), so a chunk retry can never double-apply. A lost COMMIT response is genuinely
32// UNKNOWN -- the transfer id may be gone because it committed. This client says so and tells the caller
33// to verify by hash rather than guessing; it does not retry commit.
34//
35// STATUS 2026-09-04: THE ROUND TRIP IS NOW PROVEN AND THIS ORGAN IS LIVE. It had never completed a
36// transfer before today and had never been promoted at all -- no nx_content_put_client.elf existed in
37// the serving root -- so the Python it claims to retire was in fact the only working shipper. Two
38// defects stood between the two facts: this client did not follow the edge's JOB-STARTED promotion (it
39// read the JOB id as the transfer id, both being spelled `id=`), and the shared TLS transport wrote
40// every request as ONE record, capping a body at 8 KB against the 48,402-byte chunks the server offers.
41// Both are fixed; measured since: 24 B, 12,083 B, and 410,443 B (9 chunks) all E2E OK, promoted live.
42// The 2026-09-03 line this replaces said the envelope was proven and the round trip was not. It was an
43// honest gap then and it is closed now -- but note it stood for a DAY while the header above it claimed
44// the organ retired the Python, which is the overclaiming-header class this estate keeps paying for.
45//
46// exit: 0 ok | 2 usage | 3 local-io | 4 refused-unsafe-arg | 5 begin-failed | 6 chunk-failed | 7 commit-unknown
47// license_tier: ORIGINAL   No hw writes (Rule 26).   expect_exit: 0
48import "nx_syscalls.nx"
49import "nx_base64.nx"
50import "nx_sha256.nx"
51import "nx_cdc_lib.nx"   // DI9: the local plan is cut by the SAME rule as the door's have-list (parameters read from the begin receipt)
52import "nx_https_post_lib.nx"
53import "nx_jobfollow_lib.nx"
54
55const CC_DIGEST: i64 = 32
56const CC_SHAHEX: i64 = 64
57const CC_RESP: i64 = 262144
58const CC_REQ: i64 = 262144
59const CC_NUMBUF: i64 = 32
60// Poll budget for following a JOB-STARTED promotion: 40 x 3000ms = 120s. Derived from the put lane
61// observed behaviour, not picked: a begin is fast, but the artifact appears only after the job is
62// scheduled, and the estate array is degraded. Exhausting this budget reports PENDING, never failure.
63const CC_POLLS: i64 = 40
64const CC_POLL_MS: i64 = 3000
65// Per-chunk re-send budget. 3 tries with a 4s gap: enough to ride out the transient that cost a
66// 410443 byte ship on 2026-09-04, small enough that a genuinely dead endpoint is reported in seconds.
67const CC_CHUNK_TRIES: i64 = 3
68const CC_CHUNK_RETRY_MS: i64 = 4000
69const CC_PATHCAP: i64 = 4096
70const CC_MODE_RW: i64 = 420
71// Ceiling on the missing-index table a resume can hold. NOT a guess: the server derives chunk_raw from
72// its own body cap (48,402 raw today), so 65,536 slots covers a 3.1 GB artifact -- three orders of
73// magnitude above anything this estate ships. It is a TABLE size, not a transfer limit: exceeding it
74// only disables RESUME for that transfer, which falls back to the full send that worked before.
75const CC_MAXCHUNKS: i64 = 65536
76// the JSON-RPC envelope this client sends. Its length is MEASURED at runtime wherever it matters --
77// a hand-counted length beside a literal is two copies of the same shape that drift apart.
78// It opens exactly THREE objects and ONE array, so the tail closes "]" then three braces. That pairing
79// is asserted arithmetically by nx_content_put_client_gate rather than trusted: the first draft of this
80// constant carried a DOUBLED "params" key with a four-brace tail that balanced against itself, which
81// would have produced well-formed JSON of the WRONG SHAPE -- rejected by the server for a reason naming
82// neither the client nor the real fault.
83const CC_PRE: *u8 = "{\x22jsonrpc\x22:\x222.0\x22,\x22id\x22:1,\x22method\x22:\x22tools/call\x22,\x22params\x22:{\x22name\x22:\x22nx_content_put\x22,\x22arguments\x22:{\x22argv\x22:["
84const CC_TAIL: *u8 = "}}}"
85const CC_QUOTE: i64 = 34
86const CC_BACKSLASH: i64 = 92
87const CC_SPACE: i64 = 32
88const CC_DEL: i64 = 127
89
90func cc_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
91func cc_out(s: *u8) -> i64 { sys_write(1, s, cc_slen(s)); return 0 }
92func cc_eo(s: *u8) -> i64 { sys_write(2, s, cc_slen(s)); return 0 }
93func cc_num(v: i64) -> i64 {
  let b: *u8 = sys_mmap(CC_NUMBUF)
  var m: i64 = v
  var i: i64 = CC_NUMBUF - 1
  if m == 0 { i = i - 1; b[i] = 48 as u8 }
  while m > 0 { i = i - 1; b[i] = (48 + (m % 10)) as u8; m = m / 10 }
  sys_write(1, (b as i64 + i) as *u8, (CC_NUMBUF - 1) - i)
  return 0
101}
102// write decimal into `out`, return length (no allocation, so it can be used inside the request builder)
103func cc_itoa(v: i64, out: *u8) -> i64 {
  if v == 0 { out[0] = 48 as u8; return 1 }
  let tmp: *u8 = sys_mmap(CC_NUMBUF)
  var m: i64 = v
  var i: i64 = 0
  while m > 0 { tmp[i] = (48 + (m % 10)) as u8; m = m / 10; i = i + 1 }
  var j: i64 = 0
  while j < i { out[j] = tmp[i - 1 - j]; j = j + 1 }
  return i
112}
113func cc_hex_into(d: *u8, out: *u8) -> i64 {
  var i: i64 = 0
  while i < CC_DIGEST {
      let v: i64 = d[i] as i64
      let hi: i64 = (v >> 4) & 15
      let lo: i64 = v & 15
      if hi < 10 { out[i * 2] = (48 + hi) as u8 } else { out[i * 2] = (87 + hi) as u8 }
      if lo < 10 { out[i * 2 + 1] = (48 + lo) as u8 } else { out[i * 2 + 1] = (87 + lo) as u8 }
      i = i + 1
  }
  out[CC_SHAHEX] = 0 as u8
  return 0
125}
126
127// REFUSE rather than escape. Returns 1 when every byte is safe to place inside a JSON string as-is.
128func cc_json_safe(s: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n {
      let c: i64 = s[i] as i64
      if c == CC_QUOTE { return 0 }
      if c == CC_BACKSLASH { return 0 }
      if c < CC_SPACE { return 0 }
      if c == CC_DEL { return 0 }
      i = i + 1
  }
  return 1
139}
140
141// find needle in buf[0..n); index just past it, or -1. Exits on a FLAG, never by clobbering the cursor.
