Nishi Family › Compare › Messaging & Comms Platform

Nishi Compare · capabilities, evidence and delivery

Messaging & Comms Platform

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

Nishi live comms (nishifamily.com/video + relay + sovereign codec + E2EE) vs Telegram and WhatsApp and Signal and Discord -- rivals re-grounded to Aug-2026 research (Discord DAVE, Signal SPQR)

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. Measured and live at nishifamily.com/video: group video on our own codec (two measured profiles, 640x480 adaptive live ceiling), lossless LPC voice, in-room chat and reactions over the sovereign relay wire, ChaCha20 relay-blind E2EE on video+audio+chat, screen share, keyed private rooms, SFU with simulcast and last-N, split-horizon relay cascade, Reed-Solomon FEC, video circles, self-healing clients. C1 store-and-forward LANDED 2026-08-16: nx_chat_store on the seg-store plane, gate 21/21 GREEN by forking, first production room live. C2 multi-device sync LANDED the same day (nx_msg_sync, gate 15/15 GREEN, consumer-certified convergence) -- the MESSENGER CORE IS DONE. Still open async: channels, bots, the in-call client wiring, and the games wire (measured 2026-08-16: the /games titles are static single-player with no comms wiring -- C12 is what changes that). The crypto is real but first-generation: the room key is static per session, so PFS/PCS, post-quantum and metadata privacy are all open. The counts below this line are measured at emit.

Where we need to go. THE OPERATOR'S SPEC (2026-08-16, verbatim intent): bring people together online without snooping and without bad performance, superior to Telegram, Discord, Roblox and Steam on privacy AND capability -- from a family on their own LAN, to a private conversation between lovers, to a client-and-lawyer privileged relationship, to big interest-group communities like a reddit -- ALWAYS avoiding the middleman. The technical shape of that spec: Telegram-class async messaging on the sovereign stack (M0 DONE), Discord-class calls (closest already), game interplay through the same store (C12), and the axis NO major ships -- E2EE by default with an MLS-class ratchet and post-quantum hybrid on chat AND calls, sealed-sender metadata privacy, conf-named retention for the privileged tiers, one auditable stack down to the compiler ON FAMILY HARDWARE. Discord's DAVE excludes text; Signal has crypto but no platform; Telegram has platform but opt-in E2EE; Roblox and Steam route everything through their clouds. The exceed is holding all of it at once with no company in the middle.

The unit. 1 u = one measured session-leg, calibrated in the mangagen lane where R1-R4 each landed in one leg (organ + gate + live flip). RECALIBRATED ON C1 (2026-08-16): estimated 2 u, landed in ONE leg -- organ, gate 21/21 and the live flip in a single session-leg -- so organ-class estimates here carry a measured ~2x pessimism; figures republish as each rung lands.

Cost to the messenger core: DONE. M0 reached 2026-08-16: C1 (gate 21/21) and C2 (gate 15/15) both landed inside one session against a 3.5 u estimate -- the gap this page always named as THE core messenger gap is closed and measured. Next costed answers: platform (C5+C6) 3.5 u, crypto exceed (C7-C9) 6.5 u.

Cost to product parity: 11 u. C1-C6 plus C10-C11: core, rich media, channels, bots, call polish, AI assist. Channels and bots ride the same store the core builds.

Cost to the exceed: 6.5 u more. C7 MLS-class ratchet + C8 PQ hybrid + C9 sealed sender, on chat AND calls. Independent of parity: the crypto arc needs the wire and the relay, not channels or bots. Program total 17.5 u -- the two figures sum.

Research bar. Discord DAVE (MLS, RFC 9420) is measured on group-call E2EE at platform scale: MLS group key exchange, per-sender frame keys via encoded transforms, audited by Trail of Bits. Theirs: E2EE default on ALL calls, every platform, since 2026-03 -- and text messages explicitly excluded, with no plans stated. Ours: C7+C8 land the ratchet on chat AND calls with a PQ hybrid behind it (Signal SPQR class, Oct-2025) -- the two axes the deployed bar excludes, on a stack with no WebRTC underneath [dave].

2026-09-10 cross-language prerequisite measured: RED input transform; no delivered international chat claim. Existing nx_chat_demo_api cda_text keeps printable ASCII only. Private native probe runtime/_hdl_build/nx_chat_unicode_probe_t58.nx built and executed through sovereign API job1789055890: ASCII control PASS, Japanese and Cyrillic exact UTF8 preservation FAIL; RED1/3 innerexit1 ELF33512B SHA67ede65b58dfd0da8110946b0a52e42776d71b7e261de3081dd012bc644c43ac. Probe does not write rooms or send messages. Existing runtime/nx_utf8.nx validator/decoder located and full-read for reuse; preserve validated codepoints with bounded output and explicit malformed/oversize outcomes, then qualify real store/wire/UI before shared Beach collaboration. Historical comms pos claims are not fresh cross-device proof. Preserve prior pure-Nishi-media requirement; no WebRTC replacement introduced. Beach material/navigation integration remains priority.

2026-09-10 UTF8 chat private correction: 10/10 boundary and JSON checks; not adopted. Full-read existing nx_chat_demo_api.nx before private candidate runtime/nx_chat_demo_unicode_t59.nx18999B. Reuses runtime/nx_utf8.nx utf8_validate qualified live3/3 job1789056028 before dependency authoring. Replaces ASCII deletion/truncation with bounded byte-preserving UTF8 validation and explicit too-long/invalid-utf8 errors. JSON control characters now escaped instead of converted to spaces. Native candidate gate1789056118 full-read10/10: Japanese/Cyrillic/emoji/ASCII, exact terminator+guard, oversize refusal, malformed refusal, newline/tab preservation, control escaping and UTF8 JSON. ELF38912B SHAb38fe3e1e47ae1542eb5242cacfba0896a4a9137c299a25eb87b0964b8b0f6ec. Canonical/API deployment unchanged; real store+wire+UI roundtrip required next. Identifier/name ASCII policy and existing list error handling remain separate gaps; no global multilingual collaboration claim.

2026-09-10 versioned Unicode real-store qualification: Private post-v2 7/7 then idempotent rerun6/6. Existing nx_chat_demo_api_gate full-read revealed T10 requires legacy post truncation. Private candidate19797B retains cda_text_legacy and post; adds post-v2 via shared cda_post_mode, strict UTF8/length outcomes. Isolated configuration clone nx_chat_unicode_store_t60.nx19804B changes only CHATCONF; /tmp fixture uses existing observed store budgets. Native6303 full-read7/7 and6323 rerun6/6: real append/fetch/list preserve Japanese/Cyrillic/emoji/newline/tab; oversize post-v2 refused without extra row; legacy truncation retained. Root independently JSON-parsed list and exact text matched. Second invocation reuses fixture, seq2 total1 unchanged. No HTTP/browser exposure or canonical adoption. Remaining: versioned discovery/routes, application error HTTP mapping, display-name internationalization and list missing/corrupt evidence semantics; Beach material capture remains active priority.

2026-09-21 email memory repair delivered: Live process verified; bounded stability proof. Native daemon deployment1790016188 passed health deployment with zero blockers and no override. Exact running executable matched reviewed artifact; prior binary retained for rollback. Email parent RSS fell from1837824KiB to252KiB and process swap from1158548KiB to0. Canonical mailbox checks12/12, lifetime272 calls, exact-executable HTTP144 requests passed; repeated public reads retained identical page bytes and stable parent memory. Tests are callable through native build/qualification APIs. This is Linux-backend evidence, not NishiOS portability or long-term load proof. Worklog: knowledge/status/nx_email_portal_request_ownership_20260921.md. Wider NAS pressure and resource-controller gaps remain open.

Latest recorded release

2026-09-26 · C1

chatstore-lib-extract step 2 closing proof (CHATSTORE-STEP2): the restart tooth no longer stops at a fresh in-process handle -- T26c forks the PROMOTED nx_chat_store CLI (a process with no memory of the gate's writes) to fetch the CONNECT account room from disk and requires both senders' rows, each ending in its own armor; nx_chat_store_lib_gate 51/51 GREEN (job 1790457350), SHIPPED 1b615a44 (job 1790457418, content GREEN), served /api/gate_run GREEN exit 0 on the previous ship 07788347 (job 1790457179). Served checks of the other two re-shipped gates: nx_connect_franking_gate a1a34ec5 88/88 exit 0 (job 1790457154), nx_connect_accounts_gate e6985d82 6/6 exit 0 (job 1790457359). Source hashes at close: nx_chat_store_lib.nx f27dbc02 57665 B, nx_chat_store_lib_gate.nx f74c1836 21239 B, nx_connect_franking.nx 63dba3bf 21453 B (this seat's re-seat plus the wave-13 leak seat's cseal_seal_ws edits), nx_connect_franking_gate.nx c7806a9c 41423 B (merged with that seat's teeth), nx_connect_accounts_gate.nx 6374 B.

