code wiki / _hdl_build / nx_docportal_search_serve_snip_20260912.nx
`nx_docportal_search_serve_snip_20260912.nx` source

↩ module page · 1269 lines · 73291 B
1// nx_docportal_search_serve.nx -- R2: the PUBLIC /search serve handler over the SOVEREIGN seg_store search.
2// bytes-in -> bytes-out (no socket -- the gate drives it directly, like dad_handle). Parses GET /search?q=<query>,
3// runs dss_search over the domain's PUBLIC seg_store shard (NO tsv), reads each hit's text (ss_hget) and renders a
4// branded results page with Content-Length (sites.elf's buffered reverse proxy needs the length). A stale/old-
5// format shard (-2) degrades to "0 results", never a 500. license_tier: ORIGINAL
6import "nx_docportal_search_seg.nx"
7import "nx_artifact_root.nx"   // ar_resolve/ar_read: the estate's ONE artifact-root resolver (CWD-independent conf lookup)
8import "nx_textcut.nx"         // tc_cut_trim/tc_start: NO title ends mid-word, NO snippet begins mid-word
9import "nx_docprose.nx"        // dpr_title/dpr_content_start: skip HTTP-capture headers and markup front matter
10
11// Consts for the zero-alloc numeric emitter + timespec buffer; MUST precede their first readers.
12const DSV_ASCII_0: i64 = 48
13const DSV_DEC: i64 = 10
14const DSV_TSBUF: i64 = 16
15
16const DSV_MAGIC_1000000: i64 = 1000000
17const DSV_MAGIC_1024: i64 = 1024
18const DSV_MAGIC_80000: i64 = 80000
19
20const DSV_OUTCAP: i64 = 262144
21const DSV_BODYCAP: i64 = 786432   // uniform per-request body mmap size (>= the largest body 600000); munmap'd every request to kill the leak
22const DSV_MAXR:   i64 = 30       // results per page (20->30 2026-07-24: fuller SERPs; the shrunk tf-scan cap keeps it fast)
23const DSV_SNIP:   i64 = 240     // chars of a hit's text to show
24// ---- caps that were BARE LITERALS at their cut sites until 2026-08-25 (rule 11). Naming them is not
25// cosmetic here: DSV_TITLE_CAP is the exact number that produced the live "...Database (RE" title, and a
26// reader who could not see it named could not connect the title defect to the snippet defect it caused.
27const DSV_TITLE_CAP:  i64 = 72   // bytes of the title line shown
28const DSV_TITLE_FLOOR: i64 = 56  // degenerate fallback when a document has no titled line at all
29const DSV_SENT_MAX:   i64 = 320  // hard cap on one "sentence" before dsv_best_sentence gives up looking for . ! ?
30const DSV_SNIPSCAN:   i64 = 8000 // head window scanned for the best query-covering sentence
31const DSV_SENT_MIN:   i64 = 40   // shortest span that can qualify as a sentence
32const DSV_SENT_MAXNL: i64 = 2    // newlines tolerated inside prose before it reads as a nav blob
33
34func dsv_slen(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n }
35func dsv_cat(out: *u8, o: i64, s: *u8) -> i64 { var i: i64 = 0; while s[i] != (0 as u8) { out[o] = s[i]; o = o + 1; i = i + 1 } return o }
36func dsv_catn(out: *u8, o: i64, v: i64) -> i64 {
  if v == 0 { out[o] = 48 as u8; return o + 1 }
  var m: i64 = v
  if m < 0 { out[o] = 45 as u8; o = o + 1; m = 0 - m }
  // MSB-FIRST: zero allocation (2026-07-31, debt 1785516350). Byte-identical output.
  var pw: i64 = 1
  while m / pw >= DSV_DEC { pw = pw * DSV_DEC }
  while pw > 0 { out[o] = (DSV_ASCII_0 + ((m / pw) % DSV_DEC)) as u8; o = o + 1; pw = pw / DSV_DEC }
  return o
45}
46// HTML-escape src[0..n) into out (defensive at the boundary: query echo + doc text are untrusted)
47func dsv_esc(out: *u8, o: i64, src: *u8, n: i64) -> i64 {
  var i: i64 = 0
  while i < n {
      let c: u8 = src[i]
      if c == (60 as u8) { o = dsv_cat(out, o, "&lt;" as *u8) }
      else { if c == (62 as u8) { o = dsv_cat(out, o, "&gt;" as *u8) }
      else { if c == (38 as u8) { o = dsv_cat(out, o, "&amp;" as *u8) }
      else { if c == (34 as u8) { o = dsv_cat(out, o, "&quot;" as *u8) }
      else { out[o] = c; o = o + 1 } } } }
      i = i + 1
  }
  return o
59}
60func dsv_hexval(c: u8) -> i64 {
  if c >= (48 as u8) { if c <= (57 as u8) { return (c - (48 as u8)) as i64 } }
  if c >= (97 as u8) { if c <= (102 as u8) { return ((c - (97 as u8)) as i64) + 10 } }
  if c >= (65 as u8) { if c <= (70 as u8) { return ((c - (65 as u8)) as i64) + 10 } }
  return 0 - 1
65}
66// url-decode src[0..n) -> out (cap outcap). %XX -> byte, '+' -> space. Returns out length.
67func dsv_urldecode(src: *u8, n: i64, out: *u8, outcap: i64) -> i64 {
  var i: i64 = 0
  var o: i64 = 0
  while i < n {
      if o >= outcap { return o }
      let c: u8 = src[i]
      if c == (37 as u8) {
          var handled: i64 = 0
          if i + 2 < n {
              let hh: i64 = dsv_hexval(src[i + 1])
              let ll: i64 = dsv_hexval(src[i + 2])
              if hh >= 0 { if ll >= 0 { out[o] = (hh * 16 + ll) as u8; o = o + 1; i = i + 3; handled = 1 } }
          }
          if handled == 0 { out[o] = c; o = o + 1; i = i + 1 }
      } else {
          if c == (43 as u8) { out[o] = 32 as u8 } else { out[o] = c }
          o = o + 1; i = i + 1
      }
  }
  return o
87}
88// extract query param `name` (nlen chars) from the request line "M <url>?a=b&name=val HTTP/1.1". urldecoded -> out.
89// Returns value length, or 0 if absent.
90func dsv_qparam(req: *u8, req_n: i64, name: *u8, nlen: i64, out: *u8, outcap: i64) -> i64 {
  var us: i64 = 0 - 1
  var ue: i64 = req_n
  var sp: i64 = 0
  var i: i64 = 0
  while i < req_n {
      if req[i] == (32 as u8) {
          if sp == 0 { us = i + 1; sp = 1 } else { if sp == 1 { ue = i; sp = 2 } }
      }
      i = i + 1
  }
  if us < 0 { return 0 }
  var qs: i64 = 0 - 1
  i = us
  while i < ue { if req[i] == (63 as u8) { if qs < 0 { qs = i + 1 } } i = i + 1 }
  if qs < 0 { return 0 }
  var p: i64 = qs
  while p < ue {
      var m: i64 = 1
      var x: i64 = 0
      while x < nlen { if (p + x) >= ue { m = 0 } else { if req[p + x] != name[x] { m = 0 } } x = x + 1 }
      if m == 1 { if (p + nlen) < ue { if req[p + nlen] == (61 as u8) {
          let vs: i64 = p + nlen + 1
          var vend: i64 = 0 - 1
          var ve: i64 = vs
          while ve < ue { if req[ve] == (38 as u8) { if vend < 0 { vend = ve } } ve = ve + 1 }
          if vend < 0 { vend = ue }
          return dsv_urldecode(((req as i64) + vs) as *u8, vend - vs, out, outcap)
      } } }
      var adv: i64 = 0 - 1
      var y: i64 = p
      while y < ue { if req[y] == (38 as u8) { if adv < 0 { adv = y + 1 } } y = y + 1 }
      if adv < 0 { p = ue } else { p = adv }
  }
  return 0
125}
126// dsv_host: extract the Host header value (the domain) from an HTTP request -> the search shard is dp-<domain>-pub-.
127// Port stripped; empty if absent (search then finds no shard -> graceful "0 results"). Matches "Host:" and "host:".
128func dsv_host(req: *u8, req_n: i64, out: *u8, cap: i64) -> i64 {
  var i: i64 = 0
  var hs: i64 = 0 - 1
  while i + 5 < req_n {
      if req[i] == (10 as u8) {
          var hmatch: i64 = 0
          if req[i + 1] == (72 as u8) { hmatch = 1 }
          if req[i + 1] == (104 as u8) { hmatch = 1 }
          if hmatch == 1 { if req[i + 2] == (111 as u8) { if req[i + 3] == (115 as u8) { if req[i + 4] == (116 as u8) { if req[i + 5] == (58 as u8) { hs = i + 6 } } } } }
      }
      i = i + 1
  }
  if hs < 0 { out[0] = 0 as u8; return 0 }
  var p: i64 = hs
  var g1: i64 = 1
  while g1 == 1 { if p < req_n { if req[p] == (32 as u8) { p = p + 1 } else { g1 = 0 } } else { g1 = 0 } }
  var o: i64 = 0
  var g2: i64 = 1
  while g2 == 1 {
      if p >= req_n { g2 = 0 } else {
          let c: u8 = req[p]
          if c == (13 as u8) { g2 = 0 } else { if c == (10 as u8) { g2 = 0 } else { if c == (58 as u8) { g2 = 0 } else {
              if o < cap { out[o] = c; o = o + 1 }
              p = p + 1
          } } }
      }
  }
  out[o] = 0 as u8
  return o
157}
158// tokenize the query with the INDEX'S OWN tokenizer (mirrors dss_search's inline block) so highlight
159// decisions align exactly with what matched. termstore = 16x64 bytes; returns nterms.
160func dsv_tokq(q: *u8, qn: i64, termstore: *u8, termptrs: *i64, tbl: *u8) -> i64 {
  var nterms: i64 = 0
  let qpos: *i64 = sys_mmap(16) as *i64
  qpos[0] = 0
  let tb: *u8 = sys_mmap(64)
  var qgo: i64 = 1
  while qgo == 1 {
      let l: i64 = ss_tok_next2(q, qn, qpos, tb, tbl)
      if l < 0 { qgo = 0 } else {
          if nterms < 16 {
              let dst: *u8 = (termstore as i64 + nterms * 64) as *u8
              var i: i64 = 0
              while tb[i] != (0 as u8) { dst[i] = tb[i]; i = i + 1 }
              dst[i] = 0 as u8
              termptrs[nterms] = dst as i64
              nterms = nterms + 1
          }
      }
  }
  return nterms
180}
181// escape src[0..n) into out while <b>-wrapping every token that matches a query term. Own scanner over the
182// SAME classifier table as the index tokenizer (lowercase alnum runs, len>=2, 32-char compare cap), with
183// explicit run offsets -- so highlights == matches and the raw bytes still pass through dsv_esc (XSS-safe).