142func cc_find(buf: *u8, n: i64, needle: *u8) -> i64 {
  let m: i64 = cc_slen(needle)
  if m == 0 { return 0 - 1 }
  var i: i64 = 0
  var hit: i64 = 0 - 1
  while i + m <= n {
      var j: i64 = 0
      var same: i64 = 1
      while j < m {
          if buf[i + j] != needle[j] { same = 0; j = m } else { j = j + 1 }
      }
      if same == 1 { if hit < 0 { hit = i + m } }
      i = i + 1
  }
  return hit
157}
158func cc_int_after(buf: *u8, n: i64, key: *u8) -> i64 {
  let p: i64 = cc_find(buf, n, key)
  if p < 0 { return 0 - 1 }
  var i: i64 = p
  var v: i64 = 0
  var got: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if i >= n { go = 0 } else {
          let c: i64 = buf[i] as i64
          if c < 48 { go = 0 } else {
              if c > 57 { go = 0 } else { v = v * 10 + (c - 48); got = 1; i = i + 1 }
          }
      }
  }
  if got == 0 { return 0 - 1 }
  return v
175}
176
177// append a quoted JSON string element; returns new offset, or -1 if the value is not safe as-is.
178func cc_put_arg(req: *u8, off: i64, val: *u8, vlen: i64, first: i64) -> i64 {
  if cc_json_safe(val, vlen) == 0 { return 0 - 1 }
  var o: i64 = off
  if first == 0 { req[o] = 44 as u8; o = o + 1 }
  req[o] = CC_QUOTE as u8; o = o + 1
  var i: i64 = 0
  while i < vlen { req[o + i] = val[i]; i = i + 1 }
  o = o + vlen
  req[o] = CC_QUOTE as u8; o = o + 1
  return o
188}
189func cc_streq(a: *u8, b: *u8) -> i64 {
  var i: i64 = 0
  while a[i] != (0 as u8) { if a[i] != b[i] { return 0 } i = i + 1 }
  if b[i] != (0 as u8) { return 0 }
  return 1
194}
195func cc_put_lit(req: *u8, off: i64, lit: *u8) -> i64 {
  var o: i64 = off
  let n: i64 = cc_slen(lit)
  var i: i64 = 0
  while i < n { req[o + i] = lit[i]; i = i + 1 }
  return o + n
201}
202
203// ---- IDEMPOTENCY KEY ON EVERY CALL (DI4, 2026-09-05) --------------------------------------------------
204// The tools/call transport now reads params._idem (nx_toolcall_idem_lib): the first applied outcome is recorded
205// under the key and a retry carrying the same key is REPLAYED, never re-executed. So every request this client
206// sends names itself: cpc-<stage>-<sha16 of the file>-<a>[-<b>]-<t0>, where t0 is THIS RUN's start epoch. Within a
207// run a re-send under an Outcome-Unknown replays; a fresh run (or a --resume) reserves fresh keys instead of
208// replaying a begin whose transfer the server may already have reaped. The alphabet is dash, digits and hex, so
209// the key can never need JSON escaping and cc_json_safe's refusal rule is untouched.
210const CC_IDEM_SHA16: i64 = 16
211func cc_put_idem(req: *u8, off: i64, stage: *u8, shahex: *u8, a: i64, b: i64, t0: i64) -> i64 {
  var o: i64 = cc_put_lit(req, off, ",\x22_idem\x22:\x22cpc-" as *u8)
  o = cc_put_lit(req, o, stage)
  req[o] = 45 as u8; o = o + 1
  var i: i64 = 0
  while i < CC_IDEM_SHA16 { req[o] = shahex[i]; o = o + 1; i = i + 1 }
  req[o] = 45 as u8; o = o + 1
  let nb: *u8 = sys_mmap(CC_NUMBUF)
  var l: i64 = cc_itoa(a, nb)
  i = 0
  while i < l { req[o] = nb[i]; o = o + 1; i = i + 1 }
  if b >= 0 {
      req[o] = 45 as u8; o = o + 1
      l = cc_itoa(b, nb)
      i = 0
      while i < l { req[o] = nb[i]; o = o + 1; i = i + 1 }
  }
  req[o] = 45 as u8; o = o + 1
  l = cc_itoa(t0, nb)
  i = 0
  while i < l { req[o] = nb[i]; o = o + 1; i = i + 1 }
  req[o] = CC_QUOTE as u8; o = o + 1
  return o
234}
235
236// ---- CROSS-PROCESS RESUME (DL10) -------------------------------------------------------------------
237// The in-flight retry above survives a TRANSIENT. It cannot survive the process dying, and on a degraded
238// array that is the case that costs a 400 KB ship. The server already exposes everything needed --
239// `status <id>` returns dest, total, chunk_raw, nchunks and the MISSING index list, and its header says
240// chunk_raw travels in status ON PURPOSE because a resuming client cannot derive it. So the only thing
241// missing was a client that remembers the id across runs.
242//
243// THE SIDECAR IS THE MEMORY AND THE DIGEST IS THE GUARD. It records the transfer id beside the LOCAL
244// file's sha256. Resuming a transfer whose local file has CHANGED would splice two generations into one
245// artifact -- byte-valid and semantically nonsense, exactly the franken-file the get client's header
246// warns about -- so a sha mismatch abandons the sidecar and begins fresh rather than trying to be clever.
247// A size check would not do: a same-size rewrite passes it.
248func cc_state_path(lpath: *u8, out: *u8) -> i64 {
  var o: i64 = 0
  while lpath[o] != (0 as u8) { out[o] = lpath[o]; o = o + 1 }
  out[o] = 46 as u8; out[o+1] = 99 as u8; out[o+2] = 112 as u8
  out[o+3] = 115 as u8; out[o+4] = 116 as u8; out[o+5] = 97 as u8
  out[o+6] = 116 as u8; out[o+7] = 101 as u8; out[o+8] = 0 as u8
  return o + 8
255}
256// Mark every index the server reports MISSING. The list is whitespace-separated decimals after
257// "missing:" and runs to end of line; anything already received is left 0 and will be SKIPPED.
258// Returns how many were marked, so a caller can assert the parse found something rather than
259// silently sending nothing -- a resume that skips every chunk and commits is the worst possible bug.
260func cc_mark_missing(resp: *u8, n: i64, miss: *i64, nch: i64) -> i64 {
  var i: i64 = 0
  while i < nch { miss[i] = 0; i = i + 1 }
  let p: i64 = cc_find(resp, n, "missing:" as *u8)
  if p < 0 { return 0 - 1 }
  var k: i64 = p
  var marked: i64 = 0
  var cur: i64 = 0
  var indig: i64 = 0
  var go: i64 = 1
  while go == 1 {
      if k >= n { go = 0 } else {
          let c: i64 = resp[k] as i64
          if c == 10 { go = 0 } else {
              if c >= 48 { if c <= 57 { cur = cur * 10 + (c - 48); indig = 1 } else { go = 0 } }
              else {
                  if indig == 1 { if cur < nch { miss[cur] = 1; marked = marked + 1 } cur = 0; indig = 0 }
              }
              k = k + 1
          }
      }
  }
  if indig == 1 { if cur < nch { miss[cur] = 1; marked = marked + 1 } }
  return marked
284}
285
286// Does this argument carry a readcap= prefix? Exactly 8 bytes, compared explicitly rather than by a
287// shared prefix helper, because a loose match would swallow the expect= argument beside it.