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

20 of 28 capability source symbols found|7 of them authored stronger-claims|8 open|coverage 714/1000|adoption 11 full / 9 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 20 vs present 22 · named + unnamed + withheld = 6 vs open 6 · LEAK — these do not sum, and an unexplained residual is a defect in this instrument, not in the board

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 8199 bytes · gates map: PRIMARY · stamped 3d 10h ago · source ../knowledge/status/evstamp_comms.verdict

Gap class	What it is, and the work it names
FLIP-READY	A watch contract symbol is now present in the organ it named: the cell can flip on a pure data edit with no new code. These are the cheapest closures on this board and they belong before any new work.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence comms itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_INCONSISTENT. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Current prerequisite graph is invalid or unavailable. Historical rank data is retained, but cannot establish a current order. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Store-and-forward history (C1)	cs_store_forward	LANDED 2026-08-16, done-rule PROVEN by nx_chat_store_gate 21/21 GREEN: offline delivery byte-identical and in order across process death, cursors never regress (cm_advance), additive-only soft-delete, budgets refuse loudly by conf-row name, absence is never read as empty. Composes the seg-store plane + nx_chatmsg; production room live	Organ	2 est, 1 actual u
Multi-device sync (C2) after C1	msy_devsync	LANDED 2026-08-16, done-rule PROVEN by nx_msg_sync_gate 15/15 GREEN: a fresh device pulls the full history, increments move only the missing rows in ONE commit, convergence is certified BY THE CONSUMER (nx_chat_store reads both roots byte-identically), tombstones travel, and split-brain / device-ahead / absent-source all REFUSE with nothing written. Cursors stay device-local by design	Organ	1.5 est, same-session actual u
Voice notes (C3) after C1	cs_voice_note	Record, store, replay through the sovereign lossless audio path; a note survives sender disconnect and replays byte-identical	Organ	1 u
File and media attachments (C4) after C1	cs_file_attach	Any file round-trips byte-identical through the store; the size budget is named in conf, not code, and refusal ANNOUNCES the budget	Organ	0.5 u
Channels and broadcast (C5) after C1	cc_broadcast	One-to-many fan-out at a declared scale with per-subscriber delivery counted and the partition summed; Telegram channels are the reference	Organ	1.5 u
Bot platform (C6) after C1	bot_dispatch	A bot registers over the open wire protocol, receives events and posts messages under a scoped minted cap -- capability-gated by construction, never a shared secret	Organ	2 u
MLS-class group ratchet (C7)	mls_epoch_advance	LANDED 2026-08-16, gate 12/12 GREEN by FORKING THE REAL CRYPTO (est 3 u, one leg actual): RFC 9420 key schedule [rfc9420] on x25519+sha256+chacha20, zero WebRTC/OpenSSL. Member removal is a commit that advances the epoch; the removed member -- holding the OLD epoch secret -- is absent from the new roster so no commit-secret is wrapped to it (T5), and it provably CANNOT open the next ChaCha20 frame because the MAC fails under its stale secret (T7, the done-rule end-to-end). FORWARD SECRECY proven (T8: the epoch-1 secret cannot open an epoch-0 frame; one-way HKDF) with an anti-vacuity control (T9: the epoch-0 secret DOES open its own frame). POST-COMPROMISE proven (T10: an update commit rotates past a leaked secret). Wraps are AUTHENTICATED (T11: a flipped byte fails the HMAC). HONEST SCOPE: flat O(n) commit distribution; TreeKEM's O(log n) tree is the efficiency follow-on, NOT a security gap -- every property here is the RFC 9420 property. Discord DAVE runs MLS for CALL keys only, never text; this is one ratchet for chat AND calls	Organ	3 est, 1 actual u
Post-quantum hybrid ratchet (C8) after Organ	pqh_kex	LANDED 2026-08-16, gate 7/7 GREEN by forking real crypto (est 2 u, one leg actual): the C7 commit-secret transport is now the X25519MLKEM768 HYBRID KEM (FIPS 203 ML-KEM-768 + X25519, the estate's own implementations, no liboqs) [fips203]. The wrap key is derived from ml_kem_ss(32)		x25519_ss(32), so recovery needs BOTH. PROVEN: with both halves the secret recovers exactly (T3 anti-vacuity); a classical-only break -- an attacker holding only the X25519 shared secret -- recovers NOTHING (T4, MAC fails); a KEM-only break recovers NOTHING (T5). Because the commit secret drives every future epoch, this is harvest-now-decrypt-later defence on the whole forward chain -- PQ RATCHETING not just a PQ handshake, the Signal SPQR Oct-2025 property [@spqr]. Deterministic + authenticated wraps (T6/T7). WIRING NOTE: C8 proves the hybrid transport standalone; folding it into C7's mg_wrap as the default (hybrid roster) is the integration step, filed as kdf-lib-extract + c7-hybrid-transport u
Sealed sender (C9) after C7	ss_seal	LANDED 2026-08-16, gate 10/10 GREEN (est 1.5 u, one leg actual): the full sealed-sender shape [sealed-sender] -- the relay envelope is an opaque routing token (a keyed hash of the room key, revealing neither room name nor members) + a delivery seq + ciphertext + MAC. The sender's Ed25519 identity, the content, and the room name are ALL inside the sealed payload. PROVEN BY SCANNING THE ACTUAL ENVELOPE FILE: the sender pubkey (T3) and the plaintext (T4) appear in ZERO relay-readable bytes; the route verb models the relay and shows its entire view is token+seq (T5). The recipient recovers a SIGNED, AUTHENTICATED sender (T6 anti-vacuity) that is provably alice not mallory (T7); a forgery opens as the forger's OWN key, never a claimed one (T9, no-spoof); wrong room key (T8) and tamper (T10) refuse with nothing decrypted. Composes ed25519+sha256+chacha20; rides the C7 room key so sealed sender inherits forward secrecy and (with C8) post-quantum protection, with NO relay changes. HONEST SCOPE: delivery ordering (seq) is relay-visible by design, as in Signal -- what is absent is SENDER, CONTENT, ROOM NAME. Signal is the only major with sealed sender, and none pairs it with sovereign group video on family hardware	Organ	1.5 est, 1 actual u
Noise suppression in the live path (C10)	ds_denoise_stream	The spectral-subtraction substrate already in tree (ds_spectral_gate composing nx_fft) wired into the live voice path as a stream API; SNR gain measured on real captured frames against a pre-declared floor, never asserted	Organ	1 u
AI assist (C11) after C1	cai_summarize	Summaries and translation over the sovereign LLM lane, opt-in, judged before wiring; Telegram's 2026 AI editor is the reference and Signal's refusal is the counter-argument to honor -- E2EE content never leaves the device boundary unencrypted	Local model	1.5 u

Milestones

Milestone	Rungs	Cumulative
M0 · Messenger core usable -- REACHED 2026-08-16	C1,C2	3.5 u
M1 · Rich messaging	C3,C4	5 u
M2 · Platform class (channels + bots)	C5,C6	8.5 u
M3 · The crypto exceed published	C7,C8,C9	15 u
M4 · Full parity plus polish	C10,C11	17.5 u
M5 · Comms visible in the games -- REACHED 2026-08-16 (engine + published match + portal section; in-page client still open)	C12	19.5 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Retention and disappearing messages (C13) after C1	cs_retention	LANDED 2026-08-16, gate 26/26 GREEN (the 4 retention teeth joined C1's 21 with zero regression): per-room retention is PLANE DATA (setretention writes meta:retention_ms; conf row retention_default_ms=0 makes the family archive the default and disappearing opt-in), the sweep tombstones everything past the window in ONE commit and announces the full partition (expired/already-hidden/kept, summed), keep-forever announces itself, a second sweep expires nothing. HONESTY HELD BY A TOOTH: T21 proves hidden is NOT erased -- bytes remain, and byte-erasure exists only as the separate explicit-confirm purge rung (filed below) so the disappearing-messages claim cannot overstate itself	Organ	1 est, same-leg actual u
Game-session chat (the games wire) (C12) after C1	gc_room_wire	LANDED 2026-08-16, gate 13/13 GREEN (RED first on a real one-letter mode-parse defect -- the referee earned its keep): nx_game_chat runs turn-based multiplayer THROUGH the C1 store -- the log is the game, the board is a deterministic replay, injected out-of-turn rows are counted and ignored (the wire is untrusted by construction), game definitions are conf DATA (a new grid game is one row), emits are byte-deterministic. First production match (connect four, elder vs winnie, chat interleaved, won by four-in-column-3) is PUBLISHED at /games/live/ and the /games portal now carries a data-driven Play-together section that enumerates live matches at emit time. REMAINING HALF, named: the interactive in-page browser client (play from the page, not the CLI) -- that is the client wiring rung and it composes this engine unchanged	Organ	2 est, 1 actual u
Email request lifetime isolation (C14)	nx_email_portal_daemon	DELIVERED 2026-09-21 with bounded Linux runtime evidence: each request worker owns and releases transient memory; reviewed executable identity and public response bytes verified. Native mailbox 12/12, lifecycle 272 calls, exact-executable HTTP 144 requests passed. Parent RSS 252 KiB and swap zero in measured post-deployment window. Long-duration load, NishiOS portability and wider NAS health remain open; no messaging frontier acceptance implied. Worklog knowledge/status/nx_email_portal_request_ownership_20260921.md	Organ	unknown u

Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read NO-BAR against the current month 2026-10.

Bar freshness, counted
Class	Count	Note
bars	0	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	0	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	0	RECONCILED: the parts sum to the total 0
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 14. Rank input binding: STALE_INCONSISTENT. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 78fe81d30e41b8e7d648660b40066d508f0717b1b2ebf6c3a1b109734b2582a1. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Invalid declared graph. Malformed rows or IDs 1; duplicate IDs 0; duplicate prerequisites 0; missing prerequisites 0; cyclic or cycle-dependent nodes 0. Node paths withheld.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence comms writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