184func dsv_hl(out: *u8, o: i64, src: *u8, n: i64, termptrs: *i64, nterms: i64, tbl: *u8) -> i64 {
  let tok: *u8 = sys_mmap(40)
  var i: i64 = 0
  while i < n {
      let m: i64 = tbl[src[i]] as i64
      if m == 0 {
          o = dsv_esc(out, o, ((src as i64) + i) as *u8, 1)
          i = i + 1
      } else {
          var e: i64 = i
          var l: i64 = 0
          var run: i64 = 1
          while run == 1 {
              if e >= n { run = 0 } else {
                  let c: i64 = tbl[src[e]] as i64
                  if c == 0 { run = 0 } else {
                      if l < 32 { tok[l] = c as u8; l = l + 1 }
                      e = e + 1
                  }
              }
          }
          tok[l] = 0 as u8
          var hit: i64 = 0
          if l >= 2 {
              var t: i64 = 0
              while t < nterms { if dss_streq(tok, termptrs[t] as *u8) == 1 { hit = 1 } t = t + 1 }
          }
          if hit == 1 { o = dsv_cat(out, o, "<b>" as *u8) }
          o = dsv_esc(out, o, ((src as i64) + i) as *u8, e - i)
          if hit == 1 { o = dsv_cat(out, o, "</b>" as *u8) }
          i = e
      }
  }
  return o
218}
219// url-encode src[0..n) -> out (alnum passthrough, else %XX) so a decoded query can ride a result href.
220func dsv_urlenc(out: *u8, o: i64, src: *u8, n: i64) -> i64 {
  let hex: *u8 = "0123456789ABCDEF" as *u8
  var i: i64 = 0
  while i < n {
      let c: i64 = src[i] as i64
      var plain: i64 = 0
      if c >= 48 { if c <= 57 { plain = 1 } }
      if c >= 97 { if c <= 122 { plain = 1 } }
      if c >= 65 { if c <= 90 { plain = 1 } }
      if plain == 1 { out[o] = c as u8; o = o + 1 }
      else {
          out[o] = 37 as u8
          out[o + 1] = hex[(c >> 4) & 15]
          out[o + 2] = hex[c & 15]
          o = o + 3
      }
      i = i + 1
  }
  return o
239}
240// build the source-url key "url:<cid>" -- an ingested SITE PAGE / crawled web page carries the page's real
241// location in this row, so its result links to the PAGE itself instead of the /doc text view.
242func dsv_mkurlkey(cid: i64, out: *u8) -> i64 {
  out[0] = 117 as u8; out[1] = 114 as u8; out[2] = 108 as u8; out[3] = 58 as u8   // "url:"
  var o: i64 = 4
  if cid == 0 { out[o] = 48 as u8; o = o + 1; out[o] = 0 as u8; return o }
  let t: *u8 = sys_mmap(24)
  var k: i64 = 0
  var m: i64 = cid
  while m > 0 { t[k] = (48 + (m % 10)) as u8; m = m / 10; k = k + 1 }
  var j: i64 = 0
  while j < k { out[o] = t[k - 1 - j]; o = o + 1; j = j + 1 }
  out[o] = 0 as u8
  return o
254}
255// render one result: linked title + snippet, query terms <b>-highlighted. Link target: the doc's url:<cid>
256// row when present (a real page), else the /doc?cid text view (q + web scope ride the /doc link).
257// ONE process-lifetime scratch box, replacing sys_mmap-per-call. dsv_result runs once PER RESULT and the
258// old body mmap'd two 16-byte out-boxes every time; sys_mmap rounds up to a PAGE, so a 30-result SERP
259// asked the kernel for 60 pages of scratch it never released. Whether that is a leak or merely repeated
260// waste depends on this daemon's process model, so the claim made here is only the one that is certain:
261// it removes the per-call page allocations. Same defect class as the nx_ts_lumadiff c_num body.
262const DSV_BOXBYTES: i64 = 64
263static dsv_box_g: i64
264func dsv_box() -> *i64 {
  if dsv_box_g == 0 { dsv_box_g = sys_mmap(DSV_BOXBYTES) as i64 }
  return dsv_box_g as *i64
267}
268// slot i of a box, as a pointer an out-param can be written through
269func dsv_slot(b: *i64, i: i64) -> *i64 { return ((b as i64) + i * 8) as *i64 }
270
271// Raw source span only: HTML highlighting and JSON escaping remain at their own boundaries.
272func dsv_snippet_span(txt: *u8, tn: i64, title_end: i64, termptrs: *i64, nterms: i64, tbl: *u8, offout: *i64, lenout: *i64, cutbox: *i64) -> i64 {
  var scanlen: i64 = tn
  if scanlen > DSV_SNIPSCAN { scanlen = DSV_SNIPSCAN }
  let matched: i64 = dsv_best_sentence(txt, scanlen, termptrs, nterms, tbl, offout, lenout)
  if matched == 0 {
      var start: i64 = tc_start(txt, tn, title_end)
      if start >= tn { start = tc_skip_ws(txt, tn, 0) }
      offout[0] = start
      lenout[0] = tc_cut_trim(((txt as i64) + start) as *u8, tn - start, DSV_SNIP, cutbox)
  }
  return matched
283}
284
285func dsv_result(body: *u8, b: i64, txt: *u8, tn: i64, cid: i64, q: *u8, qn: i64, termptrs: *i64, nterms: i64, tbl: *u8, url: *u8, ul: i64, webscope: i64) -> i64 {
  // ---- TITLE. WAS: "the first non-empty LINE, up to 72 bytes". That comment claimed it avoided nav
  // chrome, and it did skip blank lines -- but it then served whatever the first line WAS, and on this
  // corpus that is routinely an HTTP status line or a raw markup tag, because evidence-mirror captures
  // are indexed with their wire bytes intact. It also cut at a fixed 72 bytes, mid-token.
  // NOW: nx_docprose steps past capture headers and markup-only front matter, and nx_textcut cuts on a
  // TOKEN boundary. That second half also repairs the SNIPPET, because the snippet fallback below starts
  // exactly where the title ended -- one cap, two visible defects.
  let tbox: *i64 = dsv_box()
  var ts: i64 = 0
  var te: i64 = 0
  if dpr_title(txt, tn, DSV_TITLE_CAP, dsv_slot(tbox, 0), dsv_slot(tbox, 1), dsv_slot(tbox, 2)) == 1 {
      ts = tbox[0]
      te = ts + tbox[1]
  } else {
      // No titled line in the scan window. Fall back to the document head, STILL cut on a token
      // boundary: an honest degenerate case, never a fabricated title.
      ts = tc_skip_ws(txt, tn, 0)
      te = ts + tc_cut_trim(((txt as i64) + ts) as *u8, tn - ts, DSV_TITLE_FLOOR, dsv_slot(tbox, 2))
  }
  if te <= ts { ts = 0; te = tn; if te > DSV_TITLE_FLOOR { te = DSV_TITLE_FLOOR } }
  // semantic result: <article><h3><a> -- real structure, query terms bolded in the title
  var o: i64 = dsv_cat(body, b, "<article class=r><h3 class=t><a href=\"" as *u8)
  if ul > 0 {
      o = dsv_esc(body, o, url, ul)
  } else {
      o = dsv_cat(body, o, "/doc?cid=" as *u8)
      o = dsv_catn(body, o, cid)
      if qn > 0 { o = dsv_cat(body, o, "&q=" as *u8); o = dsv_urlenc(body, o, q, qn) }
      o = dsv_scope_link(body, o, webscope)
  }
  o = dsv_cat(body, o, "\">" as *u8)
  o = dsv_hl(body, o, ((txt as i64) + ts) as *u8, te - ts, termptrs, nterms, tbl)
  o = dsv_cat(body, o, "</a></h3>" as *u8)
  if ul > 0 {
      o = dsv_cat(body, o, "<div class=u>" as *u8)
      o = dsv_esc(body, o, url, ul)
      o = dsv_cat(body, o, "</div>" as *u8)
  }
  // ---- query-biased SNIPPET (the SOTA fix): show the best query-COVERING sentence (Google/Mojeek style),
  // NOT the page's leading nav chrome. Fall back to content just past the title only when the query isn't
  // found in prose. dsv_best_sentence already filters newline-dense nav blobs, so snippets read like content. ----
  o = dsv_cat(body, o, "<div class=s>" as *u8)
  let aoff: *i64 = dsv_slot(tbox, 5)
  let alen: *i64 = dsv_slot(tbox, 6)
  dsv_snippet_span(txt, tn, te, termptrs, nterms, tbl, aoff, alen, dsv_slot(tbox, 4))
  o = dsv_hl(body, o, ((txt as i64) + aoff[0]) as *u8, alen[0], termptrs, nterms, tbl)
  o = dsv_cat(body, o, "</div></article>" as *u8)
  return o
334}
335// shared page style (search + doc views render as one system). MOBILE-FIRST by measured markers:
336// 16px inputs (iOS never auto-zooms), >=44px touch targets (button + tabs), text-size-adjust locked,
337// prefers-color-scheme dark palette, overflow-wrap on urls -- the serve gate asserts each marker.
338func dsv_style(body: *u8, b: i64) -> i64 {
  var o: i64 = dsv_cat(body, b, "<style>html{-webkit-text-size-adjust:100%;text-size-adjust:100%}body{font-family:-apple-system,Segoe UI,sans-serif;max-width:680px;margin:3vh auto;padding:0 16px;color:#1c1c1e}header{margin:0 0 1rem}.brand{font-size:1.15rem;font-weight:700;color:#1c1c1e;text-decoration:none;letter-spacing:-.02em}.brand span{color:#0a6}form{display:flex;gap:8px}input[name=q]{flex:1;min-width:0;padding:12px;border:1px solid #ccc;border-radius:10px;font-size:16px}button{min-height:44px;padding:10px 20px;border:0;border-radius:10px;background:#0a6;color:#fff;font-size:16px}.meta{color:#666;font-size:.9rem;margin:1rem 0}.meta a{color:#0a6;text-decoration:none}.tabs{margin:.6rem 0 0}.tabs a{display:inline-block;min-height:44px;line-height:24px;color:#666;text-decoration:none;font-size:.95rem;padding:10px 14px;border-radius:8px}.tabs a.on{background:#e6f6ef;color:#064;font-weight:600}.ans{border:1px solid #bfe8d4;background:#f3fbf7;border-radius:12px;padding:14px 16px;margin:0 0 .4rem}.anstxt{font-size:1.02rem;line-height:1.5}.anssrc{color:#666;font-size:.8rem;margin-top:6px}.r{padding:.9rem 0;border-top:1px solid #eee;margin:0}.t{font-weight:600;font-size:1rem;margin:0}.t a{color:inherit;text-decoration:none}.t a:hover{text-decoration:underline;color:#0a6}.u{color:#0a6;font-size:.82rem;overflow-wrap:anywhere}.s{color:#444;font-size:.94rem}b{background:#e6f6ef}.doc{white-space:pre-wrap;line-height:1.55;overflow-wrap:anywhere}.pager{padding:1rem 0;border-top:1px solid #eee}.pager a{display:inline-block;min-height:44px;line-height:24px;padding:10px 14px;color:#0a6;text-decoration:none;font-weight:600}.credo{color:#8e8e93;font-size:.78rem;padding:1.4rem 0 2rem;border-top:1px solid #eee;margin-top:1rem}" as *u8)
  o = dsv_cat(body, o, "@media (prefers-color-scheme:dark){body{background:#111214;color:#e8e8ea}.brand{color:#e8e8ea}input[name=q]{background:#1c1c1e;color:#e8e8ea;border-color:#3a3a3c}.s{color:#a8a8ad}.meta{color:#8e8e93}.r,.pager,.credo{border-top-color:#2c2c2e}b{background:#0f3d2e;color:#b7f0d4}.tabs a{color:#a8a8ad}.tabs a.on{background:#0f3d2e;color:#7fd4ae}.t a:hover{color:#3fbf8f}.u{color:#3fbf8f}.meta a{color:#3fbf8f}.ans{background:#12241c;border-color:#1d4a36}.anssrc{color:#8e8e93}.pager a{color:#3fbf8f}}</style>" as *u8)
  return o
342}
343// JSON string escaper (API-first boundary: title/snippet/text are untrusted bytes -> \" \\ and controls)
344// R-UTF8 (2026-09-04): length of the VALID UTF-8 sequence starting at src[i], or 0 if the bytes there are
345// not valid UTF-8. Rejects stray continuations (0x80-0xBF), the overlong C0/C1 leads, and anything above
346// the U+10FFFF lead (0xF5+), and requires every continuation byte to be 0x80-0xBF. Bounded by n, so a
347// truncated sequence at the tail reports 0 rather than reading past the buffer.