288func cc_is_readcap(a: *u8) -> i64 {
  let want: *u8 = "readcap=" as *u8
  var i: i64 = 0
  while i < 8 {
      if a[i] == (0 as u8) { return 0 }
      if a[i] != want[i] { return 0 }
      i = i + 1
  }
  return 1
297}
298// THE CONTRACT THIS SATISFIES IS PUBLISHED ON /compare/deploy AS DL10 _ABSENT_:cc_resume_from_status,
299// AND IT IS EXTRACTED HERE SO THE CODE MEETS THE CONTRACT RATHER THAN THE CONTRACT BEING BENT TO FIT
300// THE CODE. The logic first shipped inline in main, which left the board cell reading WATCHING while
301// the capability was live -- exactly the mechanically-green-editorially-false mismatch the prose axis
302// of nx_board_contract_gate exists to catch, so leaving it would have been shipping a defect my own
303// gate hunts.
304//
305// Returns 1 when a resumable transfer was adopted, 0 otherwise. On 1, out[] carries
306// [0]=transfer id  [1]=chunk_raw  [2]=nchunks  [3]=chunks still missing, and `miss` is marked.
307// EVERY ONE OF THOSE NUMBERS COMES FROM THE SERVER'S `status` RECEIPT, never from anything this client
308// remembered about what it thinks it sent -- the client's only memory is the transfer id.
309func cc_resume_from_status(store_i: i64, url: *u8, spath: *u8, shahex: *u8,
                         capraw: *u8, caplen: i64,
                         resp: *u8, respcap: i64,
                         rcraw: *u8, rclen: i64,
                         miss: *i64, out: *i64, t0: i64) -> i64 {
  out[0] = 0 - 1
  out[1] = 0 - 1
  out[2] = 0 - 1
  out[3] = 0
  var res: i64 = 0
  let sbox: *i64 = sys_mmap(16) as *i64
  let sbuf: *u8 = sys_read_file(spath, sbox)
  if (sbuf as i64) != 0 {
      let sid: i64 = cc_int_after(sbuf, sbox[0], "id=" as *u8)
      // THE DIGEST IS THE GUARD, and a size check would not do: a same-size rewrite passes it while
      // splicing two generations into one artifact.
      if sid > 0 { if cc_find(sbuf, sbox[0], shahex) >= 0 {
          let sreq: *u8 = sys_mmap(CC_REQ)
          var so: i64 = cc_put_lit(sreq, 0, CC_PRE)
          so = cc_put_arg(sreq, so, "status" as *u8, 6, 1)
          let idb: *u8 = sys_mmap(CC_NUMBUF)
          let idl: i64 = cc_itoa(sid, idb)
          so = cc_put_arg(sreq, so, idb, idl, 0)
          so = cc_put_lit(sreq, so, "],\x22_cap\x22:" as *u8)
          so = cc_put_arg(sreq, so, capraw, caplen, 1)
          so = cc_put_idem(sreq, so, "status" as *u8, shahex, sid, 0 - 1, t0)
          so = cc_put_lit(sreq, so, CC_TAIL)
          let sn: i64 = jf_post_follow(store_i, url, sreq, so, resp, CC_RESP, rcraw, rclen, CC_POLLS, CC_POLL_MS)
          if sn > 0 { if cc_find(resp, sn, "CP-STATUS id=" as *u8) >= 0 {
              let r2: i64 = cc_int_after(resp, sn, "id=" as *u8)
              let c2: i64 = cc_int_after(resp, sn, "chunk_raw=" as *u8)
              let n2: i64 = cc_int_after(resp, sn, "nchunks=" as *u8)
              if r2 > 0 { if c2 > 0 { if n2 > 0 { if n2 <= CC_MAXCHUNKS {
                  let marked: i64 = cc_mark_missing(resp, sn, miss, n2)
                  // A RESUME THAT MARKS NOTHING MUST NOT PROCEED TO COMMIT. Either every chunk is
                  // already there (in which case the previous run should have committed and the
                  // honest move is to let it commit now) or the parse failed -- and a client that
                  // skipped every chunk and committed would publish whatever the server happened to
                  // hold. Only a POSITIVE mark count authorises the skip path.
                  if marked > 0 {
                      out[0] = r2; out[1] = c2; out[2] = n2; out[3] = marked; res = 1
                      cc_out("CP-RESUME id=" as *u8); cc_num(r2)
                      cc_out(" chunk_raw=" as *u8); cc_num(c2)
                      cc_out(" nchunks=" as *u8); cc_num(n2)
                      cc_out(" still_missing=" as *u8); cc_num(marked)
                      cc_out(" already_received=" as *u8); cc_num(n2 - marked)
                      cc_out(" (a prior run left state for this exact file and its digest still matches)\n" as *u8)
                  }
              } } } }
          } }
      } }
  }
  return res
362}
363
364// ---- ONE CHUNK POST (extracted 2026-09-06 so the fixed-size path and the DI9 plan-addressed path share it) ----------
365// Posts bytes [lo,hi) of `data` as chunk `idx` with its declared digest, retrying a transient at the same index
366// (idempotent by construction), naming size and code on a transport failure, and accepting both success spellings.
367// Returns the request body length on success (the wire cost), or -1 after printing the reason.
368func cc_post_chunk(store_i: i64, url: *u8, req: *u8, resp: *u8, rcraw: *u8, rclen: i64, capraw: *u8, caplen: i64,
                 rid: i64, idx: i64, lo: i64, hi: i64, data: *u8, enc: *u8, nb: *u8, cdg: *u8, chex: *u8, dbuf: *u8,
                 shahex: *u8, t0: i64, craw: i64) -> i64 {
      let elen: i64 = b64_encode((data as i64 + lo) as *u8, hi - lo, enc)
      var co: i64 = cc_put_lit(req, 0, CC_PRE)
      co = cc_put_arg(req, co, "chunk" as *u8, 5, 1)
      let il: i64 = cc_itoa(rid, nb)
      co = cc_put_arg(req, co, nb, il, 0)
      let xl: i64 = cc_itoa(idx, nb)
      co = cc_put_arg(req, co, nb, xl, 0)
      co = cc_put_arg(req, co, enc, elen, 0)
      if co < 0 { cc_eo("CC-REFUSED: base64 payload was not JSON-safe (this cannot happen; the alphabet is A-Za-z0-9+/=)\n" as *u8); return 0 - 1 }
      // DI10: declare THIS chunk's digest with the chunk, so the door refuses a corrupted or truncated chunk ON
      // ARRIVAL (CP-REFUSED-CHUNK-DIGEST index=N) instead of at commit; a legacy door ignores the extra argument
      sha256_digest((data as i64 + lo) as *u8, hi - lo, cdg)
      cc_hex_into(cdg, chex)
      var dcl: i64 = cc_put_lit(dbuf, 0, "sha256=" as *u8)
      dcl = cc_put_lit(dbuf, dcl, chex)
      co = cc_put_arg(req, co, dbuf, dcl, 0)
      co = cc_put_lit(req, co, "],\x22_cap\x22:" as *u8)
      co = cc_put_arg(req, co, capraw, caplen, 1)
      co = cc_put_idem(req, co, "chunk" as *u8, shahex, rid, idx, t0)
      co = cc_put_lit(req, co, CC_TAIL)
      // RE-SENDING ONE CHUNK IS IDEMPOTENT BY CONSTRUCTION, WHICH IS WHY THIS IS NOT THE BANNED RETRY.