C1 Store-and-forward history · cell LANDED · gate NO-GATE-DECLARED

Contract	`cs_store_forward` · executor Organ · 2 est, 1 actual u · stands on nothing
Definition of done	LANDED 2026-08-16, done-rule PROVEN by nx_chat_store_gate 21/21 GREEN: offline delivery byte-identical and in order across process death, cursors never regress (cm_advance), additive-only soft-delete, budgets refuse loudly by conf-row name, absence is never read as empty. Composes the seg-store plane + nx_chatmsg; production room live
Matrix cell	MSG: Message history / offline delivery · `runtime/nx_chat_store_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_chat_store_lib`; declare `nx_chat_store_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue PM seat: operator-goal child R8 1790355008 (durable messaging so members engage) was re-FILED to connect CN6 CN7 CN2 and comms C1; C1 Store-and-forward history (LANDED, nx_chat_store_gate 21/21: offline delivery in order across process death, cursors never regress, additive-only soft-delete) with C2 multi-device sync beside it is the incumbent connect CN6 should compose instead of growing a second durable store in a new nx_connect_msgstore; the router re-file wrote no row here for C1 (it reported logs_present=4 while this board held only the first filing C7 row), so this row records the route by hand 2026-09-26 land chatstore-lib-extract step 1 (CN6 sprawl debt 1790372726, wave-11 seat CHATSTORE-EXTRACT): the C1 store is now a LIBRARY. buildroot/runtime/nx_chat_store_lib.nx (41860 B) holds every CS_ const and all 29 cs_ store functions moved byte-for-byte in source order (made by nx_filecopy of the program plus two anchored edits whose old-strings had to match, never retyped); nx_chat_store.nx (5272 B) keeps only its CLI (cs_usage cs_confpick cs_argn main) and imports the lib. The four comms.matrix watch rows that named runtime/nx_chat_store.nx (cs_store_forward cs_retention cs_voice_note cs_file_attach) were repointed to runtime/nx_chat_store_lib.nx in the same leg so no contract goes DARK. Pre-change source and the promoted rollback artifact e226821e are banked under knowledge/status/chatstore_extract_0926.* 2026-09-26 measure chatstore-lib-extract PROOF by byte identity, same lane, minutes apart: nx_sov_build_run nx_chat_store --release on the unchanged source = 181626 B sha 55bd24ba; after the split = BUILD-CACHE MISS (the key moved, the compiler ran) and the SAME 181626 B sha 55bd24ba, confirmed independently by nx_filehash cmp identical=1. Debug flavour against the matched control (the unchanged source rebuilt on the same lane, 209264 B ca1baeaf): nx_contentdiff GREEN lost 0, one gained run = the new source path runtime/nx_chat_store_lib.nx. The line table is the only thing the move changed. The extraction lane nx_oo_extract was read first and does not fit a program-to-lib split: it REFUSES any body that reads a consumer const (at least 17 of the 29 cs_ bodies do: every verb returns a CS_EXIT_ code) and its body extent trims the doc comment above each function, which would have orphaned every comment in the program. 2026-09-26 land chatstore-lib-extract SHIPPED: nx_chat_store live = 98555eff via nx_organ_ship (rollback target e226821e banked by hash first). The ship's 3 lost runs (the SS-COMMIT REFUSED seq1730 guard text and the STS-LOCK open-failed text) are CLOSURE DRIFT from nx_seg_store and nx_store_seed_lib, not the split: the matched control (unchanged source, same closure, same lane) loses the identical 3 against live, and the seq1730 guard MOVED to ss_write_seg (a stronger placement that also covers compactors), it was not removed; approved as allow_loss_v1 25eb2cfb with that evidence. Behaviour probe fetch on a /tmp fixture room (knowledge/status/chatstore_extract_0926.probe.conf) IDENTICAL STRONG exit 0. Gates run AGAINST THE NEW LIVE BINARY after the promote: nx_chat_store_gate 29/29 GREEN, nx_msg_sync_gate 15/15 GREEN, nx_game_chat_gate 13/13 GREEN. 2026-09-26 land chatstore-lib-extract: the lib has its own REFEREE, nx_chat_store_lib_gate (SHIPPED f83dbfdd, registered, rostered in knowledge/gateroster.conf, mapped in knowledge/compare/comms.gates beside nx_chat_store_gate): it imports ONLY the lib and the verdict lib, so its build is the standalone-import proof CONNECT needs, then drives the lib in-process -- token rule at CS_NAME_MAX, hex armor against an independent encoder, row seq, key builders, conf-driven prefix, open append fetch with the stored row read back from the plane -- 20/20 GREEN, eight neg-controls, and nx_gate_bite killed a compiling mutant in the lib (valid_mutants=2 killed=1 survived=1, restore byte-verified 41860 B). Board after a scoped regen plus a fresh importer census (nx_eco_graph_build then nx_importcensus asof 1790441027): the C1 row reads LIB-WIRED importers=4 nonval=3 adopted=1 with cs_store_forward measured in runtime/nx_chat_store_lib.nx; the two future contracts cs_voice_note and cs_file_attach read DARK against the lib exactly as they did against the program (symbol absent in an existing organ, dark_contracts=3 on the page; the pre-change count was not captured). DECLARED, NOT PROMOTED: the ship loops rebuilt nx_chat_store_gate (82648 B, 29 teeth), nx_msg_sync_gate and nx_game_chat_gate because their closures moved, staged them as .new and did not promote them (another lane's referees); they read BEHIND until their lane ships them. 2026-09-26 measure chatstore-lib-extract: the extraction-lane refusal named earlier as read from its source is now MEASURED: nx_oo_extract cs_tok_ok,cs_confs run against the banked pre-change source (knowledge/status/chatstore_extract_0926.nx_chat_store.nx.pre) answered verdict=REFUSED reason=function-cs_tok_ok-reads-consumer-const-CS_NAME_MAX no-changes-made (exit 1, no probe lib written). Its fix text says move the const into the lib too, which the organ itself cannot do; a program-to-lib split with consts needs a consts-moving mode in nx_oo_extract (queued for its owner, not built here). The split was therefore made with nx_filecopy plus anchored edits and proven by the lane's own standard, a byte-identical release rebuild. 2026-09-26 land chatstore-lib-extract step 2 (CHATSTORE-STEP2, wave 13, debt 1790372726): the lib grew the QUIET message verbs CONNECT needed -- cs_msg_ensure, cs_msg_append keyed by the (sender, client msg id) pair, cs_msg_read, cs_msg_count, cs_msg_state, cs_msg_receipt, cs_msg_edit, cs_msg_delete -- with new plane keys cid:<sender>:<cid>, rcpt:<seq>, ed:<seq>; the printing verbs and the CLI contract are untouched. Referee nx_chat_store_lib_gate T19-T32: two senders at one client id both stored and each reads its own bytes, replay idempotent with the count unchanged, content-blind census over the room's segment FILES (armor present, raw bodies absent), restart through a fresh uncached handle, account isolation, receipts forward-only, edits additive, tombstones never resurrected, the poison latch refusing a lying count; 50/50 GREEN (job 1790454709), a cid-alone mutant 44/50 RED (job 1790454905); SHIPPED 07788347 (job 1790455584). Lib sha256 f27dbc02 57665 B. 2026-09-26 measure chatstore-lib-extract step 2, consumers of the extended lib (CHATSTORE-STEP2): every importer still compiles and its referee reads GREEN against the new closure -- nx_chat_store --build-only (job 1790456328), nx_msg_sync --build-only (job 1790456320), nx_game_chat --build-only (job 1790456323); nx_chat_store_gate 29/29 (job 1790456309), nx_msg_sync_gate 15/15 (job 1790456302), nx_game_chat_gate 13/13 (job 1790456306). NOT PROMOTED, said out loud: those were compile checks only, the served binaries are unchanged and behave as before, and their refreshed _build fossils now carry the unused quiet verbs (the builder does no dead-function elimination), so the drift board reads them BEHIND until their lane ships. RESOURCE, measured and named (debt 1790456690): nx_connect_franking_gate's stored path grew VmSize 13632 kB over 16 stored 4096-B relays, about 852 kB per relay -- the quiet verbs inherit the printing verbs' envelope (sts_mm buffers, the seg-store writer, the commit and cache reopen), fine in a one-shot CLI and a leak in a daemon; no daemon imports the relay today. 2026-09-26 queue nx_chat_demo_api, the 4th copy of the store, is NOT retired this leg -- blocker named, superseding debt 1790456824: (1) its referee nx_chat_demo_api_gate reads 9/10 by construction (debt 1790440838: hard-coded production CHATCONF, fixed room demo_hallway, T5 asserts one bob007 row), so no demo change can ship GREEN until the demo takes a conf path and its gate a /tmp fixture; (2) csa_append carries two measured semantics the lib does not offer (auto-open of a demo_ room, and ss_commit_deferred with no fsync so a post stays under the tools-daemon deadline on a pressured disk) and csa_fetch returns rows in a buffer where cs_fetch prints. RECIPE: fix 1790440838, then add a quiet no-client-id post with an explicit deferred-commit variant and a buffer-returning fetch to nx_chat_store_lib, gate them, re-seat the demo onto them and prove its JSON identical with nx_behaveprobe on a fixture room; the cda_ helper twins (cda_confs cda_confn cda_prefix cda_rowbuild cda_delkey cda_put_key cda_hexe cda_hexv) retire in the same edit. 2026-09-26 land chatstore-lib-extract step 2 closing proof (CHATSTORE-STEP2): the restart tooth no longer stops at a fresh in-process handle -- T26c forks the PROMOTED nx_chat_store CLI (a process with no memory of the gate's writes) to fetch the CONNECT account room from disk and requires both senders' rows, each ending in its own armor; nx_chat_store_lib_gate 51/51 GREEN (job 1790457350), SHIPPED 1b615a44 (job 1790457418, content GREEN), served /api/gate_run GREEN exit 0 on the previous ship 07788347 (job 1790457179). Served checks of the other two re-shipped gates: nx_connect_franking_gate a1a34ec5 88/88 exit 0 (job 1790457154), nx_connect_accounts_gate e6985d82 6/6 exit 0 (job 1790457359). Source hashes at close: nx_chat_store_lib.nx f27dbc02 57665 B, nx_chat_store_lib_gate.nx f74c1836 21239 B, nx_connect_franking.nx 63dba3bf 21453 B (this seat's re-seat plus the wave-13 leak seat's cseal_seal_ws edits), nx_connect_franking_gate.nx c7806a9c 41423 B (merged with that seat's teeth), nx_connect_accounts_gate.nx 6374 B.

C2 Multi-device sync · cell LANDED · gate NO-GATE-DECLARED

Contract	`msy_devsync` · executor Organ · 1.5 est, same-session actual u · stands on C1
Definition of done	LANDED 2026-08-16, done-rule PROVEN by nx_msg_sync_gate 15/15 GREEN: a fresh device pulls the full history, increments move only the missing rows in ONE commit, convergence is certified BY THE CONSUMER (nx_chat_store reads both roots byte-identically), tombstones travel, and split-brain / device-ahead / absent-source all REFUSE with nothing written. Cursors stay device-local by design
Matrix cell	MSG: Multi-device sync · `runtime/nx_msg_sync.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_msg_sync`; declare `nx_msg_sync TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-26 land chatstore-lib-extract consumer re-seat: nx_msg_sync now IMPORTS nx_chat_store_lib and its seven hand-rolled twins of the store helpers are gone (msy_w msy_n msy_len msy_eq msy_tok_ok msy_confs msy_delkey, each byte-identical to the cs_ body modulo prefix, consts equal in value: MSY_NAME_MAX = CS_NAME_MAX = 64, PIPE 124, NL 10), call sites renamed by anchored all-edits on a size ladder 16129 to 14441. Content ruler against the matched control (unchanged source, same closure, same lane): the only lost runs are the five removed debug symbol names; gained = the lib (no dead-function elimination, +5568 B). SHIPPED nx_msg_sync fe855c39 (rollback 180261 B banked): ship lost runs = the same 3 closure-drift strings the control loses against live (allow_loss_v1 fb2caf15), behaviour probe verify on the /tmp fixture room IDENTICAL STRONG exit 0, and nx_msg_sync_gate 15/15 GREEN against the NEW live binary.