348func dsv_u8seq(src: *u8, n: i64, i: i64) -> i64 {
  let c: i64 = src[i] as i64
  if c < 128 { return 1 }
  if c < 194 { return 0 }
  var need: i64 = 0
  if c < 224 { need = 1 } else { if c < 240 { need = 2 } else { if c < 245 { need = 3 } else { need = 0 } } }
  if need == 0 { return 0 }
  if i + need > n - 1 { return 0 }
  var ok: i64 = 1
  var k: i64 = 1
  while k <= need {
      let cc: i64 = src[i + k] as i64
      if cc < 128 { ok = 0 }
      if cc > 191 { ok = 0 }
      k = k + 1
  }
  if ok == 0 { return 0 }
  return need + 1
366}
367func dsv_jesc(out: *u8, o: i64, src: *u8, n: i64) -> i64 {
  let hex: *u8 = "0123456789abcdef" as *u8
  var i: i64 = 0
  while i < n {
      let c: i64 = src[i] as i64
      if c == 34 { o = dsv_cat(out, o, "\\\"" as *u8) }
      else { if c == 92 { o = dsv_cat(out, o, "\\\\" as *u8) }
      else { if c == 10 { o = dsv_cat(out, o, "\\n" as *u8) }
      else { if c == 13 { o = dsv_cat(out, o, "\\r" as *u8) }
      else { if c == 9 { o = dsv_cat(out, o, "\\t" as *u8) }
      else { if c < 32 {
          o = dsv_cat(out, o, "\\u00" as *u8)
          out[o] = hex[(c >> 4) & 15]; o = o + 1
          out[o] = hex[c & 15]; o = o + 1
      } else {
          // R-UTF8 (2026-09-04): EMIT ONLY VALID UTF-8. The old line copied every byte >= 32 verbatim,
          // so raw Latin-1/CP1252 crawl bytes -- and a gzip magic header stored as a document title --
          // went straight into a body declared `charset=utf-8`. MEASURED: 3 of 30 sampled queries could
          // not be decoded by a standards-compliant JSON client at all. A public API must never emit a
          // document its own Content-Type says is impossible.
          let sl: i64 = dsv_u8seq(src, n, i)
          if sl > 0 {
              // already valid UTF-8 (ASCII included): copy the WHOLE sequence, never split it
              var z: i64 = 0
              while z < sl { out[o] = src[i + z]; o = o + 1; z = z + 1 }
              i = i + (sl - 1)
          } else { if c > 159 {
              // invalid UTF-8 in the Latin-1 printable range: the crawler stored an undecoded
              // ISO-8859-1 / CP1252 page. Transcode it, so "f\xfcr" serves as "fuer"-with-umlaut --
              // the information is RECOVERED rather than destroyed, and the output is valid UTF-8.
              out[o] = (192 + (c >> 6)) as u8; o = o + 1
              out[o] = (128 + (c & 63)) as u8; o = o + 1
          } else {
              // a C1 control, or a byte of binary content (a gzip stream indexed as text): there is no
              // text meaning to recover, so emit U+FFFD REPLACEMENT CHARACTER as raw UTF-8 (EF BF BD).
              out[o] = 239 as u8; o = o + 1
              out[o] = 191 as u8; o = o + 1
              out[o] = 189 as u8; o = o + 1
          } }
      } } } } } }
      i = i + 1
  }
  return o
410}
411// wrap a finished JSON body in a response with CORS (a PUBLIC read API any site/app may call)
412// wrap a JSON body + FREE it. EVERY per-request body is mmap'd at DSV_BODYCAP (uniform) so munmap of that
413// size is always exact. This eliminates the ~256-586KB/request leak that forced the daemon to recycle every
414// 5000 requests -- the ~15s respawn gap was the "takes forever" the operator hit (2026-07-03). With the leak
415// gone the daemon runs a high budget without growing RSS. rule 16/21.
416func dsv_respond_json(out: *u8, status: *u8, body: *u8, b: i64) -> i64 {
  var o: i64 = 0
  o = dsv_cat(out, o, "HTTP/1.1 " as *u8)
  o = dsv_cat(out, o, status)
  o = dsv_cat(out, o, "\r\nContent-Type: application/json; charset=utf-8\r\nAccess-Control-Allow-Origin: *\r\nCache-Control: no-store\r\nConnection: close\r\nContent-Length: " as *u8)
  o = dsv_catn(out, o, b)
  o = dsv_cat(out, o, "\r\n\r\n" as *u8)
  var z: i64 = 0
  while z < b { out[o] = body[z]; o = o + 1; z = z + 1 }
  sys_munmap(body, DSV_BODYCAP)
  return o
427}
428// wrap an HTML body + FREE it (Content-Length for the buffered proxy).
429func dsv_respond(out: *u8, status: *u8, body: *u8, b: i64) -> i64 {
  var o: i64 = 0
  o = dsv_cat(out, o, "HTTP/1.1 " as *u8)
  o = dsv_cat(out, o, status)
  o = dsv_cat(out, o, "\r\nContent-Type: text/html; charset=utf-8\r\nConnection: close\r\nContent-Length: " as *u8)
  o = dsv_catn(out, o, b)
  o = dsv_cat(out, o, "\r\n\r\n" as *u8)
  var z: i64 = 0
  while z < b { out[o] = body[z]; o = o + 1; z = z + 1 }
  sys_munmap(body, DSV_BODYCAP)
  return o
440}
441// scope resolution: THREE scopes (the operator's model 2026-07-04) -> 0 SITE (this Host domain's own shard),
442// 1 WEB (the broad crawled-everything corpus "web"), 2 TRUSTED (client-flagged good resources "trusted").
443// effdom = the resolved shard name. The return value drives the tabs + all scope-preserving links.
444// THE DEFAULT SEARCH SCOPE IS DATA, NOT A CONSTANT (rules 11 + 17). Measured 2026-08-22: the default was
445// hardcoded `var scope = 1` (WEB) on 2026-07-24 with a rationale naming nishifamily.com ONLY -- but ONE
446// daemon serves every domain, so it silently turned every CLIENT site's own search into an open-web search
447// (andelinwest.com, a law firm: /search?q=probate returned recipe blogs and auction lots, ZERO firm pages).
448// A change justified for one subject was applied to all subjects. Now sourced from search_default_scope.conf.
449const DSV_SCOPE_SITE: i64 = 0
450const DSV_SCOPE_WEB: i64 = 1
451const DSV_SCOPE_TRUSTED: i64 = 2
452const DSV_SCOPE_CONF_CAP: i64 = 4096
453const DSV_PATHCAP: i64 = 1024
454const DSV_CH_LF: i64 = 10
455const DSV_CH_CR: i64 = 13
456const DSV_CH_SP: i64 = 32
457const DSV_CH_HASH: i64 = 35
458static dsv_sc_buf: *u8
459static dsv_sc_n: i64
460static dsv_sc_loaded: i64
461// Loaded ONCE into a static (the conf is config, not per-request state): dsv_scope runs on EVERY request
462// and this file already munmaps its body buffer per request to kill a leak -- an mmap per call here would
463// reintroduce exactly that. Same static-cache shape as nx_artifact_root's own ar_buf/ar_n/ar_loaded.
464func dsv_scope_conf_load() -> i64 {
  if dsv_sc_loaded == 1 { return dsv_sc_n }
  dsv_sc_loaded = 1
  dsv_sc_n = 0
  dsv_sc_buf = sys_mmap(DSV_SCOPE_CONF_CAP)
  let p: *u8 = sys_mmap(DSV_PATHCAP)
  if ar_resolve("knowledge/hosting/search_default_scope.conf" as *u8, p) == 1 {
      let rn: i64 = ar_read(p, dsv_sc_buf, DSV_SCOPE_CONF_CAP - 1)
      if rn > 0 { dsv_sc_n = rn }
  }
  return dsv_sc_n
475}
476// compare a conf token against a NAMED literal -- never against character codes: a string spelled as
477// numbers is the same defect as a magic number and no grep can find it.
478func dsv_tok_eq(off: i64, len: i64, lit: *u8) -> i64 {
  if dsv_slen(lit) != len { return 0 }
  var i: i64 = 0
  while i < len { if dsv_sc_buf[off+i] != lit[i] { return 0 } i = i + 1 }
  return 1
483}
484// Rows: "<domain> <site|web|trusted>". A domain with NO row returns SITE deliberately -- the miss
485// direction fails SAFE: a site's own search searching its own site is never harmful, whereas
486// web-by-default publishes unrelated third-party content onto someone else's site.
487func dsv_default_scope(domain: *u8) -> i64 {
  let n: i64 = dsv_scope_conf_load()
  if n <= 0 { return DSV_SCOPE_SITE }
  let dn: i64 = dsv_slen(domain)
  var ls: i64 = 0
  var i: i64 = 0
  while i <= n {
      var eol: i64 = 0
      if i == n { eol = 1 } else { if dsv_sc_buf[i] == (DSV_CH_LF as u8) { eol = 1 } }
      if eol == 1 {
          var le: i64 = i
          if le > ls { if dsv_sc_buf[le-1] == (DSV_CH_CR as u8) { le = le - 1 } }
          if le > ls { if dsv_sc_buf[ls] != (DSV_CH_HASH as u8) {
              var same: i64 = 1
              var k: i64 = 0
              while k < dn {
                  if ls + k >= le { same = 0; k = dn }
                  else { if dsv_sc_buf[ls+k] != domain[k] { same = 0; k = dn } else { k = k + 1 } }
              }
              if same == 1 {
                  let vs: i64 = ls + dn + 1
                  if vs < le { if dsv_sc_buf[ls+dn] == (DSV_CH_SP as u8) {
                      let vl: i64 = le - vs
                      if dsv_tok_eq(vs, vl, "web" as *u8) == 1 { return DSV_SCOPE_WEB }
                      if dsv_tok_eq(vs, vl, "site" as *u8) == 1 { return DSV_SCOPE_SITE }
                      if dsv_tok_eq(vs, vl, "trusted" as *u8) == 1 { return DSV_SCOPE_TRUSTED }
                  } }
              }
          } }
          ls = i + 1
      }
      i = i + 1
  }
  return DSV_SCOPE_SITE
521}
522func dsv_scope(req: *u8, req_n: i64, domain: *u8, effdom: *u8) -> i64 {
  let sc: *u8 = sys_mmap(32)
  let sn: i64 = dsv_qparam(req, req_n, "scope" as *u8, 5, sc, 15)
  var scope: i64 = dsv_default_scope(domain)   // PER-DOMAIN default from search_default_scope.conf (2026-08-22).