      // A chunk is addressed by INDEX -- `chunk <id> <index> <b64>` overwrites that one staging slot --
      // so a second send of the same index cannot double-apply the way an append can. The estate ban
      // on blind retries is about calls whose outcome is UNKNOWN and whose effect is CUMULATIVE; this
      // is neither.
      // AND IT REDUCES LOAD ON A DEGRADED ARRAY RATHER THAN ADDING IT. MEASURED 2026-09-04: a 410443
      // byte ship lost chunk 7 of 9 to a transient and discarded the ENTIRE transfer, so the operator
      // paid NINE chunk posts again to recover one. Retrying the single failed index costs one request
      // instead of nine -- this is an amplifier in reverse.
      // SCOPE, STATED: this survives a TRANSIENT, not a process death. Cross-process resume -- query
      // `status <id>` and send only the missing indices -- is rung DL10 on the deploy board and stays
      // OPEN; do not read this as closing it.
      var cn: i64 = 0
      var att: i64 = 0
      var cdone: i64 = 0
      while cdone == 0 {
          cn = jf_post_follow(store_i, url, req, co, resp, CC_RESP, rcraw, rclen, CC_POLLS, CC_POLL_MS)
          if cn > 0 { cdone = 1 } else {
              att = att + 1
              // Exits on a FLAG, never by clobbering the attempt counter -- the loop-exit sentinel
              // defect this estate has recorded four times in one day.
              if att >= CC_CHUNK_TRIES { cdone = 1 } else {
                  cc_out("CC-CHUNK retry index " as *u8); cc_num(idx)
                  cc_out(" attempt " as *u8); cc_num(att)
                  cc_out(" of " as *u8); cc_num(CC_CHUNK_TRIES)
                  cc_out(" -- same index, idempotent by construction\n" as *u8)
                  sys_sleep_ms(CC_CHUNK_RETRY_MS)
              }
          }
      }
      // A FAILURE THAT NAMES NEITHER ITS SIZE NOR ITS CODE SENDS EVERY READER INTO THE WRONG ORGAN.
      // This one cost eleven days: the transport refuses a body over its own ceiling with a NAMED
      // code, hp_post_once flattens every negative into HF_ERR_HTTP, and the caller printed only an
      // index -- so a ceiling mismatch read as a dead server. Print the two numbers that decide it.
      if cn <= 0 {
          // ONE STREAM. cc_num writes fd 1 and cc_eo writes fd 2, so a diagnostic mixing them is
          // torn into two interleaved fragments and the numbers are lost exactly when they matter.
          cc_out("CC-CHUNK: post failed at index " as *u8); cc_num(idx)
          cc_out(" transport_rc=" as *u8); cc_num(0 - cn)
          cc_out(" request_body_bytes=" as *u8); cc_num(co)
          cc_out(" server_offered_chunk_raw=" as *u8); cc_num(craw)
          cc_out("\n" as *u8)
          return 0 - 1
      }
      // SUCCESS HAS TWO SPELLINGS AND ACCEPTING ONLY ONE TURNS A SUCCESS INTO A REFUSAL.
      // The receiver answers `CP-CHUNK OK` for a fresh chunk and `CP-CHUNK DUPLICATE-IDENTICAL` for a
      // byte-identical re-send (nx_content_put.nx:510 and :532). Testing only for OK made the retry
      // added above WORSE THAN NO RETRY: the first post landed, its response was lost, the re-send was
      // correctly receipted as a duplicate, and this client called that a refusal and aborted a live
      // transfer. MEASURED here on the first live run of the retry path, 2026-09-04.
      // Both spellings are READ FROM THE SERVER SOURCE, not guessed, so this list is grounded -- the
      // same defect class as a marker list keyed on the vocabulary of only one of the two producers.
      var chunk_ok: i64 = 0
      if cc_find(resp, cn, "CP-CHUNK OK" as *u8) >= 0 { chunk_ok = 1 }
      if cc_find(resp, cn, "CP-CHUNK DUPLICATE-IDENTICAL" as *u8) >= 0 { chunk_ok = 1 }
      if chunk_ok == 0 {
          cc_out("CC-CHUNK refused at index " as *u8); cc_num(idx); cc_out("\n" as *u8)
          // a CAS refusal means a DIFFERENT body already landed for this index: stop, do not retry.
          if cc_find(resp, cn, "CHUNK-CAS" as *u8) >= 0 {
              cc_eo("CHUNK-CAS: a different body already landed for this index -- abort and re-begin, or repair the source\n" as *u8)
          }
          return 0 - 1
      }
      return co
455}
456
457// ---- DI9 REUSE BATCH (2026-09-06): rows `k off len sha` staged from the incumbent by the door; returns the rows the
458// door accepted (staged + noop), or -1 when the batch was refused or lost (the caller then sends those chunks' bytes).
459// THE FOLLOW BUDGET SCALES WITH THE ROWS (2026-09-06): every reuse row costs the door one staged chunk write -- the
460// same work a chunk post costs -- so a batch of N rows is followed for N chunk budgets. MEASURED before this fix: a
461// 122-row batch on a storming array outlived the single-post budget (HP-PENDING: accepted, still running), the
462// client called the batch FAILED and re-sent every chunk as bytes while the door was still staging the same rows.
463func cc_flush_reuse(store_i: i64, url: *u8, req: *u8, resp: *u8, rcraw: *u8, rclen: i64, capraw: *u8, caplen: i64,
                  rid: i64, rbuf: *u8, rl: i64, rows: i64, enc: *u8, nb: *u8, shahex: *u8, t0: i64, batchno: i64, wire: *i64) -> i64 {
  let elen: i64 = b64_encode(rbuf, rl, enc)
  var o: i64 = cc_put_lit(req, 0, CC_PRE)
  o = cc_put_arg(req, o, "reuse" as *u8, 5, 1)
  let il: i64 = cc_itoa(rid, nb)
  o = cc_put_arg(req, o, nb, il, 0)
  o = cc_put_arg(req, o, enc, elen, 0)
  if o < 0 { return 0 - 1 }
  o = cc_put_lit(req, o, "],\x22_cap\x22:" as *u8)
  o = cc_put_arg(req, o, capraw, caplen, 1)
  o = cc_put_idem(req, o, "reuse" as *u8, shahex, rid, batchno, t0)
  o = cc_put_lit(req, o, CC_TAIL)
  wire[0] = wire[0] + o
  var polls: i64 = CC_POLLS * rows
  if polls < CC_POLLS { polls = CC_POLLS }
  let n: i64 = jf_post_follow(store_i, url, req, o, resp, CC_RESP, rcraw, rclen, polls, CC_POLL_MS)
  if n <= 0 { cc_out("CC-REUSE: batch post failed batch=" as *u8); cc_num(batchno); cc_out(" rows=" as *u8); cc_num(rows); cc_out(" polls=" as *u8); cc_num(polls); cc_out("\n" as *u8); return 0 - 1 }
  if cc_find(resp, n, "CP-REUSE-BATCH" as *u8) < 0 {
      cc_out("CC-REUSE: batch refused batch=" as *u8); cc_num(batchno); cc_out(" -- the door answered: " as *u8); sys_write(1, resp, n); cc_out("\n" as *u8)
      return 0 - 1
  }
  let refused: i64 = cc_int_after(resp, n, "refused=" as *u8)
  if refused != 0 { cc_out("CC-REUSE: batch had refused rows batch=" as *u8); cc_num(batchno); cc_out(" refused=" as *u8); cc_num(refused); cc_out(" -- those chunks are sent as bytes\n" as *u8); return 0 - 1 }
  return cc_int_after(resp, n, "staged=" as *u8) + cc_int_after(resp, n, "noop=" as *u8)
488}
489
490// ---- DI9 THE DEDUPE SENDER (2026-09-06) ------------------------------------------------------------------------------
491// Plan the local file by the DOOR's parameters, declare the plan, read the incumbent's digests page by page, and send
492// only the chunks the receiver lacks -- every other chunk is staged by a `reuse` row, batched to the wire chunk. Prints
493// CC-DEDUPE with bytes on the wire against the total. Returns the count of chunks whose BYTES were sent, or -1.
494func cc_send_cdc(store_i: i64, url: *u8, req: *u8, resp: *u8, rcraw: *u8, rclen: i64, capraw: *u8, caplen: i64,
               rid: i64, craw: i64, cmin: i64, cavg: i64, cmax: i64, data: *u8, total: i64, shahex: *u8, t0: i64,
               nb: *u8, enc: *u8, cdg: *u8, chex: *u8, dbuf: *u8) -> i64 {
  if cmin <= 0 { cc_eo("CC-CDC: the begin receipt carried no cdc_min= -- this door predates plan-addressed transfers\n" as *u8); return 0 - 1 }
  let tbl: *u8 = sys_mmap(CDC_GEAR_BYTES)
  cdc_gear_table(tbl)
  let pcap: i64 = total / cmin + 2
  let poffs: *i64 = sys_mmap(pcap * 8) as *i64
  let pcount: i64 = cdc_plan(tbl, data, total, cmin, cavg, cmax, poffs, pcap)
  if pcount <= 0 { cc_eo("CC-CDC: the local plan was refused (not a chunking)\n" as *u8); return 0 - 1 }
  let wire: *i64 = sys_mmap(16) as *i64
  wire[0] = 0
  // declare the plan
  var o: i64 = cc_put_lit(req, 0, CC_PRE)
  o = cc_put_arg(req, o, "plan" as *u8, 4, 1)
  let il: i64 = cc_itoa(rid, nb)
  o = cc_put_arg(req, o, nb, il, 0)
  let pl: i64 = cc_itoa(pcount, nb)
  o = cc_put_arg(req, o, nb, pl, 0)
  o = cc_put_lit(req, o, "],\x22_cap\x22:" as *u8)
  o = cc_put_arg(req, o, capraw, caplen, 1)
  o = cc_put_idem(req, o, "plan" as *u8, shahex, rid, pcount, t0)
  o = cc_put_lit(req, o, CC_TAIL)
  wire[0] = wire[0] + o
  var n: i64 = jf_post_follow(store_i, url, req, o, resp, CC_RESP, rcraw, rclen, CC_POLLS, CC_POLL_MS)
  if n <= 0 { cc_eo("CC-CDC: plan post failed\n" as *u8); return 0 - 1 }
  if cc_find(resp, n, "CP-PLAN OK" as *u8) < 0 { cc_eo("CC-CDC: plan refused -- the door answered: " as *u8); sys_write(2, resp, n); cc_eo("\n" as *u8); return 0 - 1 }
  // the incumbent's digests, page by page (next=-1 ends the list)
  var hn: i64 = 0
  var hdecl: i64 = 0
  var incb: i64 = 0
  var hoff: *i64 = 0 as *i64
  var hlen: *i64 = 0 as *i64
  var hsha: *u8 = 0 as *u8
  var from: i64 = 0
  var pages: i64 = 0
  var go: i64 = 1
  while go == 1 {
      o = cc_put_lit(req, 0, CC_PRE)
      o = cc_put_arg(req, o, "have" as *u8, 4, 1)
      let il2: i64 = cc_itoa(rid, nb)
      o = cc_put_arg(req, o, nb, il2, 0)
      var fb: i64 = cc_put_lit(dbuf, 0, "from=" as *u8)
      let fl: i64 = cc_itoa(from, nb)
      var fi: i64 = 0
      while fi < fl { dbuf[fb] = nb[fi]; fb = fb + 1; fi = fi + 1 }
      o = cc_put_arg(req, o, dbuf, fb, 0)
      o = cc_put_lit(req, o, "],\x22_cap\x22:" as *u8)
      o = cc_put_arg(req, o, capraw, caplen, 1)
      o = cc_put_idem(req, o, "have" as *u8, shahex, rid, from, t0)
      o = cc_put_lit(req, o, CC_TAIL)
      wire[0] = wire[0] + o
      n = jf_post_follow(store_i, url, req, o, resp, CC_RESP, rcraw, rclen, CC_POLLS, CC_POLL_MS)
      if n <= 0 { cc_eo("CC-CDC: have post failed\n" as *u8); return 0 - 1 }
      if cc_find(resp, n, "CP-HAVE id=" as *u8) < 0 { cc_eo("CC-CDC: have refused -- the door answered: " as *u8); sys_write(2, resp, n); cc_eo("\n" as *u8); return 0 - 1 }
      pages = pages + 1
      if pages == 1 {
          incb = cc_int_after(resp, n, "incumbent_bytes=" as *u8)
          hdecl = cc_int_after(resp, n, " chunks=" as *u8)
          if incb < 0 { incb = 0 }
          if hdecl < 0 { hdecl = 0 }
          hoff = sys_mmap((hdecl + 1) * 8) as *i64
          hlen = sys_mmap((hdecl + 1) * 8) as *i64
          hsha = sys_mmap((hdecl + 1) * CC_SHAHEX + 8)
      }
      // rows: h<k> off=<a> len=<b> sha256=<hex>, one per line; parsed line by line, bounded by the declared count.
      // A line ends at byte 10 OR at the two-byte escape `\n` -- a fast `have` answers synchronously INSIDE the
      // JSON-RPC envelope, where the door's newlines arrive escaped, while a job-lane answer arrives raw from the
      // artifact. MEASURED 2026-09-06: the first live dedupe pass read `chunks=122 parsed=0` because every row sat
      // on one escaped "line" whose first byte was the header's C, and the whole incumbent would have been re-sent.
      var i: i64 = 0
      while i < n {
          var e: i64 = i
          var step: i64 = 1
          while e < n {
              if resp[e] == (10 as u8) { break }
              if resp[e] == (92 as u8) { if e + 1 < n { if resp[e + 1] == (110 as u8) { step = 2; break } } }
              e = e + 1
          }
          let ll: i64 = e - i
          let line: *u8 = ((resp as i64) + i) as *u8
          if ll > 2 { if line[0] == (104 as u8) { if line[1] >= (48 as u8) { if line[1] <= (57 as u8) { if hn < hdecl {
              let a: i64 = cc_int_after(line, ll, " off=" as *u8)
              let b: i64 = cc_int_after(line, ll, " len=" as *u8)
              let sp: i64 = cc_find(line, ll, " sha256=" as *u8)
              if a >= 0 { if b > 0 { if sp >= 0 { if sp + CC_SHAHEX <= ll {
                  hoff[hn] = a
                  hlen[hn] = b
                  var q: i64 = 0
                  while q < CC_SHAHEX { hsha[hn * CC_SHAHEX + q] = line[sp + q]; q = q + 1 }
                  hn = hn + 1
              } } } }
          } } } } }
          i = e + step
      }
      let nxt: i64 = cc_int_after(resp, n, " next=" as *u8)
      if nxt <= 0 { go = 0 } else { from = nxt }
  }
  cc_out("CC-HAVE incumbent_bytes=" as *u8); cc_num(incb)
  cc_out(" chunks=" as *u8); cc_num(hdecl)
  cc_out(" parsed=" as *u8); cc_num(hn)
  cc_out(" pages=" as *u8); cc_num(pages)
  cc_out("\n" as *u8)
  // send only what the receiver lacks; reuse rows are batched to the wire chunk and flushed by `reuse`
  let rbuf: *u8 = sys_mmap(craw + CC_NUMBUF * 3 + CC_SHAHEX + 8)
  let rowb: *u8 = sys_mmap(CC_NUMBUF * 3 + CC_SHAHEX + 8)
  let bks: *i64 = sys_mmap(pcap * 8) as *i64
  var rl: i64 = 0
  var bn: i64 = 0
  var reused: i64 = 0
  var sent: i64 = 0
  var batches: i64 = 0
  var failed: i64 = 0
  var k: i64 = 0
  while k < pcount {
      if failed == 1 { k = pcount } else {
      let lo: i64 = poffs[k]
      let hi: i64 = poffs[k + 1]
      sha256_digest((data as i64 + lo) as *u8, hi - lo, cdg)
      cc_hex_into(cdg, chex)
      var j: i64 = 0
      var found: i64 = 0 - 1
      while j < hn {
          var same: i64 = 1
          var q2: i64 = 0
          while q2 < CC_SHAHEX { if hsha[j * CC_SHAHEX + q2] != chex[q2] { same = 0; q2 = CC_SHAHEX } else { q2 = q2 + 1 } }
          if same == 1 { found = j; j = hn } else { j = j + 1 }
      }
      if found >= 0 {
          // one reuse row: k off len sha
          var rw: i64 = cc_itoa(k, nb)
          var ro: i64 = 0
          var z: i64 = 0
          while z < rw { rowb[ro] = nb[z]; ro = ro + 1; z = z + 1 }
          rowb[ro] = 32 as u8
          ro = ro + 1
          rw = cc_itoa(hoff[found], nb)
          z = 0
          while z < rw { rowb[ro] = nb[z]; ro = ro + 1; z = z + 1 }
          rowb[ro] = 32 as u8
          ro = ro + 1
          rw = cc_itoa(hlen[found], nb)
          z = 0
          while z < rw { rowb[ro] = nb[z]; ro = ro + 1; z = z + 1 }
          rowb[ro] = 32 as u8
          ro = ro + 1
          z = 0
          while z < CC_SHAHEX { rowb[ro] = chex[z]; ro = ro + 1; z = z + 1 }
          rowb[ro] = 10 as u8
          ro = ro + 1
          // flush when the batch would outgrow the wire chunk
          if rl + ro > craw {
              batches = batches + 1
              let acc: i64 = cc_flush_reuse(store_i, url, req, resp, rcraw, rclen, capraw, caplen, rid, rbuf, rl, bn, enc, nb, shahex, t0, batches, wire)
              if acc < 0 {
                  var f: i64 = 0
                  while f < bn { let bk: i64 = bks[f]; let pc: i64 = cc_post_chunk(store_i, url, req, resp, rcraw, rclen, capraw, caplen, rid, bk, poffs[bk], poffs[bk + 1], data, enc, nb, cdg, chex, dbuf, shahex, t0, craw); if pc < 0 { failed = 1; f = bn } else { sent = sent + 1; wire[0] = wire[0] + pc; f = f + 1 } }
              } else { reused = reused + bn }
              rl = 0
              bn = 0
          }
          z = 0
          while z < ro { rbuf[rl + z] = rowb[z]; z = z + 1 }
          rl = rl + ro
          bks[bn] = k
          bn = bn + 1
      } else {
          let pc2: i64 = cc_post_chunk(store_i, url, req, resp, rcraw, rclen, capraw, caplen, rid, k, lo, hi, data, enc, nb, cdg, chex, dbuf, shahex, t0, craw)
          if pc2 < 0 { failed = 1 } else { sent = sent + 1; wire[0] = wire[0] + pc2 }
      }
      k = k + 1
      }
  }
  if failed == 0 { if bn > 0 {
      batches = batches + 1
      let acc2: i64 = cc_flush_reuse(store_i, url, req, resp, rcraw, rclen, capraw, caplen, rid, rbuf, rl, bn, enc, nb, shahex, t0, batches, wire)
      if acc2 < 0 {
          var f2: i64 = 0
          while f2 < bn { let bk2: i64 = bks[f2]; let pc3: i64 = cc_post_chunk(store_i, url, req, resp, rcraw, rclen, capraw, caplen, rid, bk2, poffs[bk2], poffs[bk2 + 1], data, enc, nb, cdg, chex, dbuf, shahex, t0, craw); if pc3 < 0 { failed = 1; f2 = bn } else { sent = sent + 1; wire[0] = wire[0] + pc3; f2 = f2 + 1 } }
      } else { reused = reused + bn }
  } }
  cc_out("CC-DEDUPE mode=cdc plan_chunks=" as *u8); cc_num(pcount)
  cc_out(" incumbent_chunks=" as *u8); cc_num(hn)
  cc_out(" reused=" as *u8); cc_num(reused)
  cc_out(" sent=" as *u8); cc_num(sent)
  cc_out(" reuse_batches=" as *u8); cc_num(batches)
  cc_out(" wire_bytes=" as *u8); cc_num(wire[0])
  cc_out(" total=" as *u8); cc_num(total)
  cc_out(" (reused + sent = plan_chunks when nothing failed)\n" as *u8)
  if failed == 1 { return 0 - 1 }
  return sent
685}
686
687func main(argc: i64, argv: *i64) -> i64 {
  // `dryrun` emits the BEGIN request this client WOULD send and exits without opening a socket.
  // It exists because a malformed envelope is rejected by the SERVER, for a reason that names neither
  // the client nor the real fault -- so the request must be inspectable without a network. It is also
  // what nx_content_put_client_gate forks: the envelope is then a decidable, deterministic artifact.
  var base: i64 = 0
  if argc > 1 { if cc_streq(argv[1] as *u8, "dryrun" as *u8) == 1 { base = 1 } }
  if argc < 5 + base {
      cc_eo("usage: nx_content_put_client [dryrun] <local_path> <dest> <capfile> <url> [expect=<sha256hex>]\n" as *u8)
      return 2
  }
  let lpath: *u8 = argv[1 + base] as *u8
  let dest: *u8 = argv[2 + base] as *u8
  let capfile: *u8 = argv[3 + base] as *u8
  let url: *u8 = argv[4 + base] as *u8
702
  // OPTIONAL read capability, used ONLY to follow the edge JOB-STARTED promotion to its artifact.
  // A SCAN, not a positional slot, so it composes with the existing optional expect= argument in
  // either order and breaks no existing caller -- the same shape nx_gate_bite uses for its subject
  // keyword, adopted here for the same reason.
  var rcraw: *u8 = 0 as *u8
  var rclen: i64 = 0
  // DI9: the literal token `cdc` anywhere after the four positional arguments selects the dedupe path
  var cdcmode: i64 = 0
  var ai: i64 = 1
  while ai < argc {
      let av: *u8 = argv[ai] as *u8
      if cc_streq(av, "cdc" as *u8) == 1 { cdcmode = 1 }
      if cc_is_readcap(av) == 1 {
          let rcbox: *i64 = sys_mmap(16) as *i64
          rcraw = sys_read_file(((av as i64) + 8) as *u8, rcbox)
          if rcraw as i64 == 0 { cc_eo("CC-IO: cannot read readcap file\n" as *u8); return 3 }
          rclen = rcbox[0]
          while rclen > 0 {
              let c2: i64 = rcraw[rclen - 1] as i64
              if c2 <= CC_SPACE { rclen = rclen - 1 } else { rclen = 0 - rclen }
          }
          if rclen < 0 { rclen = 0 - rclen }
      }
      ai = ai + 1
  }
728
  // ---- local file ----
  let lenbox: *i64 = sys_mmap(16) as *i64
  let data: *u8 = sys_read_file(lpath, lenbox)
  if data as i64 == 0 { cc_eo("CC-IO: cannot read local file\n" as *u8); return 3 }
  let total: i64 = lenbox[0]
  let d: *u8 = sys_mmap(CC_DIGEST + 8)
  sha256_digest(data, total, d)
  let shahex: *u8 = sys_mmap(CC_SHAHEX + 8)
  cc_hex_into(d, shahex)
  cc_out("local file=" as *u8); cc_out(lpath)
  cc_out(" bytes=" as *u8); cc_num(total)
  cc_out(" sha256=" as *u8); cc_out(shahex); cc_out("\n" as *u8)
741
  // ---- cap token ----
  let capbox: *i64 = sys_mmap(16) as *i64
  let capraw: *u8 = sys_read_file(capfile, capbox)
  if capraw as i64 == 0 { cc_eo("CC-IO: cannot read cap file\n" as *u8); return 3 }
  var caplen: i64 = capbox[0]
  // trim trailing newline/whitespace -- a cap with a stray newline is the silent-401 class
  while caplen > 0 {
      let c: i64 = capraw[caplen - 1] as i64
      if c <= CC_SPACE { caplen = caplen - 1 } else { caplen = 0 - caplen }
  }
  if caplen < 0 { caplen = 0 - caplen }
  if cc_json_safe(capraw, caplen) == 0 {
      cc_eo("CC-REFUSED: the capability token carries a byte that would need JSON escaping -- refusing rather than escaping badly\n" as *u8)
      return 4
  }
757
  let store_i: i64 = hf_store_load()
  let resp: *u8 = sys_mmap(CC_RESP + 16)
  let req: *u8 = sys_mmap(CC_REQ + 16)
  let nb: *u8 = sys_mmap(CC_NUMBUF)
  // the run's start epoch names every idempotency key this run sends (set BEFORE the begin envelope is built,
  // so the dryrun envelope carries it too and the gate can see the key's shape)
  let t0: i64 = sys_now_realtime_sec()
765
  // ---- BEGIN ----
  var o: i64 = cc_put_lit(req, 0, CC_PRE)
  o = cc_put_arg(req, o, "begin" as *u8, 5, 1)
  if o < 0 { cc_eo("CC-REFUSED: unsafe argument\n" as *u8); return 4 }
  o = cc_put_arg(req, o, dest, cc_slen(dest), 0)
  if o < 0 { cc_eo("CC-REFUSED: destination carries a byte needing JSON escaping\n" as *u8); return 4 }
  let tl: i64 = cc_itoa(total, nb)
  o = cc_put_arg(req, o, nb, tl, 0)
  o = cc_put_arg(req, o, shahex, CC_SHAHEX, 0)
  if argc > 5 + base {
      let ex: *u8 = argv[5 + base] as *u8
      // A readcap= argument in this position is NOT an expect token. Without this guard the CAS slot
      // silently receives a FILE PATH, and the server refuses the transfer naming neither the real
      // cause nor the offending argument -- the wrong-subject error class this estate keeps paying for.
      if cc_is_readcap(ex) == 0 { if cc_streq(ex, "cdc" as *u8) == 0 {
          o = cc_put_arg(req, o, ex, cc_slen(ex), 0)
          if o < 0 { cc_eo("CC-REFUSED: expect argument carries a byte needing JSON escaping\n" as *u8); return 4 }
      } }
  }
  o = cc_put_lit(req, o, "],\x22_cap\x22:" as *u8)
  o = cc_put_arg(req, o, capraw, caplen, 1)
  o = cc_put_idem(req, o, "begin" as *u8, shahex, total, 0 - 1, t0)
  o = cc_put_lit(req, o, CC_TAIL)
789
  if base == 1 {
      sys_write(1, req, o)
      sys_write(1, "\n" as *u8, 1)
      return 0
  }
795
  // ---- RESUME FIRST, IF A PRIOR RUN LEFT STATE FOR THIS EXACT FILE ----
  // Everything here is additive: any failure to resume falls through to the ordinary begin below, so
  // the path that has been shipping all day is unchanged whenever there is no sidecar.
  let spath: *u8 = sys_mmap(CC_PATHCAP)
  cc_state_path(lpath, spath)
  let miss: *i64 = sys_mmap(CC_MAXCHUNKS * 8) as *i64
  var rid: i64 = 0 - 1
  var craw: i64 = 0 - 1
  var nch: i64 = 0 - 1
  // DI9: the door's content-defined parameters, read from its begin receipt (the server owns these numbers)
  var cmin: i64 = 0 - 1
  var cavg: i64 = 0 - 1
  var cmax: i64 = 0 - 1
  var resumed: i64 = 0
  let rout: *i64 = sys_mmap(64) as *i64
  // DI9: a dedupe run always begins fresh (its re-run is cheap by construction); the sidecar resume is the fixed path's
  if cdcmode == 0 { resumed = cc_resume_from_status(store_i, url, spath, shahex, capraw, caplen, resp, CC_RESP, rcraw, rclen, miss, rout, t0) }
  if resumed == 1 { rid = rout[0]; craw = rout[1]; nch = rout[2] }
814
  var n: i64 = 0
  if resumed == 0 {
  n = jf_post_follow(store_i, url, req, o, resp, CC_RESP, rcraw, rclen, CC_POLLS, CC_POLL_MS)
  if n <= 0 { cc_eo("CC-BEGIN: post failed\n" as *u8); return 5 }
  rid = cc_int_after(resp, n, "id=" as *u8)
  craw = cc_int_after(resp, n, "chunk_raw=" as *u8)
  nch = cc_int_after(resp, n, "nchunks=" as *u8)
  cmin = cc_int_after(resp, n, "cdc_min=" as *u8)
  cavg = cc_int_after(resp, n, "cdc_avg=" as *u8)
  cmax = cc_int_after(resp, n, "cdc_max=" as *u8)
  cc_out("CP-BEGIN id=" as *u8); cc_num(rid)
  cc_out(" chunk_raw=" as *u8); cc_num(craw)
  cc_out(" nchunks=" as *u8); cc_num(nch); cc_out("\n" as *u8)
  if rid < 0 {
      // ECHO THE DOOR'S ANSWER. A client that reports only "no id" has destroyed the refusal that names the
      // remedy (measured 2026-09-05: three failed begins, the cause -- a token spelling -- visible in none).
      cc_eo("CC-BEGIN: no transfer id in receipt -- the door answered: " as *u8)
      sys_write(2, resp, n)
      cc_eo("\n" as *u8)
      return 5
  }
  if craw <= 0 { cc_eo("CC-BEGIN: no chunk_raw in receipt (the server owns this number; it is never computed here)\n" as *u8); return 5 }
  // A FRESH BEGIN MEANS EVERY CHUNK IS MISSING. Stated explicitly rather than inferred from
  // `resumed == 0` at the send site, so the chunk loop has exactly ONE rule to follow and cannot
  // acquire a second meaning later.
  var mi: i64 = 0
  while mi < nch { if mi < CC_MAXCHUNKS { miss[mi] = 1 } mi = mi + 1 }
  // WRITE THE SIDECAR BEFORE SENDING ANYTHING, because a crash between begin and the first chunk is
  // exactly the case resume exists for -- recording the id only on success would leave the one
  // failure mode this feature targets unrecorded.
  let sfd: i64 = sys_openat_wr(spath, CC_MODE_RW)
  if sfd >= 0 {
      let sb2: *u8 = sys_mmap(CC_PATHCAP)
      var sp: i64 = cc_put_lit(sb2, 0, "id=" as *u8)
      let nb2: *u8 = sys_mmap(CC_NUMBUF)
      let nl2: i64 = cc_itoa(rid, nb2)
      var z: i64 = 0
      while z < nl2 { sb2[sp] = nb2[z]; sp = sp + 1; z = z + 1 }
      sp = cc_put_lit(sb2, sp, " sha=" as *u8)
      z = 0
      while z < CC_SHAHEX { sb2[sp] = shahex[z]; sp = sp + 1; z = z + 1 }
      sb2[sp] = 10 as u8; sp = sp + 1
      sys_write(sfd, sb2, sp)
      sys_close(sfd)
  }
  }
861
  // ---- CHUNKS ----
  let enc: *u8 = sys_mmap(((craw + 2) / 3) * 4 + 64)
  var idx: i64 = 0
  var sent: i64 = 0
  var skipped: i64 = 0
  // DI10: buffers for the per-chunk digest declared with each chunk, allocated ONCE outside the loop
  let cdg: *u8 = sys_mmap(CC_DIGEST + 8)
  let chex: *u8 = sys_mmap(CC_SHAHEX + 8)
  let dbuf: *u8 = sys_mmap(CC_SHAHEX + 16)
  // DI9: the dedupe path plans, declares, reads the incumbent's digests and sends only what the door lacks; the fixed
  // loop below is then skipped (idx = nch), and the commit that follows is the same commit
  if cdcmode == 1 {
      let cs: i64 = cc_send_cdc(store_i, url, req, resp, rcraw, rclen, capraw, caplen, rid, craw, cmin, cavg, cmax, data, total, shahex, t0, nb, enc, cdg, chex, dbuf)
      if cs < 0 { return 6 }
      sent = cs
      idx = nch
  }
  while idx < nch {
      // THE ONE RULE: send a chunk iff the server says it is missing. On a fresh begin every index is
      // marked, so this is a no-op and the proven path is byte-for-byte what it was. On a resume it is
      // the whole point -- and it reads from a table the SERVER filled, never from anything this
      // client remembered about what it thinks it sent.
      if miss[idx] == 0 { skipped = skipped + 1 } else {
      let lo: i64 = idx * craw
      var hi: i64 = lo + craw
      if hi > total { hi = total }
      // ONE chunk post for both paths (extracted 2026-09-06 for DI9): retry, diagnostics and both success spellings live once
      let pc: i64 = cc_post_chunk(store_i, url, req, resp, rcraw, rclen, capraw, caplen, rid, idx, lo, hi, data, enc, nb, cdg, chex, dbuf, shahex, t0, craw)
      if pc < 0 { return 6 }
      sent = sent + 1
      }
      idx = idx + 1
  }
895
  // ---- COMMIT ----
  var mo: i64 = cc_put_lit(req, 0, CC_PRE)
  mo = cc_put_arg(req, mo, "commit" as *u8, 6, 1)
  let ml: i64 = cc_itoa(rid, nb)
  mo = cc_put_arg(req, mo, nb, ml, 0)
  mo = cc_put_lit(req, mo, "],\x22_cap\x22:" as *u8)
  mo = cc_put_arg(req, mo, capraw, caplen, 1)
  mo = cc_put_idem(req, mo, "commit" as *u8, shahex, rid, 0 - 1, t0)
  mo = cc_put_lit(req, mo, CC_TAIL)
  let mn: i64 = jf_post_follow(store_i, url, req, mo, resp, CC_RESP, rcraw, rclen, CC_POLLS, CC_POLL_MS)
  if mn <= 0 {
      // A LOST COMMIT RESPONSE IS *UNKNOWN*, NOT A FAILURE, AND THIS CLIENT DOES NOT GUESS.
      cc_eo("CC-COMMIT-UNKNOWN: the commit response was lost. The transfer may well have committed.\n" as *u8)
      cc_eo("  VERIFY BY HASH, DO NOT RETRY: nx_filehash <dest> and compare against the sha256 printed above.\n" as *u8)
      return 7
  }
  var ok: i64 = 0
  if cc_find(resp, mn, shahex) >= 0 { if cc_find(resp, mn, "CP-COMMIT" as *u8) >= 0 { ok = 1 } }
  cc_out("E2E " as *u8)
  if ok == 1 { cc_out("OK" as *u8) } else { cc_out("FAILED" as *u8) }
  cc_out(": bytes=" as *u8); cc_num(total)
  cc_out(" chunks_sent=" as *u8); cc_num(sent)
  cc_out(" of=" as *u8); cc_num(nch)
  if skipped > 0 { cc_out(" skipped_already_received=" as *u8); cc_num(skipped) }
  cc_out("\n" as *u8)
  // THE SIDECAR IS REMOVED ONLY ON A CONFIRMED COMMIT. Removing it on ANY exit would throw away the
  // resume state in precisely the failure this feature exists for; leaving it after a commit would
  // point the next run at a transfer id the server has already retired. Neither is silent: a stale
  // sidecar whose transfer is gone falls through to a fresh begin, and this delete only fires on the
  // path where the whole-file digest was echoed back by the server.
  if ok == 1 { sys_unlinkat(spath) }
  if ok == 1 { return 0 }
  return 7
929}
nx_content_put_client.nx source

`nx_content_put_client.nx` source