C3 Voice notes · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cs_voice_note` · executor Organ · 1 u · stands on C1
Definition of done	Record, store, replay through the sovereign lossless audio path; a note survives sender disconnect and replays byte-identical
Matrix cell	MSG: Voice notes (async) · `runtime/nx_chat_store_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_chat_store_lib`; declare `nx_chat_store_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

C4 File and media attachments · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cs_file_attach` · executor Organ · 0.5 u · stands on C1
Definition of done	Any file round-trips byte-identical through the store; the size budget is named in conf, not code, and refusal ANNOUNCES the budget
Matrix cell	MSG: File and media attachments · `runtime/nx_chat_store_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_chat_store_lib`; declare `nx_chat_store_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

C5 Channels and broadcast · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cc_broadcast` · executor Organ · 1.5 u · stands on C1
Definition of done	One-to-many fan-out at a declared scale with per-subscriber delivery counted and the partition summed; Telegram channels are the reference
Matrix cell	PLATFORM: Channels / broadcast at scale · `runtime/nx_channel_cast.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_channel_cast`; declare `nx_channel_cast TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

C6 Bot platform · cell WATCHING · gate NO-GATE-DECLARED

Contract	`bot_dispatch` · executor Organ · 2 u · stands on C1
Definition of done	A bot registers over the open wire protocol, receives events and posts messages under a scoped minted cap -- capability-gated by construction, never a shared secret
Matrix cell	PLATFORM: Bot / programmable platform · `runtime/nx_bot_api.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_bot_api`; declare `nx_bot_api TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

C7 MLS-class group ratchet · cell PRESENT · gate NO-GATE-DECLARED

Contract	`mls_epoch_advance` · executor Organ · 3 est, 1 actual u · stands on nothing
Definition of done	LANDED 2026-08-16, gate 12/12 GREEN by FORKING THE REAL CRYPTO (est 3 u, one leg actual): RFC 9420 key schedule [rfc9420] on x25519+sha256+chacha20, zero WebRTC/OpenSSL. Member removal is a commit that advances the epoch; the removed member -- holding the OLD epoch secret -- is absent from the new roster so no commit-secret is wrapped to it (T5), and it provably CANNOT open the next ChaCha20 frame because the MAC fails under its stale secret (T7, the done-rule end-to-end). FORWARD SECRECY proven (T8: the epoch-1 secret cannot open an epoch-0 frame; one-way HKDF) with an anti-vacuity control (T9: the epoch-0 secret DOES open its own frame). POST-COMPROMISE proven (T10: an update commit rotates past a leaked secret). Wraps are AUTHENTICATED (T11: a flipped byte fails the HMAC). HONEST SCOPE: flat O(n) commit distribution; TreeKEM's O(log n) tree is the efficiency follow-on, NOT a security gap -- every property here is the RFC 9420 property. Discord DAVE runs MLS for CALL keys only, never text; this is one ratchet for chat AND calls
Matrix cell	CRYPTO: Ratcheting group E2EE (MLS-class PFS/PCS) · `runtime/nx_mls_group.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_mls_group`; declare `nx_mls_group TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790355008 routed by nx_intake_route (operator-seat, epoch 1790356455) from pm-seat: R8 of parent REQ 1790355000: durable messaging so members engage -- one-to-one and group messages that survive restart with receipts, edit and delete, end-to-end sealed, delivered when the app is clos -- sponsor intake-1790355008 plus1

C8 Post-quantum hybrid ratchet · cell PRESENT · gate NO-GATE-DECLARED

Contract	`pqh_kex` · executor · x25519_ss(32), so recovery needs BOTH. PROVEN: with both halves the secret recovers exactly (T3 anti-vacuity); a classical-only break -- an attacker holding only the X25519 shared secret -- recovers NOTHING (T4, MAC fails); a KEM-only break recovers NOTHING (T5). Because the commit secret drives every future epoch, this is harvest-now-decrypt-later defence on the whole forward chain -- PQ RATCHETING not just a PQ handshake, the Signal SPQR Oct-2025 property [@spqr]. Deterministic + authenticated wraps (T6/T7). WIRING NOTE: C8 proves the hybrid transport standalone; folding it into C7's mg_wrap as the default (hybrid roster) is the integration step, filed as kdf-lib-extract + c7-hybrid-transport u · stands on Organ (UNRESOLVED: no such rung on this plan)
Definition of done	LANDED 2026-08-16, gate 7/7 GREEN by forking real crypto (est 2 u, one leg actual): the C7 commit-secret transport is now the X25519MLKEM768 HYBRID KEM (FIPS 203 ML-KEM-768 + X25519, the estate's own implementations, no liboqs) [fips203]. The wrap key is derived from ml_kem_ss(32)
Matrix cell	CRYPTO: Post-quantum hybrid ratchet · `runtime/nx_pq_hybrid.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_pq_hybrid`; declare `nx_pq_hybrid TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

C9 Sealed sender · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ss_seal` · executor Organ · 1.5 est, 1 actual u · stands on C7
Definition of done	LANDED 2026-08-16, gate 10/10 GREEN (est 1.5 u, one leg actual): the full sealed-sender shape [sealed-sender] -- the relay envelope is an opaque routing token (a keyed hash of the room key, revealing neither room name nor members) + a delivery seq + ciphertext + MAC. The sender's Ed25519 identity, the content, and the room name are ALL inside the sealed payload. PROVEN BY SCANNING THE ACTUAL ENVELOPE FILE: the sender pubkey (T3) and the plaintext (T4) appear in ZERO relay-readable bytes; the route verb models the relay and shows its entire view is token+seq (T5). The recipient recovers a SIGNED, AUTHENTICATED sender (T6 anti-vacuity) that is provably alice not mallory (T7); a forgery opens as the forger's OWN key, never a claimed one (T9, no-spoof); wrong room key (T8) and tamper (T10) refuse with nothing decrypted. Composes ed25519+sha256+chacha20; rides the C7 room key so sealed sender inherits forward secrecy and (with C8) post-quantum protection, with NO relay changes. HONEST SCOPE: delivery ordering (seq) is relay-visible by design, as in Signal -- what is absent is SENDER, CONTENT, ROOM NAME. Signal is the only major with sealed sender, and none pairs it with sovereign group video on family hardware
Matrix cell	CRYPTO: Metadata privacy (sealed sender) · `runtime/nx_sealed_sender.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_sealed_sender`; declare `nx_sealed_sender TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

C10 Noise suppression in the live path · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ds_denoise_stream` · executor Organ · 1 u · stands on nothing
Definition of done	The spectral-subtraction substrate already in tree (ds_spectral_gate composing nx_fft) wired into the live voice path as a stream API; SNR gain measured on real captured frames against a pre-declared floor, never asserted
Matrix cell	LIVE: Noise suppression during speech · `runtime/nx_denoise_spectral.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_denoise_spectral`; declare `nx_denoise_spectral TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

C11 AI assist · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cai_summarize` · executor Local model · 1.5 u · stands on C1
Definition of done	Summaries and translation over the sovereign LLM lane, opt-in, judged before wiring; Telegram's 2026 AI editor is the reference and Signal's refusal is the counter-argument to honor -- E2EE content never leaves the device boundary unencrypted
Matrix cell	PLATFORM: AI assist (summaries, translate) · `runtime/nx_chat_ai.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_chat_ai`; declare `nx_chat_ai TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

C13 Retention and disappearing messages · cell LANDED · gate NO-GATE-DECLARED

Contract	`cs_retention` · executor Organ · 1 est, same-leg actual u · stands on C1
Definition of done	LANDED 2026-08-16, gate 26/26 GREEN (the 4 retention teeth joined C1's 21 with zero regression): per-room retention is PLANE DATA (setretention writes meta:retention_ms; conf row retention_default_ms=0 makes the family archive the default and disappearing opt-in), the sweep tombstones everything past the window in ONE commit and announces the full partition (expired/already-hidden/kept, summed), keep-forever announces itself, a second sweep expires nothing. HONESTY HELD BY A TOOTH: T21 proves hidden is NOT erased -- bytes remain, and byte-erasure exists only as the separate explicit-confirm purge rung (filed below) so the disappearing-messages claim cannot overstate itself
Matrix cell	CRYPTO: Disappearing messages / retention control · `runtime/nx_chat_store_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_chat_store_lib`; declare `nx_chat_store_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

C12 Game-session chat (the games wire) · cell LANDED · gate NO-GATE-DECLARED

Contract	`gc_room_wire` · executor Organ · 2 est, 1 actual u · stands on C1
Definition of done	LANDED 2026-08-16, gate 13/13 GREEN (RED first on a real one-letter mode-parse defect -- the referee earned its keep): nx_game_chat runs turn-based multiplayer THROUGH the C1 store -- the log is the game, the board is a deterministic replay, injected out-of-turn rows are counted and ignored (the wire is untrusted by construction), game definitions are conf DATA (a new grid game is one row), emits are byte-deterministic. First production match (connect four, elder vs winnie, chat interleaved, won by four-in-column-3) is PUBLISHED at /games/live/ and the /games portal now carries a data-driven Play-together section that enumerates live matches at emit time. REMAINING HALF, named: the interactive in-page browser client (play from the page, not the CLI) -- that is the client wiring rung and it composes this engine unchanged
Matrix cell	PLATFORM: Game-session chat · `runtime/nx_game_chat.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_game_chat`; declare `nx_game_chat TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790361302 routed by nx_intake_route (pmboard-seat, epoch 1790361362) from pmboard-seat: B2 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): fun games together -- members play games together inside their circles (f -- sponsor intake-1790361302 plus2 2026-09-26 land chatstore-lib-extract consumer re-seat: nx_game_chat now IMPORTS nx_chat_store_lib and its nine hand-rolled twins of the store helpers are gone (gc_w gc_n gc_len gc_eq gc_tok_ok gc_hexv gc_hexd gc_confs gc_prefix, byte-identical to the cs_ bodies modulo prefix, consts equal in value), so the replay reads the room plane with the store's own key and armor rules; its own comment had named this extraction owed. Content ruler against the matched control: lost = the six removed debug symbol names only. SHIPPED nx_game_chat 01e3d134 (rollback 211469 B banked): ship lost runs = the same 3 closure-drift strings its control loses against live (allow_loss_v1 99086757), behaviour probe board on a /tmp fixture game room IDENTICAL STRONG exit 0, and nx_game_chat_gate 13/13 GREEN against the NEW live binary. Both consumers now carry the whole lib as unreached code (+5568 B each; the builder does no dead-function elimination) -- named, not hidden.