                       // The hardcoded WEB default was right for nishifamily.com and WRONG for every CLIENT site
                       // this same daemon serves. Explicit ?scope= below still overrides. WAS (2026-07-24): nishifamily.com/search IS a web search engine; the site
                       // corpus + trusted are opt-in tabs. Was 0/site -> users landed on a tiny site-search and
                       // never saw the CC/entity web index or any ranking work. Explicit ?scope=site selects site.
  if sn == 4 { if sc[0] == (115 as u8) { if sc[1] == (105 as u8) { if sc[2] == (116 as u8) { if sc[3] == (101 as u8) { scope = 0 } } } } }
  if sn == 3 { if sc[0] == (119 as u8) { if sc[1] == (101 as u8) { if sc[2] == (98 as u8) { scope = 1 } } } }
  if sn == 7 {
      if sc[0] == (116 as u8) { if sc[1] == (114 as u8) { if sc[2] == (117 as u8) { if sc[3] == (115 as u8) { if sc[4] == (116 as u8) { if sc[5] == (101 as u8) { if sc[6] == (100 as u8) { scope = 2 } } } } } } }
  }
  if scope == 1 {
      effdom[0] = 119 as u8; effdom[1] = 101 as u8; effdom[2] = 98 as u8; effdom[3] = 0 as u8   // "web"
      return 1
  }
  if scope == 2 {
      let tn0: *u8 = "trusted" as *u8
      var t: i64 = 0
      while tn0[t] != (0 as u8) { effdom[t] = tn0[t]; t = t + 1 }
      effdom[t] = 0 as u8
      return 2
  }
  var i: i64 = 0
  while domain[i] != (0 as u8) { effdom[i] = domain[i]; i = i + 1 }
  effdom[i] = 0 as u8
  return 0
550}
551// append the scope-preserving query param for a link (nothing for site, &scope=web, &scope=trusted)
552func dsv_scope_link(body: *u8, b: i64, scope: i64) -> i64 {
  if scope == 1 { return dsv_cat(body, b, "&scope=web" as *u8) }
  if scope == 2 { return dsv_cat(body, b, "&scope=trusted" as *u8) }
  return dsv_cat(body, b, "&scope=site" as *u8)   // web is the default now -> site links MUST be explicit
556}
557// the JSON scope name (site/web/trusted)
558func dsv_scope_name(body: *u8, b: i64, scope: i64) -> i64 {
  if scope == 1 { return dsv_cat(body, b, "web" as *u8) }
  if scope == 2 { return dsv_cat(body, b, "trusted" as *u8) }
  return dsv_cat(body, b, "site" as *u8)
562}
563// the scope tabs: [This site] [Trusted] [Web] -- each preserves the current query, active one highlighted
564func dsv_tabs(body: *u8, b: i64, q: *u8, qn: i64, scope: i64) -> i64 {
  var o: i64 = dsv_cat(body, b, "<p class=tabs><a " as *u8)
  if scope == 1 { o = dsv_cat(body, o, "class=on " as *u8) }
  o = dsv_cat(body, o, "href=\"/search?scope=web" as *u8)
  if qn > 0 { o = dsv_cat(body, o, "&q=" as *u8); o = dsv_urlenc(body, o, q, qn) }
  o = dsv_cat(body, o, "\">Web</a> <a " as *u8)
  if scope == 0 { o = dsv_cat(body, o, "class=on " as *u8) }
  o = dsv_cat(body, o, "href=\"/search?scope=site" as *u8)
  if qn > 0 { o = dsv_cat(body, o, "&q=" as *u8); o = dsv_urlenc(body, o, q, qn) }
  o = dsv_cat(body, o, "\">This site</a> <a " as *u8)
  if scope == 2 { o = dsv_cat(body, o, "class=on " as *u8) }
  o = dsv_cat(body, o, "href=\"/search?scope=trusted" as *u8)
  if qn > 0 { o = dsv_cat(body, o, "&q=" as *u8); o = dsv_urlenc(body, o, q, qn) }
  o = dsv_cat(body, o, "\">Trusted</a></p>" as *u8)
  return o
579}
580// monotonic microseconds (integer; the SERP shows real measured query latency like the big engines --
581// except ours is TRUE per-request wall time, not a cached estimate)
582func dsv_now_us() -> i64 {
  let ts: *i64 = sys_mmap(DSV_TSBUF) as *i64
  sys_clock_gettime_mono(ts)
  // read BOTH fields out before releasing -- computing after the munmap would be a use-after-free.
  let sec: i64 = ts[0]
  let nsec: i64 = ts[1]
  sys_munmap(ts as *u8, DSV_TSBUF)
  return sec * DSV_MAGIC_1000000 + nsec / 1000
590}
591// FEATURED ANSWER (our own featured-snippet, extracted not asserted): scan the text's sentences
592// (. ! ? boundaries; 40..320 bytes) and return the one matching the MOST distinct query terms via the
593// index's own tokenizer. offout/lenout = the winning sentence; returns distinct terms matched (0 = none).
594func dsv_best_sentence(txt: *u8, tn: i64, termptrs: *i64, nterms: i64, tbl: *u8, offout: *i64, lenout: *i64) -> i64 {
  let tok: *u8 = sys_mmap(40)
  var best: i64 = 0
  offout[0] = 0
  lenout[0] = 0
  var s: i64 = 0
  while s < tn {
      // sentence end: next . ! ? or hard cap
      var e: i64 = s
      var run: i64 = 1
      while run == 1 {
          if e >= tn { run = 0 } else {
              let c: i64 = txt[e] as i64
              if c == 46 { run = 0 } else { if c == 33 { run = 0 } else { if c == 63 { run = 0 } else {
                  if e - s >= DSV_SENT_MAX { run = 0 } else { e = e + 1 }
              } } }
          }
      }
      let slen: i64 = e - s
      // PROSE filter: extracted-page nav chrome ("Jump to content\nMain menu\n...") arrives as newline-
      // dense blobs between real periods -- a genuine sentence carries at most a stray wrap. >2 newlines
      // = not prose, never an answer (the okapi live catch, 2026-07-03).
      var nlcount: i64 = 0
      var nz: i64 = s
      while nz < e { if txt[nz] == (10 as u8) { nlcount = nlcount + 1 } nz = nz + 1 }
      if slen >= DSV_SENT_MIN { if nlcount <= DSV_SENT_MAXNL {
          // count distinct query terms present in [s, e)
          var matched: i64 = 0
          var t: i64 = 0
          while t < nterms {
              var hit: i64 = 0
              var i: i64 = s
              while i < e {
                  let m: i64 = tbl[txt[i]] as i64
                  if m == 0 { i = i + 1 } else {
                      var e2: i64 = i
                      var l: i64 = 0
                      var r2: i64 = 1
                      while r2 == 1 {
                          if e2 >= e { r2 = 0 } else {
                              let c2: i64 = tbl[txt[e2]] as i64
                              if c2 == 0 { r2 = 0 } else {
                                  if l < 32 { tok[l] = c2 as u8; l = l + 1 }
                                  e2 = e2 + 1
                              }
                          }
                      }
                      tok[l] = 0 as u8
                      if l >= 2 { if dss_streq(tok, termptrs[t] as *u8) == 1 { hit = 1; i = e } }
                      if i < e { i = e2 }
                  }
              }
              matched = matched + hit
              t = t + 1
          }
          if matched > best {
              best = matched
              offout[0] = s
              lenout[0] = slen
          }
      } }
      s = e + 1
  }
  // ---- NORMALISE BOTH ENDS OF THE CHOSEN SPAN (2026-08-25). The segmentation above ends a sentence at
  // . ! ? OR at DSV_SENT_MAX, and that second arm cuts MID-TOKEN -- so the FOLLOWING span begins mid-word.
  // That is how a live snippet came to read "FPROP) Version 9", and another "dia, the free encyclopedia".
  // Repairing the segmenter alone would not be enough: whichever span WINS must be sound at both ends, so
  // it is normalised once here rather than at each of the three call sites (result snippet, featured
  // answer, JSON api) -- one fix, and no call site can forget it.
  if best > 0 {
      let s0: i64 = tc_start(txt, tn, offout[0])
      var l0: i64 = (offout[0] + lenout[0]) - s0
      if l0 < 0 { l0 = 0 }
      // cap = l0 measured against the REAL remaining length (tn - s0), which is what makes tc_cut walk
      // the END back to a boundary instead of returning the span unchanged.
      offout[0] = s0
      lenout[0] = tc_cut_trim(((txt as i64) + s0) as *u8, tn - s0, l0, dsv_slot(dsv_box(), 3))
  }
  return best
673}
674// THE SERVE: (domain, request bytes) -> branded HTTP results page bytes into out. Returns out length.
675func dss_serve(domain: *u8, req: *u8, req_n: i64, out: *u8) -> i64 {
  let t0: i64 = dsv_now_us()
  let q: *u8 = sys_mmap(DSV_MAGIC_1024)
  let qn: i64 = dsv_qparam(req, req_n, "q" as *u8, 1, q, 1023)
  let effdom: *u8 = sys_mmap(256)
  let webscope: i64 = dsv_scope(req, req_n, domain, effdom)
  // page param (digits; junk -> page 0)
  let pbuf: *u8 = sys_mmap(32)
  let pbn: i64 = dsv_qparam(req, req_n, "p" as *u8, 1, pbuf, 15)
  let pok: *i64 = sys_mmap(16) as *i64
  var page: i64 = dsv_atoin(pbuf, pbn, pok)
  if pok[0] == 0 { page = 0 }
  if page > 25 { page = 25 }
  let cids: *i64 = sys_mmap(DSV_MAXR * 8) as *i64
  let scores: *i64 = sys_mmap(DSV_MAXR * 8) as *i64
  let totalbox: *i64 = sys_mmap(16) as *i64
  var nres: i64 = 0
  if qn > 0 { nres = dss_search_off(effdom, q, qn, cids, scores, DSV_MAXR, page * DSV_MAXR, totalbox) }
  if nres < 0 { nres = 0 }
  let total: i64 = totalbox[0]
  let qus: i64 = dsv_now_us() - t0
  // INDEX-UNAVAILABLE MARKER (2026-08-22). Web scope + zero results + no/empty cached web handle => say
  // "index unavailable" instead of "0 result(s)". nres==0 is in the predicate ON PURPOSE: dss_search_off can
  // answer from the shared query memo without opening anything in this child, so a memo hit carries results
  // while dsc_handle is still NULL -- a "withheld" header over a rendered list would be a lie. Site/trusted
  // shards open per request and are not cached: 0 there means nothing published, and "0 result(s)" stays true.
  var idxdown: i64 = 0
  if webscope == 1 { if nres == 0 { if dss_web_index_segments() <= 0 { idxdown = 1 } } }
  // query terms + classifier table, once per request: dsv_result highlights with the index's own tokens
  let tbl: *u8 = sys_mmap(272)
  ss_tok_table(tbl)
  let termstore: *u8 = sys_mmap(16 * 64)
  let termptrs: *i64 = sys_mmap(16 * 8) as *i64
  var nterms: i64 = 0
  if qn > 0 { nterms = dsv_tokq(q, qn, termstore, termptrs, tbl) }
  let body: *u8 = sys_mmap(DSV_BODYCAP)
  var b: i64 = 0
  b = dsv_cat(body, b, "<!DOCTYPE html><meta charset=utf-8><meta name=viewport content=\"width=device-width,initial-scale=1\"><title>" as *u8)
  if qn > 0 { b = dsv_esc(body, b, q, qn); b = dsv_cat(body, b, " &mdash; " as *u8) }
  b = dsv_cat(body, b, "Nishi Search</title>" as *u8)
  b = dsv_style(body, b)
  b = dsv_cat(body, b, "<header><a class=brand href=\"/search\">Nishi<span>Search</span></a></header><main>" as *u8)
  b = dsv_cat(body, b, "<form action=/search method=get role=search>" as *u8)
  if webscope == 1 { b = dsv_cat(body, b, "<input type=hidden name=scope value=web>" as *u8) }
  if webscope == 2 { b = dsv_cat(body, b, "<input type=hidden name=scope value=trusted>" as *u8) }
  b = dsv_cat(body, b, "<input name=q value=\"" as *u8)
  b = dsv_esc(body, b, q, qn)
  b = dsv_cat(body, b, "\" placeholder=\"Search\" autofocus aria-label=\"Search query\"><button>Search</button></form>" as *u8)
  b = dsv_tabs(body, b, q, qn, webscope)
  if qn == 0 {
      b = dsv_cat(body, b, "<p class=meta>Enter a search term.</p>" as *u8)
  } else {
      if idxdown == 1 { b = dsv_cat(body, b, "<p class=meta><b>index unavailable &mdash; results withheld</b> for &ldquo;" as *u8) } else { b = dsv_cat(body, b, "<p class=meta>" as *u8); b = dsv_catn(body, b, nres); b = dsv_cat(body, b, " result(s) for &ldquo;" as *u8) }
      b = dsv_esc(body, b, q, qn); b = dsv_cat(body, b, "&rdquo;" as *u8)
      // SAY WHEN THE TOTAL IS AN ESTIMATE (2026-08-25). Once candidacy saturates at DSS_MAXCAND the
      // total stops being an enumeration and becomes a df-derived LOWER BOUND -- and it was printed in
      // byte-identical form to an exact count, so "of 372317 matched" read as more precise than the
      // "of 201 matched" beside it when it was strictly less so. "about" is the whole fix: it costs five
      // characters and it stops the page asserting a precision the engine never had.
      if total > nres {
          b = dsv_cat(body, b, " of " as *u8)
          if dss_last_estimated() == 1 { b = dsv_cat(body, b, "about " as *u8) }
          b = dsv_catn(body, b, total)
          b = dsv_cat(body, b, " matched" as *u8)
      }
      if page > 0 { b = dsv_cat(body, b, " &middot; page " as *u8); b = dsv_catn(body, b, page + 1) }
      b = dsv_cat(body, b, " &middot; " as *u8)
      if qus < 1000 { b = dsv_cat(body, b, "&lt;1" as *u8) } else { b = dsv_catn(body, b, qus / 1000) }
      b = dsv_cat(body, b, " ms" as *u8)
      if totalbox[1] == 0 { b = dsv_cat(body, b, " &middot; phrase matched loosely (index upgrading)" as *u8) }
      b = dsv_cat(body, b, "</p>" as *u8)
      // ★COVERAGE HONESTY (operator 2026-07-04: "we dont want partial results thinking we return full
      // results"): the web scope is NISHI'S OWN INDEX (our crawl + Common Crawl), NOT the whole live web.
      // This line appears on EVERY web result set so N results is never mistaken for "all the web has".
      if webscope == 1 { b = dsv_cat(body, b, "<p class=meta style=\"color:#666;font-size:.85rem\">Scope: Nishi&rsquo;s own index (our crawl + Common Crawl) &mdash; not the whole live web. Some sites block all automated crawlers (anti-bot walls), so their pages may be absent here even though we never filter lawful content.</p>" as *u8) }
      // DID-YOU-MEAN: on zero hits, offer the dictionary's closest reading of the query (typo rung)
      if nres == 0 {
          let fix: *u8 = sys_mmap(DSV_MAGIC_1024)
          let fl: i64 = dss_correct(effdom, q, qn, fix, 1023)
          if fl > 0 {
              b = dsv_cat(body, b, "<p class=meta>Did you mean <a href=\"/search?q=" as *u8)
              b = dsv_urlenc(body, b, fix, fl)
              b = dsv_scope_link(body, b, webscope)
              b = dsv_cat(body, b, "\"><b>" as *u8)
              b = dsv_esc(body, b, fix, fl)
              b = dsv_cat(body, b, "</b></a>?</p>" as *u8)
          }
          // HONEST scope empty states: our "web" is a sovereign crawl (a bounded index), NOT the live
          // internet; "trusted" is the client-curated good-resources set (small by design).
          if webscope == 1 { b = dsv_cat(body, b, "<p class=meta>The Web tab searches Nishi&rsquo;s own sovereign crawl &mdash; a growing index of pages we&rsquo;ve fetched, not the whole live internet. Try a broad topic, or search <a href=\"/search?q=" as *u8); b = dsv_urlenc(body, b, q, qn); b = dsv_cat(body, b, "\">this site</a>.</p>" as *u8) }
          if webscope == 2 { b = dsv_cat(body, b, "<p class=meta>The Trusted tab searches resources clients have flagged as good references. Nothing matched yet &mdash; try the <a href=\"/search?scope=web&q=" as *u8); b = dsv_urlenc(body, b, q, qn); b = dsv_cat(body, b, "\">Web</a> tab.</p>" as *u8) }
      }
      let prefix: *u8 = sys_mmap(512); dss_prefix(effdom, prefix)
      let h: *i64 = dss_open_maybe_cached(prefix)
      let key: *u8 = sys_mmap(64)
      let ukey: *u8 = sys_mmap(64)
      let dptr: *i64 = sys_mmap(16) as *i64; let dlen: *i64 = sys_mmap(16) as *i64
      let uptr: *i64 = sys_mmap(16) as *i64; let ulen2: *i64 = sys_mmap(16) as *i64
      // host FACET accumulator (the faceted rung): distinct hosts among this page's results
      let fhosts: *u8 = sys_mmap(256 * 12)
      let fcnt: *i64 = sys_mmap(8 * 12) as *i64
      var nfh: i64 = 0
      let hbuf: *u8 = sys_mmap(256)
      var i: i64 = 0
      while i < nres {
          dss_mkkey(cids[i], key)
          if (h as i64) != 0 { if ss_hget(h, key, dptr, dlen) == 1 {
              dsv_mkurlkey(cids[i], ukey)
              var up: i64 = 0
              var ul: i64 = 0
              if ss_hget(h, ukey, uptr, ulen2) == 1 { up = uptr[0]; ul = ulen2[0] }
              if ul > 0 {
                  let hl9: i64 = dss_url_host(up as *u8, ul, hbuf)
                  if hl9 > 0 {
                      var ff: i64 = 0 - 1
                      var fz: i64 = 0
                      while fz < nfh {
                          let fp9: *u8 = (fhosts as i64 + fz * 256) as *u8
                          var feq: i64 = 1
                          var fx: i64 = 0
                          var fgo: i64 = 1
                          while fgo == 1 { if fp9[fx] != hbuf[fx] { feq = 0; fgo = 0 } else { if hbuf[fx] == (0 as u8) { fgo = 0 } else { fx = fx + 1 } } }
                          if feq == 1 { ff = fz; fz = nfh } else { fz = fz + 1 }
                      }
                      if ff >= 0 { fcnt[ff] = fcnt[ff] + 1 } else { if nfh < 12 {
                          let fd9: *u8 = (fhosts as i64 + nfh * 256) as *u8
                          var fc9: i64 = 0
                          var fgo2: i64 = 1
                          while fgo2 == 1 { fd9[fc9] = hbuf[fc9]; if hbuf[fc9] == (0 as u8) { fgo2 = 0 } else { fc9 = fc9 + 1 } }
                          fcnt[nfh] = 1
                          nfh = nfh + 1
                      } }
                  }
              }
              // FEATURED ANSWER on the top hit of page 0: the best sentence, only when it actually
              // covers the query (all terms, or 2+ of a multi-term query) -- extracted, never asserted
              if i == 0 { if page == 0 {
                  let aoff: *i64 = sys_mmap(16) as *i64
                  let alen: *i64 = sys_mmap(16) as *i64
                  let am: i64 = dsv_best_sentence(dptr[0] as *u8, dlen[0], termptrs, nterms, tbl, aoff, alen)
                  var show: i64 = 0
                  if am >= nterms { if nterms > 0 { show = 1 } }
                  if nterms >= 3 { if am >= 2 { show = 1 } }
                  if show == 1 {
                      b = dsv_cat(body, b, "<div class=ans><div class=anstxt>" as *u8)
                      b = dsv_hl(body, b, ((dptr[0] as i64) + aoff[0]) as *u8, alen[0], termptrs, nterms, tbl)
                      b = dsv_cat(body, b, "</div><div class=anssrc>from the top result below</div></div>" as *u8)
                  }
              } }
              b = dsv_result(body, b, dptr[0] as *u8, dlen[0], cids[i], q, qn, termptrs, nterms, tbl, up as *u8, ul, webscope)
          } }
          i = i + 1
      }
      // host FACETS (zero-JS): when this page's results span 2+ sites, offer one-click site: narrowing.
      // Skipped when the query already carries a site: clause (narrowing twice is noise).
      var hassite: i64 = 0
      var hz: i64 = 0
      while hz + 5 <= qn {
          if q[hz] == (115 as u8) { if q[hz+1] == (105 as u8) { if q[hz+2] == (116 as u8) { if q[hz+3] == (101 as u8) { if q[hz+4] == (58 as u8) { hassite = 1 } } } } }
          hz = hz + 1
      }
      if nfh >= 2 { if hassite == 0 {
          b = dsv_cat(body, b, "<p class=meta>Sites: " as *u8)
          // top 4 hosts by count (selection)
          let fused: *i64 = sys_mmap(8 * 12) as *i64
          var fu: i64 = 0
          while fu < nfh { fused[fu] = 0; fu = fu + 1 }
          var fshown: i64 = 0
          var frank: i64 = 0
          while frank < 4 {
              var fbest: i64 = 0 - 1
              var fk: i64 = 0
              while fk < nfh {
                  if fused[fk] == 0 { if fbest < 0 { fbest = fk } else { if fcnt[fk] > fcnt[fbest] { fbest = fk } } }
                  fk = fk + 1
              }
              if fbest < 0 { frank = 4 } else {
                  fused[fbest] = 1
                  let fh9: *u8 = (fhosts as i64 + fbest * 256) as *u8
                  if fshown > 0 { b = dsv_cat(body, b, " &middot; " as *u8) }
                  b = dsv_cat(body, b, "<a href=\"/search?q=" as *u8)
                  b = dsv_urlenc(body, b, q, qn)
                  b = dsv_cat(body, b, "+site%3A" as *u8)
                  b = dsv_cat(body, b, fh9)
                  b = dsv_scope_link(body, b, webscope)
                  b = dsv_cat(body, b, "\">" as *u8)
                  b = dsv_cat(body, b, fh9)
                  b = dsv_cat(body, b, "</a> (" as *u8)
                  b = dsv_catn(body, b, fcnt[fbest])
                  b = dsv_cat(body, b, ")" as *u8)
                  fshown = fshown + 1
                  frank = frank + 1
              }
          }
          b = dsv_cat(body, b, "</p>" as *u8)
      } }
      // pager: Prev when past page 0; Next while ranked matches remain (total is the truth)
      if qn > 0 { if total > DSV_MAXR {
          b = dsv_cat(body, b, "<nav class=pager>" as *u8)
          if page > 0 {
              b = dsv_cat(body, b, "<a href=\"/search?q=" as *u8)
              b = dsv_urlenc(body, b, q, qn)
              b = dsv_scope_link(body, b, webscope)
              b = dsv_cat(body, b, "&p=" as *u8); b = dsv_catn(body, b, page - 1)
              b = dsv_cat(body, b, "\">&larr; Prev</a> " as *u8)
          }
          if (page + 1) * DSV_MAXR < total {
              b = dsv_cat(body, b, "<a href=\"/search?q=" as *u8)
              b = dsv_urlenc(body, b, q, qn)
              b = dsv_scope_link(body, b, webscope)
              b = dsv_cat(body, b, "&p=" as *u8); b = dsv_catn(body, b, page + 1)
              b = dsv_cat(body, b, "\">Next &rarr;</a>" as *u8)
          }
          b = dsv_cat(body, b, "</nav>" as *u8)
      } }
  }
  // the credo footer: MEASURED page facts the big engines cannot print (their SERPs ship megabytes of
  // script and ad/tracker payloads; this page is what it says it is)
  b = dsv_cat(body, b, "</main><footer class=credo>~" as *u8)
  b = dsv_catn(body, b, (b + 400 + 1023) / DSV_MAGIC_1024)
  b = dsv_cat(body, b, " KB &middot; 0 JavaScript &middot; 0 ads &middot; 0 trackers &middot; sovereign nishi search &middot; <a href=\"/api/openapi.json\">API</a></footer></body></html>" as *u8)
  return dsv_respond(out, "200 OK" as *u8, body, b)
897}
898
899// digits-only parse of s[0..n); okbox[0]=1 iff every byte was a digit and n>0 (defensive: a cid is ONLY digits)
900func dsv_atoin(s: *u8, n: i64, okbox: *i64) -> i64 {
  okbox[0] = 0
  if n <= 0 { return 0 }
  if n > 19 { return 0 }
  var v: i64 = 0
  var i: i64 = 0
  while i < n {
      let c: i64 = s[i] as i64
      if c < 48 { return 0 }
      if c > 57 { return 0 }
      v = v * 10 + (c - 48)
      i = i + 1
  }
  okbox[0] = 1
  return v
915}
916// /doc?cid=<cid>[&q=<query>] -- the PUBLIC document view that completes the search loop (result -> readable
917// doc). Serves ONLY the -pub- shard (dss_prefix); the -prv- shard is physically never opened. Visibility is
918// the owner's public/private choice at upload; the SEARCH flag governs indexing consent, not public
919// readability, so /doc serves any public doc by cid. q (if present) re-highlights + links back to results.
920func dsv_doc_serve(domain: *u8, req: *u8, req_n: i64, out: *u8) -> i64 {
  let tbl: *u8 = sys_mmap(272)
  ss_tok_table(tbl)
  let q: *u8 = sys_mmap(DSV_MAGIC_1024)
  let qn: i64 = dsv_qparam(req, req_n, "q" as *u8, 1, q, 1023)
  let effdom: *u8 = sys_mmap(256)
  let webscope: i64 = dsv_scope(req, req_n, domain, effdom)
  let termstore: *u8 = sys_mmap(16 * 64)
  let termptrs: *i64 = sys_mmap(16 * 8) as *i64
  var nterms: i64 = 0
  if qn > 0 { nterms = dsv_tokq(q, qn, termstore, termptrs, tbl) }
  let cidbuf: *u8 = sys_mmap(64)
  let cn: i64 = dsv_qparam(req, req_n, "cid" as *u8, 3, cidbuf, 31)
  let okbox: *i64 = sys_mmap(16) as *i64
  let cid: i64 = dsv_atoin(cidbuf, cn, okbox)
  var found: i64 = 0
  let dptr: *i64 = sys_mmap(16) as *i64
  let dlen: *i64 = sys_mmap(16) as *i64
  if okbox[0] == 1 {
      let prefix: *u8 = sys_mmap(512); dss_prefix(effdom, prefix)
      let h: *i64 = dss_open_maybe_cached(prefix)
      if (h as i64) != 0 {
          let key: *u8 = sys_mmap(64); dss_mkkey(cid, key)
          if ss_hget(h, key, dptr, dlen) == 1 { found = 1 }
      }
  }
  let body: *u8 = sys_mmap(DSV_BODYCAP)
  var b: i64 = 0
  b = dsv_cat(body, b, "<!DOCTYPE html><meta charset=utf-8><meta name=viewport content=\"width=device-width,initial-scale=1\"><title>Document</title>" as *u8)
  b = dsv_style(body, b)
  b = dsv_cat(body, b, "<p class=meta><a href=\"/search" as *u8)
  if qn > 0 { b = dsv_cat(body, b, "?q=" as *u8); b = dsv_urlenc(body, b, q, qn) }
  if webscope == 1 {
      if qn > 0 { b = dsv_cat(body, b, "&scope=web" as *u8) } else { b = dsv_cat(body, b, "?scope=web" as *u8) }
  }
  b = dsv_cat(body, b, "\">&larr; " as *u8)
  if qn > 0 { b = dsv_cat(body, b, "Back to results" as *u8) } else { b = dsv_cat(body, b, "Search" as *u8) }
  b = dsv_cat(body, b, "</a></p>" as *u8)
  if found == 0 {
      b = dsv_cat(body, b, "<div class=t>Document not found</div><p class=s>No public document has that id.</p></body></html>" as *u8)
      return dsv_respond(out, "404 Not Found" as *u8, body, b)
  }
  let txt: *u8 = dptr[0] as *u8
  var tn: i64 = dlen[0]
  // bounded BY CONSTRUCTION: html-escape expands up to 6x ("&quot;"), and the daemon's out buffer is
  // 512KB -- 80000 * 6 + page chrome stays safely inside it. Longer docs render truncated, marked.
  var trunc: i64 = 0
  if tn > DSV_MAGIC_80000 { tn = DSV_MAGIC_80000; trunc = 1 }
  // title = the same leading-sentence rule the results page uses
  var dot: i64 = 0 - 1
  var i: i64 = 0
  while i < tn { if i < 80 { if txt[i] == (46 as u8) { if dot < 0 { dot = i } } } i = i + 1 }
  var tt: i64 = dot
  if tt < 0 { tt = 56 }
  if tt > tn { tt = tn }
  b = dsv_cat(body, b, "<div class=t>" as *u8)
  b = dsv_hl(body, b, txt, tt, termptrs, nterms, tbl)
  b = dsv_cat(body, b, "</div><p class=\"s doc\">" as *u8)
  if tt < tn { b = dsv_hl(body, b, ((txt as i64) + tt) as *u8, tn - tt, termptrs, nterms, tbl) }
  if trunc == 1 { b = dsv_cat(body, b, " &hellip; [truncated]" as *u8) }
  b = dsv_cat(body, b, "</p></body></html>" as *u8)
  return dsv_respond(out, "200 OK" as *u8, body, b)
982}
983
984// ================= API-FIRST SURFACE (versioned JSON; the HTML SERP is just one client) =================
985// GET /api/openapi.json -> the machine-readable OpenAPI 3.1 contract for the search API (enterprise-grade:
986// client codegen, Swagger UI, contract testing all consume this). CORS-open like the data endpoints. The
987// spec is generated in code (SSOT = this file) so it can never drift from the handlers. `srv` = the Host
988// so the served spec names the caller's own domain in the servers[] block.
989func dss_api_openapi(srv: *u8, out: *u8) -> i64 {
  let body: *u8 = sys_mmap(DSV_BODYCAP)
  var b: i64 = 0
  b = dsv_cat(body, b, "{\"openapi\":\"3.1.0\",\"info\":{\"title\":\"Nishi Search API\",\"version\":\"1.0.0\",\"description\":\"Sovereign full-text search: a domain's docs + site pages, the nishi library, and the crawled open web. Integer BM25 (b=0.75), stemmed recall, phrase/boolean queries, did-you-mean. Zero third-party dependencies.\",\"x-notes\":\"cid is a STRING: 63-bit content ids exceed JSON 2^53 safe-integer range.\"}," as *u8)
  b = dsv_cat(body, b, "\"servers\":[{\"url\":\"https://" as *u8)
  b = dsv_jesc(body, b, srv, dsv_slen(srv))
  b = dsv_cat(body, b, "\"}]," as *u8)
  b = dsv_cat(body, b, "\"paths\":{" as *u8)
  // /api/search
  b = dsv_cat(body, b, "\"/api/search\":{\"get\":{\"operationId\":\"search\",\"summary\":\"Ranked full-text search\",\"parameters\":[" as *u8)
  b = dsv_cat(body, b, "{\"name\":\"q\",\"in\":\"query\",\"required\":true,\"schema\":{\"type\":\"string\"},\"description\":\"Query. Supports OR (default), +required, -excluded, \\\"quoted phrase\\\", and site:host field scoping (dot-suffix match); terms are stemmed for recall.\"}," as *u8)
  b = dsv_cat(body, b, "{\"name\":\"scope\",\"in\":\"query\",\"required\":false,\"schema\":{\"type\":\"string\",\"enum\":[\"web\",\"trusted\"]},\"description\":\"web = the broad crawled open-web corpus; trusted = resources clients flagged as good references; omit = this site's own corpus.\"}," as *u8)
  b = dsv_cat(body, b, "{\"name\":\"page\",\"in\":\"query\",\"required\":false,\"schema\":{\"type\":\"integer\",\"minimum\":0},\"description\":\"0-based results page, 20 per page.\"}]," as *u8)
  b = dsv_cat(body, b, "\"responses\":{\"200\":{\"description\":\"Ranked results\",\"content\":{\"application/json\":{\"schema\":{\"$ref\":\"#/components/schemas/SearchResponse\"}}}}}}}," as *u8)
  // /api/doc
  b = dsv_cat(body, b, "\"/api/doc\":{\"get\":{\"operationId\":\"getDoc\",\"summary\":\"Fetch a document by content id\",\"parameters\":[" as *u8)
  b = dsv_cat(body, b, "{\"name\":\"cid\",\"in\":\"query\",\"required\":true,\"schema\":{\"type\":\"string\"},\"description\":\"Decimal content id (string).\"}," as *u8)
  b = dsv_cat(body, b, "{\"name\":\"scope\",\"in\":\"query\",\"required\":false,\"schema\":{\"type\":\"string\",\"enum\":[\"web\"]}}]," as *u8)
  b = dsv_cat(body, b, "\"responses\":{\"200\":{\"description\":\"The document\",\"content\":{\"application/json\":{\"schema\":{\"$ref\":\"#/components/schemas/Doc\"}}}},\"400\":{\"description\":\"bad_cid\"},\"404\":{\"description\":\"not_found\"}}}}," as *u8)
  // /api/suggest
  b = dsv_cat(body, b, "\"/api/suggest\":{\"get\":{\"operationId\":\"suggest\",\"summary\":\"Autocomplete term completions\",\"parameters\":[" as *u8)
  b = dsv_cat(body, b, "{\"name\":\"q\",\"in\":\"query\",\"required\":true,\"schema\":{\"type\":\"string\"},\"description\":\"Term prefix.\"}," as *u8)
  b = dsv_cat(body, b, "{\"name\":\"scope\",\"in\":\"query\",\"required\":false,\"schema\":{\"type\":\"string\",\"enum\":[\"web\"]}}]," as *u8)
  b = dsv_cat(body, b, "\"responses\":{\"200\":{\"description\":\"Completions\",\"content\":{\"application/json\":{\"schema\":{\"$ref\":\"#/components/schemas/Suggest\"}}}}}}}" as *u8)
  b = dsv_cat(body, b, "}," as *u8)
  // components
  b = dsv_cat(body, b, "\"components\":{\"schemas\":{" as *u8)
  b = dsv_cat(body, b, "\"Result\":{\"type\":\"object\",\"properties\":{\"cid\":{\"type\":\"string\"},\"score\":{\"type\":\"integer\"},\"title\":{\"type\":\"string\"},\"snippet\":{\"type\":\"string\"},\"doc\":{\"type\":\"string\"},\"url\":{\"type\":\"string\"},\"host\":{\"type\":\"string\"}},\"required\":[\"cid\",\"score\",\"title\"]}," as *u8)
  b = dsv_cat(body, b, "\"SearchResponse\":{\"type\":\"object\",\"properties\":{\"v\":{\"type\":\"integer\"},\"query\":{\"type\":\"string\"},\"scope\":{\"type\":\"string\"},\"page\":{\"type\":\"integer\"},\"total\":{\"type\":\"integer\"},\"nresults\":{\"type\":\"integer\"},\"did_you_mean\":{\"type\":\"string\"},\"phrase_exact\":{\"type\":\"boolean\"},\"results\":{\"type\":\"array\",\"items\":{\"$ref\":\"#/components/schemas/Result\"}}},\"required\":[\"v\",\"nresults\",\"results\"]}," as *u8)
  b = dsv_cat(body, b, "\"Doc\":{\"type\":\"object\",\"properties\":{\"v\":{\"type\":\"integer\"},\"found\":{\"type\":\"boolean\"},\"cid\":{\"type\":\"string\"},\"url\":{\"type\":\"string\"},\"truncated\":{\"type\":\"boolean\"},\"text\":{\"type\":\"string\"}}}," as *u8)
  b = dsv_cat(body, b, "\"Suggest\":{\"type\":\"object\",\"properties\":{\"v\":{\"type\":\"integer\"},\"prefix\":{\"type\":\"string\"},\"suggestions\":{\"type\":\"array\",\"items\":{\"type\":\"string\"}}}}" as *u8)
  b = dsv_cat(body, b, "}}}" as *u8)
  return dsv_respond_json(out, "200 OK" as *u8, body, b)
1022}
1023// GET /api/search?q=<terms>[&scope=web] -> {"v":1,"query","scope","nresults","results":[{cid,score,title,
1024// snippet,doc[,url]}]}. cid is a STRING on purpose (63-bit content ids exceed JSON's 2^53 safe-integer
1025// range -- an enterprise client must never receive a silently-rounded id). No q -> a 200 self-describing
1026// usage document (the endpoint documents itself); structured errors carry machine-readable codes (rule 6).
1027func dss_api_search(domain: *u8, req: *u8, req_n: i64, out: *u8) -> i64 {
  let q: *u8 = sys_mmap(DSV_MAGIC_1024)
  let qn: i64 = dsv_qparam(req, req_n, "q" as *u8, 1, q, 1023)
  let effdom: *u8 = sys_mmap(256)
  let webscope: i64 = dsv_scope(req, req_n, domain, effdom)
  let body: *u8 = sys_mmap(DSV_BODYCAP)
  var b: i64 = 0
  if qn == 0 {
      b = dsv_cat(body, b, "{\"v\":1,\"endpoint\":\"/api/search\",\"params\":{\"q\":\"required: search terms\",\"scope\":\"optional: web = the sovereign-crawled open-web corpus; default = this site's corpus\",\"page\":\"optional: 0-based results page (20/page)\"},\"results_cap\":20,\"doc_endpoint\":\"/api/doc?cid=<cid>[&scope=web]\"}" as *u8)
      return dsv_respond_json(out, "200 OK" as *u8, body, b)
  }
  let pgbuf: *u8 = sys_mmap(32)
  let pgn: i64 = dsv_qparam(req, req_n, "page" as *u8, 4, pgbuf, 15)
  let pgok: *i64 = sys_mmap(16) as *i64
  var page: i64 = dsv_atoin(pgbuf, pgn, pgok)
  if pgok[0] == 0 { page = 0 }
  if page > 25 { page = 25 }
  let cids: *i64 = sys_mmap(DSV_MAXR * 8) as *i64
  let scores: *i64 = sys_mmap(DSV_MAXR * 8) as *i64
  let totalbox: *i64 = sys_mmap(16) as *i64
  let rc: i64 = dss_search_off(effdom, q, qn, cids, scores, DSV_MAXR, page * DSV_MAXR, totalbox)
  var nres: i64 = rc
  if nres < 0 { nres = 0 }
  b = dsv_cat(body, b, "{\"v\":1,\"query\":\"" as *u8)
  b = dsv_jesc(body, b, q, qn)
  b = dsv_cat(body, b, "\",\"scope\":\"" as *u8)
  b = dsv_scope_name(body, b, webscope)
  b = dsv_cat(body, b, "\",\"page\":" as *u8)
  b = dsv_catn(body, b, page)
  b = dsv_cat(body, b, ",\"total\":" as *u8)
  b = dsv_catn(body, b, totalbox[0])
  // ADDITIVE contract field (rule 19: adding is safe, renaming is not). A machine consumer had no way
  // to know that `total` silently changes meaning from an exact enumeration to a df-derived LOWER BOUND
  // once candidacy saturates -- so any client computing pagination or coverage from it was doing
  // arithmetic on an estimate it believed was a count.
  b = dsv_cat(body, b, ",\"total_is_estimate\":" as *u8)
  if dss_last_estimated() == 1 { b = dsv_cat(body, b, "true" as *u8) } else { b = dsv_cat(body, b, "false" as *u8) }
  b = dsv_cat(body, b, ",\"nresults\":" as *u8)
  b = dsv_catn(body, b, nres)
  if rc == (0 - 2) { b = dsv_cat(body, b, ",\"degraded\":true" as *u8) }
  if totalbox[1] != 2 {
      b = dsv_cat(body, b, ",\"phrase_exact\":" as *u8)
      if totalbox[1] == 1 { b = dsv_cat(body, b, "true" as *u8) } else { b = dsv_cat(body, b, "false" as *u8) }
  }
  if nres == 0 {
      let fixj: *u8 = sys_mmap(DSV_MAGIC_1024)
      let flj: i64 = dss_correct(effdom, q, qn, fixj, 1023)
      if flj > 0 {
          b = dsv_cat(body, b, ",\"did_you_mean\":\"" as *u8)
          b = dsv_jesc(body, b, fixj, flj)
          b = dsv_cat(body, b, "\"" as *u8)
      }
  }
  // COVERAGE HONESTY (operator 2026-07-04): the web scope is our own index, NOT the whole web -- the
  // machine-readable contract flag so a client never treats partial coverage as complete.
  if webscope == 1 { b = dsv_cat(body, b, ",\"coverage\":{\"index\":\"nishi\",\"complete\":false,\"note\":\"Nishi's own index (crawl + Common Crawl); not the whole live web. Some sites block all crawlers; lawful content is never filtered.\"}" as *u8) }
  b = dsv_cat(body, b, ",\"results\":[" as *u8)
  let prefix: *u8 = sys_mmap(512); dss_prefix(effdom, prefix)
  let h: *i64 = dss_open_maybe_cached(prefix)
  let key: *u8 = sys_mmap(64)
  let ukey: *u8 = sys_mmap(64)
  let dptr: *i64 = sys_mmap(16) as *i64; let dlen: *i64 = sys_mmap(16) as *i64
  let uptr: *i64 = sys_mmap(16) as *i64; let ulen2: *i64 = sys_mmap(16) as *i64
  let snip_tbl: *u8 = sys_mmap(272)
  ss_tok_table(snip_tbl)
  let snip_terms: *u8 = sys_mmap(DSS_MAXTERMS * 64)
  let snip_ptrs: *i64 = sys_mmap(DSS_MAXTERMS * 8) as *i64
  let snip_nterms: i64 = dsv_tokq(q, qn, snip_terms, snip_ptrs, snip_tbl)
  var emitted: i64 = 0
  var i: i64 = 0
  while i < nres {
      dss_mkkey(cids[i], key)
      if (h as i64) != 0 { if ss_hget(h, key, dptr, dlen) == 1 {
          if emitted > 0 { b = dsv_cat(body, b, "," as *u8) }
          emitted = emitted + 1
          let txt: *u8 = dptr[0] as *u8
          let dn2: i64 = dlen[0]
          // ONE TITLE RULER FOR THE WHOLE FILE (2026-08-25). This block derived the title as "everything
          // up to the first '.' within 80 bytes, else 56 bytes" -- a THIRD rule, agreeing with neither the
          // HTML SERP's nor anything else. MEASURED LIVE on the deployed binary: it emitted the title
          // "HTTP/1" (the dot inside "HTTP/1.1"), the title "<p align=..." for a markup document, and
          // 56-byte titles cut mid-word whose snippet then began "ain menu move to sidebar".