C14 Email request lifetime isolation · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nx_email_portal_daemon` · executor Organ · unknown u · stands on nothing
Definition of done	DELIVERED 2026-09-21 with bounded Linux runtime evidence: each request worker owns and releases transient memory; reviewed executable identity and public response bytes verified. Native mailbox 12/12, lifecycle 272 calls, exact-executable HTTP 144 requests passed. Parent RSS 252 KiB and swap zero in measured post-deployment window. Long-duration load, NishiOS portability and wider NAS health remain open; no messaging frontier acceptance implied. Worklog knowledge/status/nx_email_portal_request_ownership_20260921.md
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nx_email_portal_daemon`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-21 land 2026-09-21 email memory repair delivered. Native health deployment 1790016188 passed with zero blockers and no override; independent live PID/executable verification matched the reviewed 457456-byte artifact SHA256 8cf6ae687307de250c6e251ee23f8e38a5ea9e77efef969d625d5aba15b9a72e, with prior binary retained for rollback. Parent RSS changed from 1837824 KiB to 252 KiB and process swap from 1158548 KiB to zero. Native mailbox checks 12/12, lifecycle 272 calls, and exact-executable HTTP 144 requests passed. Repeated public reads retained identical page bytes and stable parent memory. This is bounded Linux-backend delivery evidence, not days-long stability, NishiOS portability, full NAS health, or acceptance of a messaging frontier rung. Worklog: knowledge/status/nx_email_portal_request_ownership_20260921.md. Wider resource-controller and compiler debts remain open.

dossiers=14 cells_joined=13 no_matrix_row=1 (sum 14) gates_recorded=0 gates_unrecorded=0 no_gate_declared=13 (sum 13 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 28 feature rows mapped of 28 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/comms.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 650–950, distinctiveness 100–400 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 677 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 650–950 · distinctiveness 100–400 · breadth 475–650 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 1 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 449 permil of the plot

Nishi Telegram WhatsApp Signal Discord
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 5 (a fact of the data: two players that close are that close) · data spread 531 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Unconventional	718	341	559	783	0 since 2026-09-26	20	11	2026-09-15
Telegram	Aspirational	873	265	607	809	0 since 2026-09-26	21	11	2026-09-15
WhatsApp	Mainstream	912	128	500	636	0 since 2026-09-26	22	11	2026-09-15
Signal	Mainstream	844	200	535	750	0 since 2026-09-26	20	11	2026-09-15
Discord	Unconventional	834	254	559	783	0 since 2026-09-26	20	11	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	28	5
2026-09-16	28	5
2026-09-17	28	5
2026-09-18	28	5
2026-09-19	28	5
2026-09-20	28	5
2026-09-21	28	5
2026-09-22	28	5
2026-09-23	28	5
2026-09-26	28	5
2026-10-08	28	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 112, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	Telegram	WhatsApp	Signal	Discord
LIVE
Group video calls Measured: `vv_enc_rct8` exists in `runtime/nx_video_codec_wasm.nx`, verified at emit. OUR OWN codec end to end; Discord group calls are Best-in-class UX; others license/embed WebRTC rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=65 nonval=19` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Discord (leads)	●	●	●	●	◉
Voice (lossless LPC audio) Measured: `queueAudioL` exists in `../sites/nishifamily/video/app.v2.js`, verified at emit. Sovereign lossless voice path; majors use Opus [rfc6716] Adoption: `ABSENT` — PARTIAL: no source and no binary: this is a build contract, not a partial deploy. not adopted: no source and no binary: this is a build contract, not a partial deploy Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: no source and no binary: this is a build contract, not a partial deploy	●	●	●	●	●
Screen share Open — no implementing organ is measured for this axis yet. Discord screen share is the reference rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Pros none measured yetCons behind Telegram, WhatsApp, Signal, Discord (leads); no implementing organ measured	○	●	●	●	◉
SFU + simulcast + last-N Measured: `sfu_set_lastn` exists in `runtime/nx_sfu_select.nx`, verified at emit. Per-receiver layer verdicts + seq rewrite + dynacast-class suspension -- Discord-class infra, ours sovereign rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Discord (leads)	●	●	●	●	◉
Relay cascade (multi-relay scale) Measured: `SIG2_DG_CASCADE` exists in `runtime/_hdl_build/nx_signaling_v2.nx`, verified at emit. Octo-class split-horizon inter-relay; majors run planetary fleets (Best) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:daemon` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Telegram (leads), WhatsApp (leads), Discord (leads)	●	◉	◉	●	◉
Media FEC resilience Open — no implementing organ is measured for this axis yet. Reed-Solomon 8-of-10 on frames rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Pros none measured yetCons behind Telegram, WhatsApp, Signal, Discord; no implementing organ measured	○	●	●	●	●
Noise suppression during speech DARK — `runtime/nx_denoise_spectral.nx` EXISTS but does not declare `ds_denoise_stream`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Discord Krisp is the reference. The spectral-subtraction substrate is already in tree (ds_spectral_gate composing nx_fft, RNNoise-class direction); C10 wires it into the live voice path as a stream API with a measured SNR floor rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching ds_denoise_stream Pros none measured yetCons behind Telegram, WhatsApp, Signal, Discord (leads); open contract; expected source declaration not established	○	●	●	●	◉
MSG
Real-time group chat Measured: `rxChat` exists in `../sites/nishifamily/video/app.v2.js`, verified at emit. In-room chat over the sovereign relay; Telegram chat UX is the reference rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `ABSENT` — PARTIAL: no source and no binary: this is a build contract, not a partial deploy. not adopted: no source and no binary: this is a build contract, not a partial deploy Pros Implementing source symbol found; runtime acceptance separateCons behind Telegram (leads); not adopted yet: no source and no binary: this is a build contract, not a partial deploy	●	◉	●	●	●
Reactions / message interactions Measured: `vc_react_pack` exists in `runtime/nx_video_client_wasm.nx`, verified at emit. SOVEREIGN protocol + emoji set in the core (wire 0x45); floating emoji live on every tile (800) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=9 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Telegram (leads), Discord (leads)	●	◉	●	●	◉
Video messages (circles) Measured: `sd2_circle_upload` exists in `runtime/_hdl_build/nx_sites_daemon_v2.nx`, verified at emit. Telegram video messages equivalent, self-hosted rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Discord; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	○
Message history / offline delivery Measured: `cs_store_forward` exists in `runtime/nx_chat_store_lib.nx`, verified at emit. THE core messenger gap: chat is in-call ephemeral today; no store-and-forward. C1 -- everything async depends on it rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=4` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Telegram (leads), Discord (leads)	●	◉	●	●	◉
Multi-device sync Measured: `msy_devsync` exists in `runtime/nx_msg_sync.nx`, verified at emit. Telegram cloud sync is the reference; nothing on our side yet. C2 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of WhatsAppCons behind Telegram (leads), Discord (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	◉	◐	●	◉
Voice notes (async) DARK — `runtime/nx_chat_store_lib.nx` EXISTS but does not declare `cs_voice_note`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Top-3 daily-use format on Telegram and WhatsApp; ours rides the C1 store and the sovereign lossless audio path. C3 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching cs_voice_note Pros none measured yetCons behind Telegram (leads), WhatsApp (leads), Signal, Discord; open contract; expected source declaration not established	○	◉	◉	●	●
File and media attachments DARK — `runtime/nx_chat_store_lib.nx` EXISTS but does not declare `cs_file_attach`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Telegram 4GB files are the reference; byte-identical round-trip through the C1 store, size budget in conf. C4 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching cs_file_attach Pros none measured yetCons behind Telegram (leads), WhatsApp, Signal, Discord; open contract; expected source declaration not established	○	◉	●	●	●
CRYPTO
E2EE for calls AND chat Measured: `mcw_xform` exists in `runtime/nx_media_crypt_wasm.nx`, verified at emit. ChaCha20 relay-blind on video+audio+chat; Signal is the E2EE reference [doubleratchet]; Telegram E2EE is opt-in secret chats [telegram-e2e]; Discord DAVE encrypts ALL calls by default since Mar-2026 but explicitly excludes text [dave] Adoption: `LIB-UNIMPORTED` — PARTIAL: nothing imports it: wire it into a consumer or retire it. not adopted: nothing imports it: wire it into a consumer or retire it Pros Implementing source symbol found; runtime acceptance separate; ahead of Telegram, DiscordCons behind Signal (leads); not adopted yet: nothing imports it: wire it into a consumer or retire it	●	◐	●	◉	◐
Private keyed rooms (invite links) Measured: `rk_token` exists in `runtime/nx_room_key.nx`, verified at emit. sha256 token wall = private invite links rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Ratcheting group E2EE (MLS-class PFS/PCS) Source present; authored stronger claim: `mls_epoch_advance` in `runtime/nx_mls_group.nx`, verified at emit. The 2025/26 group-crypto bar (RFC 9420) [rfc9420]. LANDED 2026-08-16, gate 12/12 GREEN by forking the real crypto: epoched group keys, member removal forces an epoch advance and the removed member -- holding the old secret -- provably CANNOT open the next ChaCha20 frame (MAC fails); forward-secrecy and post-compromise teeth pass. Pure composition of sovereign x25519+sha256+chacha20, no WebRTC/OpenSSL. Discord DAVE runs MLS for CALL keys only (never text); ours is one ratchet for chat AND calls -- the EXCEED no major holds Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Telegram, WhatsApp, DiscordCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	○	●	◉	◐
Post-quantum hybrid ratchet Source present; authored stronger claim: `pqh_kex` in `runtime/nx_pq_hybrid.nx`, verified at emit. Signal SPQR triple ratchet (Oct-2025) [spqr] raised this bar from PQ handshake to PQ RATCHETING; iMessage PQ3 class. LANDED 2026-08-16, gate 7/7 GREEN by forking real crypto: the C7 commit secret is sealed under X25519MLKEM768 (FIPS 203 ML-KEM-768 + X25519) [fips203], and the gate PROVES a classical-only break recovers nothing (T4) AND a KEM-only break recovers nothing (T5) -- both families must break, on the ratchet not just the handshake. Composes the estate's own ML-KEM; no liboqs. EXCEED: nobody ships PQ ratcheting on group chat AND calls on a sovereign stack Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Telegram, WhatsApp, DiscordCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	○	◐	◉	○
Metadata privacy (sealed sender) Source present; authored stronger claim: `ss_seal` in `runtime/nx_sealed_sender.nx`, verified at emit. Signal-only frontier capability [sealed-sender]. LANDED 2026-08-16, gate 10/10 GREEN: the relay envelope carries only an opaque routing token + delivery seq; the sender's Ed25519 identity and the content appear in ZERO relay-readable bytes (T3/T4 scan the actual envelope file). The recipient recovers a SIGNED, authenticated sender (T6/T7); forgery opens as the forger's own key not the claimed one (T9); wrong-key and tamper refuse. Composes ed25519+sha256+chacha20; rides the C7 room key so it inherits forward secrecy + PQ. EXCEED: Signal is the only major with this, and none pair it with sovereign group video Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Source symbol found; stronger capability claim is authored; ahead of Telegram, WhatsApp, DiscordCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	◉	○	○	◉	○
PLATFORM
Bot / programmable platform Open — watching `runtime/nx_bot_api.nx` : `bot_dispatch`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Telegram Bot API + Discord bots are the references; our wire protocol is open but has no bot surface. C6 -- cap-gated by construction rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching bot_dispatch Pros none measured yetCons behind Telegram (leads), WhatsApp, Discord (leads); open contract; expected source declaration not established	○	◉	◐	○	◉
Channels / broadcast at scale Open — watching `runtime/nx_channel_cast.nx` : `cc_broadcast`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Telegram channels are the reference; WhatsApp Channels arrived 2023-25. C5 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching cc_broadcast Pros none measured yetCons behind Telegram (leads), WhatsApp, Discord; open contract; expected source declaration not established	○	◉	◐	○	◐
AI assist (summaries, translate) Open — watching `runtime/nx_chat_ai.nx` : `cai_summarize`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Telegram's 2026 AI editor + channel summaries are the reference; Signal refuses by design -- ours must be sovereign-LLM, opt-in, and never move E2EE content off-device unencrypted. C11 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching cai_summarize Pros none measured yetCons behind Telegram (leads), WhatsApp, Discord; open contract; expected source declaration not established	○	◉	●	○	●
Game-session chat Measured: `gc_room_wire` exists in `runtime/nx_game_chat.nx`, verified at emit. Discord is THE games-chat reference; Telegram has gaming bots. Our /games titles are static single-player today (measured 2026-08-16) -- C12 wires rooms per game session through the C1 store + relay rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of WhatsApp, SignalCons behind Discord (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	○	○	◉
SOVEREIGN
Self-hosted on family hardware -- LAN-local, zero middleman Source present; authored stronger claim: `SIG2_DG_CASCADE` in `runtime/_hdl_build/nx_signaling_v2.nx`, verified at emit. Every major routes every message through their cloud [whatsapp-wp]; this stack runs on the family NAS, so a LAN conversation never leaves the LAN and there is no company in the middle to breach, subpoena or monetize -- the operator's spec from family LAN to private pair to privileged client to interest-group communities Adoption: `RUN-BY:daemon` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Telegram, WhatsApp, Signal, Discord; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
CRYPTO
Disappearing messages / retention control Measured: `cs_retention` exists in `runtime/nx_chat_store_lib.nx`, verified at emit. Signal disappearing messages are the reference; ours rides the C1 store as conf-named retention with additive tombstone expiry (never silent rotation) -- the lovers and client-lawyer tiers of the spec. C13 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=4` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Discord; fully adopted on the estate ladderCons behind Signal (leads)	●	●	●	◉	○
SOVEREIGN
full stack -- own codec, relay, crypto, language, no WebRTC/OpenSSL anywhere Source present; authored stronger claim: `vv_enc_rct8` in `runtime/nx_video_codec_wasm.nx`, verified at emit. Every major sits on WebRTC/licensed codecs/TLS libraries; ours is one auditable stack down to the compiler Adoption: `LIB-WIRED importers=65 nonval=19` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Telegram, WhatsApp, Signal, Discord; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Integer bit-exact media + recon-hash conformance Source present; authored stronger claim: `vc_recon_hash` in `runtime/nx_video_codec_wasm.nx`, verified at emit. Per-frame decode-truth verification is impossible on float pipelines Adoption: `LIB-WIRED importers=65 nonval=19` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Telegram, WhatsApp, Signal, Discord; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Self-healing ops (drift badges, auto-fallback, self-upgrade) Source present; authored stronger claim: `driftCheck` in `../sites/nishifamily/video/app.v2.js`, verified at emit. The call diagnoses and heals itself; majors ship opaque failures Adoption: `ABSENT` — PARTIAL: no source and no binary: this is a build contract, not a partial deploy. not adopted: no source and no binary: this is a build contract, not a partial deploy Pros Source symbol found; stronger capability claim is authored; ahead of Telegram, WhatsApp, Signal, DiscordCons not adopted yet: no source and no binary: this is a build contract, not a partial deploy	◉	○	○	○	○

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	24	rows carrying a Yes, Best or Part in a rival column
cited	5	a reference mark resolves to a pinned mirror
uncited	19	an observation read, badged until a reference lands
rows, summed	24	RECONCILED: the parts sum to the total 24

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Debt register

Id	Sev	What it is	Unblock
kdf-lib-extractnot in this scope	2	C7 (nx_mls_group) and C8 (nx_pq_hybrid) each carry the same HMAC-SHA256 + HKDF-Expand-Label + hex + file-io helpers (mg_/pqh_ prefixed). Correct OO move is one shared nx_kdf_lib both import -- named here rather than left as a silent copy. Not done in-leg because it re-opens two just-gated crypto binaries; a focused rung.	Extract the shared helpers to nx_kdf_lib.nx, rebuild+re-gate C7 and C8 against it, byte-prove nothing else changed.
c7-hybrid-transportnot in this scope	3	C8 proves the X25519MLKEM768 hybrid transport standalone (gate 7/7). Folding it into C7 as the DEFAULT commit distribution (members carry a hybrid identity: X25519 pub + ML-KEM ek; mg_wrap becomes pqh_wrap) makes every epoch PQ-safe by construction, not just provable in isolation.	Add a hybrid roster mode to nx_mls_group whose commit wraps go through nx_pq_hybrid; gate the removal + PQ-both-families teeth together on one flow.
purge-rungnot in this scope	4	DISCHARGED SAME DAY (2026-08-16, gate 29/29 GREEN first run): `purge <room> <actor> confirm=yes` is live -- confirm-gated (refuses and describes without the literal token), REDACT-IN-PLACE (tombstoned rows keep seq/epoch/kind/sender so cursors and the seq==ordinal invariant survive; visible history byte-identical, proven), then re-seed, COMPACT (ss_compact called with our lock released -- it takes the plane lock itself, verified from source), then the superseded segment FILES are UNLINKED, because a purge that leaves the secret in an unreachable-but-on-disk file has not purged. THE PROOF IS AT THE RAW DISK: T24 shows the secret's hex present in the segment files before (the fixture provably reached the condition), T25 shows it ABSENT from every segment file after. Partial compaction announces PURGE-PARTIAL and the re-run -- a partial destruction never reports complete.	Done. The disappearing-messages story for the lovers and client-lawyer tiers is now hidden-by-retention AND destroyable-on-demand, both gated.
room-sfu-unauthorisednot in this scope	3	nx_room_sfu is REGISTERED-UNAUTHORISED (S4, measured by nx_catalog 2026-08-16): on the MCP surface, no cap ever minted, so no seat can drive it.	One scoped /api/cap/mint call per the banked recipe; then a smoke invocation, and the catalog rereads LIVE.
static-room-keynot in this scope	5	The live room E2EE key is static per session -- named on this page since admission and still true. No PFS, no PCS: one compromised key reads the whole session.	C7 is the fix. Until it lands this row stays open and the page keeps saying so.