          // A FIX THAT LIVES IN ONE ORGAN AND NOT ITS SIBLING IS HALF A FIX, AND THE HALF LEFT UNDONE IS
          // THE ONE THAT SHIPS: the HTML path was repaired and this one went out broken in the SAME
          // binary, invisible to anyone not calling the JSON API. Both now share dpr_title + nx_textcut,
          // so the two surfaces cannot drift apart again -- there is only one of it.
          let abox: *i64 = dsv_box()
          var ats: i64 = 0
          var atl: i64 = 0
          if dpr_title(txt, dn2, DSV_TITLE_CAP, dsv_slot(abox, 0), dsv_slot(abox, 1), dsv_slot(abox, 2)) == 1 {
              ats = abox[0]
              atl = abox[1]
          } else {
              ats = tc_skip_ws(txt, dn2, 0)
              atl = tc_cut_trim(((txt as i64) + ats) as *u8, dn2 - ats, DSV_TITLE_FLOOR, dsv_slot(abox, 2))
          }
          dsv_snippet_span(txt, dn2, ats + atl, snip_ptrs, snip_nterms, snip_tbl, dsv_slot(abox, 5), dsv_slot(abox, 6), dsv_slot(abox, 4))
          let asn: i64 = abox[5]
          // Preserve the API's existing byte cap even when HTML selects a longer sentence.
          var asl: i64 = abox[6]
          if asl > DSV_SNIP { asl = tc_cut_trim(((txt as i64) + asn) as *u8, dn2 - asn, DSV_SNIP, dsv_slot(abox, 3)) }
          b = dsv_cat(body, b, "{\"cid\":\"" as *u8)
          b = dsv_catn(body, b, cids[i])
          b = dsv_cat(body, b, "\",\"score\":" as *u8)
          b = dsv_catn(body, b, scores[i])
          b = dsv_cat(body, b, ",\"title\":\"" as *u8)
          b = dsv_jesc(body, b, ((txt as i64) + ats) as *u8, atl)
          b = dsv_cat(body, b, "\",\"snippet\":\"" as *u8)
          b = dsv_jesc(body, b, ((txt as i64) + asn) as *u8, asl)
          b = dsv_cat(body, b, "\",\"doc\":\"/doc?cid=" as *u8)
          b = dsv_catn(body, b, cids[i])
          if webscope == 1 { b = dsv_cat(body, b, "&scope=web" as *u8) }
          b = dsv_cat(body, b, "\"" as *u8)
          dsv_mkurlkey(cids[i], ukey)
          if ss_hget(h, ukey, uptr, ulen2) == 1 {
              if ulen2[0] > 0 {
                  b = dsv_cat(body, b, ",\"url\":\"" as *u8)
                  b = dsv_jesc(body, b, uptr[0] as *u8, ulen2[0])
                  b = dsv_cat(body, b, "\"" as *u8)
                  // host: the site: filter/facet key, parsed from the url (additive contract field)
                  let hostb: *u8 = sys_mmap(256)
                  let hostl: i64 = dss_url_host(uptr[0] as *u8, ulen2[0], hostb)
                  if hostl > 0 {
                      b = dsv_cat(body, b, ",\"host\":\"" as *u8)
                      b = dsv_jesc(body, b, hostb, hostl)
                      b = dsv_cat(body, b, "\"" as *u8)
                  }
              }
          }
          b = dsv_cat(body, b, "}" as *u8)
      } }
      i = i + 1
  }
  b = dsv_cat(body, b, "]" as *u8)
  // INDEX STATE (2026-08-22, ADDITIVE, rule 19). Unconditional on purpose (coverage above is web-only and an
  // abstain signal absent where it matters is no signal). segments = h[0] of the handle THIS response rendered
  // from (web: the parent-cached one; site/trusted: this request's own open) -- MEASURED per scope. state: ok(>0)
  // | unavailable(web,0 = OUTAGE, never no-results) | empty(site/trusted,0 = nothing published, not an outage)
  // | unopened(-1). A stale memo hit can ship as ok for <= one refresh window. HTTP status UNCHANGED on purpose:
  // a 503 reads as daemon-down to every health probe (the amplifying failure). Body only.
  var iseg: i64 = 0 - 1
  if (h as i64) != 0 { iseg = h[0] }
  b = dsv_cat(body, b, ",\"index\":{\"segments\":" as *u8)
  b = dsv_catn(body, b, iseg)
  b = dsv_cat(body, b, ",\"state\":\"" as *u8)
  if iseg > 0 { b = dsv_cat(body, b, "ok" as *u8) }
  if iseg == 0 { if webscope == 1 { b = dsv_cat(body, b, "unavailable" as *u8) } else { b = dsv_cat(body, b, "empty" as *u8) } }
  if iseg < 0 { b = dsv_cat(body, b, "unopened" as *u8) }
  b = dsv_cat(body, b, "\"}}" as *u8)
  return dsv_respond_json(out, "200 OK" as *u8, body, b)
1177}
1178// GET /api/suggest?q=<prefix>[&scope=web] -> ranked completions from the index's OWN term dictionary
1179// (API-first autocomplete: apps/clients wire the keystroke loop; the HTML SERP stays zero-JS by design)
1180func dss_api_suggest(domain: *u8, req: *u8, req_n: i64, out: *u8) -> i64 {
  let q: *u8 = sys_mmap(256)
  let qn: i64 = dsv_qparam(req, req_n, "q" as *u8, 1, q, 63)
  let effdom: *u8 = sys_mmap(256)
  let webscope: i64 = dsv_scope(req, req_n, domain, effdom)
  let body: *u8 = sys_mmap(DSV_BODYCAP)
  var b: i64 = 0
  if qn == 0 {
      b = dsv_cat(body, b, "{\"v\":1,\"endpoint\":\"/api/suggest\",\"params\":{\"q\":\"required: term prefix\",\"scope\":\"optional: web\"},\"max\":8}" as *u8)
      return dsv_respond_json(out, "200 OK" as *u8, body, b)
  }
  // normalize the prefix with the index's own classifier (lowercase alnum)
  let tbl: *u8 = sys_mmap(272)
  ss_tok_table(tbl)
  let pfx: *u8 = sys_mmap(64)
  var pn: i64 = 0
  var i: i64 = 0
  while i < qn { if pn < 32 { let m: i64 = tbl[q[i]] as i64; if m != 0 { pfx[pn] = m as u8; pn = pn + 1 } } i = i + 1 }
  let sg: *u8 = sys_mmap(8 * 64)
  var n: i64 = 0
  if pn >= 1 { n = dss_suggest(effdom, pfx, pn, sg, 8) }
  b = dsv_cat(body, b, "{\"v\":1,\"prefix\":\"" as *u8)
  b = dsv_jesc(body, b, pfx, pn)
  b = dsv_cat(body, b, "\",\"scope\":\"" as *u8)
  b = dsv_scope_name(body, b, webscope)
  b = dsv_cat(body, b, "\",\"suggestions\":[" as *u8)
  var k: i64 = 0
  while k < n {
      if k > 0 { b = dsv_cat(body, b, "," as *u8) }
      b = dsv_cat(body, b, "\"" as *u8)
      let sp: *u8 = (sg as i64 + k * 64) as *u8
      var sl: i64 = 0
      while sp[sl] != (0 as u8) { sl = sl + 1 }
      b = dsv_jesc(body, b, sp, sl)
      b = dsv_cat(body, b, "\"" as *u8)
      k = k + 1
  }
  b = dsv_cat(body, b, "]}" as *u8)
  return dsv_respond_json(out, "200 OK" as *u8, body, b)
1219}
1220// GET /api/doc?cid=<cid>[&scope=web] -> the full public document as JSON (text bounded like the HTML view)
1221func dss_api_doc(domain: *u8, req: *u8, req_n: i64, out: *u8) -> i64 {
  let effdom: *u8 = sys_mmap(256)
  let webscope: i64 = dsv_scope(req, req_n, domain, effdom)
  let cidbuf: *u8 = sys_mmap(64)
  let cn: i64 = dsv_qparam(req, req_n, "cid" as *u8, 3, cidbuf, 31)
  let okbox: *i64 = sys_mmap(16) as *i64
  let cid: i64 = dsv_atoin(cidbuf, cn, okbox)
  let body: *u8 = sys_mmap(DSV_BODYCAP)
  var b: i64 = 0
  if okbox[0] == 0 {
      b = dsv_cat(body, b, "{\"v\":1,\"error\":{\"code\":\"bad_cid\",\"message\":\"cid must be a decimal content id\"}}" as *u8)
      return dsv_respond_json(out, "400 Bad Request" as *u8, body, b)
  }
  let dptr: *i64 = sys_mmap(16) as *i64
  let dlen: *i64 = sys_mmap(16) as *i64
  var found: i64 = 0
  let prefix: *u8 = sys_mmap(512); dss_prefix(effdom, prefix)
  let h: *i64 = dss_open_maybe_cached(prefix)
  let key: *u8 = sys_mmap(64)
  if (h as i64) != 0 {
      dss_mkkey(cid, key)
      if ss_hget(h, key, dptr, dlen) == 1 { found = 1 }
  }
  if found == 0 {
      b = dsv_cat(body, b, "{\"v\":1,\"error\":{\"code\":\"not_found\",\"message\":\"no public document with that cid\"}}" as *u8)
      return dsv_respond_json(out, "404 Not Found" as *u8, body, b)
  }
  var tn: i64 = dlen[0]
  var trunc: i64 = 0
  if tn > DSV_MAGIC_80000 { tn = DSV_MAGIC_80000; trunc = 1 }
  b = dsv_cat(body, b, "{\"v\":1,\"found\":true,\"cid\":\"" as *u8)
  b = dsv_catn(body, b, cid)
  b = dsv_cat(body, b, "\",\"scope\":\"" as *u8)
  b = dsv_scope_name(body, b, webscope)
  b = dsv_cat(body, b, "\",\"truncated\":" as *u8)
  if trunc == 1 { b = dsv_cat(body, b, "true" as *u8) } else { b = dsv_cat(body, b, "false" as *u8) }
  let ukey: *u8 = sys_mmap(64)
  let uptr: *i64 = sys_mmap(16) as *i64; let ulen2: *i64 = sys_mmap(16) as *i64
  dsv_mkurlkey(cid, ukey)
  if ss_hget(h, ukey, uptr, ulen2) == 1 {
      b = dsv_cat(body, b, ",\"url\":\"" as *u8)
      b = dsv_jesc(body, b, uptr[0] as *u8, ulen2[0])
      b = dsv_cat(body, b, "\"" as *u8)
  }
  b = dsv_cat(body, b, ",\"text\":\"" as *u8)
  b = dsv_jesc(body, b, dptr[0] as *u8, tn)
  b = dsv_cat(body, b, "\"}" as *u8)
  return dsv_respond_json(out, "200 OK" as *u8, body, b)
1269}
nx_docportal_search_serve_snip_20260912.nx source

`nx_docportal_search_serve_snip_20260912.nx` source