Risk register

Risk	Likelihood x impact	Mitigation
Messaging logic drifting into app.v2.js instead of organs	possible x medium	C1 ships organ-side with a wire protocol; the JS stays a presentation shim per the interop law.
Store-and-forward creates durable user data on the relay box	certain x medium	Additive-only with soft-delete, a conf-named size budget that refuses loudly before the cliff, retention an operator decision -- never silent rotation.
A crypto rung regresses the relay-blind property while adding features	possible x high	Every C7-C9 gate carries a negative control that reads the relay's own capture; the relay and a removed member must BOTH fail to decrypt.
A watch contract flips on symbol existence, so a stub reads green	possible x high	The done-rule proven by a gate is the bar; the flip is the receipt (standing hive law -- no rung counts without its gate).
Estimates calibrated in another lane	certain x medium	C1 recalibrates the unit natively; actual-vs-estimate republishes on every landed rung.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-21	C14	land	2026-09-21 email memory repair delivered. Native health deployment 1790016188 passed with zero blockers and no override; independent live PID/executable verification matched the reviewed 457456-byte artifact SHA256 8cf6ae687307de250c6e251ee23f8e38a5ea9e77efef969d625d5aba15b9a72e, with prior binary retained for rollback. Parent RSS changed from 1837824 KiB to 252 KiB and process swap from 1158548 KiB to zero. Native mailbox checks 12/12, lifecycle 272 calls, and exact-executable HTTP 144 requests passed. Repeated public reads retained identical page bytes and stable parent memory. This is bounded Linux-backend delivery evidence, not days-long stability, NishiOS portability, full NAS health, or acceptance of a messaging frontier rung. Worklog: knowledge/status/nx_email_portal_request_ownership_20260921.md. Wider resource-controller and compiler debts remain open.
2026-09-25	C7	queue	INTAKE 1790355008 routed by nx_intake_route (operator-seat, epoch 1790356455) from pm-seat: R8 of parent REQ 1790355000: durable messaging so members engage -- one-to-one and group messages that survive restart with receipts, edit and delete, end-to-end sealed, delivered when the app is clos -- sponsor intake-1790355008 plus1
2026-09-25	C1	queue	PM seat: operator-goal child R8 1790355008 (durable messaging so members engage) was re-FILED to connect CN6 CN7 CN2 and comms C1; C1 Store-and-forward history (LANDED, nx_chat_store_gate 21/21: offline delivery in order across process death, cursors never regress, additive-only soft-delete) with C2 multi-device sync beside it is the incumbent connect CN6 should compose instead of growing a second durable store in a new nx_connect_msgstore; the router re-file wrote no row here for C1 (it reported logs_present=4 while this board held only the first filing C7 row), so this row records the route by hand
2026-09-25	C12	queue	INTAKE 1790361302 routed by nx_intake_route (pmboard-seat, epoch 1790361362) from pmboard-seat: B2 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): fun games together -- members play games together inside their circles (f -- sponsor intake-1790361302 plus2
2026-09-26	C1	land	chatstore-lib-extract step 1 (CN6 sprawl debt 1790372726, wave-11 seat CHATSTORE-EXTRACT): the C1 store is now a LIBRARY. buildroot/runtime/nx_chat_store_lib.nx (41860 B) holds every CS_ const and all 29 cs_ store functions moved byte-for-byte in source order (made by nx_filecopy of the program plus two anchored edits whose old-strings had to match, never retyped); nx_chat_store.nx (5272 B) keeps only its CLI (cs_usage cs_confpick cs_argn main) and imports the lib. The four comms.matrix watch rows that named runtime/nx_chat_store.nx (cs_store_forward cs_retention cs_voice_note cs_file_attach) were repointed to runtime/nx_chat_store_lib.nx in the same leg so no contract goes DARK. Pre-change source and the promoted rollback artifact e226821e are banked under knowledge/status/chatstore_extract_0926.*
2026-09-26	C1	measure	chatstore-lib-extract PROOF by byte identity, same lane, minutes apart: nx_sov_build_run nx_chat_store --release on the unchanged source = 181626 B sha 55bd24ba; after the split = BUILD-CACHE MISS (the key moved, the compiler ran) and the SAME 181626 B sha 55bd24ba, confirmed independently by nx_filehash cmp identical=1. Debug flavour against the matched control (the unchanged source rebuilt on the same lane, 209264 B ca1baeaf): nx_contentdiff GREEN lost 0, one gained run = the new source path runtime/nx_chat_store_lib.nx. The line table is the only thing the move changed. The extraction lane nx_oo_extract was read first and does not fit a program-to-lib split: it REFUSES any body that reads a consumer const (at least 17 of the 29 cs_ bodies do: every verb returns a CS_EXIT_ code) and its body extent trims the doc comment above each function, which would have orphaned every comment in the program.
2026-09-26	C1	land	chatstore-lib-extract SHIPPED: nx_chat_store live = 98555eff via nx_organ_ship (rollback target e226821e banked by hash first). The ship's 3 lost runs (the SS-COMMIT REFUSED seq1730 guard text and the STS-LOCK open-failed text) are CLOSURE DRIFT from nx_seg_store and nx_store_seed_lib, not the split: the matched control (unchanged source, same closure, same lane) loses the identical 3 against live, and the seq1730 guard MOVED to ss_write_seg (a stronger placement that also covers compactors), it was not removed; approved as allow_loss_v1 25eb2cfb with that evidence. Behaviour probe fetch on a /tmp fixture room (knowledge/status/chatstore_extract_0926.probe.conf) IDENTICAL STRONG exit 0. Gates run AGAINST THE NEW LIVE BINARY after the promote: nx_chat_store_gate 29/29 GREEN, nx_msg_sync_gate 15/15 GREEN, nx_game_chat_gate 13/13 GREEN.
2026-09-26	C2	land	chatstore-lib-extract consumer re-seat: nx_msg_sync now IMPORTS nx_chat_store_lib and its seven hand-rolled twins of the store helpers are gone (msy_w msy_n msy_len msy_eq msy_tok_ok msy_confs msy_delkey, each byte-identical to the cs_ body modulo prefix, consts equal in value: MSY_NAME_MAX = CS_NAME_MAX = 64, PIPE 124, NL 10), call sites renamed by anchored all-edits on a size ladder 16129 to 14441. Content ruler against the matched control (unchanged source, same closure, same lane): the only lost runs are the five removed debug symbol names; gained = the lib (no dead-function elimination, +5568 B). SHIPPED nx_msg_sync fe855c39 (rollback 180261 B banked): ship lost runs = the same 3 closure-drift strings the control loses against live (allow_loss_v1 fb2caf15), behaviour probe verify on the /tmp fixture room IDENTICAL STRONG exit 0, and nx_msg_sync_gate 15/15 GREEN against the NEW live binary.
2026-09-26	C12	land	chatstore-lib-extract consumer re-seat: nx_game_chat now IMPORTS nx_chat_store_lib and its nine hand-rolled twins of the store helpers are gone (gc_w gc_n gc_len gc_eq gc_tok_ok gc_hexv gc_hexd gc_confs gc_prefix, byte-identical to the cs_ bodies modulo prefix, consts equal in value), so the replay reads the room plane with the store's own key and armor rules; its own comment had named this extraction owed. Content ruler against the matched control: lost = the six removed debug symbol names only. SHIPPED nx_game_chat 01e3d134 (rollback 211469 B banked): ship lost runs = the same 3 closure-drift strings its control loses against live (allow_loss_v1 99086757), behaviour probe board on a /tmp fixture game room IDENTICAL STRONG exit 0, and nx_game_chat_gate 13/13 GREEN against the NEW live binary. Both consumers now carry the whole lib as unreached code (+5568 B each; the builder does no dead-function elimination) -- named, not hidden.
2026-09-26	C1	land	chatstore-lib-extract: the lib has its own REFEREE, nx_chat_store_lib_gate (SHIPPED f83dbfdd, registered, rostered in knowledge/gateroster.conf, mapped in knowledge/compare/comms.gates beside nx_chat_store_gate): it imports ONLY the lib and the verdict lib, so its build is the standalone-import proof CONNECT needs, then drives the lib in-process -- token rule at CS_NAME_MAX, hex armor against an independent encoder, row seq, key builders, conf-driven prefix, open append fetch with the stored row read back from the plane -- 20/20 GREEN, eight neg-controls, and nx_gate_bite killed a compiling mutant in the lib (valid_mutants=2 killed=1 survived=1, restore byte-verified 41860 B). Board after a scoped regen plus a fresh importer census (nx_eco_graph_build then nx_importcensus asof 1790441027): the C1 row reads LIB-WIRED importers=4 nonval=3 adopted=1 with cs_store_forward measured in runtime/nx_chat_store_lib.nx; the two future contracts cs_voice_note and cs_file_attach read DARK against the lib exactly as they did against the program (symbol absent in an existing organ, dark_contracts=3 on the page; the pre-change count was not captured). DECLARED, NOT PROMOTED: the ship loops rebuilt nx_chat_store_gate (82648 B, 29 teeth), nx_msg_sync_gate and nx_game_chat_gate because their closures moved, staged them as .new and did not promote them (another lane's referees); they read BEHIND until their lane ships them.
2026-09-26	C1	measure	chatstore-lib-extract: the extraction-lane refusal named earlier as read from its source is now MEASURED: nx_oo_extract cs_tok_ok,cs_confs run against the banked pre-change source (knowledge/status/chatstore_extract_0926.nx_chat_store.nx.pre) answered verdict=REFUSED reason=function-cs_tok_ok-reads-consumer-const-CS_NAME_MAX no-changes-made (exit 1, no probe lib written). Its fix text says move the const into the lib too, which the organ itself cannot do; a program-to-lib split with consts needs a consts-moving mode in nx_oo_extract (queued for its owner, not built here). The split was therefore made with nx_filecopy plus anchored edits and proven by the lane's own standard, a byte-identical release rebuild.
2026-09-26	C1	land	chatstore-lib-extract step 2 (CHATSTORE-STEP2, wave 13, debt 1790372726): the lib grew the QUIET message verbs CONNECT needed -- cs_msg_ensure, cs_msg_append keyed by the (sender, client msg id) pair, cs_msg_read, cs_msg_count, cs_msg_state, cs_msg_receipt, cs_msg_edit, cs_msg_delete -- with new plane keys cid:<sender>:<cid>, rcpt:<seq>, ed:<seq>; the printing verbs and the CLI contract are untouched. Referee nx_chat_store_lib_gate T19-T32: two senders at one client id both stored and each reads its own bytes, replay idempotent with the count unchanged, content-blind census over the room's segment FILES (armor present, raw bodies absent), restart through a fresh uncached handle, account isolation, receipts forward-only, edits additive, tombstones never resurrected, the poison latch refusing a lying count; 50/50 GREEN (job 1790454709), a cid-alone mutant 44/50 RED (job 1790454905); SHIPPED 07788347 (job 1790455584). Lib sha256 f27dbc02 57665 B.
2026-09-26	C1	measure	chatstore-lib-extract step 2, consumers of the extended lib (CHATSTORE-STEP2): every importer still compiles and its referee reads GREEN against the new closure -- nx_chat_store --build-only (job 1790456328), nx_msg_sync --build-only (job 1790456320), nx_game_chat --build-only (job 1790456323); nx_chat_store_gate 29/29 (job 1790456309), nx_msg_sync_gate 15/15 (job 1790456302), nx_game_chat_gate 13/13 (job 1790456306). NOT PROMOTED, said out loud: those were compile checks only, the served binaries are unchanged and behave as before, and their refreshed _build fossils now carry the unused quiet verbs (the builder does no dead-function elimination), so the drift board reads them BEHIND until their lane ships. RESOURCE, measured and named (debt 1790456690): nx_connect_franking_gate's stored path grew VmSize 13632 kB over 16 stored 4096-B relays, about 852 kB per relay -- the quiet verbs inherit the printing verbs' envelope (sts_mm buffers, the seg-store writer, the commit and cache reopen), fine in a one-shot CLI and a leak in a daemon; no daemon imports the relay today.
2026-09-26	C1	queue	nx_chat_demo_api, the 4th copy of the store, is NOT retired this leg -- blocker named, superseding debt 1790456824: (1) its referee nx_chat_demo_api_gate reads 9/10 by construction (debt 1790440838: hard-coded production CHATCONF, fixed room demo_hallway, T5 asserts one bob007 row), so no demo change can ship GREEN until the demo takes a conf path and its gate a /tmp fixture; (2) csa_append carries two measured semantics the lib does not offer (auto-open of a demo_ room, and ss_commit_deferred with no fsync so a post stays under the tools-daemon deadline on a pressured disk) and csa_fetch returns rows in a buffer where cs_fetch prints. RECIPE: fix 1790440838, then add a quiet no-client-id post with an explicit deferred-commit variant and a buffer-returning fetch to nx_chat_store_lib, gate them, re-seat the demo onto them and prove its JSON identical with nx_behaveprobe on a fixture room; the cda_ helper twins (cda_confs cda_confn cda_prefix cda_rowbuild cda_delkey cda_put_key cda_hexe cda_hexv) retire in the same edit.
2026-09-26	C1	land	chatstore-lib-extract step 2 closing proof (CHATSTORE-STEP2): the restart tooth no longer stops at a fresh in-process handle -- T26c forks the PROMOTED nx_chat_store CLI (a process with no memory of the gate's writes) to fetch the CONNECT account room from disk and requires both senders' rows, each ending in its own armor; nx_chat_store_lib_gate 51/51 GREEN (job 1790457350), SHIPPED 1b615a44 (job 1790457418, content GREEN), served /api/gate_run GREEN exit 0 on the previous ship 07788347 (job 1790457179). Served checks of the other two re-shipped gates: nx_connect_franking_gate a1a34ec5 88/88 exit 0 (job 1790457154), nx_connect_accounts_gate e6985d82 6/6 exit 0 (job 1790457359). Source hashes at close: nx_chat_store_lib.nx f27dbc02 57665 B, nx_chat_store_lib_gate.nx f74c1836 21239 B, nx_connect_franking.nx 63dba3bf 21453 B (this seat's re-seat plus the wave-13 leak seat's cseal_seal_ws edits), nx_connect_franking_gate.nx c7806a9c 41423 B (merged with that seat's teeth), nx_connect_accounts_gate.nx 6374 B.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/comms.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain comms, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from comms.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	2
scanned	2
fetched	2
reused	0
failed	0
named	2
candidates	2
mentions	2
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	Telegram	1	1	col0-telegram	named	https://core.telegram.org/api/end-to-end
2	Signal	1	1	col2-signal	named	https://signal.org/blog/spqr/

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 26 capabilities: 14 exclusive to it and 12 shared with other boards. Shared rows on this page: 12 = home here 1 + home elsewhere 0 + ambiguous 1 + undecided 10 + refused 0 (partition 12); undecided = unmapped 0 + unproven 10 + unevidenced 0; homonyms 1; since the previous census: new 0, resolved 0. Census FRESH age_s=6346.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
vv_enc_rct8	`nx_video_codec_wasm.nx`	comms, videocodec, video	—	none	unproven	undecided
getDisplayMedia	`app.v2.js`	comms, video	—	none	unproven	undecided
sfu_set_lastn	`nx_sfu_select.nx`	comms, video	—	none	unproven	undecided
SIG2_DG_CASCADE	`nx_signaling_v2.nx`	comms, video	—	none	unproven	undecided
vc_fecs_pack	`app.v2.js`	comms, video	—	none	unproven	undecided
ds_denoise_stream	`nx_denoise_spectral.nx`	comms, video	—	ambiguous	plan	ambiguous
rxChat	`app.v2.js`	comms, video	—	none	unproven	undecided
cs_store_forward	`-`	comms:runtime/nx_chat_store_lib.nx, synthroom:runtime/nx_chat_store.nx, companionchat:runtime/nx_chat_store.nx	—	homonym	-	homonym
mcw_xform	`nx_media_crypt_wasm.nx`	comms, video	—	none	unproven	undecided
rk_token	`nx_room_key.nx`	comms, video, synthroom	—	none	unproven	undecided
gc_room_wire	`nx_game_chat.nx`	comms*, sharehub, gameengine+	comms	rung	plan	home here
vc_recon_hash	`nx_video_codec_wasm.nx`	comms, video	—	none	unproven	undecided
driftCheck	`app.v2.js`	comms, video	—	none	unproven	undecided

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395451 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[rfc9420] Barnes, Beurdouche, Robert, Millican, Omara, Cohn-Gordon. The Messaging Layer Security (MLS) Protocol. IETF RFC 9420, July 2023. publisher · read in our library knowledge/fetched/cmp_comms_rfc9420.html · pin h158ab3ce6241c8bb8516bebe57a27d316846d34e62099d6feab2992a90110827 · accessed 2026-08-18 · published-standardGrounds: The CRYPTO: Ratcheting group E2EE (MLS-class PFS/PCS) row and rung C7: the RFC 9420 key schedule, epoch advance on commit, member removal, forward secrecy and post-compromise security are the properties nx_mls_group_gate proves 12/12; TreeKEM O(log n) is named there as the efficiency follow-on, not a security gap.
[dave] Discord. DAVE Protocol Whitepaper: Discord Audio and Video End-to-End Encryption -- MLS group key exchange, per-sender frame keys via encoded transforms, external audit. Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_comms_dave.html · pin h1f7eaee3da73953bc424a71efd5d8fe841c3f9a6ecf6b7d4c1e9e957f7ad2389 · accessed 2026-08-18 · vendor-docGrounds: The comms.plan bar row (Discord DAVE, MLS RFC 9420) and the Discord column on CRYPTO: E2EE for calls AND chat (Part) and Ratcheting group E2EE (Part): DAVE encrypts calls by default and runs MLS for CALL keys only, never text -- the axis the exceed (one ratchet for chat AND calls) is defined against.
[spqr] Signal. Signal Protocol and Post-Quantum Ratchets: introducing the Sparse Post Quantum Ratchet (SPQR), the triple ratchet. Signal blog, October 2025. publisher · read in our library knowledge/fetched/cmp_comms_spqr.html · pin h2d697627c4948c56326c336df8b952784f64a33ebe474026dcc27bcc044a83da · accessed 2026-08-18 · vendor-docGrounds: The CRYPTO: Post-quantum hybrid ratchet row and rung C8: Signal SPQR (Oct-2025) raised the bar from PQ handshake to PQ RATCHETING, which is why C8 seals the C7 commit secret on every epoch (harvest-now-decrypt-later defence on the whole forward chain) rather than only at key agreement.
[sealed-sender] Lund, J. (Signal). Technology preview: Sealed sender for Signal. Signal blog, October 2018. publisher · read in our library knowledge/fetched/cmp_comms_sealed-sender.html · pin hf1a9f8a8b56ae99a479b7c7171a1c18b00ba956e6c3d71bf7dcef70eab047530 · accessed 2026-08-18 · vendor-docGrounds: The CRYPTO: Metadata privacy (sealed sender) row (Signal-only frontier capability) and rung C9: the relay sees only a routing token plus delivery seq, sender identity and content are inside the sealed payload -- the shape nx_sealed_sender_gate scans the actual envelope file for (T3/T4).
[doubleratchet] Perrin, Marlinspike. The Double Ratchet Algorithm. Signal Protocol specification, revision 1, 2016. publisher · read in our library knowledge/fetched/cmp_comms_doubleratchet.html · pin hf3b65d15f3c2364a83d8afd48e396526a76fe968c73127d87e375f5204d172d9 · accessed 2026-08-18 · published-standardGrounds: Signal is the E2EE reference on the CRYPTO: E2EE for calls AND chat row, and this specification defines the forward-secrecy and post-compromise vocabulary the ratchet rows and the static-room-key debt use (one compromised key reads the whole session until C7 lands).
[fips203] NIST. FIPS 203: Module-Lattice-Based Key-Encapsulation Mechanism Standard (ML-KEM). Federal Information Processing Standards Publication, August 2024. publisher · read in our library knowledge/fetched/cmp_comms_fips203.html · pin h8ee4108f5d9ccf76d058a1848b7ba221b4c998623eccb7dc0674aef73e105203 · accessed 2026-08-18 · published-standardGrounds: Rung C8 and the Post-quantum hybrid ratchet row: the commit secret is sealed under X25519MLKEM768, i.e. FIPS 203 ML-KEM-768 plus X25519 from the estate's own implementations (no liboqs); the gate proves both families must break (T4 classical-only, T5 KEM-only recover nothing).
[telegram-e2e] Telegram. End-to-End Encryption, Secret Chats (MTProto API documentation). Accessed August 2026. publisher · read in our library knowledge/fetched/cmp_comms_telegram-e2e.html · pin h9a584762bf0aff9ded117d5f24b230a1233334ebbb45037f6d37e78706cd1818 · accessed 2026-08-18 · vendor-docGrounds: The Telegram column on CRYPTO: E2EE for calls AND chat (Part -- Telegram E2EE is opt-in secret chats) and the goal line (Telegram has platform but opt-in E2EE); cloud chats are the reference for MSG: Multi-device sync and Message history.
[whatsapp-wp] WhatsApp (Meta). WhatsApp Encryption Overview: Technical white paper, revision February 2026 -- Signal Protocol based end-to-end encryption for messages, calls and groups -- re-fetched COMPLETE 2026-08-20 at 1879555 B after the stored mirror was proven truncated at 255260 B; the document own title reads WhatsApp Encryption Overview - 2026-02 (confirming the February 2026 revision) and its outline covers Defining End-to-End Encryption, Exchanging Messages, Calculating a Chain Key from a Root Key, Group Messages, Call Setup and Group Calling. publisher · read in our library knowledge/fetched/cmp_comms_whatsapp-wp.pdf · pin h4cc7bf38d91abf7fefd1957fc9259f63fcc8aaa2d79c97d2bed3d11948e3a386 · accessed 2026-08-20 · vendor-docGrounds: The WhatsApp column on CRYPTO: E2EE for calls AND chat (Yes) and Ratcheting group E2EE (Yes): WhatsApp runs the Signal Protocol by default, and every message still routes through Meta's servers -- the middleman the SOVEREIGN: Self-hosted on family hardware row removes.
[rfc6716] Valin, Vos, Terriberry. Definition of the Opus Audio Codec. IETF RFC 6716, September 2012. publisher · read in our library knowledge/fetched/cmp_comms_rfc6716.html · pin hc82a8f3977bf8320ed47c2f3b6376d32ba2b85600054d090c6f3e683f25ee245 · accessed 2026-08-18 · published-standardGrounds: The LIVE: Voice (lossless LPC audio) row: majors use Opus -- this RFC is the codec every rival column embeds (SILK plus CELT, lossy), against which the sovereign lossless LPC voice path is the different-path claim.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/comms.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls