Nishi Family › Compare › Connection, Language Exchange and Meetup

Nishi Compare · capabilities, evidence and delivery

Connection, Language Exchange and Meetup

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

Nishi CONNECT vs Tandem and HelloTalk and Meetup and Discord and Signal and Matrix/Element

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. Measured 2026-08-19. Presence: 43 of 52 matrix rows measured against source, 1 exceed (the two-deep youth wall), 9 watch contracts. Depth, from the estate's own cynical gauge run live this day (nx_connect_maturity, registered on the MCP surface and executed -- the number below is read from the run artifact): raw 21/48, PRODUCTION-READINESS 437/1000, one author-optimism downgrade applied by hg_grade, 0 real users. What is REAL underneath: sovereign TLS 1.3 serving nishifamily.com, live OPAQUE login (RFC 9807), the X25519 agreed-key E2E loop over the public edge, and the 11-page zero-JS app at /connect (gate 8 of 8, GET and POST verified over the edge; 11 = the CS_P page constants in the serve core, not a hand count). The August-2026 field this page is graded against: Discord DAVE E2EE universal for calls [discord-dave-all], RCS UP3.0 MLS E2EE in beta between iPhone and Android [apple-rcs], Signal shipping automatic key verification [signal-akv] and rolling out the SPQR post-quantum ratchet [signal-spqr], WhatsApp shipping free on-device translation [whatsapp-translate], Matrix/Element self-hosting at national scale [element-bundeswehr], and Duolingo moving AI conversation practice into its mainstream tier [duolingo-videocall]. Three of the four old exceeds retired against that field; the distance is this roadmap. RE-MEASURED 2026-09-25 by the BOARD seat: nx_connect_maturity run live through /api/organ_run (job 1790355612, exit 0) reads raw 21/48 and PRODUCTION-READINESS 437/1000 with one hg_grade downgrade and 0 real users, unchanged since 2026-08-19 -- accounts/identity PARTIAL (live OPAQUE, own realm, family-wide unification pending), messaging core STUB (in-memory per-session), push, native apps and the user base ABSENT; presence is now 43 of 60 matrix rows with 17 watch contracts, the 8 added today naming CN13 to CN18 plus the two unmapped M1 contracts acc_realm_unify (CN5) and msg_store_append (CN6). The September-2026 field for the operator's goal is the dated bar SB-CONNECT-2609 below: passwordless or password-blind sign-up with no phone or email [fido-passkeys], wallet-presented proof of age and personhood [dcapi-2609], face and ID checks at the dating incumbents [tinder-press], parish-style group communities [hallow] and free scripture study with friends [youversion].

Where we need to go. Operator order 2026-09-25, first: from the first byte up, people sign up with full privacy and security, then meet their circles -- immediate family, mission family, ward family, stake family, members worldwide who opted in, then Christians of other traditions who opted in -- until an LDS boy and an LDS girl can talk and be friends with their guardians able to see the friendship and the two-deep wall governing every adult and minor pair; dating lanes only between consenting adults; community, reconnection and youth belonging, never congregation administration, official Church records or proselytizing, and never speaking for or competing with the Church's own apps. Standing since 2026-08-19: a product people actually install and use, with the safety architecture as SHIPPING CRITERIA no rung may trade away: the two-deep wall, fail-closed CSAE reporting, content-blind serving and zero paywalled connection features. Then, in order: the proven A/V codec inside every call, a native mobile shell over the same content-blind core, a seeded cohort on the wedge vertical so a new member meets someone tonight, and trained no-float matching and moderation models behind the behavioral signals. Depth follows the gauge, not the matrix: a rung that flips a watch without moving nx_connect_maturity is a stub by definition.

The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: the public web app landed gate 8/8 with GET+POST verified over the edge in one leg; the OPAQUE login plus the agreed-key E2E loop landed in one leg on 2026-07-25; trained-model rungs carry more risk than organ rungs.

Where we are: 437 permil readiness (re-measured 2026-09-25), 43 of 60 present. Safety architecture at or beyond the field; presence across chat, events, community, crypto and API; STUB depth on translation quality, messaging scale, media, matching scale and moderation; SOURCE LANDED this leg by the builder seats, gate proof UNVERIFIED by this seat: the private sign-up contract, the concentric circles, the tradition table, the realm join, the durable message store and cohort seeding (nx_catalog 2026-09-25: six LIB sources present -- nx_connect_signup, circles, faith, realm, msgstore, liquidity), which is why the ranker reads M1 by symbol presence and targets 0.5; ABSENT still: study circles, the service board, verified personhood, push, native apps and users.

Cost to private sign-up and your circles: 10 u. CN13 private sign-up + CN14 concentric circles + CN15 traditions at equal fidelity + CN5 family-realm accounts + CN6 messaging on the durable store + CN3 cohort seeding -- a cohort invited onto an app that forgets messages on restart, or into a sign-up that is not yet private, would be a false launch, so the store, the private sign-up and the circles precede the invite.

Cost to circles that study, serve, play and verify: 6.5 u. CN18 verified person without storing identity + CN16 scripture study circles + CN17 service and help board + CN19 games together, one to one or in groups -- engagement inside the circles, with personhood kept as a signed claim and nothing else stored, and every youth game room held two-deep on join and on leave.

Cost to sealed calls in a pocket: 8.5 u. CN7 AEAD wired live + CN8 post-quantum hybrid + CN1 codec into calls + CN2 the native shell with push.

Cost to learned, speaking intelligence: 7.5 u. CN9 real NMT through the LLM serve (graded against the WMT25 finding that LLM-class systems lead [wmt25]) + CN4 trained matching and moderation + CN11 the practice partner.

Cost to everywhere: 4 u. CN10 live voice translation in calls + CN12 the federation probe.

Research bar. The live app (ours) is measured on 11 pages, zero JS, ADA, OPAQUE login, sealed inbox. Theirs: incumbents ship polished native apps to millions. Ours: LIVE -- home, partners, chat, reconnect, community, events, secure, contacts, login, register, account.

Research bar. Discord DAVE (E2EE calls) is measured on default E2EE on every call surface. Theirs: universal since March 2026, MLS group keying, no text E2EE [discord-dave-all]. Ours: our room model is gate-proven, not composed live -- rungs CN1, CN7, CN8.

Research bar. Signal (E2E depth) is measured on post-quantum ratchet + automatic key verification. Theirs: SPQR rolling out [signal-spqr], AKV shipped Aug 2026 [signal-akv]. Ours: our X25519 loop is live; the X25519 plus ML-KEM-768 hybrid key agreement is proven on the shipped page (CN8, X25519-only for members until the directory carries kx=2), the post-quantum ratchet is CN20 [apple-pq3], and key verification is unbuilt.

Research bar. RCS UP3.0 (interoperable E2EE) is measured on cross-vendor MLS E2EE. Theirs: iPhone-Android beta since May 2026 [apple-rcs]. Ours: federation is the CN12 contract.

Research bar. Matrix/Element (self-host) is measured on self-hosted secure messaging at national scale. Theirs: 100000-plus Bundeswehr users [element-bundeswehr]. Ours: we self-host the whole stack from the assembler up; their deployed scale is the depth bar.

Research bar. Tandem and HelloTalk is measured on installed user base, native apps, in-chat correction. Theirs: distribution [tandem] [hellotalk]. Ours: CN2 and CN3.

Research bar. WhatsApp translation (the free field) is measured on free on-device in-chat translation. Theirs: six languages Android, 19-plus iPhone, on-device [whatsapp-translate]. Ours: ours is unlimited by construction but lexicon-grade -- CN9 is the answer.

Latest recorded release

2026-09-29 · CN7

ROSTERED AND SELF-CLEANING: nx_connect_sealed_api_gate is on knowledge/gateroster.conf, hand-added with its reason (its edge twin nx_connect_alpha_sealed_gate is deliberately NOT rostered: every run registers three alpha accounts with no reap). Before the beat could run it, the gate learned to remove its own scratch: csag_rm walks each run directory (files, the knowledge/ conf directory, then the directory itself; it walks again after any walk that removed something and COUNTS what it could not remove) and tooth C1 asserts nothing is left. Three CAS edits on a predicted size ladder (21677 -> 22223 -> 24542 -> 24866 B: consts first, the function second, the use last), SHIPPED by nx_organ_ship 6b667a2d prove=GREEN 30/30, ADOPT APPROVED content GREEN (job 1790660911), and the PROVE run's directories are gone. BITE: aim csag_rm site 28 (depth > 0, so the conf directory is never walked) KILLED, restore byte-identical 24866 B, both twins RESTORED, mutant_live=0 (job 1790661056). LEFT BEHIND, named: 7 directory pairs under /tmp/nx_connect_sealed_api_gate/ written by the pre-C1 binary (this leg's dev runs and ship proves, the old live binary's adopt probe) and the killed mutant; no delete verb this seat may call reaches a /tmp tree, and the promoted gate removes only its own run. NOTE for the syscall owner: this is the eighth hand-rolled unlinkat AT_REMOVEDIR in buildroot/runtime (nx_absent REMOVEDIR: 15 matches, coverage_complete=1); nx_syscalls has sys_unlinkat but no directory twin.

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

58 of 64 capability source symbols found|1 of them authored stronger-claims|6 open|coverage 906/1000|adoption 36 full / 22 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 56 vs present 56 · named + unnamed + withheld = 6 vs open 6 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 29384 bytes · gates map: PRIMARY · stamped 10d 0h ago · STALE against the shared TTL of 604800s — this is evidence about a build nobody can vouch for now · source ../knowledge/status/evstamp_connect.verdict

Gap class	What it is, and the work it names
FLIP-READY	A watch contract symbol is now present in the organ it named: the cell can flip on a pure data edit with no new code. These are the cheapest closures on this board and they belong before any new work.
STALE	This profile is older than the shared TTL, or its clock ran backwards. It is reported as unusable rather than as fresh, because being wrong in the direction of refusing is the safe direction.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence connect itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_OR_INVALID_BINDING. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Retained ranking is not bound to the current plan and matrix: STALE_OR_INVALID_BINDING. Historical data remains retained. Refresh the ranking after resolving the input differences. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Content-blind room receive (CB0)	recv_bw_svc	SVC layout-aware receive, server decodes 0 -- LANDED, gated	Organ	0 u
Public web app (CB1)	so_feed	Live at nishifamily.com/connect, gate 8/8 over the edge -- LANDED	Organ	0 u
Reciprocal matching (CB2)	mx_inter_popc	Harmonic-mean reciprocity -- LANDED	Organ	0 u
Honesty gauge on the surface (CB3)	nx_connect_maturity	LANDED 2026-08-19: registered on the MCP surface (/api/tools/register, callable) and run live -- 437/1000 published on this page from the run artifact, never from prose	Organ	0 u
Codec bound into calls (CN1) after CB0	cc_call_codec_bind	The sovereign vcodec encodes and decodes inside the call path that CB0 already receives content-blind; gate proves a two-peer call round-trips a frame through our encoder and the server still decodes zero bytes	Organ	2 u
Native mobile shell (CN2) after CB1	cl_mobile_shell	A native shell over the existing web core (same auth, same content-blind store) with push, camera and mic permissions; done-rule: the web gate's 8 teeth pass through the shell on a real device and the youth wall is enforced identically; push delivery (push_deliver) is part of this done-rule -- a message posted while the app is closed produces a device notification	Organ	4 u
Cohort seeding on the wedge (CN3) after CB1,CB2,CN6,CN13,CN14	lq_cohort_seed	Invite-by-token cohorts for the LDS community vertical with the reconnection lane as the hook; the connection-quality funnel (replies, meetings) is the ruler; done-rule: a seeded cohort shows a measured reply rate above the empty-room baseline within its first week, published beside the cohort size -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/nx_connect_liquidity.nx 19195 B sha 5a0bcf3b declares lq_cohort_seed; nx_connect_liquidity_gate 72/72 GREEN re-run by the verifier (gate_run and a fresh qualify) and bite-killed 1 of 1, promoted 8bd41082, rostered. Done-rule OPEN: the first-week field reply rate is UNMEASURED (no live cohort, not wired into nx_connect_serve); lq_funnel_verdict compares point rates only and read ABOVE on overlapping Wilson intervals, so an interval-separated verdict is owed; the guardian link is inviter-asserted and the band caller-supplied	Organ	2 u
Trained matching and moderation (CN4) after CB2,CN3	nn_match_train	No-float models trained on consented behavioral signals only (no plaintext), replacing the hand-weighted reciprocity and abuse scores where they measure better; pre-declared accept rule: beat the hand-weighted baseline on a held-out labelled set or stay UNWIRED	Organ	4 u
Family-realm account unification (CN5)	acc_realm_unify	The nishi_connect OPAQUE realm joins the family-wide identity so one account spans CONNECT and the suite; done-rule: login on /connect with a family account round-trips whoami, the auth gate stays GREEN, and the gauge's accounts row re-grades on evidence -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/_hdl_build/nx_connect_realm.nx 24607 B sha da9b78ee declares acc_realm_unify (NIST SP 800-63C-4 sec 3.8.1 account linking [nist80063c4], one family identity per account); nx_connect_realm_gate 47/47 GREEN re-run by the verifier and bite-killed 1 of 1, promoted e47c7ffd, rostered; nx_connect_auth_gate 12/12 GREEN. Done-rule OPEN: nx_connect_appd does not call acc_realm_unify (0 hits) so no served whoami round trip exists and the gauge accounts row stays 2; owed fixes: realm_links.log is written 0644 with unkeyed uid digests, the read-then-append is unlocked, and no attested band source exists yet	Organ	1.5 u
Messaging core on the durable store (CN6) after CN5	cs_msg_append	The per-session in-memory thread becomes the per-account durable world end to end (send, receipts, edit and delete surviving restart, two accounts proven isolated); done-rule: the accounts gate grows a restart tooth and the gauge's messaging row moves STUB to PARTIAL on evidence -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/_hdl_build/nx_connect_msgstore.nx 21094 B sha 5694c3c3 declares msg_store_append (Matrix room version 11 redaction model [matrix-rooms-v11], deviations declared); nx_connect_msgstore_gate 56/56 GREEN re-run by the verifier, promoted aa3abf18; nx_connect_accounts_gate 7/7 GREEN with the T7 RESTART tooth, so done-rule part 1 is met. Done-rule OPEN: the store is not wired into the served daemon and the gauge messaging row is still STUB; the verifier bite left one surviving mutant (msd_slen at off 5947 lets the .msg path alias the .cst world snapshot, tooth owed); the channel verdict is caller-trusted and yw_may_channel allows an unknown band; edit and delete carry no actor check; the save uses a fixed temp name	Organ	1.5 u
AEAD sealing wired into the live serve (CN7) after CN6	cs_sealed_aead	/connect/secure stores Poly1305-tagged sealed messages and REJECTS tamper live, positive and negative proven over the edge; retires the unauthenticated stream the seal gate neg-controls (cseal teeth already GREEN)	Organ	1 u
Post-quantum hybrid key agreement (CN8) after CN7	kx_pq_hybrid	Compose the estate's nx_pq_hybrid organ into the browser key agreement so the conversation key is an X25519-plus-PQ hybrid; done-rule: a keyx-vm-class gate proves the hybrid on the shipped wasm -- the watch flips by the gate, never by the symbol name	Organ	1.5 u
Real NMT through the LLM serve (CN9)	ct_llm_translate	/connect/chat translation routes through the live LLM serve daemon with the lexicon as offline fallback; done-rule: a banked bilingual fixture set graded by an estate judge beats the lexicon on every pair, and the quality claim carries the judge output	Organ	2 u
Live voice translation in calls (CN10) after CN9,CN1	lt_call_caption	Captions in the listener's language rendered inside the call at conversational latency, composing CN9 and CN1; done-rule: a banked bilingual call fixture round-trips with judge-graded caption quality	Organ	2 u
AI conversation-practice partner (CN11) after CN9	cp_practice_turn	A consent-gated practice mode on the LLM serve whose corrections bind into the chat's correction loop; done-rule: practice turns graded by the judge panel against a banked rubric -- never by engagement time	Organ	1.5 u
Federation probe (CN12) after CN7	fed_route	A second Nishi CONNECT instance exchanges sealed messages with the first over the sovereign transport (self-federation first, standard bridges later); done-rule: cross-instance delivery proven with content-blind servers on both ends	Organ	2 u
Private, secure sign-up (CN13)	csu_signup_admit	A person signs up from the first byte with full privacy and security: a handle and a passphrase through OPAQUE so the server stores an envelope and never a password equivalent; no phone number, email or legal name required; an age band attested without storing any identity document; consent recorded per purpose (discovery, faith, each circle) and OFF until the member turns it on; the end-to-end key pair generated on the device; single-use recovery codes; automated or replayed sign-up refused without tracking the person; one account across the Nishi platforms through the family realm; done-rule: the gate proves a completed sign-up stores exactly the declared minimal fields and no password equivalent, discovery is off by default, a minor account opens only peer and guardian lanes under the two-deep wall, an automated or replayed sign-up is refused, and a recovery code works exactly once -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/_hdl_build/nx_connect_signup.nx 27825 B sha 9e151f9b declares csu_signup_admit over OPAQUE RFC 9807 [rfc9807], with Privacy Pass named as the anti-automation successor [rfc9576]; nx_connect_signup_gate 66/66 GREEN re-run by the verifier and bite-killed 1 of 1, promoted 18159ce0, rostered; policy knowledge/connect_signup.conf carries UNMEASURED calibration rows. Done-rule OPEN on the served surface: only csu_handle_taken is wired and only on /alpha/connect; production still lets a taken handle be re-registered (debt 1790359363 sev 8) and 9 other organs call olg_register without the uniqueness check (live reach UNVERIFIED); the age band is caller-attested; minors get no GROUP lane; passkeys and the device-side OPAQUE client are owed	Organ	2 u
Concentric community circles (CN14) after CN13	ccl_circle_reach	A member community is concentric circles joined by consent and vouching, never by any official Church record: immediate family, mission family (those who served in the same mission, from the reconnection lane), ward family, stake family, members worldwide who opted in, then Christians of other traditions who opted in; reach widens one circle at a time, contact needs mutual acceptance, two youth peers (an LDS boy and an LDS girl) may become friends by mutual acceptance with their guardians able to see the friendship, and the two-deep wall governs every adult and minor pair; done-rule: the gate proves each circle admits only by consent plus vouching, reach never skips a circle the member has not opened, two youth peers can befriend each other while an unrelated adult cannot open a private channel to either, and leaving a circle removes its reach at once -- STATUS 2026-09-25 (SYNC, verifier CONFIRMED): lib runtime/_hdl_build/nx_connect_circles.nx 41453 B sha 7ff66d3a declares ccl_circle_reach with the rings as data in knowledge/connect_circles.conf; nx_connect_circles_gate 73/73 GREEN re-run by the verifier and bite-killed 1 of 1, promoted 82aac86a, rostered; the gate proves every done-rule clause, and a read-only circles page is live on /alpha/connect/circles only. Open before acceptance: reach used as profile visibility would let a non-guardian adult discover a minor in a shared ring (wall adult-to-minor reach before wiring); guardian consent is a flag, not an act; circle instance ids are self-asserted; no backward endorser accountability (RepuLink [arxiv-vouching]); shipped, referee grade UNMEASURED, awaiting operator acceptance	Organ	2 u
Christian traditions at equal fidelity (CN15)	cfa_tradition_admit	Growth from Latter-day Saints to other Christians: every Christian tradition (Catholic, Orthodox, the Protestant families and the Restoration churches including The Church of Jesus Christ of Latter-day Saints) self-identifies at the same depth from a data table under each church preferred name; faith is optional, self-declared and consent-gated as a special category, a discovery signal weighted by the member own stated importance, never an enforced filter, and no copy speaks for any church; done-rule: every table row admits at equal depth, an undeclared tradition is refused rather than guessed, withdrawing consent removes the member from faith discovery at once, and the youth wall verdict is identical with and without faith -- STATUS 2026-09-25 (SYNC, verifier CONFIRMED): lib runtime/_hdl_build/nx_connect_faith.nx 22406 B sha 2b6e19b6 declares cfa_tradition_admit over knowledge/connect_faith_traditions.conf (16 traditions, 63 churches under each church preferred name; the Pew landscape-study mirror was withdrawn as a ref because its fetch redirected); consent is explicit and withdrawable as GDPR Art. 9 and Art. 7(3) require [gdpr-art9] [gdpr-art7]; nx_connect_faith_gate 63/63 GREEN re-run by the verifier and bite-killed 1 of 1, promoted 39bd51a7, rostered; the gate proves every done-rule clause. Open before acceptance: faith discovery lists minors to minors across the whole population with no circle or guardian scope (a policy decision before any route), the importance scale calibration is UNVERIFIED, nothing is served, operator acceptance outstanding	Organ	1 u
Scripture study circles (CN16) after CN14	csc_circle_post	A study circle is a consent-joined group following a reading plan held as data (a Come, Follow Me week or a Bible reading plan); every passage resolves through the estate verse door from the public-domain corpus (Church-copyright headings, footnotes and cross-references are never copied); members post reflections anchored to a verse reference; youth circles obey the two-deep wall on join and on leave; done-rule: the gate proves a verse-anchored reflection round-trips with its reference resolved from the corpus, an unknown reference is refused rather than guessed, and a youth circle left with one adult refuses the change	Organ	1.5 u
Service and help board (CN17) after CN14	csh_need_match	Members post needs (meals, a move, a ride) and service projects with a place, a time and a capacity; neighbours offer help; matching is by consent, a coarse locality band and capacity, never by faith, looks or status; the exact address is withheld until both sides confirm; minors join service projects only inside the two-deep wall; done-rule: the gate proves need, offer and confirm round-trip idempotently, capacity holds under over-offer, the address stays coarse before mutual confirmation, and a minor one-to-one adult request refuses	Organ	1.5 u
Verified person without storing identity (CN18) after CN13	cvh_person_attest	A member proves they are a real person, and for youth features their age band, without the estate storing any identity document: a presentation from a digital credential (the W3C Digital Credentials API over an ISO mobile driving licence or a state-endorsed digital identity) or an in-person vouch by two verified members, reduced to a signed claim of personhood and age band only; done-rule: the gate proves a valid presentation yields that claim and nothing else is stored, a replayed or forged presentation is refused, and the member can revoke the claim	Organ	2 u
Games together, one to one or in groups (CN19) after CN14	cpl_play_move	Members play together inside their circles, one to one or in a group room: a play session holds one two-player game in a room admitted by room_admit on join and on leave (two-deep, from the one youth room rule in nx_connect_lds_room_lib), a one-to-one invitation only where ccl_channel admits the pair (two minors through ysf_peer_may_connect, never an adult and a minor), every co-presence asked of ast_may_discover both ways so a blocked pair is refused either way, every move and the turn order validated by the server through the one nx_folkgame_lib move generator (never a second rules copy), a chained det_state_checksum digest after every move that any client on any device replays to prove it holds the same state and history, idle expiry and the room cap as conf rows with reasons (knowledge/connect_play.conf), and no function signature taking an IP, a location, a device id or a fingerprint; done-rule: nx_connect_play_gate proves a lone adult with youth refused on join and on leave while two adults with youth are admitted, a youth-youth one-to-one admitted where the peer rule allows and an adult-minor one-to-one refused both ways, a blocked pair refused both ways in a group room and in a one-to-one, an illegal and an out-of-turn move refused, the win detected identically to the generator down to the published 255,168-game tic-tac-toe tree walked through the session, every align game the spec names played through the session against the generator driven directly with the turn order taken from the generator (capture and movement phases reached), the digest identical across replays, different after a different move and recomputed at every ply by a second method class (a bitwise CRC-32C anchored to its catalogued check value), play_state answering only the caller's own room, and the signature scan clean; members reach it only when the front door carries the play verbs	Organ	1.5 u

Milestones

Milestone	Rungs	Cumulative
M1 · Sign up privately and meet your circles	CN13,CN14,CN15,CN5,CN6,CN3	10 u
M2 · Circles that study, serve, play and verify	CN18,CN16,CN17,CN19	16.5 u
M3 · Sealed, called, in a pocket	CN7,CN8,CN20,CN1,CN2	28 u
M4 · Learned and speaking	CN9,CN4,CN11	35.5 u
M5 · Everywhere	CN10,CN12	39.5 u

Ladder to SOTA

Two dated targets, and every rung's role toward them. Best in class is the proven, deployed leader today; the frontier is the research edge as of its month. Each target is dated by a sotabar row and judged against the current month by the bar-age ruler (FRESH, ATTESTED with the fallback month named, or refused). Each rung is substrate (what the target's own methods consume), an arm (a sovereign arm that triangulates without competing for the number), a contender (its done-rule is a number against the target) or superseded (kept as capability, retired as a claim), and carries the rungs it stands on.

best-in-class (T-BIC-CONNECT), dated by SB-CONNECT-2609 = 2026-09 ATTESTED. Best in class as of September 2026, matched in one free, content-blind service: phishing-resistant or password-blind sign-up with no phone number or email required [fido-passkeys] [rfc9807] where the privacy leader still registers by phone [signal-usernames]; dating-grade verification and pre-contact privacy [tinder-press] [hinge-press] [bumble-safety]; a faith community organised as churches, groups and small groups with chat, events and flagging [hallow]; free study with friends and church groups [youversion]; the Latter-day Saint dating lane [mutual] held to consenting adults; and the messaging bar already on this page -- E2E calls by default [discord-dave-all], a post-quantum ratchet [signal-spqr], free on-device translation [whatsapp-translate] -- with the two-deep youth wall holding for every adult and minor pair ref fido-passkeys

frontier (T-FRONT-CONNECT), dated by SB-CONNECT-2609 = 2026-09 ATTESTED. The September 2026 frontier, which no incumbent assembles: personhood and age band proved by a browser-mediated wallet presentation over a mobile driving licence [dcapi-2609] and kept only as a signed claim; age assurance run as an accountable process from evidence to claim to decision [arxiv-ageassure]; private matching over encrypted signals (Hidden Elo, arXiv 2603.26407) [arxiv-datingapp]; cross-vendor interoperable E2E [apple-rcs] and live speech translation in calls [google-livetranslate] -- joined to concentric consent-and-vouch circles from immediate family through mission, ward and stake to Christians of other traditions, where two youth peers can befriend each other under their guardians' sight and no adult can open a private channel to a minor ref dcapi-2609

Rung	Role	Toward	Stands on	Why
CB0	substrate	T-BIC-CONNECT	-	The content-blind SVC receive every call rung stands on; landed and gated
CB1	substrate	T-BIC-CONNECT	-	The served zero-JS app every sign-up, circle and study page ships through; landed, gate 8 of 8
CB2	substrate	T-FRONT-CONNECT	-	The reciprocity arithmetic (mx_inter_popc) that private matching over encrypted signals composes
CB3	arm	T-BIC-CONNECT	-	The cynical readiness gauge triangulates every claim on this page without competing for a cell
CN1	contender	T-BIC-CONNECT	CB0	Its done-rule puts our codec inside every call at the field's E2E-by-default bar
CN2	contender	T-BIC-CONNECT	CB1	Installed native apps with push are table stakes at every incumbent; its done-rule runs the web gate teeth through the shell
CN3	contender	T-BIC-CONNECT	CB1,CB2,CN6,CN13,CN14	Its done-rule is a measured reply rate above the empty-room baseline, the liquidity every incumbent already has
CN4	contender	T-FRONT-CONNECT	CB2,CN3	Trained no-float matching and moderation on consented signals only, accepted only if it beats the hand-weighted baseline
CN5	substrate	T-BIC-CONNECT	-	One OPAQUE account across every Nishi property through the family login product; the account CN13 signs a person into
CN6	substrate	T-BIC-CONNECT	CN5	The durable per-account store every circle, study and service conversation writes to
CN7	contender	T-BIC-CONNECT	CN6	Authenticated E2E sealing live at the Signal-class bar, tamper rejected over the edge
CN8	contender	T-FRONT-CONNECT	CN7	The post-quantum hybrid key agreement the frontier names
CN9	contender	T-BIC-CONNECT	-	Real translation quality against the free on-device field, graded by an estate judge
CN10	contender	T-FRONT-CONNECT	CN9,CN1	Live speech translation inside calls, the 2026 frontier
CN11	arm	T-BIC-CONNECT	CN9	A consent-gated practice partner beside the language lane; it triangulates learning without competing for the sign-up or circle cells
CN12	contender	T-FRONT-CONNECT	CN7	Cross-instance sealed delivery with content-blind servers at both ends, the interoperable-E2E frontier
CN13	contender	T-BIC-CONNECT	-	Its done-rule meets the passkey and OPAQUE bar with no phone or email, discovery off by default and the youth lanes walled
CN14	contender	T-FRONT-CONNECT	CN13	Concentric consent-and-vouch circles from immediate family to other Christians, the structure no incumbent models
CN15	substrate	T-FRONT-CONNECT	-	The equal-fidelity tradition table and faith-consent gate that the widening circles consume
CN16	contender	T-BIC-CONNECT	CN14	Study circles at the YouVersion and Hallow bar, every passage from the public-domain corpus
CN17	contender	T-FRONT-CONNECT	CN14	Consent-matched service with a coarse locality and the address withheld until both confirm, which no incumbent in the bar ships
CN18	contender	T-FRONT-CONNECT	CN13	Personhood and age band from a credential presentation or a two-member vouch with nothing else stored, the September 2026 frontier
CN19	contender	T-FRONT-CONNECT	CN14	Games together inside the circles at the embedded-multiplayer bar the category leader sets [discord-activities], held to the two-deep youth room on join and on leave, the one contact rule for one-to-one play and server-validated moves under a digest any device replays, so two youth peers play under their guardians' rules and no adult ever plays a minor alone

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Post-quantum ratchet (forward secrecy and post-compromise healing) (CN20) after CN8	kx_pq_ratchet	The CN8 hybrid key agreement grows into a ratchet at the Level 3 bar [apple-pq3] [signal-spqr]: a symmetric chain that derives a fresh key per message and deletes the one before it, an X25519 step with every reply, and a periodic ML-KEM-768 epoch whose fresh encapsulation re-seeds the chain, so a copied device state stops opening messages after the next epoch; done-rule: a ratchet-vm-class gate proves on the SHIPPED wasm that (1) a message key is gone from the state one step later and a stolen current state cannot open a message sealed before the theft (forward secrecy), (2) a stolen state stops opening messages once the next ML-KEM epoch lands (post-compromise healing, planted both ways), (3) out-of-order delivery inside a bounded skip window opens while a replay is refused, and (4) a downgrade that strips the epoch is refused once both peers advertise it -- the watch flips by the gate, never by the symbol name	Organ	3 u

Rung	Role	Toward	Stands on	Why
CN20	contender	T-BIC-CONNECT	CN8	The post-quantum ratchet the best-in-class messaging bar names (Signal SPQR, iMessage PQ3 Level 3), which the static-key hybrid of CN8 does not reach

Ladder verdict. LADDERED. Targets, rung roles and bars are counted in the tables below, each partition re-derived beside its total. Bars read FRESH against the current month 2026-10.

Ladder verdict, counted (17 rows, more than the 12-row disclosure bar)

Ladder verdict, counted
Class	Count	Note
targets	2	sotatarget rows on the plan
best in class	1	targets whose class is best-in-class, by code
frontier	1	targets whose class is frontier, by code
undated	0	targets naming no bar that exists
bad class	0	targets whose class is neither word
duplicate	0	target ids an earlier row already carries
rungs	24	rung rows on the plan
placed	24	rungs carrying a rungrole row
unplaced	0	rungs with no role toward any target
bad role	0	rungrole rows naming a role the ladder does not know
bad target	0	rungrole rows naming a target no sotatarget row declares
rungs, summed	24	RECONCILED: the parts sum to the total 24
substrate	6	what the target's own methods consume
arm	2	a sovereign arm that triangulates without competing for the number
contender	16	its done-rule is a number against the target
superseded	0	kept as capability, retired as a claim
placed, summed	24	RECONCILED: the parts sum to the total 24

Bar freshness, counted
Class	Count	Note
bars	1	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	1	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	1	RECONCILED: the parts sum to the total 1
current month	2026-10	the month every bar is judged against

Treatment verdict. PARTIAL -- a declared row is unmet: the ranker refuses this board until every declared row verifies. The declared rows, the rungs and the evidence read are counted in the table below, the row partition re-derived beside its total. The complete effective clock view could not be read. Agent absence remains UNPROVEN; restore that observation before claiming completion.

Treatment verdict, counted
Class	Count	Note
rows	10	treat rows declared on the plan
complete	9	every declared step verifies against the evidence
partial	1	a declared step is unmet
malformed	0	a treat row missing a field
rows, summed	10	RECONCILED: the parts sum to the total 10
rungs	24	rungs on the plan
undeclared	14	rungs with no treat row
allowlist bytes read	207076	the MCP allowlist the ranker reads
roster bytes read	119881	the gate roster
clock plane bytes read	0	the clock DESIRED plane

Rung	MCP row	API route	Primitive	Workflow	Agent beat	Verdict
CN13	nx_connect_signup_gate present	/api/gate_run?target=nx_connect_signup_gate present	nx_connect_signup present	connect-onboard present	nx_connect_signup_gate present	COMPLETE
CN14	nx_connect_circles_gate present	/api/gate_run?target=nx_connect_circles_gate present	nx_connect_circles present	connect-onboard present	nx_connect_circles_gate present	COMPLETE
CN6	nx_chat_store_lib_gate present	/api/gate_run?target=nx_chat_store_lib_gate present	nx_chat_store_lib present	connect-onboard present	nx_chat_store_lib_gate present	COMPLETE
CN5	nx_connect_realm_gate present	/api/gate_run?target=nx_connect_realm_gate present	nx_connect_realm present	connect-onboard present	nx_connect_realm_gate present	COMPLETE
CN3	nx_connect_liquidity_gate present	/api/gate_run?target=nx_connect_liquidity_gate present	nx_connect_liquidity present	connect-onboard present	nx_connect_liquidity_gate present	COMPLETE
CN18	nx_connect_personhood_gate present	/api/gate_run?target=nx_connect_personhood_gate present	nx_connect_personhood present	connect-onboard present	nx_connect_personhood_gate present	COMPLETE
CN15	nx_connect_faith_gate present	/api/gate_run?target=nx_connect_faith_gate present	nx_connect_faith present	youthsafety-audit present	nx_connect_faith_gate present	COMPLETE
CN16	nx_connect_study_gate present	/api/gate_run?target=nx_connect_study_gate present	nx_connect_study present	youthsafety-audit present	nx_connect_study_gate present	COMPLETE
CN17	nx_connect_service_gate present	/api/gate_run?target=nx_connect_service_gate present	nx_connect_service present	youthsafety-audit present	nx_connect_service_gate present	COMPLETE
CN8	nx_connect present	/api/organ_run?target=nx_connect&args=kx_policy present	nx_connect_pq present	connect-pqkx present	gaterosterheavy declared	PARTIAL

Inspect a rung and its prerequisites

Declared nodes 24. Rank input binding: STALE_OR_INVALID_BINDING. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 d76e0275f87c9e06ddb7355b9402e4d3963f7fb93acdfb4c7ca1d553e1bd81ef. Target rows 2; role rows 24. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 24 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

CB0 — Content-blind room receive
Prerequisites: None declared; this does not establish execution eligibility.
Contract: recv_bw_svc
Acceptance: SVC layout-aware receive, server decodes 0 -- LANDED, gated
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CB1 — Public web app
Prerequisites: None declared; this does not establish execution eligibility.
Contract: so_feed
Acceptance: Live at nishifamily.com/connect, gate 8/8 over the edge -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CB2 — Reciprocal matching
Prerequisites: None declared; this does not establish execution eligibility.
Contract: mx_inter_popc
Acceptance: Harmonic-mean reciprocity -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CB3 — Honesty gauge on the surface
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nx_connect_maturity
Acceptance: LANDED 2026-08-19: registered on the MCP surface (/api/tools/register, callable) and run live -- 437/1000 published on this page from the run artifact, never from prose
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN1 — Codec bound into calls
Prerequisites: CB0 (acceptance unverified)
Contract: cc_call_codec_bind
Acceptance: The sovereign vcodec encodes and decodes inside the call path that CB0 already receives content-blind; gate proves a two-peer call round-trips a frame through our encoder and the server still decodes zero bytes
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN2 — Native mobile shell
Prerequisites: CB1 (acceptance unverified)
Contract: cl_mobile_shell
Acceptance: A native shell over the existing web core (same auth, same content-blind store) with push, camera and mic permissions; done-rule: the web gate's 8 teeth pass through the shell on a real device and the youth wall is enforced identically; push delivery (push_deliver) is part of this done-rule -- a message posted while the app is closed produces a device notification
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN3 — Cohort seeding on the wedge
Prerequisites: CB1 (acceptance unverified), CB2 (acceptance unverified), CN6 (acceptance unverified), CN13 (acceptance unverified), CN14 (acceptance unverified)
Contract: lq_cohort_seed
Acceptance: Invite-by-token cohorts for the LDS community vertical with the reconnection lane as the hook; the connection-quality funnel (replies, meetings) is the ruler; done-rule: a seeded cohort shows a measured reply rate above the empty-room baseline within its first week, published beside the cohort size -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/nx_connect_liquidity.nx 19195 B sha 5a0bcf3b declares lq_cohort_seed; nx_connect_liquidity_gate 72/72 GREEN re-run by the verifier (gate_run and a fresh qualify) and bite-killed 1 of 1, promoted 8bd41082, rostered. Done-rule OPEN: the first-week field reply rate is UNMEASURED (no live cohort, not wired into nx_connect_serve); lq_funnel_verdict compares point rates only and read ABOVE on overlapping Wilson intervals, so an interval-separated verdict is owed; the guardian link is inviter-asserted and the band caller-supplied
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN4 — Trained matching and moderation
Prerequisites: CB2 (acceptance unverified), CN3 (acceptance unverified)
Contract: nn_match_train
Acceptance: No-float models trained on consented behavioral signals only (no plaintext), replacing the hand-weighted reciprocity and abuse scores where they measure better; pre-declared accept rule: beat the hand-weighted baseline on a held-out labelled set or stay UNWIRED
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN5 — Family-realm account unification
Prerequisites: None declared; this does not establish execution eligibility.
Contract: acc_realm_unify
Acceptance: The nishi_connect OPAQUE realm joins the family-wide identity so one account spans CONNECT and the suite; done-rule: login on /connect with a family account round-trips whoami, the auth gate stays GREEN, and the gauge's accounts row re-grades on evidence -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/_hdl_build/nx_connect_realm.nx 24607 B sha da9b78ee declares acc_realm_unify (NIST SP 800-63C-4 sec 3.8.1 account linking [@nist80063c4], one family identity per account); nx_connect_realm_gate 47/47 GREEN re-run by the verifier and bite-killed 1 of 1, promoted e47c7ffd, rostered; nx_connect_auth_gate 12/12 GREEN. Done-rule OPEN: nx_connect_appd does not call acc_realm_unify (0 hits) so no served whoami round trip exists and the gauge accounts row stays 2; owed fixes: realm_links.log is written 0644 with unkeyed uid digests, the read-then-append is unlocked, and no attested band source exists yet
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN6 — Messaging core on the durable store
Prerequisites: CN5 (acceptance unverified)
Contract: cs_msg_append
Acceptance: The per-session in-memory thread becomes the per-account durable world end to end (send, receipts, edit and delete surviving restart, two accounts proven isolated); done-rule: the accounts gate grows a restart tooth and the gauge's messaging row moves STUB to PARTIAL on evidence -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/_hdl_build/nx_connect_msgstore.nx 21094 B sha 5694c3c3 declares msg_store_append (Matrix room version 11 redaction model [@matrix-rooms-v11], deviations declared); nx_connect_msgstore_gate 56/56 GREEN re-run by the verifier, promoted aa3abf18; nx_connect_accounts_gate 7/7 GREEN with the T7 RESTART tooth, so done-rule part 1 is met. Done-rule OPEN: the store is not wired into the served daemon and the gauge messaging row is still STUB; the verifier bite left one surviving mutant (msd_slen at off 5947 lets the .msg path alias the .cst world snapshot, tooth owed); the channel verdict is caller-trusted and yw_may_channel allows an unknown band; edit and delete carry no actor check; the save uses a fixed temp name
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN7 — AEAD sealing wired into the live serve
Prerequisites: CN6 (acceptance unverified)
Contract: cs_sealed_aead
Acceptance: /connect/secure stores Poly1305-tagged sealed messages and REJECTS tamper live, positive and negative proven over the edge; retires the unauthenticated stream the seal gate neg-controls (cseal teeth already GREEN)
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN8 — Post-quantum hybrid key agreement
Prerequisites: CN7 (acceptance unverified)
Contract: kx_pq_hybrid
Acceptance: Compose the estate's nx_pq_hybrid organ into the browser key agreement so the conversation key is an X25519-plus-PQ hybrid; done-rule: a keyx-vm-class gate proves the hybrid on the shipped wasm -- the watch flips by the gate, never by the symbol name
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN9 — Real NMT through the LLM serve
Prerequisites: None declared; this does not establish execution eligibility.
Contract: ct_llm_translate
Acceptance: /connect/chat translation routes through the live LLM serve daemon with the lexicon as offline fallback; done-rule: a banked bilingual fixture set graded by an estate judge beats the lexicon on every pair, and the quality claim carries the judge output
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN10 — Live voice translation in calls
Prerequisites: CN9 (acceptance unverified), CN1 (acceptance unverified)
Contract: lt_call_caption
Acceptance: Captions in the listener's language rendered inside the call at conversational latency, composing CN9 and CN1; done-rule: a banked bilingual call fixture round-trips with judge-graded caption quality
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN11 — AI conversation-practice partner
Prerequisites: CN9 (acceptance unverified)
Contract: cp_practice_turn
Acceptance: A consent-gated practice mode on the LLM serve whose corrections bind into the chat's correction loop; done-rule: practice turns graded by the judge panel against a banked rubric -- never by engagement time
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN12 — Federation probe
Prerequisites: CN7 (acceptance unverified)
Contract: fed_route
Acceptance: A second Nishi CONNECT instance exchanges sealed messages with the first over the sovereign transport (self-federation first, standard bridges later); done-rule: cross-instance delivery proven with content-blind servers on both ends
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN13 — Private, secure sign-up
Prerequisites: None declared; this does not establish execution eligibility.
Contract: csu_signup_admit
Acceptance: A person signs up from the first byte with full privacy and security: a handle and a passphrase through OPAQUE so the server stores an envelope and never a password equivalent; no phone number, email or legal name required; an age band attested without storing any identity document; consent recorded per purpose (discovery, faith, each circle) and OFF until the member turns it on; the end-to-end key pair generated on the device; single-use recovery codes; automated or replayed sign-up refused without tracking the person; one account across the Nishi platforms through the family realm; done-rule: the gate proves a completed sign-up stores exactly the declared minimal fields and no password equivalent, discovery is off by default, a minor account opens only peer and guardian lanes under the two-deep wall, an automated or replayed sign-up is refused, and a recovery code works exactly once -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/_hdl_build/nx_connect_signup.nx 27825 B sha 9e151f9b declares csu_signup_admit over OPAQUE RFC 9807 [@rfc9807], with Privacy Pass named as the anti-automation successor [@rfc9576]; nx_connect_signup_gate 66/66 GREEN re-run by the verifier and bite-killed 1 of 1, promoted 18159ce0, rostered; policy knowledge/connect_signup.conf carries UNMEASURED calibration rows. Done-rule OPEN on the served surface: only csu_handle_taken is wired and only on /alpha/connect; production still lets a taken handle be re-registered (debt 1790359363 sev 8) and 9 other organs call olg_register without the uniqueness check (live reach UNVERIFIED); the age band is caller-attested; minors get no GROUP lane; passkeys and the device-side OPAQUE client are owed
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN14 — Concentric community circles
Prerequisites: CN13 (acceptance unverified)
Contract: ccl_circle_reach
Acceptance: A member community is concentric circles joined by consent and vouching, never by any official Church record: immediate family, mission family (those who served in the same mission, from the reconnection lane), ward family, stake family, members worldwide who opted in, then Christians of other traditions who opted in; reach widens one circle at a time, contact needs mutual acceptance, two youth peers (an LDS boy and an LDS girl) may become friends by mutual acceptance with their guardians able to see the friendship, and the two-deep wall governs every adult and minor pair; done-rule: the gate proves each circle admits only by consent plus vouching, reach never skips a circle the member has not opened, two youth peers can befriend each other while an unrelated adult cannot open a private channel to either, and leaving a circle removes its reach at once -- STATUS 2026-09-25 (SYNC, verifier CONFIRMED): lib runtime/_hdl_build/nx_connect_circles.nx 41453 B sha 7ff66d3a declares ccl_circle_reach with the rings as data in knowledge/connect_circles.conf; nx_connect_circles_gate 73/73 GREEN re-run by the verifier and bite-killed 1 of 1, promoted 82aac86a, rostered; the gate proves every done-rule clause, and a read-only circles page is live on /alpha/connect/circles only. Open before acceptance: reach used as profile visibility would let a non-guardian adult discover a minor in a shared ring (wall adult-to-minor reach before wiring); guardian consent is a flag, not an act; circle instance ids are self-asserted; no backward endorser accountability (RepuLink [@arxiv-vouching]); shipped, referee grade UNMEASURED, awaiting operator acceptance
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN15 — Christian traditions at equal fidelity
Prerequisites: None declared; this does not establish execution eligibility.
Contract: cfa_tradition_admit
Acceptance: Growth from Latter-day Saints to other Christians: every Christian tradition (Catholic, Orthodox, the Protestant families and the Restoration churches including The Church of Jesus Christ of Latter-day Saints) self-identifies at the same depth from a data table under each church preferred name; faith is optional, self-declared and consent-gated as a special category, a discovery signal weighted by the member own stated importance, never an enforced filter, and no copy speaks for any church; done-rule: every table row admits at equal depth, an undeclared tradition is refused rather than guessed, withdrawing consent removes the member from faith discovery at once, and the youth wall verdict is identical with and without faith -- STATUS 2026-09-25 (SYNC, verifier CONFIRMED): lib runtime/_hdl_build/nx_connect_faith.nx 22406 B sha 2b6e19b6 declares cfa_tradition_admit over knowledge/connect_faith_traditions.conf (16 traditions, 63 churches under each church preferred name; the Pew landscape-study mirror was withdrawn as a ref because its fetch redirected); consent is explicit and withdrawable as GDPR Art. 9 and Art. 7(3) require [@gdpr-art9] [@gdpr-art7]; nx_connect_faith_gate 63/63 GREEN re-run by the verifier and bite-killed 1 of 1, promoted 39bd51a7, rostered; the gate proves every done-rule clause. Open before acceptance: faith discovery lists minors to minors across the whole population with no circle or guardian scope (a policy decision before any route), the importance scale calibration is UNVERIFIED, nothing is served, operator acceptance outstanding
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN16 — Scripture study circles
Prerequisites: CN14 (acceptance unverified)
Contract: csc_circle_post
Acceptance: A study circle is a consent-joined group following a reading plan held as data (a Come, Follow Me week or a Bible reading plan); every passage resolves through the estate verse door from the public-domain corpus (Church-copyright headings, footnotes and cross-references are never copied); members post reflections anchored to a verse reference; youth circles obey the two-deep wall on join and on leave; done-rule: the gate proves a verse-anchored reflection round-trips with its reference resolved from the corpus, an unknown reference is refused rather than guessed, and a youth circle left with one adult refuses the change
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN17 — Service and help board
Prerequisites: CN14 (acceptance unverified)
Contract: csh_need_match
Acceptance: Members post needs (meals, a move, a ride) and service projects with a place, a time and a capacity; neighbours offer help; matching is by consent, a coarse locality band and capacity, never by faith, looks or status; the exact address is withheld until both sides confirm; minors join service projects only inside the two-deep wall; done-rule: the gate proves need, offer and confirm round-trip idempotently, capacity holds under over-offer, the address stays coarse before mutual confirmation, and a minor one-to-one adult request refuses
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN18 — Verified person without storing identity
Prerequisites: CN13 (acceptance unverified)
Contract: cvh_person_attest
Acceptance: A member proves they are a real person, and for youth features their age band, without the estate storing any identity document: a presentation from a digital credential (the W3C Digital Credentials API over an ISO mobile driving licence or a state-endorsed digital identity) or an in-person vouch by two verified members, reduced to a signed claim of personhood and age band only; done-rule: the gate proves a valid presentation yields that claim and nothing else is stored, a replayed or forged presentation is refused, and the member can revoke the claim
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN19 — Games together, one to one or in groups
Prerequisites: CN14 (acceptance unverified)
Contract: cpl_play_move
Acceptance: Members play together inside their circles, one to one or in a group room: a play session holds one two-player game in a room admitted by room_admit on join and on leave (two-deep, from the one youth room rule in nx_connect_lds_room_lib), a one-to-one invitation only where ccl_channel admits the pair (two minors through ysf_peer_may_connect, never an adult and a minor), every co-presence asked of ast_may_discover both ways so a blocked pair is refused either way, every move and the turn order validated by the server through the one nx_folkgame_lib move generator (never a second rules copy), a chained det_state_checksum digest after every move that any client on any device replays to prove it holds the same state and history, idle expiry and the room cap as conf rows with reasons (knowledge/connect_play.conf), and no function signature taking an IP, a location, a device id or a fingerprint; done-rule: nx_connect_play_gate proves a lone adult with youth refused on join and on leave while two adults with youth are admitted, a youth-youth one-to-one admitted where the peer rule allows and an adult-minor one-to-one refused both ways, a blocked pair refused both ways in a group room and in a one-to-one, an illegal and an out-of-turn move refused, the win detected identically to the generator down to the published 255,168-game tic-tac-toe tree walked through the session, every align game the spec names played through the session against the generator driven directly with the turn order taken from the generator (capture and movement phases reached), the digest identical across replays, different after a different move and recomputed at every ply by a second method class (a bitwise CRC-32C anchored to its catalogued check value), play_state answering only the caller's own room, and the signature scan clean; members reach it only when the front door carries the play verbs
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
CN20 — Post-quantum ratchet (forward secrecy and post-compromise healing)
Prerequisites: CN8 (acceptance unverified)
Contract: kx_pq_ratchet
Acceptance: The CN8 hybrid key agreement grows into a ratchet at the Level 3 bar [@apple-pq3] [@signal-spqr]: a symmetric chain that derives a fresh key per message and deletes the one before it, an X25519 step with every reply, and a periodic ML-KEM-768 epoch whose fresh encapsulation re-seeds the chain, so a copied device state stops opening messages after the next epoch; done-rule: a ratchet-vm-class gate proves on the SHIPPED wasm that (1) a message key is gone from the state one step later and a stolen current state cannot open a message sealed before the theft (forward secrecy), (2) a stolen state stops opening messages once the next ML-KEM epoch lands (post-compromise healing, planted both ways), (3) out-of-order delivery inside a bounded skip window opens while a replay is refused, and (4) a downgrade that strips the epoch is refused once both peers advertise it -- the watch flips by the gate, never by the symbol name
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence connect writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

CB0 Content-blind room receive · cell PRESENT · gate NO-GATE-DECLARED

Contract	`recv_bw_svc` · executor Organ · 0 u · stands on nothing
Definition of done	SVC layout-aware receive, server decodes 0 -- LANDED, gated
Matrix cell	E2E content-blind group video receive (SVC, server decodes 0) · `runtime/_hdl_build/nx_connect_room_rx.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_room_rx`; declare `nx_connect_room_rx TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 measure FINISH seat qualify builds on the NAS (nx_sov_build_run --qualify, admission GRANT each time): nx_connect_room_rx GREEN 8/8 exit 0 18286 B sha256 b2f9cbab (build-cache hit), nx_connect_social GREEN 8/8 exit 0 28429 B sha256 899aa975, nx_connect_lds_youth GREEN 8/8 exit 0 18491 B sha256 86410499, nx_connect_lds_reconnect GREEN 8/8 exit 0 22263 B sha256 b63e9284, nx_connect_idage GREEN 8/8 exit 0 18820 B sha256 85928a41. All five are hand-rolled tcheck verdicts carried by the exit code, not nx_gate_verdict; none carries a _gate/_test/_kat name, so the name-keyed D001 promote guard (nx_mgmt_api ma_name_is_oracle) does not apply to them. OPEN: promote, roster admit, execsurface census, so the CB0 and CB1 FINISH rows can close; migration onto gv_check is a separate queue item 2026-09-25 measure FINISH seat: CB0 [recv_bw_svc] and CB1 [so_feed] are CLOSED as FINISH rows. Instrument chain: nx_execsurface census (organs=3037 on_surface=1251 ref_only=134 dark=1652 sum=3037, roster_rows=955, asof=1790356741) reads nx_connect_room_rx ON-SURFACE launched-by roster; nx_compare_rank connect then printed rungs=22 done=9 open=13 finish=6 with neither CB0 nor CB1 among them (artefact buildroot/knowledge/compare/connect.rank 12992 B sha256 4085b83f). The six FINISH rows now open are all LIB-UNCENSUSED libraries landed this leg by other seats: CN3 lq_cohort_seed, CN5 acc_realm_unify, CN6 msg_store_append, CN13 csu_signup_admit, CN14 ccl_circle_reach, CN15 cfa_tradition_admit; remedy named by the catalog: nx_eco_graph_build then nx_importcensus, then a shipping importer for each (the connect daemon), else they stay LIB-GATE-ONLY. nx_connect_maturity re-run through /api/organ_run: raw 21/48, PRODUCTION-READINESS 437/1000, unchanged from 2026-08-19 as expected, because promoting self-tests moves no depth row 2026-09-25 queue FINISH seat hand-off, what is still open and the recipe for each: (1) nx_connect_msg is now a library (cmsg_selftest, owner CN6); its promoted and rostered binary 984514f7 was built from the pre-edit program; the owner re-points knowledge/gateroster.conf at a gate calling cmsg_selftest or retires nx_connect_msg.elf with nx_retire_path. (2) Bites not yet run: nx_connect_lds_reconnect (its strength rule lives in the lib, so plant through nx_gate_bite with subject), nx_connect_room_rx, nx_connect_social, nx_connect_lds_free, nx_connect_lds_census. (3) nx_connect_auth_gate still writes fixed /tmp/nxcauth_keys.bin and /tmp/nxcauth_store.log; move them under /tmp/nx_connect_auth_gate/ created at setup (sys_mkdir) and clear the store there; B1 re-registers the same handle and passed on repeat runs, so today it is idempotent by olg behaviour, not by construction. (4) The roster beat stamp knowledge/status/gateroster.stamp read ts=1790178517 at 1790356448, about 49 h stale: the 10 admitted rows are an execution surface the catalog counts, but no beat has run them yet; whoever owns the roster beat should read its clock row. (5) Six FINISH rows (CN3, CN5, CN6, CN13, CN14, CN15) read LIB-UNCENSUSED: nx_eco_graph_build then nx_importcensus, then a shipping importer (the connect daemon), else LIB-GATE-ONLY. (6) The ten organs are PROMOTED but not registered on the MCP surface; the ranker counts them through the roster (RUN-BY), registration is optional and adds rows to the already-windowed tools/list. Recipe for any further hand migration, proven ten times this leg: bank the source, import nx_gate_verdict.nx, delegate the local check to gv_check, gv_ctr, gv_kv values, return gv_verdict, rename one tooth neg-control-..., --qualify --release, nx_contentdiff with deadline_ms, promote with expect_sha256 (allow_capability_loss only after the lost runs are named) 2026-09-25 measure FINISH seat bite on the content-blind exceed: planting server_decoded_blind to decode every stream read T3 FAIL with server_decoded_blind=9 beside server_decoded_non_e2e=9 while the new neg-control stayed PASS, passed 8/9 verdict=RED exit 1; restored, cache hit reproduced b8a7f859, nx_filehash cmp identical=1 against the live binary, GREEN 9/9. Bites this leg now five: auth gate, youth wall, idage, youth rooms, room_rx. Last build of the seat; no build left in flight 2026-09-28 measure W17 SEAT CALL-CODEC gave CB0 its MCP row: nx_connect_room_rx (PROMOTED 44471 B, a self-gating organ whose main runs 9 teeth on the base class and returns gv_verdict) REGISTERED through /api/tools/register (job 1790620383, callable 1) and run through /api/organ_run (job 1790620422): exit 0, 9/9 GREEN, capture complete. /api/gate_run REFUSES it by name (job 1790620406: verifiers only, the name must end in gate, test or kat), so the roster and the gate route cannot run it until a thin nx_connect_room_rx_gate exists -- queued, not built. HONEST SCOPE: its T3 content-blind tooth is a modelled constant (server_decoded_blind returns 0 by definition and rx_decrypt is an additive stand-in); the MEASURED content-blind proof for the call path now lives in nx_connect_codec_gate T4 (the decoder refuses what the relay holds, accepts the plaintext) and T5 (the relay closure and CB0 import no decoder and no AEAD).

CB1 Public web app · cell PRESENT · gate NO-GATE-DECLARED

Contract	`so_feed` · executor Organ · 0 u · stands on nothing
Definition of done	Live at nishifamily.com/connect, gate 8/8 over the edge -- LANDED
Matrix cell	Profile + moments feed + stories (additive tombstones) · `runtime/_hdl_build/nx_connect_social.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_social`; declare `nx_connect_social TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 land FINISH seat: nine CONNECT LDS-vertical organs PROMOTED to the serving root through /api/promote with expect_sha256, each staged by nx_filecopy from the exact _build artifact that ran GREEN (verified=1, mode 0755): nx_connect_room_rx 18286 B b2f9cbab, nx_connect_social 28429 B 899aa975, nx_connect_lds_youth 18491 B 86410499, nx_connect_lds_reconnect 22263 B b63e9284, nx_connect_idage 18820 B 85928a41, nx_connect_lds_room 22319 B c1cf735f (8/8), nx_connect_msg 20820 B 984514f7 (7/7), nx_connect_lds_census 23118 B 3645c1f0 (ABSENT 0 PRESENT 15 EXCEEDS 2), nx_connect_lds_free 17614 B 4ecf871d (5/5). Roster: nx_gate_roster_run trial over the promoted binaries read 9/9 GREEN (journal knowledge/status/gateroster_trial_connect_finish_20260925.jrnl, deadline 60000 ms), then admit wrote admitted_new=9 to knowledge/gateroster.conf, partition reconciles. OPEN: execsurface census so the catalog reads RUN-BY, then the ranker re-read for the CB0 and CB1 FINISH rows; the roster beat stamp is stale (gateroster.stamp ts=1790178517, about 49 h old at this row), so rostered is not yet ran-on-the-beat 2026-09-25 land FINISH seat: the two FINISH-row organs are on the base class too. nx_connect_room_rx (CB0, source 7461 to 8042 B, banked knowledge/status/nx_connect_room_rx.nx.bank-20260925) gained a ninth tooth neg-control-non-e2e-sfu-decodes-every-stream so the content-blind exceed cannot pass against a dead comparator; release build passed 9/9 GREEN 44471 B sha256 b8a7f859, values grid_tiles 9, recv_bw_svc_9 180 vs naive 900, server_decoded_blind 0 vs non_e2e 9, fit_budget_150 150, recv_bw_svc_25 340 vs naive 2500. nx_connect_social (CB1, 15476 to 16054 B, banked likewise) T8 renamed neg-control-phonebook-upload; passed 8/8 GREEN 54765 B sha256 77e90d17, values feed 3 then 2 after tombstone, story 1 then 0 after expiry, handle 1 and -1, token 2, forged -1, expired -2, incumbent phonebook surfaced 555 vs ours -1. nx_contentdiff lost 3 and 4 runs, every one a superseded hand-verdict literal; both promoted with allow_capability_loss=yes and expect_sha256. idage bite: verify_attest planted to accept any MAC read T2 neg-control-forged-attestation FAIL, passed 7/8 verdict=RED exit 1; restored. Still hand-rolled and queued: nx_connect_lds_room, nx_connect_msg, nx_connect_lds_census, nx_connect_lds_free

CB2 Reciprocal matching · cell PRESENT · gate NO-GATE-DECLARED

Contract	`mx_inter_popc` · executor Organ · 0 u · stands on nothing
Definition of done	Harmonic-mean reciprocity -- LANDED
Matrix cell	Reciprocal language-partner matching · `runtime/_hdl_build/nx_connect_match_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_match_lib`; declare `nx_connect_match_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790361304 routed by nx_intake_route (pmboard-seat, epoch 1790361368) from pmboard-seat: B4 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): language learning together -- members find reciprocal language partners ( -- sponsor intake-1790361304 plus2

CB3 Honesty gauge on the surface · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nx_connect_maturity` · executor Organ · 0 u · stands on nothing
Definition of done	LANDED 2026-08-19: registered on the MCP surface (/api/tools/register, callable) and run live -- 437/1000 published on this page from the run artifact, never from prose
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nx_connect_maturity`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

CN1 Codec bound into calls · cell LANDED · gate UNRECORDED

Contract	`cc_call_codec_bind` · executor Organ · 2 u · stands on CB0
Definition of done	The sovereign vcodec encodes and decodes inside the call path that CB0 already receives content-blind; gate proves a two-peer call round-trips a frame through our encoder and the server still decodes zero bytes
Matrix cell	Production A/V codec substrate composed into calls · `runtime/nx_connect_codec.nx` · LANDED decl
Gate	`nx_connect_codec_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-28 measure W17 SEAT CALL-CODEC RESUMED (T0 1790618784, after the 12:39 CDT network outage killed the first run mid-work). The predecessor journaled nothing on this board but left three NEW sources, re-read whole: buildroot/runtime/nx_connect_codec.nx (18243 B: cc_ctx_new, cc_call_codec_bind, cc_call_codec_open, cc_ctx_free), nx_connect_codec_relay.nx (8893 B: the ONE clear call-frame header plus the content-blind relay hop over nx_room_relay rr_post and rr_live, importing only nx_room_relay) and nx_connect_codec_gate.nx (34944 B). nx_sov_build_run nx_connect_codec_gate --qualify (job 1790618931, build-cache hit sha256 89fc9f74, 235900 B) reads 54/54 GREEN: the receiver's frame is byte-identical to the sender's encoder reconstruction across bind, seal, relay and open in both directions; key Y-PSNR 4454 cdB and P-frame 3771 cdB against the codec's own 2800 cdB bar at qp 32; the decoder refuses the bytes the relay holds (rc -1) while the same decoder accepts the plaintext stream (rc 0); a flipped ciphertext or tag byte, an edited counter, a relabelled layer and the wrong call key are refused -31 at the AEAD before the decoder runs, a misroute -27, a replay -29; VmSize flat across 16 sealed P-frames. AEAD composed: nx_connect_seal cseal_seal_ws and cseal_open_ws (RFC 8439 ChaCha20-Poly1305, caller workspace) because the room path had no cipher (nx_connect_room_rx rx_decrypt is an additive stand-in). Next: bite, ship, register, roster. 2026-09-28 land W17 SEAT CALL-CODEC: CN1 SHIPPED, gate 60/60, awaiting acceptance. nx_connect_codec_gate shipped by nx_organ_ship (job 1790620070) sha256 6e2212bf: prove GREEN 60/60 on the fresh build, first promote live equal to staged, _offc twin installed, REGISTERED callable 1; served /api/gate_run (job 1790620130) exit 0 GREEN 60/60 on the FAST path, capture 8417 B untruncated, source_newer 0, sources resolved from the nishihost root through buildroot/runtime. Libs: buildroot/runtime/nx_connect_codec.nx sha256 7e92ca5e 18243 B declares cc_call_codec_bind (the contract symbol the matrix watch names, in the organ path the row names) with cc_call_codec_open, cc_ctx_new and cc_ctx_free; nx_connect_codec_relay.nx sha256 0f0d5a57 8893 B. This seat added the real-frame leg on the estate's REAL-frame fixture knowledge/staging/media/bframe_test_decoded.yuv (YUV420 576x1024, the frames nx_vcodec_t8noise_gate and nx_vcodec_bgop_bench read): frame 0 as a key frame 94930 codec bytes sealed to 94970 at 4488 cdB, frame 1 as a P-frame 1779 codec bytes sealed to 1819 at 3958 cdB, closed loop both times (gate source 34944 to 36925 B). Bite-proven: nx_gate_bite 3 of 3 compiling mutants KILLED, each restore byte-verified -- the lib comparison site at off 10012, the geometry guard in cc_ctx_new (job 1790619821); aimed numeric site 30 at off 16255, the receiver replay window ctr + 1 in cc_call_codec_open (job 1790619956); the relay comparison site at off 6574, the magic check in ccr_hdr_parse (job 1790620023). Rostered in knowledge/gateroster.conf, cited in knowledge/compare/connect.gates, declared for both libs in knowledge/organ_gate.conf. RESOURCE ENVELOPE, named: one call context holds an AEAD workspace of cseal_ws_bytes of its plaintext bound, 2765824 B at 320x240 (the incumbent arena AEAD spends a block state per 64 plaintext bytes, about 6x the 460818 B bound), allocated once in cc_ctx_new and returned by cc_ctx_free (VmSize falls 3396 kB on free); nothing is allocated per frame (VmSize delta 0 over 16 sealed frames). The watch flip on the next connect publish is the receipt, not the proof. 2026-09-28 queue CN1 INTEGRATION SPEC for the call UI owner (the alpha daemon sources are wave 16 locked, and no /connect source carries a call path today: nx_txtscan count of video is 0 in nx_connect_appd 89245 B, nx_connect_serve 132671 B and nx_connect_ui 33585 B). SERVER, alpha first then production: one call route pair composes nx_connect_codec_relay ONLY and never nx_connect_codec -- POST a sealed frame through ccr_relay_post(st, arena, room, now, frame, n, info) over relay state from ccr_state_cells(nslots) with rr_init slot bytes cc_frame_cap(W, H) of the call's top rung (a frame over a slot is REFUSED CCR_E_SLOT, never truncated); GET the newest frame of one sender and layer through ccr_relay_fetch(st, arena, room, kid, layer, now, ttl, out, cap). Admission stays with its owners: nx_connect_lds_room room_admit on join AND on leave (two-deep youth wall), nx_connect_circles ccl_channel for a one-to-one pair, nx_connect_antistalk ast_may_discover for who may be called. CLIENT: compile nx_connect_codec through nx_compile_wat into the call worker (the door nx_opaque_wasm_gate proved for the OPAQUE client); per own stream cc_ctx_new(W, H, qp, kid, layer, call_key) once, each camera tile vv_rgba_to_yuv420 then cc_call_codec_bind(ctx, yuv, key_req, out, cc_frame_cap(W, H)) then POST; per remote sender one receiver context, each fetched frame cc_call_codec_open(ctx, frame, n) then render cc_ctx_frame(ctx); cc_ctx_free at hang-up. The family video app already writes the same 6-byte inner header before its vv_enc stream (nx_video_appv2_emit encodes at RT + 0xB0000 + 6), so swapping NX.vv_enc and vv_dec for cc_call_codec_bind and cc_call_codec_open there is wire-compatible; four literal probes of that emitter (crypt, seal, subtle, chacha) count 0 each over its 74595 B, so its frames cross nx_vroom without a cipher today (ephemeral by nx_room_privacy_gate, not content-blind by construction). CALL KEY: until CN7 and CN8 land a server-free key agreement, the call key comes from the sealed-messaging key path (wave 16 SEALED), never from the server. Teeth the integration owes: extend the T5 import census over the serving daemon (no decoder, no AEAD in its closure), a live two-peer call over the served route round-trips a frame while the relay holds ciphertext, and a lone adult is refused on join and on leave of a youth call room. 2026-09-28 land W17 SEAT CALL-CODEC RE-SHIPPED CN1 with two call-path fixes, gate 80/80, awaiting acceptance. (1) LOSS: cc_call_codec_open now decodes a P-frame only against the reference it was predicted from; a counter gap or a P-frame before any key frame is refused CC_E_NEEDKEY once it authenticates, undecoded, reference untouched, and cc_ctx_need_key asks the app for a key frame (key_req on the sender's next bind, the picture-loss-indication pattern of RFC 4585). Before this, a frame the relay's newest-frame slot overwrote (nx_room_relay keeps one frame per sender and layer) made the receiver decode every later P-frame against the wrong reference. (2) GEOMETRY: nx_vcodec codes whole 16x16 macroblocks only, so at 320x240 the 160x120 chroma planes (7.5 macroblocks tall) keep their last 8 rows uncoded and a key frame cannot resync a receiver with another buffer history -- measured by the new T12: the same raw key frame decoded into a dirty buffer differs by 2845 bytes, all chroma, luma identical. The binding now codes a padded frame (each dimension rounded up to a multiple of 32 by cc_coded, last row and column replicated, cropped back for display, the frame-cropping practice of H.264) and accepts any even geometry; padded, the same key frame decodes identically whatever the receiving buffer held (0 bytes). Found because the first T11 run read 71/73 RED: the recovery key frame opened (rc 0) but its picture differed from the sender's. Evidence: qualify job 1790622413 80/80; bites on the shipped lib bytes (sha256 aa596da8, 26134 B): aimed site 27 the reference-held check in cc_call_codec_open KILLED (job 1790622471), aimed site 2 the padded-view branch of cc_publish KILLED (job 1790622522), both restores byte-verified and both live twins restored. SHIPPED by nx_organ_ship (job 1790622782) sha256 a845a98b: loss set exactly the two relabelled teeth (the bad-geometry neg-control now names the odd-width rule it tests; the plaintext neg-control now compares after the crop), approved by allow_loss_v1 11740e02; behaviour change reviewed (review file knowledge/status/harness/review-nx_connect_codec_gate-a845a98b-20260928.txt sha256 a69ef16b over observation b1b6ba3a and evidence 2e3d7c03); promote live equal to staged, _offc twin installed. Served /api/gate_run (job 1790622801) exit 0 GREEN 80/80 FAST, capture 10946 B untruncated, source_newer 0. Values: sealed key frame 6397 B at 320x240 coded 320x256, AEAD workspace 2950144 B per context, key Y-PSNR 4455 cdB. Roster, connect.gates and the matrix note updated to the new counts. 2026-09-28 retract W17 SEAT CALL-CODEC corrects its own queue row 1790620520 in two places. (1) It said swapping the family video app's NX.vv_enc and vv_dec for cc_call_codec_bind and cc_call_codec_open is wire-compatible: only the 6-byte inner header LAYOUT matches. A bound frame is sealed and, since the padding fix, coded at the padded geometry, so a raw vv_dec peer can neither open it nor decode it -- both ends of a call swap together, never one. (2) It told the client to call cc_ctx_new(W, H, ...) as if any macroblock multiple worked; any EVEN geometry now works (320x240 codes as 320x256 and crops back), and the client must also honour cc_ctx_need_key -- when a receiver context raises it, send the sender a key-frame request and the sender binds its next frame with key_req 1; until that key frame lands the tile freezes rather than showing a picture predicted from a lost reference. 2026-09-28 lesson A KEY FRAME IS A RESYNC POINT ONLY IF IT OVERWRITES EVERY BYTE OF THE RECEIVER'S FRAME. The codec gate and this gate's first 60 teeth proved the closed loop byte-exact because sender and receiver always started from identical zeroed buffers, and every quality number was luma-only -- so 8 never-coded chroma rows at 320x240 (the live family video app's geometry) were invisible to every instrument that already existed. A tooth that gives the receiver a DIFFERENT history (a frame dropped by the relay, a late joiner, a dirty buffer) is the only instrument that can see a codec defect whose symptom is identical output under identical history; T11 found it by reading RED, T12 pins it on the raw codec. The family video app still calls vv_enc at 320x240: filed as debt 1790622664 (sev 5, videocodec) with the measurement and the padding remedy, for the vcodec and family video owners. 2026-09-28 land W17 SEAT CALL-CODEC: the relay can now size its slots with NO codec in its closure, gate 83/83, awaiting acceptance. The integration spec (row 1790620520) told the serving daemon to size rr_init slots with cc_frame_cap, which lives in nx_connect_codec -- importing it would have put the decoder in the server's closure and broken the content-blind construction T5 proves. The frame sizing now has ONE home in nx_connect_codec_relay (ccr_yuv_bytes, ccr_coded, ccr_frame_cap with CCR_MB, CCR_CHROMA_DIV, CCR_INNER, CCR_VV_PREFIX, CCR_STREAM_BYTES_PER_SAMPLE, CCR_TAG; the relay still imports only nx_room_relay), nx_connect_codec derives cc_frame_cap, cc_plain_cap and cc_coded from it, and cc_ctx_new refuses to build a context if its inner-header, plane-prefix or AEAD tag width ever disagrees with the relay's. New T13 checks the relay-side bound against hand derivations: 491572 B for 320x240 (coded 320x256) and 5652532 B for 720p (coded 1280x736). Qualify job 1790623990 83/83; SHIPPED by nx_organ_ship (job 1790624051) sha256 39f98d3d, content GREEN with no lost run, behaviour DIFFERS as expected (three teeth added), promote live equal to staged, _offc twin installed; served /api/gate_run (job 1790624098) exit 0 GREEN 83/83 FAST, capture 11372 B untruncated. Sources: nx_connect_codec.nx sha256 843ac93b 25876 B, nx_connect_codec_relay.nx f9583bf9 11229 B, gate d907b9d4 46987 B. Not bitten this round: the sizing functions carry no numeric or comparison site the harness mutates, and T13 asserts exact hand-derived values. 2026-09-28 queue CN1 INTEGRATION SPEC, CORRECTED (supersedes the SERVER sizing line of row 1790620520): the serving daemon sizes each relay slot with ccr_frame_cap(W, H) from nx_connect_codec_relay for the call's top rung, and composes nx_connect_codec_relay ONLY -- never nx_connect_codec, whose closure holds the decoder and the AEAD. Extend nx_connect_codec_gate's T5 import census over the daemon source when the route lands (the census reads quoted import names, so the check is one call per source). Everything else in rows 1790620520 and 1790623080 stands: ccr_relay_post and ccr_relay_fetch for the route pair, room_admit on join and leave, ccl_channel and ast_may_discover for who may call whom, the client compiling nx_connect_codec through nx_compile_wat, any even geometry, and cc_ctx_need_key honoured by a key-frame request that the sender answers with key_req 1. 2026-09-28 land W17 SEAT CALL-CODEC: simulcast through the binding, gate 90/90, awaiting acceptance. New T14: one sender binds a base layer (320x240, 6357 codec bytes on its key frame) and a top layer (640x480 from the same camera frame, 17104 bytes) under one call key; they take two relay slots (the relay keys a slot on sender and layer); the thumbnail receiver and the speaker receiver each open only their own layer, byte-identical to the sender's reconstruction of that layer; a base-layer receiver refuses the top layer's frame by its layer (-28) before the AEAD runs. This is CB0's layout-aware selection carried by real sealed codec streams rather than modelled byte counts; each layer keeps its own counter and the layer is bound into the nonce, so the relay can choose which layer to forward but cannot relabel one. Qualify job 1790624676 90/90; SHIPPED by nx_organ_ship (job 1790624720) sha256 44d86106, content GREEN, behaviour DIFFERS as expected, promote live equal to staged, _offc twin installed; served /api/gate_run (job 1790624737) exit 0 GREEN 90/90 FAST, capture 12108 B untruncated. Gate source sha256 b9ad8a6f 51297 B; the two libs unchanged since row 1790624280. Roster and connect.gates updated to 90/90. 2026-09-28 queue W17 SEAT CALL-CODEC RETURNS -- CN1 is shipped as lib plus gate, 90/90 on the served binary, and is a FINISH item, not done: the published page reads nishi 1 with adoption LIB-GATE-ONLY importers=1 (connect regen job 1790624898, page_verify job 1790624925 GREEN static only, browser rendering unverified). The PSNR the gate emits recomputes by hand from its own values: key Y SSE 174827 over 76800 pixels gives 44.56 dB against the ruler's 4455 cdB. OPEN, each for its owner: (1) the served call route in the alpha daemon per rows 1790620520, 1790623080 and 1790624310 (alpha daemon sources are wave 16 locked; no /connect source carries a call path today); (2) the call key without the server is CN7 and CN8, and per-sender secrets are what would stop a member forging another member's kid; (3) nx_connect_room_rx is registered but /api/gate_run and the roster refuse its name, so a thin nx_connect_room_rx_gate is owed, and its T3 content-blind tooth stays a modelled constant; (4) nx_connect_codec_gate and nx_connect_room_rx read REGISTERED-UNAUTHORISED until the cap owner mints a cap naming them; (5) debt 1790622664 (sev 5, videocodec): the live family video app codes 320x240 raw and so leaves 8 chroma rows uncoded; (6) not bound yet: the range-coded and t8 codec variants and rate control (the binding codes at a fixed qp); (7) no treat row declared -- media frames do not ride the MCP front door, and the plane and agent surfaces were not built; (8) acceptance is three-party: referee panel, operator ACCEPT row, seat attestation -- shipped, gate 90/90, awaiting acceptance.

CN2 Native mobile shell · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cl_mobile_shell` · executor Organ · 4 u · stands on CB1
Definition of done	A native shell over the existing web core (same auth, same content-blind store) with push, camera and mic permissions; done-rule: the web gate's 8 teeth pass through the shell on a real device and the youth wall is enforced identically; push delivery (push_deliver) is part of this done-rule -- a message posted while the app is closed produces a device notification
Matrix cell	Deployed clients at scale (polished mobile/web apps) · `runtime/nx_connect_client.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_client`; declare `nx_connect_client TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790355008 routed by nx_intake_route (operator-seat, epoch 1790356455) from pm-seat: R8 of parent REQ 1790355000: durable messaging so members engage -- one-to-one and group messages that survive restart with receipts, edit and delete, end-to-end sealed, delivered when the app is clos -- sponsor intake-1790355008 plus1 2026-09-28 queue W17 SEAT PUSH-DELIVERY resumed (predecessor died in the 12:39 CDT network outage with no journal row): found its two sources, buildroot/runtime/nx_webpush.nx (estate-wide RFC 8291 encryption + RFC 8292 VAPID + RFC 8030 header lines, composing nx_p256_ecdh, nx_hkdf, nx_aes128_gcm, nx_jose_es256, nx_ecdsa_p256_sign, nx_ecdsa_p256, nx_base64, nx_jwt, nx_csprng) and buildroot/runtime/nx_connect_push.nx (push_deliver, closed vocabulary, SSRF host fence, four-field subscription record, owner tombstone, VAPID key file), plus the three RFC mirrors (knowledge/fetched/cmp_connect_rfc8291.txt d7130962, rfc8292 2165418a, rfc8030 bc8b9646, re-hashed equal). No gate, no conf, no build existed. This leg: bounded every caller-sized scratch request before allocation (a p256dh, auth or signature segment larger than the arena block would have killed the process, exit 231), made the rs check strict (RFC 8291 section 4 says rs GREATER than record plus tag) and added the RFC 8030 7.2 body cap WPUSH_BODY_MAX, and wrote buildroot/runtime/nx_connect_push_gate.nx (54618 B, sections A RFC 8291 worked example byte exact, B refusals, C RFC 8292, D policy end to end to the POST). First build next. 2026-09-28 land W17 SEAT PUSH-DELIVERY: push_deliver SHIPPED, gate 127/127, awaiting acceptance (the rung CN2 itself stays OPEN: cl_mobile_shell and its real-device witness are not built). SOURCES (buildroot/runtime): nx_webpush.nx 33130 B (estate-wide: RFC 8291 aes128gcm encryption with every intermediate exposed, RFC 8292 ES256 VAPID with RFC 6979 nonces, RFC 8030 header lines; composes nx_p256_ecdh, nx_hkdf, nx_aes128_gcm, nx_jose_es256, nx_ecdsa_p256_sign, nx_ecdsa_p256 verify, nx_base64, nx_jwt, nx_csprng); nx_connect_push.nx 36067 B (push_deliver, push_deliver_account which lists ONE account's directory <root>/<account>/ until getdents64 returns 0, cpush_subscribe and cpush_unsubscribe own-account operations, cpush_vapid_key and cpush_vapid_public, the closed vocabulary, the SSRF host fence); nx_connect_push_gate.nx 64340 B. POLICY DATA: knowledge/connect_push.conf 2888 B (three content-free payload rows -- New message, New invitation, Something new in your circles -- padded to one length; host rows fcm.googleapis.com and updates.push.services.mozilla.com, hostsuffix rows .push.apple.com and .notify.windows.com, UNPINNED until the vendor documents are mirrored; vapid_sub https://nishifamily.com/connect; vapid_exp 43200, ttl 86400, urgency normal, topic nxconnect, each THRESHOLD row carrying its reason). GATE nx_connect_push_gate 127/127 GREEN in the build lane and through /api/gate_run on the promoted binary (path FAST, exit 0, production conf resolved_by=knowledge/connect_push.conf): A RFC 8291 section 5 and Appendix A byte for byte at every intermediate (keys derived from private keys, ECDH from both parties, PRK_key, key_info, IKM, PRK, cek_info, CEK, nonce_info, NONCE, 86-octet header, whole body) plus the reference receiver; B refusals by name (wrong auth secret, tampered ciphertext and tag, delimiter 0x01 and none, off-curve and not-below-p and compressed keys, rs equal to record plus tag, body past 4096); C RFC 8292 section 2.4 token verifies under its own k with the estate verifier, our claims reproduce its signing input, k equals the JWK x and y, our token deterministic and refused past 24 h, aud and sub rules; D policy end to end to the POST with no trust store; E the production conf builds every kind at one length. SHIPPED: /api/build (src_path names the gate, src_sha256 c035a8c5, closure 75bb12c6) then /api/promote expect_sha256 e8b95223a70eeec17c977ec3f9a8ceb5e532174fa6d4469a4cfc016d1ff9de73 (623656 B, PROMOTED), /api/tools/register callable 1 (schema 0), knowledge/gateroster.conf row, knowledge/compare/connect.gates row. BITE: nx_gate_bite killed a compiling comparison mutant in each lib (restores byte-verified 33130 and 30184 B); a hand-planted revert of the RFC 8291 section 4 greater-than rule turned the gate RED 126/127 on exactly B12 (actual 144 expected -4), restored and GREEN again from the same build-cache key as the first green. No daemon touched, nothing deployed. 2026-09-28 queue VERB REQUEST FOR FRONTDOOR-FINISH: the push verbs, rung CN2 (contract push_deliver), engine nx_connect_push (import runtime/nx_connect_push.nx; it composes runtime/nx_webpush.nx, nx_https_fetch_lib and nx_https_post_lib; the cpush_ and wpush_ prefixes and push_deliver are defined only there; gate nx_connect_push_gate 127/127 GREEN, promoted e8b95223, registered, rostered). THREE VERBS. (1) push_vapid_key -- a PURE READ, no caller identity needed: cpush_vapid_public(path: u8, out: u8) -> i64 with path knowledge/keys/connect_vapid.key (a 32-octet P-256 scalar, mode 0600, created on first use with O_EXCL so two racers cannot both mint one; the lane owner may pick another path but must keep it off every served root) and out sized wpush_b64u_cap(65) = 89 octets; returns 87 (the base64url applicationServerKey length) or a named refusal (CPUSH_ERR_IO -25, WPUSH_ERR_RNG -14); answer 200 with the 87 characters as the body. (2) push_subscribe -- OWN-ACCOUNT: cpush_subscribe(conf: u8, clen: i64, root: u8, account: u8, device: u8, js: u8, jn: i64, now: i64) -> i64 where conf and clen are knowledge/connect_push.conf read with sys_read_file, root is the subscription store (proposed knowledge/store/connect_push_subs, created 0700; the lib creates <root>/<account>/ on first use), account is the session's AUTHENTICATED account id and NEVER a request field, device is the request field device= (16 random bytes as base64url the client keeps in localStorage; only [A-Za-z0-9_-] passes), js and jn are the request field a= holding PushSubscription.toJSON(), now is the server clock; returns the endpoint length (> 0) or a named refusal CPUSH_ERR_SUBJSON -22, CPUSH_ERR_HOST -23 (the SSRF fence: https on a named push host only), CPUSH_ERR_ID -24, CPUSH_ERR_IO -25, WPUSH_ERR_POINT -1, WPUSH_ERR_AUTH -3, WPUSH_ERR_ENDPOINT -15; answer 200 ok when > 0, else 400 naming the rule. (3) push_unsubscribe -- OWN-ACCOUNT: cpush_unsubscribe(root: u8, account: u8, device: u8, now: i64) -> i64, returns WPUSH_OK 1, CPUSH_ERR_NOSUB -26 or CPUSH_ERR_ID -24; the record becomes a tombstone keeping only created and removal time. The client speaking exactly this contract is buildroot/sites/connect_assets/push/connect_push_client.js (POST form fields device= and a= to <mount>api/v1/<verb>, mount /alpha/connect/ or /connect/). GATE TEETH to add to nx_connect_api_gate: push_vapid_key returns 87 characters decoding to a 65-octet point that passes wpush_point_ok; push_subscribe with an allowed-host fixture subscription writes a record of exactly four fields under the SESSION account; neg-control, an account= field in the request is ignored and the record lands only under the session account; an unauthenticated call is refused before the lib runs; a subscription on an unnamed host answers CPUSH_ERR_HOST by name; push_unsubscribe leaves a tombstone with no endpoint and no key; a device id holding a slash is refused CPUSH_ERR_ID. BLOCKER already measured on this board (row about realm_unify): ca_dispatch carries no caller identity on either surface, so (2) and (3) wait on the front door passing the authenticated account into the dispatcher; (1) can land today. 2026-09-28 queue INTEGRATION SPEC for the /connect daemon owner (the alpha and production daemon sources nx_connect_appd, nx_connect_serve and nx_connect_ui are wave-16 locked; nothing in this row edits them). The web shell assets have a source home now: buildroot/sites/connect_assets/push/ (this seat's subdirectory; a sibling subdirectory under connect_assets/ is free for the device sign-in assets ALPHA-SIGNUP-DOOR is housing). (a) Serve connect_sw.js (2852 B) at <mount>sw.js with Content-Type text/javascript and Cache-Control no-cache, so its default scope is the mount (/connect/ or /alpha/connect/); the worker reads its own scope, shows only the decrypted vocabulary sentence under one notification tag, fetches nothing, and a tap opens or focuses the mount. (b) Serve connect.webmanifest (308 B) at <mount>manifest.webmanifest as application/manifest+json and link it from the page head; start_url, scope and id are relative, so one file serves both mounts. Icons are EMPTY and OWED: Chromium installability wants 192 and 512 px icons, and iOS web push only works after the member adds the app to the Home Screen (display standalone). (c) Render a Notify-me-on-this-device control that calls connectPushOptIn() from connect_push_client.js (3643 B) on a tap and never on load, plus an off switch calling connectPushOptOut(). (d) In the message path, after a message is stored for a recipient ACCOUNT, call push_deliver_account(store_i, knowledge/connect_push.conf, <subscription root>, recipient_account, 1, now, vapid_priv, box) from a FORKED worker, never on the request path: each delivery maps small buffers the incumbent HKDF, GCM and SHA-256 never unmap, so a worker per batch returns them; store_i from hf_store_load once per worker, vapid_priv from cpush_vapid_key; kind 2 for an invitation and 3 for a circle event. (e) The content stays out of the notice by construction: push_deliver takes a kind, never text, and the words come only from knowledge/connect_push.conf, so a minor's lock screen never shows a sender, a circle or a message. CSP: all three assets are same-origin. 2026-09-28 lesson THREE LAWS FROM THE PUSH LEG. (1) A WORKED EXAMPLE CAN DISAGREE WITH ITSELF: RFC 8291 section 5 prints Content-Length 145 over a base64url body that decodes to 144 octets (86-octet header, 42-octet record, 16-octet tag, and Appendix A's header plus ciphertext concatenate to exactly that body); the bytes are the oracle and the prose number is not, so the gate asserts the bytes and prints both numbers instead of trusting either one silently. (2) A SCRATCH REQUEST SIZED BY A CALLER IS A KILL SWITCH: nx_scratch exits 231 on any single request above its 1 MiB block, and the inherited libs sized three scratch requests from caller input (a p256dh, an auth secret, a token's signature segment) and one from the conf size -- a 2 MiB subscription would have killed the serving process, not refused the request. Every caller-sized request is bounded before it is made now, and D19 proves it discriminates: a 2 MiB p256dh answers WPUSH_ERR_POINT where the unbounded code dies. (3) READ THE COMPARISON IN THE RFC, NOT THE ONE THAT FEELS RIGHT: RFC 8291 section 4 requires rs GREATER than plaintext plus delimiter plus padding plus tag; the inherited check allowed equality, and a planted revert turns B12 RED 126/127 with actual 144 against expected -4, so the rule is now a tooth rather than a reading. 2026-09-28 measure LIVE PUSH DOOR MEASURED with nx_connect_push_probe (built for measurement from buildroot/runtime/nx_connect_push_probe.nx and deliberately NOT promoted or rostered: its answer depends on a third party's network, so it is a measurement taken on purpose, never a beat). One RFC 8030 POST [rfc8030] through push_deliver with the estate trust store, a fixture subscription on a token nobody was issued, the RFC 8291 section 5 keys [rfc8291] and a VAPID key drawn in memory [rfc8292]: Mozilla autopush (updates.push.services.mozilla.com, the endpoint family of the autopush documentation [autopush-http]) answered 404 in 784 ms after full certificate-chain validation, and FCM (fcm.googleapis.com) answered 410 in 301 ms; both times the lib's gone rule left the record a tombstone (record_after_rc -26). PROVEN: TLS to a real push service, the request framing, the status read-back and the gone handling. NOT PROVEN: that either service accepted our VAPID token as valid (a lookup of an unknown token may answer before the token is checked) or that a device shows the notice -- that needs a real subscription from a real browser on a served origin. The SSRF fence rows in knowledge/connect_push.conf now carry their evidence: .push.apple.com from Apple's instruction to allow https://.push.apple.com [apple-webpush], .notify.windows.com from the WNS rule that a channel must use that domain [wns-channel], push.services.mozilla.com added from the autopush documentation, fcm.googleapis.com and updates.push.services.mozilla.com from the live probe (no Google document mirrored: the FCM migrate page answered a definitive 404 and the web.dev push article names no host). The three RFC mirrors re-fetched from the RFC Editor hash identical to the ones the gate reads. 2026-09-28 land W17 PUSH-DELIVERY second ship: the message path's one call exists and is gated. buildroot/runtime/nx_connect_push.nx 40640 B adds push_deliver_account_async(store_i, conf_path, root, account, kind, now, vapid_priv, receipt) -- it forks a worker that forks once more and exits at once, the caller reaps that middle child immediately (no zombie, no SIGCHLD handler), and the grandchild closes every inherited descriptor above stderr (a worker holding the daemon's listening socket would keep a restarted port hostage), runs push_deliver_account and exits, so the TLS session, the P-256 work and the incumbents' never-unmapped HKDF, GCM and SHA-256 buffers die with a short-lived process instead of accumulating in the serving daemon; a second-fork failure comes back as CPUSH_ERR_FORK -28 through the middle child's exit status, never silently. The subscription store is one directory per account (<root>/<account>/<device>.sub, created 0700 on first subscribe), and push_deliver_account lists ONE account's directory with getdents64 until the kernel returns 0. Gate nx_connect_push_gate 132/132 GREEN: D57-D65 (two live devices, a tombstone, a temp file and a stray name in one account, another account's device never seen) and D66-D70 (the async call returns the reaped middle child; the detached worker's receipt lands in 100 ms against a budget of fifty times the 78 ms synchronous call and equals the synchronous tally exactly; a bad account id forks nothing and leaves no receipt after the observed worker latency). Planted defect: the worker writing the wrong tally box turned it RED 131/132 on exactly D68, restored. SHIPPED /api/build (src_path names the gate, closure 5597dbf3) then /api/promote expect_sha256 87d8bd9f5598af052ec91f8867c7d95ba9089397709f8355a6ec3781c0763e43 (633032 B, PROMOTED, prev slot holds e8b95223); /api/gate_run on the promoted binary GREEN 132/132 exit 0, 13514 B captured of 16384 (not truncated). The INTEGRATION SPEC step (d) is now one call: push_deliver_account_async(store_i, knowledge/connect_push.conf, <root>, recipient_account, kind, now, vapid_priv, 0). connect.gates row updated to 132/132. 2026-09-28 queue CN2 STAYS OPEN, named precisely. BUILT this wave: the push half (push_deliver, push_deliver_account, push_deliver_account_async, subscription store, VAPID key, policy conf, gate 132/132 promoted, live push services reached) and the web-shell sources (buildroot/sites/connect_assets/push/: connect_sw.js, connect.webmanifest, connect_push_client.js). NOT BUILT: cl_mobile_shell in runtime/nx_connect_client.nx (no source was written under that name on purpose -- a stub carrying the contract name would flip the watch cell with nothing behind it). REAL-BROWSER PROOF UNVERIFIED, reason: no served secure origin hosts the worker yet (the /connect routes are wave-16 locked), and a service worker cannot register from a file or from an origin that does not serve it, so the CM13 capture driver has nothing to open; a push reaching a browser also needs a real subscription the page creates. OWED IN ORDER: (1) FRONTDOOR-FINISH lands push_vapid_key now and push_subscribe and push_unsubscribe once ca_dispatch carries the session account (row 1790622060); (2) the /connect daemon owner serves sw.js and manifest.webmanifest under the mount, renders the opt-in control, and calls push_deliver_account_async after a message is stored (row 1790622100); (3) then the WHAT THE OPERATOR MUST DO ON A REAL PHONE, which is the done-rule's witness: on an iPhone with iOS 16.4 or later open https://nishifamily.com/connect/ in Safari, Share, Add to Home Screen, open Connect from the Home Screen icon (web push only works in the installed app on iOS), sign in, tap Notify me on this device and Allow; on an Android phone open the same page in Chrome, sign in, tap Notify me on this device and Allow. Close the app on both. From a second member's account send each phone a message: each phone must show the notice New message and nothing else (no sender, no circle, no text), a tap must open Connect, and signing a minor's device in must show the identical words. Record device, OS version, time and a lock-screen photo, then run the web gate's teeth inside the installed app and grant camera and mic in a call; with those an operator ACCEPT row in the accept plane is the third signature. Icons for the manifest (192 and 512 px) are owed for Chromium installability. 2026-09-28 measure PUBLISHED after the second ship: nx_compare_regen_scoped buildroot ../sites/nishifamily/compare/ --domain connect (job 1790623722) verdict=GREEN fork-fresh, index.html 1325899 B, api.json 126017 B; nx_page_verify https://nishifamily.com/compare/connect/ (job 1790623772) status 200, a11y-issues 0, broken 0, VERDICT=GREEN (static checks; browser rendering unverified). The push watch cell now reads Measured: push_deliver exists in runtime/nx_connect_push.nx (data-s me, flagged lib-uncensused until nx_importcensus next runs). Ranker (job 1790623741): CN2 still #1, priority 6900 (was 6300), TREATMENT-UNDECLARED because only the primitive lib of the five surfaces exists -- no treat row declared, by rule. REFS: six rows added to connect.refs (rfc8291, rfc8292, rfc8030, apple-webpush, wns-channel, autopush-http), each cited inline [rfc8291] [rfc8292] [rfc8030] [apple-webpush] [wns-channel] [autopush-http] in rows 1790622700 and this one; nx_compare_refs_gate named two defects in my own first rows (the Apple row cited the page URL while the fetch journal held the JSON URL I fetched; the WNS fetch had followed a redirect to a MOVED page) and both are fixed (cite the fetched URL; re-fetch the WNS page from its canonical URL, bytes identical), so provenance mismatch is 0 and the WNS row left the open-redirect list. The gate still reads 43/45 on two ratchets I did not move: provenance-open-redirect-ratchet-does-not-rise (17 against baseline 14: pmdash monday_ai_2026_09_23, automation osworld26, search marginalia-api, datavis plot) and moved-ratchet-does-not-rise (pmdash monday_ai_2026_09_23 MOVED) -- named for those boards' owners, not touched. 2026-09-28 land W17 PUSH-DELIVERY third ship: the front door's answer is one table in the lib. cpush_refusal_name(rc) -> u8 gives each of the 25 refusal codes of nx_webpush (-1..-16) and nx_connect_push (-20..-28) a distinct machine-readable rule name (unknown codes read unknown-refusal), and cpush_http_status(rc) -> i64 maps a positive value to 200, a refused request (bad key, bad auth, not https, incomplete subscription, unnamed push host, bad id, kind with no words) to 400, a removed device to 404, an unreachable push service to 502 and the service's own failures to 500 -- so the push verbs answer 200 with the value or that status with the rule name as the body, and no caller re-derives the mapping (rule 6). ADDENDUM TO THE VERB REQUEST (row 1790622060): FRONTDOOR-FINISH composes these two functions for every push verb's reply. Gate nx_connect_push_gate 141/141 GREEN (F1-F9: every code named, no duplicate name, gap and past-end codes unknown, the five status classes); planted duplicate name turned it RED 140/141 on exactly F2 (actual 1 expected 0), restored. SHIPPED /api/build (src_path names the gate, closure 8be208c6) then /api/promote expect_sha256 7c19c3ca1fce7992c6ce3e15db4163a979263c266e6520b3619f81e898b6e28e (637504 B, PROMOTED); /api/gate_run on the promoted binary GREEN 141/141 exit 0, 14358 B captured of 16384 -- the gate is within 2 KB of the FAST-path capture cap, so further teeth should move to a sibling gate or print less rather than risk a truncated verdict. nx_connect_push.nx 43936 B, nx_webpush.nx 33130 B, gate 71038 B. 2026-09-28 land VAPID refresh window shipped: the token exp is now - (now mod vapid_refresh) + vapid_exp, so every delivery inside one conf-declared window signs byte-identical bytes (RFC 6979) and a push service sees one token per window; knowledge/connect_push.conf gained vapid_refresh 3600 with its evidence (Apple asks senders not to refresh the VAPID JWT more than once per hour, mirrored knowledge/fetched/cmp_connect_apple_webpush.json); cpush_build refuses a refresh that is not positive or not below vapid_exp (CPUSH_ERR_CONF), which keeps exp - now inside the RFC 8292 24 hours by construction and guards the modulo. Gate nx_connect_push_gate 146/146 GREEN: D39 checks the windowed exp, D71 a window mints one token (its first and last second compared, the fixture derives a window of at least two seconds), neg-control D72 the next window mints a different token that still verifies, neg-control D73 a conf file with refresh equal to vapid_exp is refused through push_deliver, neg-control D74 a zero refresh is refused, E8 the production refresh is at least an hour and below vapid_exp. Two defects planted at once (a mint that ignores the window, a refresh bound off by one): RED 143/146 failing exactly D39 D71 D73 (D73 read -27, the bad conf reached the POST); restored; /api/build sha 78c7782e is byte-identical to the pre-plant qualify build; /api/promote PROMOTED 78c7782e with expect_sha256; /api/gate_run on the live binary GREEN 146/146 exit 0; nx_offc_install installed=1. 2026-09-28 measure nx_connect_push_gate live run at 1790625412: refresh chosen by the run 26864 s, vapid_exp 39142 s, windowed exp 1790659062 = 1790625412 - 5492 + 39142 recomputed by hand; production vapid_refresh 3600 below vapid_exp 43200; gate output 15007 B against the /api/gate_run FAST capture cap 16384 B (capture_truncated=0, 1377 B headroom). 2026-09-28 lesson A same-window tooth over a one-second window compares an instant with itself and cannot fail, so the fixture derives its refresh from a named two-instant floor (CPG_WINDOW_INSTANTS) and asserts the last second is after the first before comparing tokens. A gate whose FAST capture sits at 15007 of 16384 B has room for about eight more tooth lines: the next push teeth belong in a sibling gate, or the verdict line falls off the capture. 2026-09-28 queue Open after wave 17 PUSH-DELIVERY: cl_mobile_shell stays OPEN (real-device witness, no stub written); FRONTDOOR-FINISH owns push_vapid_key (a pure read, ready now) and push_subscribe and push_unsubscribe (blocked until ca_dispatch carries the session account); the connect daemon owner owns serving connect_sw.js and connect.webmanifest, the opt-in control, and calling push_deliver_account_async from the message path; the manifest icons are owed; the real-browser push proof is UNVERIFIED (no served secure origin for the connect assets, and the capture driver cannot grant notification permission or receive a push); CN2 needs the operator ACCEPT row before it reads complete. 2026-09-28 land W17 PUSH-DELIVERY fifth leg (resumed T0 1790630704; the fourth ship's gate re-built byte-identical 78c7782e and read 146/146 before any edit, so no half-applied batch was left): buildroot/runtime/nx_connect_push_ua_probe.nx 31708 B, NEW, the far end of the wire -- a push user agent that receives and opens what push_deliver sends. It composes, never copies: hf_open for TLS 1.3 (CSPRNG ephemerals, chrome then plain hello, chain validated by the trust store), nx_ws_client_build_request plus the push-notification subprotocol line, wscs_send and wscs_recv_headers for records, ws_build_header, ws_apply_mask and ws_parse_frame, the estate JSON DOM nx_value_parse_json for every server message, and cpush_subscribe, push_deliver, cpush_unsubscribe and wpush_decrypt from the push libs. Its own code is only what no incumbent had: a stream reader that keeps the bytes after a frame and answers pings (pua_ws_recv), UUIDv4 channel ids from the CSPRNG, and the message builders. The protocol is read from the service's own source [autopush-protocol] [autopush-notification] [autopush-endpoint] and its design page [mozpush-design], never recalled. Privacy by construction: keys and auth secrets live in memory only, the uaid and endpoints print as lengths only (they are capabilities), both channels unregister and both subscription records are removed by the owner verb before exit. Not rostered: its answer depends on a third party's network. 2026-09-28 measure PUSH DELIVERED END TO END THROUGH A REAL PUSH SERVICE, measured twice with the same binary (b73e0879, the second run a build-cache hit; clocks 1790632099 and 1790632189): the probe opens Mozilla autopush's user-agent WebSocket, says hello, registers two channels restricted to one VAPID key (the service answers v2 endpoints bound to that key's sha256 [autopush-endpoint]), subscribes both through cpush_subscribe with user-agent keys and auth secrets it drew itself, and delivers through push_deliver [rfc8030]. BOTH RUNS IDENTICAL: a POST to channel B signed by a DIFFERENT VAPID key answered 401 and nothing ever arrived for B (VAPID-CHECKED); the POST to channel A signed by its registered key answered 201 (VAPID-ACCEPTED) [rfc8292]; the notification for A was already waiting on the socket when push_deliver returned (inside the 199 and 223 ms POST round trips), named aes128gcm, and its 176-character data decoded to a 132-octet body -- exactly the length push_deliver builds for the production conf, record size 4096; the reference receiver recovered exactly the 11 octets of the kind-1 words (DECRYPTED) [rfc8291] and refused the same body under another auth secret (WPUSH_ERR_TAG); both channels unregistered with status 200. Verdict 18/18 GREEN, the accept rule declared in the probe source before the first run. This PROVES the two claims row 1790622700 left open: a real push service validates and accepts our VAPID token, and our aes128gcm bytes cross it intact and open. STILL NOT PROVEN: that a browser's own decryptor opens them (our receiver is anchored to the RFC 8291 section 5 bytes by the gate, not to a browser) and that a phone shows the notice, which is the done-rule's device witness. 2026-09-28 measure SAME-LENGTH ON THE LIVE WIRE, added before its first run and declared in the probe header: after kind 1, the probe delivers kind 2 to the same channel through push_deliver (201 in 161 ms); the notification arrives, its body is 132 octets -- exactly kind 1's, though the words are 14 octets against 11 -- and it opens to exactly the kind-2 words; neither forwarded body holds a plaintext word sequence. So Mozilla autopush, the party that sees every notice, sees two notices of one length and only ciphertext [rfc8291] [autopush-notification]. Probe 22/22 GREEN (qualify build a3601ec2, clock 1790632746). Discrimination of these two live teeth lives in the gate, not here: D31 and E4 prove the padding makes every kind one length in-process, and a live POST cannot plant an unpadded body without editing the policy lib. 2026-09-28 queue REAL-BROWSER PROOF STILL UNVERIFIED, the reason re-measured this leg rather than inherited: nx_cdp_capture (82749 B) holds zero occurrences of grantPermissions and zero of ServiceWorker, so the CM13 driver can neither grant notification permission nor read a service worker's notifications; and no served secure origin hosts connect_sw.js yet (the /connect routes are wave-16 locked). The push-service half no longer waits on a browser: nx_connect_push_ua_probe proves it sovereignly (rows 1790632320 and 1790632780). OWED FOR THE BROWSER LEG, each for its owner: (1) the /connect daemon owner serves sw.js and manifest.webmanifest under the mount (row 1790622100); (2) the capture-driver owner (cms) adds one door that calls Browser.grantPermissions for notifications on the page origin and reads registration.getNotifications() through Runtime.evaluate after a delivery; (3) then the browser proof is: open the served mount in the headless oracle, subscribe from the page, deliver kind 1 through push_deliver, read the notice back. Firefox is the quickest browser referee because its push service is the one this probe measured. 2026-09-28 queue DEFECT FILED FOR ANOTHER LANE, found reading an incumbent before composing it: debt 1790632360 sev 6 on runtime/_hdl_build/nx_ws_client_session.nx -- wscs_connect fills the TLS 1.3 client random and the key-share seed with consecutive bytes of a caller integer (256 possible private keys, an observer can enumerate them), and wscs_ws_recv keeps only binary frames and drops the bytes after the first frame of a record. Its importers are three never-built video probes, so no live exposure was measured; the remedy is one edit (draw both from nx_csprng_fill as hf_open does, or delegate to hf_open), and pua_ws_recv is the candidate reader to fold in. Not edited here: another lane's file. 2026-09-28 lesson TWO LAWS FROM THE USER-AGENT PROBE. (1) A 2xx FROM A RECEIVER IS EVIDENCE ONLY BESIDE A REFUSAL THE SAME RECEIVER MUST ISSUE: without the wrong-key POST a 201 could come from a service that validates nothing; two channels bound to one key, one POST per key, made the 201 proof and the 401 its control in the same session, three runs out of three. (2) READ A SHARED HELPER'S KEY SOURCE BEFORE COMPOSING IT: the estate's WSS helper looked like the obvious client and derives its TLS key share from a caller integer, while the fetch lib's opener hf_open already drew both secrets from the CSPRNG; composing hf_open gave the WebSocket a sound session for free and the defect went to its owner as a debt row instead of into a second client. 2026-09-28 measure FRONTDOOR-FINISH ON push_vapid_key (the PUSH-DELIVERY row 1790625463 calls it a pure read, ready now): it is NOT a pure read. runtime/nx_connect_push.nx cpush_vapid_public(path, out) calls cpush_vapid_key, which reads the 32-byte server key at path and, when it is absent, MINTS a new P-256 key pair and writes it with O_EXCL mode 0600 (lines 536-567). The door runs with the nishihost root as its CWD on the MCP surface and with the alpha's own CWD on the mount, so a relative key path read through the door either mints a second server key in the wrong directory or reads a private key the door has no custody of -- the row stays not_yet_wired with its key-custody reason. RECIPE for the push owner (the door wires it the same hour it lands): a read-only sibling cpush_vapid_public_ro(path, out) that returns a named refusal (no key) instead of minting, with the key path declared as a row of knowledge/connect_push.conf resolved on the root ladder the other push rows use; gate teeth: an existing key reads its base64url public point, an absent key is refused by name and NO file is created (stat before and after), and the door's reply carries the public point only. 2026-09-28 land VAPID KEY CUSTODY SHIPPED, the precondition the front door's push_vapid_key row waits on (nx_connect_frontdoor4 CFD4_VAPID_PENDING: a stateless door must never be the minter of a server secret). runtime/nx_connect_push.nx 44913 to 49274 B adds cpush_vapid_read and cpush_vapid_public_read (READ-ONLY: an absent key is CPUSH_ERR_NOKEY -29, rule vapid-key-absent-or-unreadable, status 503, and nothing is created) and cpush_vapid_mint (the one mint for the push lane owner: a CSPRNG scalar written 0600 with O_EXCL into a directory it creates 0700; any key already in place is CPUSH_ERR_EXISTS -30, rule vapid-key-already-minted, status 409, left byte-identical, because every live subscription is bound to the applicationServerKey its browser was given); CPUSH_ERR_LAST now bounds the refusal table, and nx_connect_push_gate enumerates to it with zero added output lines (146/146, refusal codes 27 distinct, promoted f76431c8, capture 15008 of 16384 B). NEW runtime/nx_connect_push_key_gate.nx 9969 B: 21/21 GREEN in the build lane and through /api/gate_run on the promoted binary a462583f, registered, rostered, connect.gates row; planted defect (a read that mints) RED 18/21 on exactly K1 K2 K3b, restored, and the push gate rebuilt to the identical f76431c8, which proves the restore byte-exact. NEW runtime/nx_connect_push_vapid.nx 3646 B (mint and public verbs, promoted b6943e53, registered, offc twin installed). PRODUCTION KEY MINTED through /api/organ_run by the push lane owner: public before the mint answered REFUSED vapid-key-absent-or-unreadable status 503 and left knowledge/keys absent; mint answered MINTED (32 octets, 0600, directory 0700, the scalar never printed) with applicationServerKey BMt-9p9mkoxSnHBoQdjz8EOTaTg6LMmVidSbaJcWqrz4itl2lN8X_D37vygEKCHIJTB6qysKOfmpc4tfgHisv9M (public by design); a second mint answered REFUSED vapid-key-already-minted status 409; the key gate then read production_key_present 1, mode 384 (0600), 32 octets. No subscription existed yet, so no rotation was possible. 2026-09-28 queue VERB REQUEST FOR FRONTDOOR-FINISH (addendum to rows 1790622060 and 1790624350; it answers nx_connect_frontdoor4 CFD4_VAPID_PENDING): push_vapid_key is UNBLOCKED and is a pure read with no caller identity, so it can be wired today. Engine: cpush_vapid_public_read(path: u8, out: u8) -> i64 in runtime/nx_connect_push.nx, READ-ONLY (it never creates a key; do NOT call cpush_vapid_public, which mints on first use). path knowledge/keys/connect_vapid.key (now minted, 0600, off every served root); out sized wpush_b64u_cap(65) = 89 octets. Returns 87 (the applicationServerKey length) or CPUSH_ERR_NOKEY -29 or CPUSH_ERR_IO -25; answer 200 with the 87 characters, else cpush_http_status(rc) with cpush_refusal_name(rc) as the body (503 vapid-key-absent-or-unreadable, 500 subscription-store-io). The row's pending reason can then be retired. Gate teeth for nx_connect_api_gate: push_vapid_key answers 87 characters decoding to a 65-octet point that passes wpush_point_ok and equals the production key's public point; neg-control, pointed at an absent key file the verb answers 503 vapid-key-absent-or-unreadable and creates no file. push_subscribe and push_unsubscribe still wait on ca_dispatch carrying the session account (row 1790622060). 2026-09-28 queue INTEGRATION SPEC AMENDED for the /connect daemon owner (row 1790622100 step d): the message-path worker reads the signing key with cpush_vapid_read(knowledge/keys/connect_vapid.key, priv_out, pub_out), READ-ONLY, never cpush_vapid_key, which would mint a second key if the file were ever missing and silently orphan every subscription bound to the first. On CPUSH_ERR_NOKEY the worker delivers nothing and logs the rule; the push lane owner, never a request path, mints (nx_connect_push_vapid mint, which refuses when a key exists). 2026-09-28 lesson A PLANTED DEFECT GRADES THE TEETH, NOT JUST THE CODE. The first plant (a read that mints) turned the custody gate RED on K1 and K2 by return code, but K3, the no-mint tooth, still PASSED: the mint-on-read failed only because the fixture key's directory did not exist, so no file could be written, and the tooth was right for the wrong reason. K3a and K3b now read inside a directory that EXISTS with no key, the one place a minting read could write, and the second plant fails there (RED 18/21, K3b included). A GREEN earned under a condition the defect cannot exploit proves nothing about that defect. 2026-09-28 measure THE PRODUCTION KEY WORKS AT A REAL PUSH SERVICE: nx_connect_push_ua_probe gained an optional key-file argument (channel A registered with that key's public point, push_deliver signing with its scalar read through the READ-ONLY cpush_vapid_read, never minted, never printed; channel B still signed by a key drawn in memory). Shipped /api/build 051ac8cc (src_path names the probe, closure 4b25bd3c) then /api/promote expect_sha256 PROMOTED 639536 B, offc twin installed. LIVE through /api/organ_run target=nx_connect_push_ua_probe args knowledge/connect_push.conf - knowledge/keys/connect_vapid.key (clock 1790634659): exit 0, 22/22 GREEN, vapid_key_from_custody_file 1, Mozilla autopush answered 201 to the POST signed by the production key and 401 to the wrong-key control, kind 1 and kind 2 both arrived at 132 octets and opened to their own words, both channels unregistered. The same verdict came from the qualify build (clock 1790634538). So the key the front door will serve as applicationServerKey is proven end to end against a push service before any member subscribes with it. Five live runs this leg (1790632099, 1790632189, 1790632473, 1790632746 and 1790632883 with in-memory keys, then 1790634538 and 1790634659 with the production key), every one GREEN with identical statuses. 2026-09-28 retract Correction to row 1790634680, which says Five live runs and then lists seven: the leg made SEVEN live runs of nx_connect_push_ua_probe against Mozilla autopush, five with VAPID keys drawn in memory (clocks 1790632099, 1790632189, 1790632473, 1790632746, 1790632883) and two with the production key (1790634538, 1790634659), every one GREEN with the same 401 and 201 statuses. Every other figure in that row stands. 2026-09-28 queue VERB REQUEST FOR FRONTDOOR-FINISH, the reply shape of push_vapid_key (read before wiring it): ca_dispatch answers every verb in its versioned JSON envelope (ca_open2: v, tool, verb, verb_v, then the verb's fields), so the push client now reads the key from the envelope field application_server_key (87 base64url characters, exactly what cpush_vapid_public_read writes) when ok is 1, and still accepts a bare 87-character body; push_subscribe and push_unsubscribe count as success only when the HTTP status is 200 AND the envelope's ok is 1, so a refusal should carry ok 0 and rule = cpush_refusal_name(rc) with the status from cpush_http_status. Please ship exactly that field name, or say so on this board and the one constant NX_PUSH_KEY_FIELD changes. The client was fixed this leg (buildroot/sites/connect_assets/push/connect_push_client.js 3643 to 4669 B): the earlier version base64url-decoded the whole reply body, so the first envelope it met would have thrown inside atob and every opt-in would have failed on a real phone with no visible reason; it now also checks the key against the 87-character base64url shape before handing it to pushManager.subscribe. 2026-09-28 land WORKFLOW PLANE SEEDED for the push lane: knowledge/store/plan-connect-push- (3 rows through nx_store_put, PUT 1-3 replaced=0) runs nx_connect_push_gate, nx_connect_push_key_gate and nx_connect_push_vapid public knowledge/keys/connect_vapid.key -- all read-only, none contacting a third party (the live autopush probe is kept out of any ritual so no future clock row can make it one). nx_plan_run connect-push (job 1790635030) refused managed-owned-definition-required, execution NOT_STARTED, the same state W16 measured for connect-onboard and youthsafety-audit (row 1790614121). Binding it needs an Accountable for a connect-push activity in the RACI cell store and then nx_pm_owned_define (recipe row 1790460735), which belongs to the PM and RACI owners. Treatment state of CN2 after this leg: primitive nx_connect_push present, workflow plane manifest present, agent present (gateroster rows nx_connect_push_gate and nx_connect_push_key_gate), api follows the mcp verb; the one missing surface is the front-door verb push_vapid_key, so no treat row is declared, by rule. 2026-09-28 land KEY CUSTODY MOVED INTO THE DELIVERY WORKER: runtime/nx_connect_push.nx 49274 to 51137 B. The detached double fork now has ONE home, cpush_spawn, and two thin entry points: push_deliver_account_async (unchanged contract, caller-held key; the push gate's D66-D70 still pass on it) and the new push_notify_account(store_i, conf_path, root, account, kind, now, key_path, receipt), whose grandchild reads the VAPID key itself through the READ-ONLY cpush_vapid_read, so the serving daemon never holds the private scalar and a missing key yields a receipt naming CPUSH_ERR_NOKEY -- never a mint. nx_connect_push_key_gate 26/26 GREEN (K19-K23: a fixture device subscribed under the production conf; the worker's receipt equals the synchronous tally byte for byte, tried 1 and transport 1 with no trust store so nothing leaves the box; with the key path absent inside an existing directory the worker delivers to nobody, its receipt equals the NOKEY receipt byte for byte, and no key appears); planted defect (the worker minting through cpush_vapid_key) RED 24/26 on exactly K22 and K23, restored, and the re-qualify was a build-cache HIT on the green key 9dbc44e1, which proves the restore byte-exact. SHIPPED: nx_connect_push_key_gate 431c1092 (586000 B) and nx_connect_push_gate 78c2aff1 (146/146, capture 15007 of 16384 B) through /api/build with src_path checked, /api/promote expect_sha256, /api/gate_run GREEN on both promoted binaries, offc twins installed; nx_connect_push_vapid rebuilt 9ee65c70 and promoted; the probe rebuilt byte-identical to the live 051ac8cc, so nothing to promote. 2026-09-28 queue INTEGRATION SPEC SIMPLIFIED for the /connect daemon owner (supersedes step d of rows 1790622100 and 1790634542): after a message is stored for a recipient account, the message path makes ONE call and returns to its request at once -- push_notify_account(store_i, knowledge/connect_push.conf, <subscription root>, recipient_account, kind, now, knowledge/keys/connect_vapid.key, 0) with kind 1 for a message, 2 for an invitation and 3 for a circle event, and store_i from hf_store_load once per daemon. The worker reads the key read-only, lists the recipient's live devices and delivers the content-free notice; the daemon holds no key material, never mints, and the TLS sessions and the incumbents' never-unmapped buffers die with the worker. A NOKEY receipt means the push lane owner has not minted (nx_connect_push_vapid mint); nothing else can create the key. 2026-09-28 land FIRST-USE STORE ROOT FIXED (found by reviewing the path the daemon owner will run, not by a user): cpush_subscribe now creates the subscription store root 0700 before the account directory, one sys_mkdir whose EEXIST is the common case, so the first opt-in on a fresh production store no longer answers a 500 because nobody hand-made that directory. The key gate grew K24 (the fresh root is absent before the subscribe, the condition reached first), K25 (the record FILE is read back, the state and not the return code) and K26 (root mode 0700): qualify 29/29 GREEN, RED 27/29 on a planted removal of that one mkdir failing exactly K25 and K26, restore proven byte-exact by a build-cache HIT on the pristine key 1e0914f8 (sha 6fed4bc1). Shipped by /api/build + /api/promote with expect_sha256, src_path checked on each: nx_connect_push_key_gate 6fed4bc1, nx_connect_push_gate 80510874 (146/146 on the new lib, qualified before its promote), nx_connect_push_vapid 0036a2a5, nx_connect_push_ua_probe 2888f875 (the banked prior stage was the live 051ac8cc, no sibling work); nx_offc_install on all four; /api/gate_run on the promoted binaries: key gate 29/29 GREEN (3479 of 16384 B), push gate 146/146 GREEN (15100 of 16384 B, capture_truncated 0). gateroster.conf and connect.gates rows restated with the new counts and shas. 2026-09-28 measure FRONTDOOR-FINISH HAS CONSUMED THE PUSH CONTRACT in its _hdl_build sources (nx_absent over buildroot/runtime, corpus_complete=1: 9 files import nx_connect_push.nx, 4 of them theirs): push_vapid_key is WIRED in _hdl_build/nx_connect_api_lib.nx and emits application_server_key, the exact field connect_push_client.js reads, and their gate drives cpush_vapid_public_read, the refusal table and one mint in-process (T72); push_subscribe and push_unsubscribe stay not_yet_wired under CFD4_PUSH_PENDING (the subscriber is the signed-in account and ca_dispatch carries no caller identity, so both wait for the alpha daemon, which matches this lane's integration spec). Their next build picks up today's store-root fix through the same import; no file of theirs was edited. 2026-09-28 queue DECLARED, NOT FORGOTTEN: nx_connect_push_probe (the first live POST probe) stays BUILT-UNPROMOTED on purpose -- a hand measurement against a third party's network, never rostered, whose live gone-to-tombstone leg the UA probe does not repeat; its _build fossil predates today's lib edit, so run it with --qualify when the measurement is wanted. The four CN2 organs read REGISTERED-UNAUTHORISED (S4) in nx_catalog because no cap names them yet: minting one is the push lane owner's call, not a seat's. 2026-09-28 lesson A STORE'S FIRST USE IS ITS OWN CODE PATH. Every tooth ran against a fixture tree its setup made, so the one directory production would lack was the one directory no tooth ever lacked, and 146 plus 26 green teeth said nothing about it. Walking the integration as its owner will run it (fresh root, first opt-in) found it in minutes; K24 asserts the root is absent BEFORE the subscribe so the tooth cannot pass on a leftover, and K25 reads the record back instead of trusting the return code. 2026-09-28 land NEG-CONTROL FOR THE STORE-ROOT FIX: the key gate's K27 subscribes into a root whose PARENT is absent and asserts CPUSH_ERR_IO with nothing created, so the fix stays one level (a mistyped root never grows a tree) and a failed write can never read as a landed record: qualify 30/30 GREEN, RED 29/30 on a planted swallowed write failure that returned the endpoint length (61) for a record that never landed, failing exactly K27; restore proven byte-exact by a build-cache HIT on the pristine key 1dcdc77d (sha 6dc92311). /api/build + /api/promote expect_sha256 6dc92311, nx_offc_install, /api/gate_run on the promoted binary 30/30 GREEN (3721 of 16384 B, capture_truncated 0). The lib bytes are the ones the push gate 80510874, vapid 0036a2a5 and ua probe 2888f875 were promoted from (51276 B, restored twice by self-adjudicating replaces). gateroster.conf and connect.gates restated (a sibling edit of connect.gates landed between my reads and the content CAS carried the retry). 2026-09-28 queue DAEMON WIRING ADDENDUM for the nx_connect_appd edit-lease holder (SOTA-SEALED-MESSAGING since row 1790636840; this seat edits no wave-16 file): the store root no longer needs a hand-made directory -- pick one whose parent exists (for example knowledge/connect_push_subs) and the first subscribe creates it 0700. Owed on the daemon, all of it through functions that already exist and are gate-proven: serve <mount>sw.js from buildroot/sites/connect_assets/push/connect_sw.js as text/javascript (its scope is the mount, so no Service-Worker-Allowed header), serve connect.webmanifest as application/manifest+json and link it from the page head, serve connect_push_client.js; render a Notify-me-on-this-device control that calls connectPushOptIn() only on tap and an opt-out that calls connectPushOptOut(); answer POST <mount>api/v1/push_subscribe (fields device and a) with cpush_subscribe(conf, clen, root, the SESSION account, device, a, alen, now) and push_unsubscribe (field device) with cpush_unsubscribe(root, account, device, now), refusals as cpush_http_status and cpush_refusal_name; on each new message or event call push_notify_account(0, knowledge/connect_push.conf, root, recipient account, kind, now, knowledge/keys/connect_vapid.key, receipt) and never wait on it -- the daemon never holds the VAPID scalar. push_vapid_key is already wired by FRONTDOOR-FINISH (row 1790637411). 2026-09-28 queue OPEN AT THIS SEAT'S CLOSE (shipped, gates 146/146 and 30/30 GREEN on the promoted binaries, awaiting acceptance; CN2 stays OPEN): (1) cl_mobile_shell in runtime/nx_connect_client.nx is not built and its real-device witness is owed -- once the daemon addendum above is served on the alpha mount, the operator on a real iPhone (iOS 16.4 or later) opens https://nishifamily.com/alpha/connect/ in Safari, Share then Add to Home Screen, opens Connect FROM THE HOME SCREEN ICON, signs in, taps Notify me on this device and allows notifications; closes the app, has a second account send a message, and confirms a notification arrives reading one vocabulary sentence and naming no sender or circle; taps it and lands in Connect; then opts out and confirms nothing further arrives; the same on an Android phone in Chrome without the Home Screen step; (2) the daemon wiring above (lease holder); (3) push_subscribe and push_unsubscribe front-door rows stay not_yet_wired under CFD4_PUSH_PENDING until the daemon carries the caller identity; (4) manifest icons (192 and 512 px PNG plus an apple-touch-icon) are a design-lane item and read incomplete until referee and operator accept them; (5) the real-browser proof stays UNVERIFIED: nx_cdp_capture has no Browser.grantPermissions and no ServiceWorker domain, and the served routes are wave-16 locked; (6) the plan plane plan-connect-push- is seeded but refused managed-owned-definition-required until nx_pm_owned_define binds it with a RACI Accountable; (7) no treat row is declared, because the api surface (a served push_vapid_key) and the workflow binding are not both present; (8) debt 1790632360 (the video lane wscs_connect key space) stays with its owner; (9) the operator ACCEPT row in knowledge/store/accept- is the third signature this rung still lacks. 2026-09-28 land THE GONE RULE, LIVE ON A REAL ENDPOINT: the UA probe's accept rule gained GONE (declared in its source before the tooth's first run) and P22 -- after both channels unregister, push_deliver to channel A must answer 404 or 410 and leave A's record a tombstone. Against Mozilla autopush with the production VAPID key: 23/23 GREEN, gone_post_status=410, cpush_sub_load then answers CPUSH_ERR_NOSUB (-26), so the owner's later unsubscribe finds nothing live; RED 22/23 on a planted gone rule that keeps the record (gone_record_load_rc=234, the endpoint length of a live record), failing exactly P22; restore proven byte-exact by a build-cache HIT on the pristine key 29aa521f and a third live run 23/23. /api/build + /api/promote expect_sha256 db3c2b72 (the qualify runs used these exact bytes), nx_offc_install. The matrix row restated (23/23, ten live runs). 2026-09-28 queue SUPERSEDED, SUPERSEDING ROW 1790637412: nx_connect_push_probe's one unique leg (a 404 or 410 turning a record into a tombstone, measured on a token nobody was issued) is now repeated more strongly by the UA probe's P22 on a real, unregistered endpoint, so the old probe is SUPERSEDED by nx_connect_push_ua_probe. Mined before archive: it carries no MCP verb, API route, plan step, RACI row, clock row or ritual and sits on no execution surface (BUILT-UNPROMOTED, unregistered, unrostered). Archival through nx_retire_path is owed by the push lane owner; this seat's caps do not name nx_retire_path, so it is left in place with this row as its lifecycle record rather than deleted.

CN3 Cohort seeding on the wedge · cell LANDED · gate NO-GATE-DECLARED

Contract	`lq_cohort_seed` · executor Organ · 2 u · stands on CB1, CB2, CN6, CN13, CN14
Definition of done	Invite-by-token cohorts for the LDS community vertical with the reconnection lane as the hook; the connection-quality funnel (replies, meetings) is the ruler; done-rule: a seeded cohort shows a measured reply rate above the empty-room baseline within its first week, published beside the cohort size -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/nx_connect_liquidity.nx 19195 B sha 5a0bcf3b declares lq_cohort_seed; nx_connect_liquidity_gate 72/72 GREEN re-run by the verifier (gate_run and a fresh qualify) and bite-killed 1 of 1, promoted 8bd41082, rostered. Done-rule OPEN: the first-week field reply rate is UNMEASURED (no live cohort, not wired into nx_connect_serve); lq_funnel_verdict compares point rates only and read ABOVE on overlapping Wilson intervals, so an interval-separated verdict is owed; the guardian link is inviter-asserted and the band caller-supplied
Matrix cell	Network liquidity (installed user base) · `runtime/nx_connect_liquidity.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_liquidity`; declare `nx_connect_liquidity TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 land lq_cohort_seed LANDED as a library: buildroot/runtime/nx_connect_liquidity.nx 19195 B sha256 5a0bcf3b (no main, no syscalls, caller-supplied buffers sized by lq_cohort_words; composes nx_connect_lds_reconnect_lib rc_lane for the mission lane, adults only). Invite tree seeded by an ADULT organizer in six circles FAMILY MISSION WARD STAKE WORLDWIDE CHRISTIAN; handles single-use expiring revocable and never re-mintable; a minor arrives only with an adult-member guardian link that travels with the handle; no phonebook path; funnel first-message reply meeting per cohort over a declared window vs the empty room, UNOBSERVABLE (rate -1, never 0) on no observations, WINDOW-OPEN before the window closes; no ads to minors. Gate buildroot/runtime/nx_connect_liquidity_gate.nx 19585 B sha256 81fcf3a9, built by nx_sov_build_run --qualify (job 1790357096) _build elf 75715 B sha256 f95f845a: NX-CONNECT-LIQUIDITY-GATE passed 72/72 verdict=GREEN run-exit 0; fixture reply 625 permil n=8 Wilson 306..863 vs empty room 125 permil n=16 35..360 (fixture sizes chosen by the clock). OPEN: the done-rule field measurement (a live cohort first-week reply rate above the empty room, beside its size) is UNMEASURED; so_add_by_token and show_by live inside programs with a main and could not be imported (extraction queued); not yet wired into nx_connect_serve (integrator seat) 2026-09-25 measure planted-defect bite on nx_connect_liquidity_gate: the single-use check (state REDEEMED refuses) removed from lq_inv_redeem (lib 19195 to 19127 B) went RED 69/72 exit 1 (job 1790357207) on exactly token-single-use-refuses-second-redeem (actual 2 = a second person admitted on a used handle), refused-redeem-leaves-size-unchanged (3 vs 2) and every-member-but-the-organizer-is-one-redeemed-invite (7 vs 6); restored lib byte-identical (sha256 5a0bcf3b both before and after) and the gate read GREEN 72/72 exit 0 again (job 1790357321). Also measured building it: a main() local initialised from a constant (let hour = 3600) read 2433600 at every later use while the constant printed 3600 in the same run (jobs 1790356621, 1790356956); the gate now uses the named constant at every use; compiler cause UNMEASURED 2026-09-25 land gate SHIPPED by nx_organ_ship (job 1790357388): prove=GREEN 72/72 on the fresh build, promoted sha256 8bd41082 (first promote of this target, adoptgate announced no-live-elf), _offc twin installed, REGISTERED callable=1; roster admission MECHANICAL: nx_gate_roster_run trial (job 1790357497) GREEN exit 0 in 352 ms under deadline 60000 (the organ's own GRR_MS_DEFAULT), then admit (job 1790357552) admitted_new=1 partition reconciles 1 of 1, row nx_connect_liquidity_gate now in knowledge/gateroster.conf. The library has no main and is not promoted. OPEN: integration into nx_connect_serve (integrator seat) and the done-rule first-week field measurement 2026-09-25 queue CN3 stays OPEN on its done-rule. Recipe for what is waiting: (1) INTEGRATOR imports runtime/nx_connect_liquidity.nx into nx_connect_serve, persists each cohort buffer (lq_cohort_words slots) through nx_connect_accounts acc_save, routes seed, invite, revoke, join and reconnect, and feeds lq_funnel conversation rows (cohort, opened, first reply, meeting) from the CN6 message store; (2) the invite handle is the digest prefix of an nx_invite_token 256-bit secret so only the secret travels and only the handle is stored; the invite ttl becomes a conf row with its calibration, never a typed number; (3) after a live seeded cohort closes its first week, lq_funnel_verdict against the empty room is published with n and a Wilson interval beside lq_cohort_size -- only then can the done-rule close; (4) so_add_by_token (a self-share token, add me) and show_by (a fixed 8-candidate ranking demo) live inside programs with a main; read, they are different concepts from a vouch-for-another invite and from a per-cohort rate, but both still owe extraction into libs so every surface binds one implementation; (5) youth peers meet inside family and ward cohorts through nx_connect_youth_lib yw_may_channel, which this rung does not compose (the mission lane here is adult-adult by construction); (6) debt 1790357498 (sev 6): a main() local read 2433600 where its constant was 3600, cause UNMEASURED, minimal repro owed 2026-09-25 measure independent lane receipt: /api/gate_run target=nx_connect_liquidity_gate (job 1790357746) path FAST exit_code 0 verdict GREEN 72/72, deadline 14750 ms from conf, capture_truncated 0. The matrix watch row Network liquidity names runtime/nx_connect_liquidity.nx with _ABSENT_:lq_cohort_seed and that symbol now exists there, so the next regen flips the cell; the flip is the receipt that the contract symbol exists, not the done-rule, which stays open until a live cohort's first-week reply rate is measured against the empty room. All 82 const LQC_ declarations in buildroot/runtime are this library's own (nx_shelltool grep corpus_complete=1), and no lq_ function name collides with nx_linkqual or nx_fin_liquidity, so the integrator's import cannot trip a duplicate definition 2026-09-25 measure VERIFIER PARTIAL 72/72 -- mechanism reproduced (fresh qualify job 1790358001 run-exit 0 and /api/gate_run job 1790357955 exit 0 both 72/72 GREEN; lib sha 5a0bcf3b 19195 B and gate sha 81fcf3a9 19585 B match; promoted gate 8bd41082 86872 B; 5 claimed CN3 log rows present; roster row present; nx_gate_bite job 1790358111 killed=1 survived=0 void=0 first-kill-wins so ONE mutant, lib restored byte-identical). GAPS: (1) lq_funnel_verdict says ABOVE on POINT rates -- the run the builder quoted printed fixture_intervals_separated=0 (cohort 625 lo 306 vs empty room 125 hi 360) and the gate still asserts ABOVE, so the done-rule ruler would pass statistically inconclusive data; verdict needs interval separation or a minimum n. (2) the guardian link is ASSERTED by the inviter at mint, never consented by the guardian -- any adult member can name any other adult member as a minor's guardian. (3) the age band is caller-supplied in rc_src at redeem, so a minor claiming adult redeems an adult handle and skips the guardian link; band must come from the nx_connect_idage attestation at the boundary. (4) consent default-off is not by construction here (optin is caller data) and mission+area+dates are Art.9-class fields stored per member. (5) two-deep wall covers only the reconnect lane; youth peers and adult-minor channels inside a cohort are not governed (yw_may_channel not composed). (6) leftover diag_ value lines in the gate; no sotabar or refs source for CN3. Done-rule field rate UNMEASURED. 2026-09-26 land W11 SEAT CIRCLES-CONSOLIDATE liquidity guardian (REVIEW R2c3): a minor's invite is minted only BY THE GUARDIAN IT NAMES -- lq_inv_mint refuses LQC_E_NOT_GUARDIAN_ACT -16 when a member names another adult as the guardian, so the guardian on an invite is the guardian's own act, never an inviter's assertion; redemption still requires the youth to name that same guardian. Lib buildroot/runtime/nx_connect_liquidity.nx 5a0bcf3b 19195 B to c9fe201e 20131 B (banked knowledge/bank/nx_connect_liquidity.nx-5a0bcf3b-20260926-wave11). RED 71/73 on the old lib carrying only the new constant (job 1790439846: the neg-control actual 6 = an invite index minted by a non-guardian, and census-invites-minted 9 vs 8 = that extra invite); GREEN 73/73 (job 1790439978). Gate nx_connect_liquidity_gate 81fcf3a9 19585 B to 4d93525c 19902 B (the positive tooth now mints as the guardian; the old tooth name kept) SHIPPED 2de98b00: content GREEN lost 0, behave DIFFERS by design, promoted, offc twin installed, registered; served /api/gate_run GREEN exit 0 (job 1790440557). 2026-09-26 land LIFECYCLE SUPERSEDED (wave 11): nx_connect_liquidity LQC_I_GUARD, LQC_M_GUARD and lq_member_guardian as a guardian LINK store (the duplicate REVIEW R2c3 named). Successor: circles ccl_is_guardian, taken by the guardian's verifiable consent in fam_guardian_consent after the youth names them. MINING RECEIPT: the store carried three rules -- a minor's invite needs an adult member guardian (kept in lq_inv_mint), the guardian travels with the handle and must match at redemption (kept in lq_inv_redeem as the youth's naming), and NEW the guardian must be the minter (the guardian's own act, LQC_E_NOT_GUARDIAN_ACT); no API route, plan step, clock row, RACI row or MCP verb (liquidity_seed is not_yet_wired in nx_connect_api_lib). The slots stay as the invite's provenance; readers of lq_member_guardian: nx_connect_liquidity_gate L148 and the scratch nx_zz_lqhour_probe L149 (nx_absent matches=3 corpus_complete=1). ARCHIVED when the integrator hands a redeemed minor to ccl_guardian_name plus fam_guardian_consent and the provenance reader moves.

CN4 Trained matching and moderation · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nn_match_train` · executor Organ · 4 u · stands on CB2, CN3
Definition of done	No-float models trained on consented behavioral signals only (no plaintext), replacing the hand-weighted reciprocity and abuse scores where they measure better; pre-declared accept rule: beat the hand-weighted baseline on a held-out labelled set or stay UNWIRED
Matrix cell	Trained neural matching + moderation models · `runtime/nx_connect_neural.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_neural`; declare `nx_connect_neural TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue MINED from faithsocial FS9, retired onto this rung by the wave-9 S3 seat (debt 1790372858): FS9's accept rule made the held-out labelled set INCLUDE romance-scam patterns (the faithsocial SB-FS-MATCH bar, folk deception cues and detection strategies, arXiv 2606.23241); CN4 says only a held-out labelled set. Owed to the CN4 owner: adopt that clause, so a model that beats the hand-weighted baseline while missing scam patterns stays UNWIRED; the verbatim FS9 row is banked in knowledge/retired/buildroot_knowledge_compare_faithsocial.plan-precons-1790373638

CN5 Family-realm account unification · cell LANDED · gate NO-GATE-DECLARED

Contract	`acc_realm_unify` · executor Organ · 1.5 u · stands on nothing
Definition of done	The nishi_connect OPAQUE realm joins the family-wide identity so one account spans CONNECT and the suite; done-rule: login on /connect with a family account round-trips whoami, the auth gate stays GREEN, and the gauge's accounts row re-grades on evidence -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/_hdl_build/nx_connect_realm.nx 24607 B sha da9b78ee declares acc_realm_unify (NIST SP 800-63C-4 sec 3.8.1 account linking [nist80063c4], one family identity per account); nx_connect_realm_gate 47/47 GREEN re-run by the verifier and bite-killed 1 of 1, promoted e47c7ffd, rostered; nx_connect_auth_gate 12/12 GREEN. Done-rule OPEN: nx_connect_appd does not call acc_realm_unify (0 hits) so no served whoami round trip exists and the gauge accounts row stays 2; owed fixes: realm_links.log is written 0644 with unkeyed uid digests, the read-then-append is unlocked, and no attested band source exists yet
Matrix cell	Family-realm account unification (one OPAQUE account across the suite) · `runtime/_hdl_build/nx_connect_realm.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_realm`; declare `nx_connect_realm TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790355002 routed by nx_intake_route (operator-seat, epoch 1790356419) from pm-seat: R2 of parent REQ 1790355000: one account across all Nishi platforms (the family realm) -- a person who signs up once on /connect uses the same sovereign login on every nishi property, one OPAQUE ident -- sponsor intake-1790355002 plus1 2026-09-25 land BUILDER seat: acc_realm_unify landed as a new lib buildroot/runtime/_hdl_build/nx_connect_realm.nx (22753 B sha256 939409b4) with gate nx_connect_realm_gate.nx (15587 B sha256 7de12fab). Mechanism: an explicit consent-gated one-to-one LINK between a family identity (realm nishi_site_admin) and a CONNECT account (realm nishi_connect), written only when BOTH sessions verify in their own realms through the incumbent olg_whoami, kept in an append-only log dir/realm_links.log (unlink appends a U row); acc_realm_unify resolves a verified family session to the linked account id, the same id the daemon derives via acc_id_from_range, and refuses unlinked, forged, expired, wrong-realm sessions and a corrupt log by name; a relink can never change the band on record. nx_sov_build_run --qualify on the NAS (admission GRANT): GREEN 43/43 exit 0, artifact _build/nx_connect_realm_gate.sov.elf 336532 B sha256 cd26a6ae, 9 neg-controls. OPEN: bite proof, auth gate re-run, ship + roster, daemon integration by the INTEGRATOR seat 2026-09-25 measure BUILDER seat bite proof on the NAS, both directions: planted rc = CRL_OK for an unlinked family identity inside acc_realm_unify (lib 22739 B) -> nx_connect_realm_gate RED 40/43 exit 1, exactly T1 T2 T14b failing (actual 0 expected -2201), every neg-control still passing; restored lib byte-identical (sha256 939409b4, 22753 B) -> GREEN 43/43 exit 0. nx_connect_auth_gate --qualify (admission GRANT, fresh build 422357 B sha256 85fa13f4): every one of its 12 teeth prints PASS yet its hand-rolled tally reads fails=12 and it exits 1 verdict=RED -- a tally defect inside that gate, independent of CN5 (nx_connect_realm is outside its import closure); the done-rule clause the auth gate stays GREEN is therefore NOT met today. OPEN: root-cause the auth gate tally (control = its staged 422552 B artifact), migrate it onto nx_gate_verdict 2026-09-25 retract BUILDER seat withdraws its row 1790356745 claim that nx_connect_auth_gate is RED: the source changed under the build -- a sibling seat was migrating it onto nx_gate_verdict (9424 B hand-rolled tally to 9527 B sha256 fd8c327e, au_check now gv_check), and the qualify build compiled a mid-migration copy whose au_check counted every tooth into the pointer main still read as a fail count (fails=12 with 12 PASS lines). Discriminating experiment: the same verb on the settled source gave GREEN 12/12 exit 0 (build-cache hit 443084 B sha256 c722d0a9, wrong_pw_rc -1410, unknown_handle_rc -1409, tampered_token_rc -1403). The done-rule clause the auth gate stays GREEN HOLDS. Lesson: hash the source immediately before and after a gate run on a shared tree 2026-09-25 land BUILDER seat shipped the gate: /api/build src_path runtime/_hdl_build/nx_connect_realm_gate.nx src_sha256 7de12fab BUILT 385800 B sha256 9fecc7bd; /api/promote expect_sha256 PROMOTED nx_connect_realm_gate.elf; /api/tools/register callable; nx_offc_install installed=1; /api/gate_run on the promoted binary GREEN 43/43 exit 0 FAST inside 14750 ms, capture 4852 B untruncated; knowledge/gateroster.conf row HAND-ADDED with its evidence (77307 B). The lib is not promoted (no main). The matrix watch row runtime/_hdl_build/nx_connect_realm.nx acc_realm_unify now names a present symbol, so the mechanical cell flips on the next regen; acceptance stays with the referee, the operator and the seat. OPEN: the daemon wiring (INTEGRATOR seat), the gauge accounts row re-grade, a link route and an attested band source 2026-09-25 land FINISH seat: nx_connect_auth_gate MIGRATED by hand from its hand-rolled au_check verdict onto nx_gate_verdict (au_check now delegates to gv_check per tooth, gv_ctr, nine gv_kv values, return gv_verdict; B4 B5 B6 renamed neg-control-wrong-passphrase, neg-control-unknown-handle, neg-control-tampered-token), source 9424 to 9527 B, pre-edit copy banked at knowledge/status/nx_connect_auth_gate.nx.bank-20260925. Baseline before edit GREEN 12/12 hand-rolled 416199 B. After: passed 12/12 verdict=GREEN 443084 B sha256 c722d0a9. Bite: a planted no-op tamper (xor 0x00) read B6 FAIL, tampered_token_rc=0, passed 11/12 verdict=RED exit 1; restored, cache-hit key 60d3b857 reproduced c722d0a9 GREEN 12/12. PROMOTED through /api/promote with expect_sha256 (the D001 guard admitted it), /api/gate_run GREEN exit 0 FAST 14750 ms deadline, roster trial GREEN 1309 ms and admit admitted_new=1. Values published: register_rc 0, login_rc 0, whoami_rc 0, uid_bytes 32, wrong_pw_rc -1410, unknown_handle_rc -1409, tampered_token_rc -1403. OPEN: the gate still uses fixed /tmp/nxcauth_* fixture paths rather than a /tmp/nx_connect_auth_gate/ dir created at setup 2026-09-25 land BUILDER seat v2: the production door crl_family_ctx_open (lib now 24607 B sha256 da9b78ee) opens the family realm nishi_site_admin for VALIDATION only and REFUSES when the family keys file is absent (-2211), because olg_ctx_setup_ttl loads-or-INITS keys and would silently mint a second family key set whose sessions no family login can produce. Bite on the NAS: guard removed -> gate RED 45/47 exit 1, exactly neg-control-family-context-refuses-missing-keys (actual 0 expected -2211) and neg-control-missing-family-keys-are-never-minted failing; restored -> GREEN 47/47 exit 0 by build-cache hit (byte-identical closure). Shipped: /api/build src_sha256 7903b1e2 BUILT 387368 B sha256 e47c7ffd, /api/promote expect_sha256 PROMOTED, nx_offc_install refreshed, /api/gate_run on the promoted binary GREEN 47/47 exit 0 FAST capture 5259 B untruncated. Integration for the INTEGRATOR seat: boot crl_family_ctx_open(famctx, opaque_keys.bin, opaque_store.log) (cwd nishihost as daemons.reg runs both CONNECT and the :9091 family login); per request when nxc_auth did not authenticate, acc_realm_unify(famctx, X-Nishi-Session value, now, connect, acct, band); link route crl_link, unlink route crl_unlink. OPEN: daemon wiring, an attested band source for crl_link (CONNECT stores no band today), gauge accounts row re-grade after the served round trip is observed 2026-09-25 measure BUILDER seat bar source read this month from mirrored bytes (for the BOARD seat's refs row): NIST SP 800-63C-4 Sec. 3.8.1 Account Linking, knowledge/fetched/cmp_connect_nist80063c4.html 416501 B sha256 01e2808b (nx_research_fetch 2026-09-25, status 200): the RP SHALL require an authenticated session with the subscriber account for all linking functions and SHOULD require authentication with one existing identifier before linking the new one; when an identifier is removed the RP SHALL disallow access from it. acc_realm_unify meets both clauses (crl_link verifies the CONNECT session AND the family session; teeth T11b and T14b prove access stops after unlink). Declared deviation, stricter than the bar: one family identity per account (NIST permits many) because there is one family realm and a second link would be an account-sharing path. Incumbent basis RFC 9807 OPAQUE mirrored knowledge/fetched/cmp_connect_rfc9807.txt 152656 B sha256 42410327 2026-09-25 queue BUILDER seat hands off, nothing of CN5 left half-built: lib nx_connect_realm.nx (24607 B) + gate nx_connect_realm_gate (promoted 387368 B e47c7ffd, registered, _offc installed, rostered, GREEN 47/47 on the NAS, two bites proven). OPEN, in order: (1) INTEGRATOR wires nx_connect_appd -- boot crl_family_ctx_open(famctx, opaque_keys.bin, opaque_store.log); when nxc_auth did not authenticate, read X-Nishi-Session (nx_http_header_find as nx_site_auth does) and call acc_realm_unify(famctx, value, n, now, connect, acct, band), on CRL_OK authed=1 acct=value, ctx CS_UID stays 0 so device keys change only through the CONNECT door; POST /connect/link -> crl_link(famctx, famtok, n, actx, nxc_auth token, n, now, consent, band, connect); POST /connect/unlink -> crl_unlink(actx, token, n, now, CRL_SIDE_CONNECT, connect). (2) an ATTESTED band on the CONNECT account (CN13 or CN18): crl_link must be offered only with a recorded band, never a guessed one. (3) the done-rule live proof: login on /connect with a family session round-trips whoami on the served daemon, observed by nx_https_get. (4) re-grade the accounts row in nx_connect_maturity only after (3). (5) BOARD seat: refs rows for NIST SP 800-63C-4 Sec 3.8.1 and RFC 9807 from the mirrors named in row 1790357560 2026-09-25 measure VERIFIER PARTIAL 47/47 GREEN re-run by this seat via /api/gate_run (job 1790357763, exit 0, capture 5259 B untruncated) on the promoted gate e47c7ffd built from gate src 7903b1e2, lib da9b78ee 24607 B declares func acc_realm_unify at off 16737; nx_gate_bite nx_connect_realm_gate nx_connect_realm.nx 2 (job 1790357840) killed=1 survived=0 void=0 valid_mutants=1, restore byte-identical and both twins restored (hashes rechecked); all 7 claimed CN5 rows present. Builder claims hold INSIDE the gate only: nx_connect_appd.nx (now 32799 B) has 0 calls to acc_realm_unify so the served round trip is UNPROVEN. Gaps named: (1) PRIVACY the link log is written mode 0644 (CRL_MODE_0644) and stores the family uid hex = unkeyed SHA-256(realm then three pipes then handle) beside the CONNECT account id, so any local reader who guesses handles correlates a family identity to its CONNECT account -- owed 0600 plus a keyed digest; (2) CONCURRENCY crl_link_verified reads state then appends with no lock, so two concurrent links can bind two family identities to one account and break one-to-one -- UNVERIFIED whether appd serves concurrently, owed a lease around read-then-append; (3) the first link trusts the caller's band, no attestation source exists yet (CN13/CN18). No dating lane, Church record or Church text in this lib; the two-deep wall is out of this lib's scope (it only carries the band). 2026-09-25 land FINISH seat: the serve core the auth gate composes changed under this leg (buildroot/runtime/_hdl_build/nx_connect_serve.nx mtime 1790358029, the Circles page landing for CN14), so the promoted auth gate (c722d0a9) was testing the old closure. Re-qualified against the current closure: cache miss, 449378 B sha256 edf35213, passed 12/12 GREEN, so real OPAQUE register, login and whoami still round-trip and the nav invariant (exactly one aria-current tab) holds with the new Circles tab. nx_contentdiff (deadline 120000 ms; the default 12000 ms timed out on the 443 KB pair and printed a partial, read as UNKNOWN, not as a verdict) read lost_from_live=0, ONE-WAY-GAIN 20 runs, incl. the circle copy: mission family by consent plus vouching from members who served in the same mission and area with overlapping months, ward through a vouched stake mapping, one worldwide circle, members of The Church of Jesus Christ of Latter-day Saints, open to Christians of any tradition. Re-promoted without any loss flag; /api/gate_run GREEN exit 0 FAST. A _build fossil of 505576 B built by another seat at 1790357344 (default flavour, likely debug from the incumbent) sat beside the 443084 B live binary until this rebuild 2026-09-26 land RESUME-CRYPTO-REALM wave-10 seat finished the wave-8 FIX-CRYPTO-REALM work on debt 1790372748 (R4c), which had been rebuilt and staged but never proven or journaled: nx_connect_realm.nx (buildroot/runtime/_hdl_build, 30367 B sha256 79eb13b7, banked knowledge/bank/nx_connect_realm.nx-fix-79eb13b7-20260926) creates realm_links.log and realm_links.key 0600, refuses to append to a log wider than 0600 (-CRL_E_STORE, the log is never widened or rewritten), and stores the family uid column as HMAC-SHA-256 under the 0600 CSPRNG link key, so a reader can no longer hash a guessed handle and join it to a CONNECT account or a minor band. RED on the planted pre-change lib (log opened 0644, no mode check, unkeyed column; sha256 6059ab94): qualify job 1790437311 passed 49/56 verdict=RED (T16 log mode 420 vs 384, T16b key absent, T16c key 0 B, T17 raw family uid in the log, T17b keyed uid absent, planted 0644 log accepted rc 0 vs -2207, refused log written 100 B). GREEN on the restored fix: job 1790437543 56/56. SHIPPED by nx_organ_ship job 1790438652: gate sha 95557945 promoted over e47c7ffd, _offc twin installed, already registered; loss approved allow_loss_v1 df99a761 (crl_uidhex is the retired unkeyed column; _ma_register_credential is an auth-closure symbol the gate no longer links, still defined in hub/nx_modern_auth_flow.nx, and the seven-member register and sign-in teeth pass); behaviour reviewed in knowledge/status/harness/review-realm-gate-20260926.review (sha256 ef3dafe8, evidence e7dc6a11). EXISTING ROWS: the lib is imported only by its gate (grep over 26622 files, corpus_complete=1) and no realm_links file exists under connect/ (114 files) or alpha_connect/ (18 files), finds corpus_complete=1, so no production row needs migrating; an unkeyed row still parses but no longer matches a keyed lookup, and a log that holds rows with no key refuses every call rather than silently re-keying. OPEN: nx_connect_accounts acc_save and the msgstore MSD_FILE_MODE still write 0644 (named in 1790372748 as not this lib, carried into a new row); nx_connect_appd still does not call acc_realm_unify, so no served whoami round trip exists. 2026-09-26 queue RESUME-CRYPTO-REALM debt outcomes, each read back from its job artifact: 1790372748 (realm link log) DEBT-EATEN job 1790439138; its not-this-lib clause (nx_connect_accounts acc_save and the msgstore MSD_FILE_MODE writing 0644) carried forward as 1790438959. Franking (YS5, journaled on youthsafety.plan 1790439000): 1790372740 and 1790372741 eaten, residual 1790438989, dependency growth 1790439040. Nothing from this leg is served: both libs are imported only by their gates, realm_unify and franking_verify stay not_yet_wired in nx_connect_api_lib, and the alpha (connect_alpha) and production were not touched.

CN6 Messaging core on the durable store · cell LANDED · gate NO-GATE-DECLARED

Contract	`cs_msg_append` · executor Organ · 1.5 u · stands on CN5
Definition of done	The per-session in-memory thread becomes the per-account durable world end to end (send, receipts, edit and delete surviving restart, two accounts proven isolated); done-rule: the accounts gate grows a restart tooth and the gauge's messaging row moves STUB to PARTIAL on evidence -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/_hdl_build/nx_connect_msgstore.nx 21094 B sha 5694c3c3 declares msg_store_append (Matrix room version 11 redaction model [matrix-rooms-v11], deviations declared); nx_connect_msgstore_gate 56/56 GREEN re-run by the verifier, promoted aa3abf18; nx_connect_accounts_gate 7/7 GREEN with the T7 RESTART tooth, so done-rule part 1 is met. Done-rule OPEN: the store is not wired into the served daemon and the gauge messaging row is still STUB; the verifier bite left one surviving mutant (msd_slen at off 5947 lets the .msg path alias the .cst world snapshot, tooth owed); the channel verdict is caller-trusted and yw_may_channel allows an unknown band; edit and delete carry no actor check; the save uses a fixed temp name
Matrix cell	Messaging core on the durable store (survives restart, isolated accounts) · `runtime/nx_chat_store_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_chat_store_lib`; declare `nx_chat_store_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790355008 routed by nx_intake_route (operator-seat, epoch 1790356455) from pm-seat: R8 of parent REQ 1790355000: durable messaging so members engage -- one-to-one and group messages that survive restart with receipts, edit and delete, end-to-end sealed, delivered when the app is clos -- sponsor intake-1790355008 plus1 2026-09-25 queue PM seat, for the BOARD and BUILD seats: comms C1 Store-and-forward history (cs_store_forward in runtime/nx_chat_store.nx) is LANDED on the comms board with nx_chat_store_gate 21/21 GREEN -- offline delivery byte-identical and in order across process death, cursors that never regress, additive-only soft-delete, budgets that refuse by conf-row name -- and comms C2 multi-device sync (msy_devsync) is LANDED beside it; the CN6 watch row now names a NEW organ runtime/_hdl_build/nx_connect_msgstore.nx (source present per nx_goalmap this hour), so CN6 must compose nx_chat_store rather than grow a second durable message store, and CN13 should compose authz AZ9 wauth_assert_verify for passkeys while CN18 and CN13 compose authz AZ10, which now watches the single sa_age_attest contract in nx_site_auth that synthroom SR9 already names; routes FILED this hour: R1 CN13, R2 CN5, R3 CN14 plus familyatlas FA8, R4 CN14 plus CN13, R5 CN15, R8 CN6 CN7 CN2 plus comms C1, R9 CN18 plus authz AZ10, R11 authz AZ10 plus CN18, R12 CN16 plus scripturestudy SS2, R13 CN17 (intake REQ 1790355000 children) 2026-09-25 measure nx_connect_msgstore_gate FIRST RUN 41/55 RED (sov_build_run --qualify, elf 113020 B sha 6eb9670e): account A's own valid 1338 B snapshot read back TAMPERED while B's 431 B loaded. Root cause is in the incumbent codec: nx_connect_accounts acc_w64 wrote every NEGATIVE i64 wrong (x / 256 truncates toward zero) and the store's FNV trailer and client ids are signed hashes. Fixed at the root as (x - low byte) / 256, byte-identical for every non-negative value; a codec tooth now pins it. Also nx_connect_msg.nx main renamed cmsg_selftest (now a LIB, body unchanged) so the store composes log_append; its checks run from nx_connect_msg_gate 7/7 GREEN run-exit 0 (20846 B sha b21ba720) 2026-09-25 land msg_store_append LANDED in buildroot/runtime/_hdl_build/nx_connect_msgstore.nx (21094 B, LIB): a per-account durable message world composing nx_connect_msg (log_append, set_state, edit_msg, del_msg; rows are REPLAYED from an append-only event journal) and nx_connect_accounts (acc_path isolation, acc_w64 codec, tmp+rename+fsync); file dir/<account>.msg beside the world snapshot; content-blind opaque ciphertext arena; edits and deletes additive; every send needs an ALLOW channel verdict (yw_may_channel via msg_store_chan_yw), absent or deny refuses; fail-closed load (TORN, TAMPERED, MAGIC, VERSION, ACCOUNT, REPLAY) leaves the store empty and poisoned so the refused file is never overwritten. Gate nx_connect_msgstore_gate 56/56 GREEN (sov_build_run --qualify, 113269 B sha c2de6e88, run-exit 0): a restart that scrubs every in-memory structure and compares 48 fields in order, receipts edit delete and idempotent replay across restart, B file untouched by A, B bytes at A path refused ACCOUNT, torn refused TORN, tampered refused TAMPERED with the restored file as positive control, non-positive account refused. BITE: trailer check removed gave 53/56 RED run-exit 1 with exactly the three tamper teeth failing; restored gave BUILD-CACHE HIT on the GREEN key 0d45eae1 and 56/56 GREEN. nx_connect_accounts_gate still 6/6 GREEN after the acc_w64 fix (68039 B sha 4e58b2b9). OPEN: daemon wiring (INTEGRATOR), gauge row STUB to PARTIAL (needs the served path), accounts-gate restart tooth 2026-09-25 land SHIPPED nx_connect_msgstore_gate through nx_organ_ship: BUILT sha aa3abf18 (api/build lane), PROVE 56/56 GREEN exit 0 on the fresh stage-1 build, first promote (no live elf, announced), _offc twin installed, REGISTERED callable=1 schema=0, harness hb7c8103e793b5679; admitted to knowledge/gateroster.conf as a HAND-ADDED row with its evidence. DONE-RULE PART 1 MET: nx_connect_accounts_gate grew tooth T7 RESTART (msgstore saved 354 B, a fresh store reloaded rows=2 with receipt, edit, tombstone and bytes intact, account B load=0 and empty) and reads 7/7 GREEN run-exit 0 under sov_build_run --qualify. OPEN: gauge messaging row STUB to PARTIAL (nx_connect_maturity re-grade, needs the daemon wired by the INTEGRATOR), schema row for tools/list discovery, T7 not separately bite-proven (its lib is, via the msgstore gate) 2026-09-25 measure SECOND MUTANT, delete not replayed on load: nx_connect_msgstore_gate 54/56 RED run-exit 1 with exactly restart-every-field-equal-in-order-a (2 fields, del flag and handle of the deleted row) and restart-delete-survives-a2 (read 219 bytes where a tombstone belongs) failing, and nx_connect_accounts_gate 6/7 RED with T7 RESTART failing; restored, the msgstore gate HIT the build-cache key of the SHIPPED artifact (aa3abf18, 126352 B) and read 56/56 GREEN, the accounts gate 7/7 GREEN, both run-exit 0; served and _offc twins stayed aa3abf18 throughout (nx_filehash cmp identical=1), so no mutant reached the serving root 2026-09-25 queue OPEN for the INTEGRATOR: wire nx_connect_appd /connect/secure and /connect/chat onto msg_store_open plus msg_store_load at session start, msg_store_append with msg_store_chan_yw(yw_may_channel(...)) on every send, msg_store_receipt, msg_store_edit, msg_store_delete, msg_store_read, and msg_store_save after each mutation, into the same dir as acc_save (the file is dir/<account>.msg). OPEN for the BOARD or SYNC seat: map the CN6 contract to runtime/_hdl_build/nx_connect_msgstore.nx msg_store_append (the ranker read it UNMAPPED). OPEN: the gauge messaging row STUB to PARTIAL waits on the served path (nx_connect_maturity still hand-grades it 1, in-memory per-session demo); nx_connect_msg_gate (20846 B) and nx_connect_accounts_gate (7 teeth, T7 new) are BUILT-UNPROMOTED by declaration because both roll their own verdict and need a D001 migration onto gv_check before a promote; nx_connect_msgstore_gate is REGISTERED but no cap names it yet 2026-09-25 measure BEST-IN-CLASS MECHANISM named and read this month: the store follows the Matrix event model, where a delete is an APPENDED m.room.redaction event and the target keeps its skeleton with content stripped (Room Version 11, Matrix spec v1.19: Upon receipt of a redaction event, the server must strip off any keys not in the following list). Mirrored knowledge/fetched/cmp_connect_matrix_rooms_v11.html 72788 B sha256 77be4fcfb4ccb236b986dff78c4468e1d7a1ea3b6fb2778e45232e2b41cfb7d1 status 200 fetched 2026-09-25, for the BOARD seat to pin as a refs row on the Messaging core row. DECLARED DEVIATIONS: our tombstone clears the handle while the opaque ciphertext stays in the append-only arena (retention is a lifecycle follow-on); edits append a new blob and re-point the row rather than a replacement event; no event graph or federation (CN12) 2026-09-25 land nx_connect_accounts_gate MIGRATED onto nx_gate_verdict (ag_check delegates to gv_check, gv_verdict exit code, neg-control-T5, values emitted) and SHIPPED through nx_organ_ship: BUILT c56205f6, PROVE 7/7 GREEN exit 0 incl. T7 RESTART, first promote, _offc twin, REGISTERED; admitted to knowledge/gateroster.conf beside nx_connect_msgstore_gate. The accounts gate therefore carries the done-rule's restart tooth on the served estate, not only in source 2026-09-25 lesson The first ship of the accounts gate was refused BUILD-FAILED because nx_connect_serve.nx line 1727 called cs_page_circles before its definition had landed (a sibling seat mid-edit); the definition arrived minutes later and the retry shipped. The store composes acc_path, acc_w64 and acc_r64, which live in nx_connect_accounts beside acc_serialize and so drag the whole 125 KB nx_connect_serve closure into every store consumer: any in-flight serve edit breaks every store rebuild. QUEUE: extract the accounts path and codec into a leaf lib (no serve import) that nx_connect_accounts and nx_connect_msgstore both compose 2026-09-25 land nx_connect_msg_gate MOVED onto nx_gate_verdict (the seven checks nx_connect_msg's old main carried, same fixture values, neg-control-T7 named, values emitted) and SHIPPED through nx_organ_ship: BUILT 8a25e8c3, PROVE 7/7 GREEN exit 0, first promote, _offc twin, REGISTERED, rostered. BITE: set_state allowing a backward receipt gave 6/7 RED exit 1 with T3 alone failing; restored, the ship's fresh build proved 7/7. The Messaging core row of /compare/connect (log_append in nx_connect_msg.nx) now has a shipped, rostered gate for the first time. OPEN: the old cmsg_selftest body and its sw, sn and tcheck helpers are now dead code inside the nx_connect_msg lib (nothing calls them); remove them in one exact edit, then rebuild nx_connect_msg_gate and nx_connect_msgstore_gate to prove nothing depended on them 2026-09-25 measure VERIFIER PARTIAL 56/56 -- lib nx_connect_msgstore.nx 21094 B sha 5694c3c3 exists and declares msg_store_append once (nx_txtscan count=1); gate re-run by /api/gate_run exit 0 GREEN 56/56 and fresh sov_build_run --qualify 56/56 run-exit 0; nx_connect_accounts_gate 7/7 GREEN with T7 RESTART PASS; served gate twins identical aa3abf18; Matrix v11 mirror pin 77be4fcf matches and holds the quoted sentence; all 9 claimed CN6 log rows present. nx_gate_bite 2 sites: valid 2 killed 1 SURVIVED 1 -- the survivor is the != in msd_slen (off 5947), which makes msd_path keep the .cst extension so dir/<id>.msg ALIASES the world snapshot dir/<id>.cst and no tooth notices; the claimed never-the-same-file invariant is unguarded (owed: a tooth asserting msg_store_path ends in .msg and differs from acc_path). Other gaps: the store trusts a caller-supplied chan verdict (1 = ALLOW) and does not bind it to sender or recipient bands, so the two-deep wall holds only if the integrator computes it; yw_may_channel reads any band other than 0 or 1 as peer and ALLOWS it (fail-open on an unknown age band); edit and delete take no actor, so authorship is unchecked in the lib; sender id and lang are stored in the clear (metadata, not content-blind); deleted ciphertext stays in the arena; the tmp name is fixed and the directory is not fsynced after rename, so concurrent saves of one account race and a rename can be lost on power loss (single-writer UNVERIFIED for nx_connect_appd). Done-rule part 2 NOT met: nothing on the served /connect path, gauge row still STUB; the CN5 dependency is still UNMAPPED. 2026-09-25 queue FIX-CRYPTO-REALM wave-8 seat: nx_connect_msgstore leaks NOT patched here by design (save leak debt 1790372761, alias tooth debt 1790372756) because R4a classified the CN6 per-account snapshot store SPRAWL beside nx_chat_store (comms C1, seg-store, promoted, consumers nx_msg_sync and nx_game_chat; consolidation debt 1790372726). Order: (1) extract nx_chat_store_lib per comms.plan chatstore-lib-extract so the one store is importable; (2) re-seat CONNECT on it (nx_connect_franking mfr_relay and every msg_store_ caller) with replay dedup keyed by (sender, client msg id) -- log_append keys the id alone, so a second sender's message at the same id is answered with the first one's seq and never stored (source read this leg; the franking nonce fix makes the two ciphertexts distinct but cannot make the store keep both); (3) nx_connect_msgstore to SUPERSEDED then ARCHIVED through the lifecycle states with a mining receipt (msd_path alias guard, poison latch, youth-wall channel verdict, receipt states, edit and tombstone rows). The R4d alias tooth (acc_save a world, msg_store_save, assert the .cst bytes unchanged and loadable, the .msg path differs from acc_path) is several lines, not one, so it rides step (2) instead of a gate edit now. 2026-09-26 queue CHATSTORE-EXTRACT wave-11 seat: consolidation STEP 1 of the CN6 SPRAWL (debt 1790372726, review R4) is DONE and step 2 is ready. The comms C1 store is now a library: buildroot/runtime/nx_chat_store_lib.nx (every CS_ const and all 29 cs_ verbs and helpers, moved byte-for-byte; release rebuild of nx_chat_store byte-identical before and after, sha 55bd24ba), proven importable STANDALONE by its own in-process gate nx_chat_store_lib_gate 20/20 GREEN (it imports only the lib and the verdict lib, then drives open append fetch and reads the row back from the plane). nx_chat_store (98555eff), nx_msg_sync (fe855c39) and nx_game_chat (01e3d134) all import it and are shipped with their gates GREEN (29/29, 15/15, 13/13). STEP 2 for a later seat, in this order: (a) re-seat CONNECT on the lib -- every msg_store_ caller and nx_connect_franking mfr_relay store through cs_store_forward and read through cs_fetch, one room plane per conversation; (b) REPLAY DEDUP keyed by (sender, client msg id) BEFORE cs_store_forward, because the C1 store has no idempotency key and the msgstore log_append keys the id alone (a second sender's message at the same id is answered with the first one's seq and never stored); (c) the caller contract: every cs_ verb prints its verdict line on fd 1 and returns an exit code, so an in-process CONNECT caller that needs rows in memory needs a NEW lib verb (a buffer-returning fetch), never a silent change to cs_fetch; (d) cs_ and CS_ are owned by the lib in any importer's closure -- check CONNECT's names first; (e) then nx_connect_msgstore goes SUPERSEDED then ARCHIVED through the lifecycle (nx_retire_path with a mining receipt of its verbs, API routes, gate teeth and callers), never deleted. Wave 10 owns franking this week: coordinate before touching it. 2026-09-26 land CHATSTORE-STEP2 (wave 13, debt 1790372726 consolidation step 2): CONNECT re-seated on nx_chat_store_lib. The lib gained QUIET message verbs (cs_msg_ensure, cs_msg_append, cs_msg_read, cs_msg_count, cs_msg_state, cs_msg_receipt, cs_msg_edit, cs_msg_delete; codes CS_Q_ -51..-59): replay dedup keyed by the (sender, client msg id) PAIR through key cid:<sender>:<cid> committed in ONE CAS segment with the row, receipts rcpt:<seq> forward-only through cm_advance, edits ed:<seq> additive, tombstone del:<seq> (the cs_del key), and the msgstore poison latch carried as a refuse-on-inconsistent-count check; lib 41860 to 57665 B sha256 f27dbc02. nx_connect_franking re-seated: mfr_store_open binds room acct<id> and refuses a non-positive id, mfr_relay judges the tri-state channel verdict first, refuses a record for another recipient and appends through cs_msg_append; the ctx codec is aead_put_u64_le plus mfr_get_u64_le so franking no longer pulls nx_connect_accounts and the serving-daemon closure. RED on the old code: nx_connect_franking_gate with the dedup teeth against the msgstore read 64/66 RED (job 1790454198, two-senders-at-one-client-id and the second record opening under its own sender FAIL). GREEN on the fix: nx_chat_store_lib_gate 50/50 (job 1790454709), a cid-alone mutant of cs_cidkey killed 44/50 RED (job 1790454905) then restored byte-identical f27dbc02; nx_connect_franking_gate 88/88 GREEN (job 1790455935, merged with the wave-13 leak seat's workspace-AEAD teeth, both seats edited the same gate). SHIPPED nx_chat_store_lib_gate 07788347 (job 1790455584) and nx_connect_accounts_gate e6985d82 (its T7 msgstore restart tooth moved to the lib gate T26-T30, 75 lost runs enumerated, reviewed behaviour, job 1790456113). 2026-09-26 land LIFECYCLE nx_connect_msgstore SUPERSEDED then ARCHIVED (CHATSTORE-STEP2, debt 1790372726): header marker written (21094 to 21738 B), then nx_retire_path moved the lib to knowledge/retired/buildroot_runtime__hdl_build_nx_connect_msgstore.nx-1790456647 and its gate source to knowledge/retired/buildroot_runtime__hdl_build_nx_connect_msgstore_gate.nx-1790456670 (reversible, bytes preserved, deleted 0); the gate's row in knowledge/gateroster.conf is commented with its restore line (93697 to 94101 B). ABSENCE PROVEN after the move: nx_shelltool grep nx_connect_msgstore.nx over buildroot/runtime, 26662 files, coverage_complete=1 corpus_complete=1, matches=2, both comments (nx_connect_msg.nx L16, nx_connect_msg_gate.nx L2) -- no importer remains. MINING RECEIPT, each event and where it lives now: SEND with idempotent client id -> cs_msg_append, keyed by the (sender, client msg id) PAIR instead of the id alone (the defect this step fixes); RECEIPT forward-only sent, delivered, read -> cs_msg_receipt and cs_msg_state (lib gate T28-T28d); EDIT, new ciphertext appended, never resurrecting a tombstone -> cs_msg_edit on key ed:<seq> (T29-T29c, T30c); DELETE-FOR-ALL tombstone with bytes retained -> cs_msg_delete on del:<seq>, the cs_del key (T30-T30c); READ with ABSENT, TOMBSTONE and SMALL refusals -> cs_msg_read (T22-T24b, T27b); msd_path ALIAS GUARD -> mfr_store_open refuses an account id below one (franking neg-control-store-refuses-a-non-positive-account) and a room plane <store_root>chat_acct<id>- cannot alias a dir/<id>.cst world snapshot by namespace; POISON LATCH -> cs_q_tail_ok refuses any append while the count declares a row the store cannot produce and writes nothing (T32, T32b), and the whole-file overwrite the latch guarded is gone (append-only segments under CAS); YOUTH-WALL CHANNEL VERDICT tri-state, ABSENT default, only ALLOW stores -> mfr_chan_yw and MFR_CHAN_ in nx_connect_franking, judged before the store (franking teeth youth-wall allow and deny, relay refuses denied and absent); ACCOUNT BINDING -> mfr_store_open binds room acct<id>, mfr_relay refuses a record for another recipient; RESTART -> the plane's segment files (T26, T26b fresh uncached handle; census T25-T25c); ISOLATION -> one plane per room (T27-T27c). NOT CARRIED, named: the FNV-1a snapshot trailer with its TORN, TAMPERED, MAGIC, VERSION and ACCOUNT load refusals (the .msg format is gone; segment integrity is the seg-store's contract, integrity not authenticity as before); the per-send verdict audit field (only ALLOW sends were ever stored); the per-message lang field (the content-blind relay always wrote 0); an edited-flag accessor (no consumer read it). REMAINING for the lifecycle lane: the promoted nx_connect_msgstore_gate.elf, its _offc twin and its MCP registry row (no unregister verb in this seat's caps); nx_connect_api_lib L510 whose UNWIRED msg_append row still names nx_connect_msgstore.msg_store_append (successor owner nx_connect_franking mfr_relay over nx_chat_store_lib cs_msg_append; the api lib is in the alpha lane and was not edited); the two stale comments above. 2026-09-26 land CONTRACT REPOINTED so the archived msgstore does not take the capability dark (CHATSTORE-STEP2): connect.matrix row 'Messaging core on the durable store' organ runtime/_hdl_build/nx_connect_msgstore.nx symbol msg_store_append -> organ runtime/nx_chat_store_lib.nx symbol cs_msg_append (25843 to 25827 B), and the CN6 rung contract msg_store_append -> cs_msg_append (edit under content CAS after two refusals from concurrent appends); the watch reads LANDED on the next regen because cs_msg_append is declared in that organ. DEBTS: 1790372726 EATEN (job 1790456883, remainder superseded by 1790456824 -- the nx_chat_demo_api duplicate, blocked by the unpassable demo gate of debt 1790440838, recipe on comms.plan); 1790438989 superseded by 1790457092 with its item 3 (store dedup by sender and client id) closed by this step; new 1790456690 (the quiet verbs' measured VmSize envelope, about 852 kB per stored 4096-B relay, a leak for any daemon composing mfr_relay). SHARED GATE, said out loud for the wave-13 leak seat (debt 1790439040): nx_connect_franking_gate a1a34ec5 was shipped by this seat and CARRIES that seat's workspace-AEAD KAT and sender/recipient absolute leak teeth (88/88 GREEN); nx_connect_franking.nx 21453 B is my re-seat plus that seat's cseal_seal_ws edits. 2026-09-28 land W16 BOARD-TREATMENT-AND-RANK (T0 1790613009): the CN6 treat row named the ARCHIVED nx_connect_msgstore (prim absent; its gate retired from the roster 2026-09-26) so nx_compare_rank refused the whole board TREATMENT-PARTIAL (job 1790613009, exit 8). Repointed to the successor under content CAS (expect h4fef2e7370ef471c, 434233 to 434225 B as predicted): mcp and agent nx_chat_store_lib_gate (tool_allowlist.conf row GREEN, gateroster.conf row present), api /api/gate_run?target=nx_chat_store_lib_gate, prim nx_chat_store_lib (buildroot/runtime/nx_chat_store_lib.nx 57665 B, the CN6 contract organ since CHATSTORE-STEP2), wf connect-onboard. The successor was proven on the served binary first: /api/gate_run nx_chat_store_lib_gate GREEN 51/51 exit 0 source_newer 0 (job 1790613240), including T26 restart, T27 isolation and T20-T21 dedup by the (sender, client id) pair. The journey workflow itself still ran the archived gate too: plan-connect-onboard- step 7 repointed from nx_connect_msgstore_gate to nx_chat_store_lib_gate (nx_store_put PUT 7 replaced=1 rows=8, job 1790613282). AFTER: nx_treatment connect rows=9 complete=9 partial=0 undeclared=13 verdict=TREATED; nx_compare_rank connect ranks again (job 1790613514, exit 0, connect.rank sha256 6c0d3162). 2026-09-28 queue W16 open for owners. (1) LIFECYCLE: nx_connect_msgstore_gate is still a PARALLEL-TOOL -- its tool_allowlist.conf row reads GREEN while nx_catalog calls the binary PROMOTED-SOURCELESS (its source was archived 2026-09-26); unregister the row and retire the binary and its _offc twin through the lifecycle (no unregister verb in this seat's caps). (2) debt 1790372756 EATEN (job 1790614081, DEBT-EATEN): its subject, msd_path in the archived msgstore, is ABSENT-PROVEN in buildroot/runtime (nx_absent coverage_complete=1 corpus_complete=1), and the successor guards the alias by namespace (the room plane chat_acct<id>- cannot name a dir/<id>.cst snapshot) and by the nx_connect_franking_gate tooth neg-control-store-refuses-a-non-positive-account. (3) debt 1790614098 for the two unowned workflows (row 1790614121). (4) CB3 symbol mapping (row 1790614123). (5) the STAGED nx_connect_appd.sov.elf.new 806805 B matches the size row 1790456840 gives the W13 candidate cb3b5c3d; identify it by hash before any use. 2026-09-28 measure W16: CN6 is a FINISH item the ranker cannot see. Its contract organ is now the shared nx_chat_store_lib, which ships inside nx_chat_store, nx_msg_sync and nx_game_chat, so the ranker's adoption test (does any shipping program import the contract organ) passes and CN6 reads done. But the CONNECT caller of cs_msg_append, nx_connect_franking mfr_relay, is imported ONLY by nx_connect_franking_gate (nx_absent import line over buildroot/runtime: 1 match, coverage_complete=1 corpus_complete=1), so no CONNECT serving daemon stores a message durably yet, and the done-rule's second half (the gauge's messaging row moves STUB to PARTIAL) stays open -- the matrix note still reads STUB from the 2026-09-25 gauge run. Next for CN6: a caller of mfr_relay in the served daemon (alpha first, under the SEALED seat's edit lease on the three daemon sources), then a gauge re-run through /api/organ_run. For the ranker owner: judge FINISH against the board's own serving product when a contract organ is shared across boards.

CN7 AEAD sealing wired into the live serve · cell PRESENT · gate UNRECORDED

Contract	`cs_sealed_aead` · executor Organ · 1 u · stands on CN6
Definition of done	/connect/secure stores Poly1305-tagged sealed messages and REJECTS tamper live, positive and negative proven over the edge; retires the unauthenticated stream the seal gate neg-controls (cseal teeth already GREEN)
Matrix cell	Sealed messages live on a served instance: AEAD envelopes stored, tamper refused, franking reports verified (CN7, ALPHA) · `runtime/_hdl_build/nx_connect_sealed_api.nx` · PRESENT decl
Gate	`nx_connect_sealed_api_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-25 queue INTAKE 1790358610 routed by nx_intake_route (operator-seat, epoch 1790360523) from ys-pm-seat: Y10 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): report abuse without surveillance. A recipient can repor -- sponsor intake-1790358610 plus1 2026-09-28 queue FOR THE SEALING OWNER (wave 16), from the wave-17 DATE-SAFETY seat: the estate now carries ONE RFC 9180 HPKE, runtime/_hdl_build/nx_hpke_lib.nx (base mode; DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, ChaCha20Poly1305; hpk_derive_keypair, hpk_encap, hpk_decap, hpk_key_schedule, hpk_seal and hpk_open at a caller-passed sequence number, hpk_export, and the single-shot hpk_seal_base and hpk_open_base), proven byte for byte against the RFC's own Appendix A.2.1 vectors by nx_hpke_lib_gate 47/47 GREEN (promoted sha 839be23c, bite-proven twice). faithsocial FS8 seals date plans through it. If a sealing rung seals anything to a recipient's public key, compose it rather than build a second box; this seat touched no wave-16 file. Declared limits: base mode and one suite only; Encap's ikm must come from the caller's CSPRNG. 2026-09-29 measure RESUME W16 SEAT SOTA-SEALED-MESSAGING (third run, T0 1790654755, after the operator pause): the predecessor journaled NO row and banked nothing. MEASURED nx_connect_appd.nx against the retired byte copy of the source that built the alpha bdeb97bc (knowledge/retired/buildroot_runtime__hdl_build_nx_connect_appd_w17check.nx-1790638485, sha256 57edfb76 116620 B) with nx_srcdiff (job 1790654999, complete surplus listing): every surplus line belongs to CONNECT-SHIP-2's CN13-DEVICE batch, closed by its EDIT-DONE row 1790655420 (261d59c8 119815 B), and the file holds 0 occurrences of seal; nx_connect_serve.nx (sha256 54aed8ae 141624 B, mtime 1790625396) and nx_connect_ui.nx (sha256 ddd7c780 33585 B, mtime 1790460071) predate the alpha build. No half-applied SEALED batch exists, so there is nothing to complete or revert. PLAN, stage-gated end to end: a NEW lib runtime/_hdl_build/nx_connect_sealed_api.nx composing nx_connect_franking (mfr_relay into the recipient's own C1 room with the youth wall as the channel verdict, the server tag re-verified before any stored record is served, mfr_report_verify for a franking report) behind <mount>/secure/v1/ send, inbox, report and whoami on a STAGED instance only; the daemon wiring lands as ONE content-CAS write of nx_connect_appd.nx from a compile-checked scratch copy, between an EDIT-START and an EDIT-DONE row; nx_connect_serve.nx and nx_connect_ui.nx are not planned to change. 2026-09-29 queue EDIT-START W16 SEAT SOTA-SEALED-MESSAGING, ONE batch on runtime/_hdl_build/nx_connect_appd.nx (sha256 261d59c87d17ad96 119815 B, CONNECT-SHIP-2's EDIT-DONE bytes of row 1790655420 restated by row 1790656830; no other seat holds an open EDIT-START on it): the sealed message lane behind <mount>/secure/v1/ send, inbox, report and whoami on a STAGED instance only, landed as ONE content-CAS write-file from the compile-checked scratch copy runtime/_hdl_build/nx_connect_appd_cn7w16.nx (136487 B, built 1226368 B sha256 20983e1d in job 1790657624). HEEDING row 1790656990 (the appd closure is at the compiler's 256-module import cap, which this seat also measured independently: job 1790656520 COMPILE-FAIL when the scratch imported the new lib, the lib alone building in job 1790656778), the batch adds NO file to the closure: the lane runs in a HELPER PROCESS ./nx_connect_sealed.elf (NEW runtime/_hdl_build/nx_connect_sealed.nx over the NEW lib runtime/_hdl_build/nx_connect_sealed_api.nx, which composes nx_connect_franking), forked and exec'd per call over sys_pipe2, sys_fork, sys_dup3 and sys_execve_clean already in the closure; the daemon keeps the session, the account-log resolution of a recipient handle and the S1 bands. Stage-only: production never arms the lane, never probes the helper and keeps its SIGPIPE disposition (a staged instance now ignores SIGPIPE, inherited by the helper). nx_connect_serve.nx and nx_connect_ui.nx are NOT edited. EDIT-DONE follows with the landed hash. 2026-09-29 land EDIT-DONE W16 SEAT SOTA-SEALED-MESSAGING (closes EDIT-START row 1790657850): runtime/_hdl_build/nx_connect_appd.nx 261d59c8 119815 B to sha256 1c56d7bc78b64769 136487 B by ONE content-CAS write-file (expect h2ca35bcc3b6f8284, job 1790657880), byte-identical to the compile-checked scratch (nx_filehash cmp identical 1). COMPILES: nx_sov_build_run nx_connect_appd --build-only (job 1790657905), debug flavour, 1338512 B sha256 5a5784a13ae61eb4, debug-line files=256 (the batch added no file to the closure), serving-root twin HELD, nothing installed. What the batch adds, all stage-gated: cd_sealed_new (the lane's hoisted scratch), cd_acct_of_handle (a recipient handle resolved as the account log keys it), cd_acct_band (the S1 band through the lib's own reader), cd_sealed_exec and cd_sealed_call (fork, exec and the pipe protocol of the helper), cd_sealed_route (the <mount>/secure/v1/<verb> door; the probe verb is never forwarded from the web), cd_sealed_probe at startup, sys_ignore_sigpipe on a staged instance, and the route branch inside the staged api block. Production's own paths are untouched: staged 0 never arms, probes, forks or changes SIGPIPE. KNOWN, inherited from the tree and measured by CONNECT-SHIP-2 (row 1790656990): this build, like every appd build from this tree, carries NO crash guard because nx_crash.nx would be the 257th file; the lang lane owns the fix. The helper and the gate are NEW files (runtime/_hdl_build/nx_connect_sealed.nx 7838 B built 155033 B sha256 a5b62a6b, job 1790657333; runtime/_hdl_build/nx_connect_alpha_sealed_gate.nx 26793 B built 522663 B sha256 9b3598da, job 1790657778) and knowledge/connect_sealed.conf is the lane's store conf (1165 B). The edit lease stays with this seat for the alpha restart that follows. 2026-09-29 land THE SEALED MESSAGE LANE IS LIVE ON THE ALPHA, PROVEN OVER THE EDGE: https://nishifamily.com/alpha/connect/secure/v1/ send, inbox, report and whoami now run on nx_connect_appd 5a5784a13ae61eb4 (1338512 B, built from nx_connect_appd.nx 1c56d7bc, row 1790657960) with its helper alpha_connect/nx_connect_sealed.elf (a5b62a6b 155033 B, mode 0755). RESTART BY THE ALPHA RECIPE: the prior alpha bdeb97bc stays banked (knowledge/bank/nx_connect_appd.elf-alpha-bdeb97bc-20260928) and daemons.reg was banked first (knowledge/bank/daemons.reg-pre-cn7-bdeb97bc-20260928, 14783 B); the connect_alpha row repointed under content CAS (expect h33f415a19977760a, job 1790658048), re-signed by nx_reg_sign (job 1790658065: SIGNED daemons.reg.sig), nx_proc_kill exact 20441 start_ticks 525039228 digest bdeb97bc signal 15 (job 1790658104: signal_sent 1, the process went to state Z within the 5000 ms deadline and its parent the supervisor reaped it), and nx_proc_observe then read ONE process of 5a5784a1: pid 3843, start_ticks 527411182, parent 25615, digest_match 1, with bdeb97bc ABSENT in a complete scan. GATE: NEW runtime/_hdl_build/nx_connect_alpha_sealed_gate.nx (26793 B, built 9b3598da 522663 B) is both devices -- it seals with mfr_frank on the sender's side and opens with mfr_receive on the recipient's, posting only envelopes: 26/26 GREEN against the new alpha (job 1790658162: whoami per session; envelope 160 B for 80 B of plaintext stored at seq 2 and a replay answering seq 2; the stored record 224 B carries none of the plaintext and sits only in the recipient's room; the recipient opens the exact 80 B; a flipped ciphertext byte refused -45, a flipped commitment -46, a relabelled sender -45; the franking report verifies on the server naming the sender whoami named, routed safety; the server refuses a framed text opening_mismatch, a relabelled record server_tag_mismatch, the sender's own report not_recipient, an adult's private message to the 16-17 year old fixture channel_denied 403 with nothing stored, a signed-out call sign_in_required 401, an unknown handle and a short envelope). RED 0/26 against the old alpha bdeb97bc (job 1790657835: the fixture accounts were made through the door, token 204 B each, and every lane path fell through to an HTML page). Each run makes three alphaseal* accounts in the ALPHA realm only. Shipped, gate 26/26, awaiting acceptance (referee and operator ACCEPT still owed). 2026-09-29 measure CN7 REGRESSION AND REFEREE EVIDENCE on the new alpha 5a5784a1 (pid 3843): nx_connect_prod_register_gate 31/31 GREEN in PRODUCTION mode on a scratch instance of the same bytes (job 1790658243, subject alpha_connect/nx_connect_appd-5a5784a1.elf, scratch port 18151, takeover teeth T1 to T5b, M1 to M3 production serves no API, K1 to K4 the legacy /sealed vf flag honest both ways, Z1 reaped) -- the stage-gated lane changed nothing on the production path; over the edge on the live alpha nx_connect_alpha_signup_gate 23/23 GREEN (job 1790658443) and nx_connect_alpha_api_gate 32/32 GREEN (job 1790658445). THE GATE IS SHIPPED: nx_organ_ship nx_connect_alpha_sealed_gate (job 1790658366): build 857446a1, PROVE 26/26 GREEN (a third live run), adoptgate first promote announced, promoted, offc twin installed, REGISTERED callable. PIXEL REFEREE on https://nishifamily.com/alpha/connect/secure: CM13 nx_cdp_capture could not run on the MCP surface (CD-BROWSER-ABSENT candidates=2, this seat measured it) so the oracle ran where the browser is, the laptop Edge through WSL, the lane prior seats used (rows 1790439130 and 1790439132) -- a named non-MCP exception whose gap is a browser door on the estate surface: phone 390x844 dsf 2 and desktop 1440x900 both OK, CM6 nx_page_pixjudge on the production bars: contrast_fails 0, overlap_pairs 0, hierarchy_violations 0, worst ratio 4.71 (the footer, above 4.5), motion settled; the /secure page itself is unchanged by this rung. PROVENANCE: the lib's comment-only edits after the install rebuilt the helper byte-identical (job 1790658431: sha256 a5b62a6b 155033 B, the installed bytes); the pre-change daemon source is BANKED by hash, reconstructed by exactly reversing the three inserted blocks and verified sha256 261d59c8 119815 B (knowledge/bank/nx_connect_appd.nx-261d59c8-pre-cn7-20260928). 2026-09-29 land CN7 ON THE BOARD, and the rest of the alpha re-proven on the new bytes: nx_connect_alpha_device_gate 42/42 GREEN over the edge (job 1790658670) and nx_connect_alpha_rate_gate 21/21 GREEN on a scratch staged instance of 5a5784a1 (job 1790658673; the scratch directory holds no helper, so its lane announced OFF by name and the device budgets were untouched). connect.matrix gains the watch row Sealed messages live on a served instance (CN7, ALPHA) on runtime/_hdl_build/nx_connect_sealed_api.nx cs_sealed_aead (31759 to 32593 B under size CAS, job 1790658871); its rival codes are copied from the grounded sealing row and the note says ALPHA only. nx_compare_regen_scoped --domain connect (job 1790658909) published /compare/connect index.html 1602484 B (prev 1560060) and api.json 132497 B, the CN7 dossier linking cell-cs_sealed_aead PRESENT, verdict GREEN with fork freshness reconciled; nx_page_verify https://nishifamily.com/compare/connect/ GREEN (job 1790658955, a11y-issues 0). knowledge/organ_gate.conf now declares nx_connect_sealed_api and nx_connect_sealed to nx_connect_alpha_sealed_gate, so the dossier's NO-GATE-DECLARED clears on the next publish. LIFECYCLE: the two scratch sources are ARCHIVED reversibly by nx_retire_path (knowledge/retired/buildroot_runtime__hdl_build_nx_connect_appd_cn7w16.nx-1790658805, the compile-checked copy byte-identical to the landed daemon source; knowledge/retired/buildroot_runtime__hdl_build_nx_connect_sealed_cc.nx-1790658807, a never-run compile check); mining receipt: neither carried an MCP verb, API route, plan step, RACI row, clock row or ritual. Two build fossils stay because the retire organ refuses .elf by rule: buildroot/_build/nx_connect_appd_cn7w16.sov.elf and buildroot/_build/nx_connect_sealed_cc.sov.elf, neither registered nor on any execution surface. ALPHA RELEASE RECIPE, one file more from now on: alpha_connect/nx_connect_sealed.elf (built from runtime/_hdl_build/nx_connect_sealed.nx, mode 0755) beside the daemon; the daemon's startup probe announces SEALED lane ON or OFF by name, and knowledge/connect_sealed.conf is the store conf it reads. 2026-09-29 land IN-PROCESS GATE for the lane lib (wave 16 SOTA-SEALED-MESSAGING): nx_connect_sealed_api_gate (buildroot/runtime/_hdl_build/nx_connect_sealed_api_gate.nx, 21677 B) 29/29 GREEN (job 1790659406) over lib sha256 51576d7c (25054 B): K1-K4 key custody (loaded, created owner-only, never rewritten when present), S1-S6 send and the channel verdict, I1-I3 inbox budget, A1-A3 AT-REST TAMPER (one ctx byte flipped in the stored record) withheld from the inbox and its report refused server_tag_mismatch, R1-R5 report, V1-V4 values emitted. The first run read 28/29 RED: tooth A3 flipped a TF byte, so the commitment check fired first and the reply read opening_mismatch -- the plant now flips a ctx byte so only the relay stamp can see it; and a gate that chdirs into its fixture must chdir home before the verdict or the gate journal append fails (fixed). BITE: nx_gate_bite aim cnsl_inbox site 42 KILLED, restore verified byte-identical 25054 B (job 1790659493). SHIPPED by nx_organ_ship 9b6e3c09 prove=GREEN, registered (job 1790659518). knowledge/organ_gate.conf declares nx_connect_sealed_api -> nx_connect_sealed_api_gate (the lib's own proof) and nx_connect_sealed -> nx_connect_alpha_sealed_gate (the helper's edge proof), one row per name (edit job 1790659572 OK bytes=50765). 2026-09-29 measure DECLARED, NOT PROMOTED, ON PURPOSE (wave 16): buildroot/_build/nx_connect_appd.sov.elf now holds the CN7 alpha build 5a5784a1 (1,338,512 B) while production serves 1,324,376 B, so nx_catalog reads BUILT != PROMOTED for nx_connect_appd; the sealed lane is stage-gated (inert on a production instance) and production belongs to CONNECT-SHIP-2 -- do NOT promote from this row. The helper nx_connect_sealed (a5b62a6b, 155,033 B) reads BUILT-UNPROMOTED because it is an alpha-local artifact installed at alpha_connect/nx_connect_sealed.elf, a root the catalogue cannot see. LIVE WITNESS at 1790660000: nx_proc_observe nx_connect_appd-5a5784a1.elf pid 3843 digest_match=1, enumeration_complete=1. Two scratch fossils of this leg remain, sources already retired: buildroot/_build/nx_connect_appd_cn7w16.sov.elf (1,226,368 B) and buildroot/_build/nx_connect_sealed_cc.sov.elf (146,058 B); nx_retire_path REFUSES any .elf by name (code=4 token=.elf), so their disposition belongs to the build-artifact owner. The import census (knowledge/status/importers.tsv, 789,891 B) carries no nx_connect_sealed_api.nx row yet, which is why the ranker reads LIB-UNCENSUSED until its daily nx_eco_graph_build then nx_importcensus pass. 2026-09-29 land ACCEPTANCE WATCH ROW on connect.matrix, right below the CN7 mechanical row: 'Sealed messages ACCEPTED as complete (CN7: operator, referee, seat)', organ runtime/nx_accept_decl.nx, symbol _ABSENT_:ga_accept_connect_sealed (CAS edit on h9a29455e1b151e87, 32593 -> 33374 B). It flips only through nx_accept emit on an operator ACCEPT row whose targets carry ga_accept_connect_sealed plus a referee row and a seat attestation. Republished by nx_compare_regen_scoped (job 1790660235: published=2 fails=0 verdict=GREEN, index.html 1,612,134 B prev 1,602,484, api.json 133,293 B, fork FRESH a892f53b); nx_page_verify GREEN status 200, a11y-issues 0 (job 1790660275). 2026-09-29 lesson THE NEW ACCEPTANCE CELL RENDERS DARK ('EXISTS but does not declare ga_accept_connect_sealed: something shipped at this path under another name') -- and so does every acceptance row measured (charsim ga_accept_face over the same organ; dcc ga_accept_boneheat and ga_accept_curveskel, whose organ runtime/nx_accept_gate.nx can never carry a subject declaration at all). A DARK predicate that cannot tell the GENERATED acceptance-declarations file (empty of every unaccepted subject by design) from a hand-written organ convicts every awaiting subject of having shipped under another name. Filed debt 1790660361 (sev 5) for the compare-emitter RACI lane: an AWAITING-ACCEPTANCE state for that one organ, a neg-control that any other organ lacking its symbol still reads DARK, and a repoint of the nx_accept_gate.nx rows. The cell is left in place because the doctrine requires it and its note tells the truth. 2026-09-29 land ROSTERED AND SELF-CLEANING: nx_connect_sealed_api_gate is on knowledge/gateroster.conf, hand-added with its reason (its edge twin nx_connect_alpha_sealed_gate is deliberately NOT rostered: every run registers three alpha accounts with no reap). Before the beat could run it, the gate learned to remove its own scratch: csag_rm walks each run directory (files, the knowledge/ conf directory, then the directory itself; it walks again after any walk that removed something and COUNTS what it could not remove) and tooth C1 asserts nothing is left. Three CAS edits on a predicted size ladder (21677 -> 22223 -> 24542 -> 24866 B: consts first, the function second, the use last), SHIPPED by nx_organ_ship 6b667a2d prove=GREEN 30/30, ADOPT APPROVED content GREEN (job 1790660911), and the PROVE run's directories are gone. BITE: aim csag_rm site 28 (depth > 0, so the conf directory is never walked) KILLED, restore byte-identical 24866 B, both twins RESTORED, mutant_live=0 (job 1790661056). LEFT BEHIND, named: 7 directory pairs under /tmp/nx_connect_sealed_api_gate/ written by the pre-C1 binary (this leg's dev runs and ship proves, the old live binary's adopt probe) and the killed mutant; no delete verb this seat may call reaches a /tmp tree, and the promoted gate removes only its own run. NOTE for the syscall owner: this is the eighth hand-rolled unlinkat AT_REMOVEDIR in buildroot/runtime (nx_absent REMOVEDIR: 15 matches, coverage_complete=1); nx_syscalls has sys_unlinkat but no directory twin. 2026-09-29 queue OPEN on CN7 at return (wave 16 SOTA-SEALED-MESSAGING, T0 1790654755). The mechanical cell reads done on its symbol; the done-rule is NOT fully met and the rung awaits acceptance (ga_accept_connect_sealed row added). (1) THE UNAUTHENTICATED STREAM IS NOT RETIRED: /connect/secure's in-browser client (runtime/nx_connect_e2e_client.nx) still seals with ChaCha20 plus a SHA3-256 tag and does not call this lane. Retirement needs a wasm build of the cseal envelope (ChaCha20-Poly1305 via nx_connect_seal) and the franking commitment, the per-sender key as nx_connect_franking derives it from the device X25519 agreement, POST <mount>/secure/v1/send, inbox open with the recipient check, and the report verb -- and debt 1790457092 (two DEVICES of one sender reuse a ChaCha20-Poly1305 nonce) turns live the moment that client runs on two devices, so per-device keys land first. (2) A VERIFIED REPORT FILES NOTHING DURABLE: no queue row, no CSAE sink attempt -- debt 1790660252 (sev 6), incumbent semantics nx_connect_groupmod cgm_report_message and cgm_file. (3) production /connect is not on the lane (CONNECT-SHIP-2's lane; nothing promoted from this leg). (4) acceptance: operator ACCEPT row, referee row and seat attestation owed; the acceptance cell renders DARK by a generator rule (debt 1790660361). (5) FINISH reads LIB-UNCENSUSED until the daily nx_eco_graph_build then nx_importcensus pass. (6) the appd crash guard stays absent (debt 1790657243, the 256-module import cap). (7) each edge-gate run leaves three alpha accounts (alphasealsnd, alphasealrcv, alphasealmin plus epoch) with no reap. (8) two scratch _build fossils await the build-artifact owner (nx_retire_path refuses .elf).

CN8 Post-quantum hybrid key agreement · cell LANDED · gate UNRECORDED

Contract	`kx_pq_hybrid` · executor Organ · 1.5 u · stands on CN7
Definition of done	Compose the estate's nx_pq_hybrid organ into the browser key agreement so the conversation key is an X25519-plus-PQ hybrid; done-rule: a keyx-vm-class gate proves the hybrid on the shipped wasm -- the watch flips by the gate, never by the symbol name
Matrix cell	Post-quantum hybrid key agreement · `runtime/nx_connect_pq.nx` · LANDED decl
Gate	`nx_connect_pqkx_vm_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-28 queue W16 SOTA-PQ-HYBRID REQUEST to the seat holding the daemon-source edit lease (SOTA-SEALED-MESSAGING per row 1790614470; nx_connect_serve.nx and nx_connect_appd.nx were NOT edited by this seat): make the hybrid LIVE by shipping the additive kx=2 fields exactly as buildroot/runtime/nx_connect_pq.nx (sha256 62b0faad) defines them -- import it and compose its validators, never a second format. (1) POST /connect/pubkey, the cs_route pubkey branch beside cs_sh_pub_put2: read optional kx and q with cs_form_get; when q is present refuse unless kxp_q_ok(kx, q, qn) == 1; store q (kxp_ek_hex() = 2368 hex, one ML-KEM-768 encapsulation key) in the directory row beside the X25519 pub under the SAME owner rule as cs_sh_pub_put2 (a verified handle's q changes only by its owner, never an unowned rebind) and append it as an additive field of the shared.cbl pubkey row so a legacy row replays X25519-only; the plane arena grows by kxp_ek_hex() + 1 bytes per directory row. (2) GET /connect/pubkeys: a row carrying q gains kx 2 and q hex (additive JSON fields). (3) POST /connect/seal: read optional kx, kc (kxp_kc_ok, 2176 hex) and tg (kxp_tg_ok, 32 hex); refuse a partial envelope (kc without tg or the reverse); store both with the message and in the cbl msg row as additive fields; CS_CTHEX does not move. (4) GET /connect/sealed: a message carrying kc gains kc and tg. (5) defense in depth: refuse a seal without kc when BOTH from and to carry q (kxp_accept(1,1,0,0) = KXP_REFUSE_DOWNGRADE), since the page already refuses it. Bodies grow by about 2.4 KB (publish) and 2.2 KB (seal); the appd request buffer is 262144 B so no cap moves. Proof owed with the change: an alpha gate tooth that publishes a q, reads it back from /pubkeys, seals with kc and tg, reads both back from /sealed and refuses the four malformed cases; then the alpha /connect UI links /synth/connect_e2e_pq on stage instances. Until then the page is X25519-only BY RULE (no peer can advertise a field the directory does not carry) and says so on screen. 2026-09-28 measure W16 SOTA-PQ-HYBRID FOUND on the LIVE X25519-only E2E page: nx_page_verify https://nishifamily.com/synth/connect_e2e (job 1790616410) serves 38117 B for a 37122 B file -- the edge router appends its ad slot AND an inline view-beacon script (navigator.sendBeacon to /ad/view) to any page lacking the literal nx-ad-optout (nx_host_router hr_has_optout). On a page that keeps X25519 private keys in localStorage that is a script the page did not write running beside the keys, and a view beacon on the messaging surface, against the no-tracking-by-construction directive. Measured the same on the hybrid page before its fix (file 82452 B, served 83447 B with the slot); the hybrid page now carries the comment literal and is served byte-identical (82471 = 82471, job 1790616049), gate tooth T9d pins it. NOT fixed on production by this seat (another lane's surface, rollback discipline): the remedy is the same literal after the head tag in ce_emit_html plus a publish-guarded republish of /synth/connect_e2e with the old page banked; nx_connect_device_client emits the same head and carries the same exposure. 2026-09-28 queue W16 SOTA-PQ-HYBRID REQUEST for wave 17 FRONTDOOR-FINISH (owner of nx_connect_api_lib and nx_connect_api per row 1790614470; neither edited here): two PURE front-door verbs over nx_connect_pq so agents, tests and other doors reuse the rule instead of re-deriving it -- nothing stored, no key material in or out. kx_policy <self_adv> <peer_adv> <pinned> <has_kc> answers kxp_accept (hybrid, x25519-only or refused-downgrade) and kx_policy send <peer_adv> <pinned> answers kxp_send_mode; kx_fields <kx> <q> <kc> <tg> answers kxp_q_ok, kxp_kc_ok and kxp_tg_ok for a directory row or envelope an agent is about to submit. Engine nx_connect_pq, rung CN8. Api gate teeth to carry: both-advertise without kc refused, a pinned peer refused after the directory strips q, a legacy peer x25519-only (positive control), kx 1 refused, a short q refused, a non-hex tag refused. The crypto itself stays in the browser's wasm: a server verb must never touch a private key or a shared secret. 2026-09-28 land W16 SOTA-PQ-HYBRID RESUMED (T0 1790618739; the predecessor was killed by the 12:40 outage after shipping the gate and before journaling a land row). CN8 is LANDED ON THE PAGE and proven on the shipped wasm, and is NOT live for members until the directory half ships. WHAT: runtime/nx_connect_pq.nx (22167 B sha256 62b0faad) holds kx_pq_hybrid (okm = SHAKE256 over LABEL, ss_mlkem, ss_x25519, ct_mlkem, sender and recipient identity keys, 64 bytes: the ChaCha20 key then the tag key), the SHA3-256 message tag kxp_mac, the downgrade rule kxp_accept and kxp_send_mode, the additive kx=2 wire validators kxp_q_ok kxp_kc_ok kxp_tg_ok and the memory layout the page JavaScript is emitted from; nx_connect_e2e_client pq writes /synth/connect_e2e_pq (82471 B sha256 028082ba, banked knowledge/bank/connect_e2e_pq.html-028082ba-v2-cn8-20260928, the ML-KEM-768 module banked nx_ml_kem_768.wasm-0abd65a8-cn8-20260928), the X25519-only page untouched. PROOF on the promoted referee nx_connect_pqkx_vm_gate 2441a3c8 (241968 B, shipped by nx_organ_ship at 1790616675, _offc twin identical): GREEN 53/53 on the shipped page (nx_job_run pid 3478, /tmp/cn8_w16r_green.out, vm_elapsed_ms 173872): FIPS 203 NIST ACVP ML-KEM-768 keygen tcId 26 plus the first encapsulation case, its decapsulation and the modified-ciphertext implicit-rejection case byte-exact on the shipped module from the sha256-pinned mirror a556952c, RFC 7748 section 6.1 on the shipped X25519, both ends derive the same okm equal to the native kx_pq_hybrid, a tampered ML-KEM ciphertext and a wrong X25519 half each make the tag refuse, either half alone derives a different key, and X25519-only is refused once both peers advertise or the peer is pinned. RED 26/53 on the X25519-only page (nx_job_run pid 3984, /tmp/cn8_w16r_red_oldpage.out): exactly the 27 KEM, hybrid, tamper and page-wiring teeth fail while the pure rule teeth T8 and the classical-module teeth pass, which is the discrimination. BITE: nx_gate_bite nx_connect_pqkx_vm_gate nx_connect_pq.nx 2 aim kxp_accept 5 (job 1790620413): the has_kc == 1 site mutant compiled and the gate went RED, valid_mutants=1 killed=1, restore byte-identical 22167 B, both twins RESTORED and re-hashed 2441a3c8. WIRED THIS LEG: knowledge/organ_gate.conf rows nx_connect_pq and nx_connect_e2e_client to nx_connect_pqkx_vm_gate (the close ruler had resolved nx_connect_gate by one-segment strip); heavy-roster admission by nx_gate_roster_run trial then admit (GREEN 53/53 in 171261 ms at nice 10, 38 percent of the 450000 ms heavy share, admitted_new=1, partition reconciles); knowledge/bite_deadline.conf row 450000 for this gate; a knowledge/compare/connect.gates evidence row; treat row CN8 (nx_treatment COMPLETE, board TREATED 10 of 10). HONEST SCOPE: static identity keys, so no ratchet and no forward secrecy (Signal SPQR and iMessage PQ3 are ratchets), no safety numbers, and every conversation is X25519-only BY RULE until the directory carries kx=2 (queue row 1790616560). Shipped, referee GREEN, awaiting operator acceptance. 2026-09-28 measure W16 SOTA-PQ-HYBRID, WHAT THE CLOSE RULER READS AND WHY ONE LINK IS FALSE. nx_rungclose check connect CN8 now reads stage LIVE: journal, built (kx_pq_hybrid declared in runtime/nx_connect_pq.nx), live (treat row, mcp present), wired (treat COMPLETE) and page HOLD; tested FAILS no-green-since-land with the gate resolved by the organ_gate.conf declaration and rostered in knowledge/gateroster_heavy.conf. Its operated link reads HOLDS run=1790619791 read_from=clock-ran-the-agent-by-its-job-name, and that witness is NOT a run: knowledge/status/actlog.jrnl line 1979538 is a CLOCK-DISPATCH-V2 row for job=gaterosterheavy with exit=0 but pid=0 execution=NONE state=WAITING_AUTHORITY late=431131, which rgc_ax_index credits because it never reads execution= (debt 1790620981, sev 6, close-ruler owner). So CN8 operated is UNVERIFIED, and tested cannot hold until a roster beat runs: every clock row read (the three roster beats and all 51 complete rows of the nx_clockjob live prefix) is WAITING_AUTHORITY with executable_binding=UNBOUND and execution_proven=0, and knowledge/status/gateroster.jrnl and gateroster.stamp end at ts=1790178517 -- no gate roster pass for 5.1 days (debt 1790620957, sev 8, clock-plane owner; recipe nx_clockjob bind). THE TREAT ROW, CAVEATED: wf=connect-pqkx names knowledge/store/plan-connect-pqkx- (row 1 nx_filehash of the shipped page, row 2 nx_job_run of the referee into /tmp/planrun_connect_pqkx.out), which nx_plan_run REFUSES before step 1 with managed-owned-definition-required (job 1790620103), the same manifest-only state as every connect workflow (row 1790614121, debt 1790614098) -- the binding is the PM or publisher lane through nx_pm_owned_define (recipe row 1790460735); agent=gaterosterheavy is the beat the gate is admitted under and runs nothing while its clock row waits for authority; api=/api/organ_run with deadline_ms=300000 because /api/gate_run's FAST path cannot hold a 174 s gate. 2026-09-28 land W16 SOTA-PQ-HYBRID CLOSED THE TRACKING EXPOSURE ON THE LIVE X25519-ONLY E2E PAGE and pinned it with a tooth (the predecessor measured it in row 1790616580 and left it). BEFORE: nx_page_verify https://nishifamily.com/synth/connect_e2e (job 1790621093) served 38117 B for a 37122 B file with the router's injected ad slot (asset adnet_ha_video.png 728x90) and its inline view-beacon script beside the page's localStorage private keys. FIX, rollback-banked first: the page banked knowledge/bank/connect_e2e.html-cf51038e-pre-optout-cn8-20260928 (nx_filecopy verified=1, 37122 B sha256 cf51038e); ce_emit_html in runtime/nx_connect_e2e_client.nx emits the 19-byte opt-out literal after the head tag exactly as the hybrid emitter already does (source 27114 to 27133 B, sha256 61b5440698db6b2f; compile proof nx_sov_build_run --build-only job 1790621224, 54186 B sha256 9200feeb, not promoted, the emitter is run by hand); the served page carries the same literal at the same place (37141 B sha256 b57bcf64; not re-emitted, because the X25519-only mode needs the two raw wasm files the page embeds base64). AFTER: nx_page_verify (job 1790621289) serves 37141 B == the file, img=0, a11y-issues=0, VERDICT GREEN. PINNED: nx_connect_pqkx_vm_gate gains T10d (the X25519-only page carries the opt-out too): GREEN 54/54 on the current pages (qualify job 1790621415, vm_elapsed 167976 ms) and RED 53/54 with exactly T10d failing against the banked pre-opt-out page (job 1790621641), T10a and T10b still passing because the modules did not move. SHIPPED by nx_organ_ship (job 1790621863): prove 54/54, content GREEN, behave DIFFERS (expected, the new tooth line), promoted 130fe90a (242160 B, debug flavour as the incumbent), _offc twin identical; prior 2441a3c8 banked knowledge/bank/nx_connect_pqkx_vm_gate.elf-2441a3c8-pre-t10d-20260928 and its source knowledge/bank/nx_connect_pqkx_vm_gate.nx-a785fc02-pre-t10d-20260928 (both verified=1); gate source now 41100 B sha256 4883e9aa; connect.gates label 54/54. ROLLBACK: nx_filecopy the two banks back over the page and the gate. 2026-09-28 land W16 SOTA-PQ-HYBRID SHIPPED T11, THE PAGE'S OWN DOWNGRADE RULE EXECUTED, NOT GREPPED. nx_connect_pqkx_vm_gate now imports nx_js_eval and runs kxAccept and kxSendMode, cut by brace count from the shipped connect_e2e_pq page, in the estate JavaScript evaluator over all 16 accept inputs and all 4 send-mode inputs, comparing every answer with the native kxp_accept and kxp_send_mode rule (T11b to T11e); a copy with its refusal flipped (return -1 made return 1) must disagree on exactly the 3 refusing inputs (neg-control-T11g), so an evaluator that answered everything identically cannot pass. Qualify job 1790622990 GREEN 61/61; the X25519-only page reads RED 29/61 (job 1790623193). Shipped by nx_organ_ship job 1790623243: promoted sha 791f8335, 1664264 B, _offc twin identical; banks knowledge/bank/nx_connect_pqkx_vm_gate.elf-130fe90a-pre-t11-20260928 and .nx-4883e9aa-pre-t11-20260928. T10d pins the router ad-slot opt-out on the X25519-only page as well. The wave 17 connect front door answers kx_policy (organ_run jobs 1790623321 and 1790623323), so the treat row now names mcp=nx_connect with api=/api/organ_run?target=nx_connect&args=kx_policy; the matrix note and the connect.gates label read 61/61. Shipped, referee GREEN, awaiting operator acceptance. 2026-09-28 measure W16 SOTA-PQ-HYBRID REFRESHED THE IMPORT CENSUS THE CLOCK COULD NOT. CN8 read FINISH state=LIB-UNCENSUSED because knowledge/status/importers.tsv predated every importer of nx_connect_pq, and the census refresh rides the clock plane, which has executed nothing since about 2026-09-23 (debt 1790620957). nx_eco_graph_build (job 1790624758, heavy-I/O slot 2 of 4, ADMIT) rebuilt knowledge/store/ecograph_full over buildroot/runtime: nodes=22684 edges=65104 files_scanned=22709 complete=1; nx_importcensus then rewrote importers.tsv: rows=22684 = has_nonval 4623 + val_only 2772 + orphan 15289 (sums), edges=65104, asof=1790624646. nx_connect_pq.nx now reads 5 importers, 3 of them non-validation, first nx_connect_e2e_client.nx. nx_compare_rank connect (job 1790624896): finish (done but partially adopted) 7 to 2. CN8, CN3, CN16, CN18 and CN19 left the list; rows read for CN18 (nx_connect_personhood, imported by nx_connect_frontdoor2) and CN19 (nx_connect_play, imported by nx_connect_frontdoor3), CN3 and CN16 not read individually. CN1 moved from LIB-UNCENSUSED to LIB-GATE-ONLY and CN5 stays LIB-GATE-ONLY, both named for their owners. Scoped regen job 1790624940 published the page at 1360837 B with no live LIB-UNCENSUSED state left (the 14 remaining mentions are journal prose). Every board that reads importers.tsv picks the refresh up on its next publish; the census stays stale again from here until the clock plane is bound. 2026-09-28 land W16 SOTA-PQ-HYBRID third run (T0 1790630683; the second run was cut off after building T12 and before journaling it) SHIPPED T12, THE PAGE'S OWN TAG COMPARISON EXECUTED. The predecessor had written T12a to T12g into runtime/nx_connect_pqkx_vm_gate.nx and built it (banks knowledge/bank/nx_connect_pqkx_vm_gate.nx-cbdcf725-pre-t12-20260928 and .elf-791f8335-pre-t12-20260928, the elf bank verified identical to the served 791f8335 by nx_filehash cmp); this run corrected the header (it credited T12 with the helper-block check, which is T9a, and never described kxSame) and proved it. kxSame, cut from the shipped connect_e2e_pq page by brace count, runs in nx_js_eval over one designed case set counted natively first (equal; first, second and last byte differing; one byte short; either side absent; two bytes transposed so their XORs cancel) and agrees with native byte equality on all 8, while two mutants of the page's own function disagree exactly where each is wrong (d===0 widened to d>=0 on the 4 same-length differing pairs, d

CN9 Real NMT through the LLM serve · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`ct_llm_translate` · executor Organ · 2 u · stands on nothing
Definition of done	/connect/chat translation routes through the live LLM serve daemon with the lexicon as offline fallback; done-rule: a banked bilingual fixture set graded by an estate judge beats the lexicon on every pair, and the quality claim carries the judge output
Matrix cell	NO-MATRIX-ROW — no matrix row carries `ct_llm_translate`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

CN10 Live voice translation in calls · cell WATCHING · gate NO-GATE-DECLARED

Contract	`lt_call_caption` · executor Organ · 2 u · stands on CN9, CN1
Definition of done	Captions in the listener's language rendered inside the call at conversational latency, composing CN9 and CN1; done-rule: a banked bilingual call fixture round-trips with judge-graded caption quality
Matrix cell	Live voice translation inside calls · `runtime/nx_connect_live_translate.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_live_translate`; declare `nx_connect_live_translate TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

CN11 AI conversation-practice partner · cell WATCHING · gate NO-GATE-DECLARED

Contract	`cp_practice_turn` · executor Organ · 1.5 u · stands on CN9
Definition of done	A consent-gated practice mode on the LLM serve whose corrections bind into the chat's correction loop; done-rule: practice turns graded by the judge panel against a banked rubric -- never by engagement time
Matrix cell	AI conversation-practice partner · `runtime/nx_connect_ai_partner.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_ai_partner`; declare `nx_connect_ai_partner TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

CN12 Federation probe · cell WATCHING · gate NO-GATE-DECLARED

Contract	`fed_route` · executor Organ · 2 u · stands on CN7
Definition of done	A second Nishi CONNECT instance exchanges sealed messages with the first over the sovereign transport (self-federation first, standard bridges later); done-rule: cross-instance delivery proven with content-blind servers on both ends
Matrix cell	Federation and third-party E2E interop · `runtime/nx_connect_federation.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_federation`; declare `nx_connect_federation TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

CN13 Private, secure sign-up · cell LANDED · gate NO-GATE-DECLARED

Contract	`csu_signup_admit` · executor Organ · 2 u · stands on nothing
Definition of done	A person signs up from the first byte with full privacy and security: a handle and a passphrase through OPAQUE so the server stores an envelope and never a password equivalent; no phone number, email or legal name required; an age band attested without storing any identity document; consent recorded per purpose (discovery, faith, each circle) and OFF until the member turns it on; the end-to-end key pair generated on the device; single-use recovery codes; automated or replayed sign-up refused without tracking the person; one account across the Nishi platforms through the family realm; done-rule: the gate proves a completed sign-up stores exactly the declared minimal fields and no password equivalent, discovery is off by default, a minor account opens only peer and guardian lanes under the two-deep wall, an automated or replayed sign-up is refused, and a recovery code works exactly once -- STATUS 2026-09-25 (SYNC, verifier PARTIAL): lib runtime/_hdl_build/nx_connect_signup.nx 27825 B sha 9e151f9b declares csu_signup_admit over OPAQUE RFC 9807 [rfc9807], with Privacy Pass named as the anti-automation successor [rfc9576]; nx_connect_signup_gate 66/66 GREEN re-run by the verifier and bite-killed 1 of 1, promoted 18159ce0, rostered; policy knowledge/connect_signup.conf carries UNMEASURED calibration rows. Done-rule OPEN on the served surface: only csu_handle_taken is wired and only on /alpha/connect; production still lets a taken handle be re-registered (debt 1790359363 sev 8) and 9 other organs call olg_register without the uniqueness check (live reach UNVERIFIED); the age band is caller-attested; minors get no GROUP lane; passkeys and the device-side OPAQUE client are owed
Matrix cell	Private, secure sign-up (OPAQUE, no phone or email, consent off by default) · `runtime/_hdl_build/nx_connect_signup.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_signup`; declare `nx_connect_signup TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue ORCHESTRATOR FACT for CN13 CN5 and ALPHA seats: the family-wide identity is the NISHI LOGIN product (operator 2026-07-14: one OPAQUE account across every nishi property, the LDS site named) -- nx_opaque_login.nx (olg_login, olg_whoami, olg_refresh), engine nx_modern_auth_flow.nx, nx_no_cookie_session.nx 152-byte Ed25519 session token, keys opaque_keys.bin and store opaque_store.log at the nishihost CWD, login daemon port 9091 behind the edge routes /login /whoami /register /access, session check anywhere via nx_sa_validate (nx_site_auth.nx), user-held caps via nx_cap_token.nx (capt_issue, capt_verify, capt_attenuate, capt_revoke); compose these for sign-up and realm unification, never a second auth stack (source: seat record of 2026-07-14, re-verify on disk before relying on it) 2026-09-25 land BOARD seat: rungs CN13 csu_signup_admit, CN14 ccl_circle_reach, CN15 cfa_tradition_admit, CN16 csc_circle_post, CN17 csh_need_match, CN18 cvh_person_attest declared verbatim from the leg brief; milestones renumbered M1..M5 with ver 0.1 M1 (sign up privately and meet your circles = CN13 CN14 CN15 CN5 CN6 CN3, cumulative 10 u), ver 0.5 M2 new (circles that study, serve and verify = CN18 CN16 CN17, 15 u), ver 1.0 M3 (old M2 sealed, called, in a pocket, 23.5 u), 2.0 M4 (old M3, 31 u), 3.0 M5 (old M4, 35 u); nx_fs_write edit OK plan 12473 to 17213 B under CAS h327a7dc14006f3db; OPEN: ladder rows (sotabar, barscan, sotatargets, rungrole for all 22 rungs), matrix watch rows, refs rows, pos re-grade 2026-09-25 queue INTAKE 1790355001 routed by nx_intake_route (operator-seat, epoch 1790356399) from pm-seat: R1 of parent REQ 1790355000 (operator goal 2026-09-25): private and secure sign-up from the first byte on Nishi platforms -- no password equivalent held by the server (OPAQUE), no phone number or emai -- sponsor intake-1790355001 plus2 2026-09-25 queue INTAKE 1790355004 routed by nx_intake_route (operator-seat, epoch 1790356425) from pm-seat: R4 of parent REQ 1790355000: youth peers can talk and be friends safely -- operator words: an lds boy can talk and be friends with an lds girl on the site -- by mutual acceptance only, with guardians -- sponsor intake-1790355004 plus2 2026-09-25 land BOARD seat: the dated ladder landed as ONE append (8011 B, plan 26227 to 34238 B) because four hash-CAS edits in a row were refused by concurrent log appends every 20 to 40 s -- sotabar SB-CONNECT-2609 (2026-09, ref dcapi-2609), 5 barscans read today (dcapi-2609 newest=2026-09, arxiv-ageassure 2026-09, arxiv-passkeys 2026-08 on subject after excluding 4 ML passkey-retrieval homonyms and 1 SSH paper, arxiv-datingapp 2026-06, tinder-press 2026-03), sotatargets T-BIC-CONNECT and T-FRONT-CONNECT, rungrole for all 22 rungs, 3 risk rows; MEASURED nx_ladder connect verdict=LADDERED targets=2 rungs=22 placed=22 substrate=6 arm=2 contender=14 sum=22; nx_barfresh connect verdict=FRESH bars=1 fresh=1 scans_this_month=5; refs +13 rows (connect.refs 29656 to 40719 B, every pin taken with nx_filehash), matrix +8 watch rows (19555 to 25657 B); OPEN: CN3 deps, pos and goal re-grade, refs gate, ranker read; UNREAD this leg: Facebook Groups and the W3C TR copy (403, the editor's draft mirrored instead) 2026-09-25 land BUILDER seat: csu_signup_admit LANDED in buildroot/runtime/_hdl_build/nx_connect_signup.nx (27825 B, sha256 9e151f9b47fd0a77) composing the incumbents, no second stack: olg_register (OPAQUE RFC 9807, the account log keyed by a realm-scoped user-id hash, BIP39 recovery as a second OPAQUE record rotated on use), yw_may_channel (the two-deep wall), lc_geti over the new knowledge/connect_signup.conf (fail closed on a missing row), sha256_digest (hashcash bound to challenge and handle). Gate buildroot/runtime/_hdl_build/nx_connect_signup_gate.nx (21546 B, sha256 dd03bd49ea416165) GREEN 65/65 on a REAL OPAQUE account log under /tmp/nx_connect_signup_gate (artifact 309968 B sha256 c9c70467afce7704, run-exit 0): exact S1 census of 4 declared fields, passphrase and SHA-256(passphrase) and mnemonic and handle text absent from the log, every consent purpose off though the request asked for all, minor opens peer+guardian only with the non-guardian adult DM refused, replay and burst and expired and unknown and insufficient-work refused, recovery works once. BITE: planted taken==2 in the duplicate-handle check, RED 55/65 (duplicate handle refused HANDLE_TAKEN FAIL actual=0 expected=10, log rows 6 not 4, holder sign-in -1410 = the takeover), restored, GREEN 65/65 with build-cache key 3628d7b5 identical to the first build. FINDING: the account log is latest-row-wins and olg_register SUPERSEDES, so the live register route (nx_opaque_login_routes olg_route, LAN plus invite gated) re-registers a taken handle as a credential takeover; the gate's neg-control shows the attacker signing in as the holder through the incumbent alone. Best-in-class read today: RFC 9807 mirrored knowledge/fetched/cmp_connect_rfc9807.txt (152656 B, sha256 424103278391d895). OPEN: the passphrase still reaches the server in-process (the RFC hides it even at registration only with the client-side wasm Blind and Finalize, V-MODAUTH-8); age-band attestation verify lives in nx_connect_idage (a program with main, extraction owed); policy rows UNMEASURED; page and route integration is the INTEGRATOR seat's. 2026-09-25 retract BUILDER seat CORRECTION of my land row 1790356840: I wrote that the live register route re-registers a taken handle as a credential takeover. That was NOT verified and is withdrawn as stated. MEASURED: olg_register supersedes a taken handle (the gate's neg-control on a fixture log, after which the attacker signs in as the holder); nx_lan_signup.ls_signup_allowed blocks re-registration only because a CLAIMED handle is no longer invited; hra_claim is called after register in runtime/_hdl_build/nx_lan_signup_routes.nx line 75 and appears 0 times in runtime/nx_opaque_login_routes.nx, whose olg_route register branch calls olg_register right after ls_signup_allowed. UNVERIFIED: which router serves the live register path; if it is olg_route an invited handle stays invited after its sign-up and a LAN peer holding the handle name can re-register it. The discriminating read is the login daemon's route wiring (port 9091). csu_signup_admit does not depend on the invite plane: it asks the account log itself. 2026-09-25 land BUILDER seat: nx_connect_signup_gate SHIPPED through nx_organ_ship: prove=GREEN 65/65 on a fresh build, promoted sha256 c262004f5bcd10fc (first promote, no live elf before), _offc twin installed from the promoted root binary, REGISTERED callable=1 schema=0, harness token hcecc78c54bd8f8c2. ADMITTED to knowledge/gateroster.conf by nx_gate_roster_run admit (admitted_new=1, partition reconciles) from trial journal knowledge/status/trial_cn13_signup.jrnl: GREEN exit=0 ms=7513 against the roster's own 60000 ms per-gate default. The matrix watch row _ABSENT_:csu_signup_admit names runtime/_hdl_build/nx_connect_signup.nx, the file that now carries the symbol, so the next regen can flip it (presence only; acceptance needs the referee and the operator). Production policy knowledge/connect_signup.conf written: pow_bits_base 16, window_s 3600, window_budget 300 (derived: the modauth context rate of 5 per minute x 60), challenge_ttl_s 600, calibration UNMEASURED and named on every row. 2026-09-25 measure BOARD seat: nx_compare_refs_gate run twice (fleet-wide, 37 of 44 RED, capture complete 25583 B in _jobs/job_1790357071.out) -- connect offenders found and fixed: 4 of today's refs cited a redirecting url (bumble-safety, hinge-press, youversion, church-gospellibrary) and were re-mirrored from their canonical url with 0 hops (3 byte-identical, bumble 79317 B re-pinned h8e591d0a), and the pre-existing gdpr-art9 read PIN-MISMATCH because cmp_connect_gdpr_art9.html was rewritten at epoch 1790356901 by another writer this leg -- re-pinned h24fde5a6 after reading the Article 9 text in it (religious or philosophical beliefs, 2 hits); connect.refs 40744 B; the other RED rows belong to other boards (UNCITED in authz, deepresearch, deploy, dataio, civicmap, extllm, gameengine, loadgov; PIN-MISMATCH in graphics; the new faithsocial.refs reuses cmp_connect_discord_teen, church_gh20 and rfc9807 mirrors as PROV UNPROVEN and cites redirecting hinge and bumble urls); LESSON: a seat must never re-fetch into another board's mirror filename, the pin on that board breaks silently 2026-09-25 queue BUILDER seat, what is OPEN on CN13 after the land: (1) INTEGRATOR wiring -- ctx from olg_ctx_setup_ttl over the family login's opaque_keys.bin and opaque_store.log at production argon2id cost (the one account across properties, CN5), st = csu_state_new(pol) once per process with pol from csu_policy_default per request, a challenge route calling csu_challenge_issue with a CSPRNG nonce, the wasm client running csu_pow_search and generating the X25519 key pair on the device, POST calling csu_signup_admit, S1 rows persisted from csu_record_emit, the 24-word secret shown once, consent changes through csu_consent_set and every channel open through csu_may_channel; (2) the passphrase still reaches the server in-process, and RFC 9807 hides it even at registration only with the client-side Blind and Finalize in wasm (V-MODAUTH-8); (3) the age band is trusted from the caller's attested flag until nx_connect_idage's verify is extracted into a lib and its keyed-mix stand-in becomes an issuer signature; (4) anti-automation is hashcash over SHA-256; the unlinkable-token frontier is the Privacy Pass architecture, RFC 9576 mirrored knowledge/fetched/cmp_connect_rfc9576.txt (70624 B, sha256 51f781afa07f3236), which needs an issuer the estate does not have; (5) the four policy rows are UNMEASURED until the client reports solve times; (6) passkeys (FIDO) as a second credential kind are not built; (7) the door state lives per process, so a restart clears live challenges (fail closed); (8) the olg_route claim question in my retract row 1790357160. Gate re-shipped with a production-policy tooth: GREEN 66/66 reading knowledge/connect_signup.conf (1356 B, sha256 94bc774d34ab3130) back as 16 3600 300 600. 2026-09-25 measure BUILDER seat, closing the question in my retract row 1790357160 by measurement: olg_route_ip has exactly 6 textual hits over buildroot/runtime (nx_shelltool grep, coverage_complete=1 corpus_complete=1): its definition, its own rule-19 wrapper olg_route which passes ip4=0 so every register through that door is DENIED by construction, and 4 calls inside nx_signup_origin_gate. No daemon registers through it, and the family signup router (nx_lan_signup_routes line 75) claims the invite after register. So there is NO live re-registration path found; the supersede hazard is real only for a caller of olg_register that skips an existence check, which is exactly what csu_signup_admit refuses. Also re-shipped the gate with a production-policy tooth: nx_organ_ship prove=GREEN 66/66, adoptgate APPROVED content=GREEN, promoted sha256 18159ce0504b3145, _offc twin installed, harness he7a74f9b262ce8cb. 2026-09-25 queue BUILDER seat, two more measured facts for the SYNC seat and the next CN13 pass: (1) /api/gate_run target=nx_connect_signup_gate on the promoted registered artifact answered 66/66 verdict=GREEN exit_code 0 from the serving root, production policy read back 16 3600 300 600; nx_compare_rank connect now lists CN13 as FINISH state=LIB-UNCENSUSED (the symbol is present, the library is younger than the eco-graph build) -- the recipe is nx_eco_graph_build then nx_importcensus then the scoped regen, the SYNC seat's call. (2) WEAKNESS NAMED: the challenge table is door state with capacity window_budget, so anyone can request that many challenges and hold issuance at BURST for one ttl -- a door-wide lockout that tracks no person but serves no person either. The standard fix is a STATELESS challenge (nonce, issue time and bits sealed under a server key with the incumbent HMAC-SHA-256) so issuance holds no memory and only spent nonces are remembered, bounded by admissions rather than requests; the gate's burst and replay teeth carry over unchanged. 2026-09-25 measure VERIFIER PARTIAL 66/66 GREEN: lib 27825 B sha 9e151f9b and gate 22014 B sha ad77f6ab match the claim, func csu_signup_admit declared at off 26175; /api/gate_run job 1790357847 exit_code 0 source_newer 0 passed 66/66 verdict=GREEN; nx_gate_bite via organ_run job 1790357916 valid_mutants=1 killed=1 void=0 not_reached=0 (cmp site off 9368), lib restored byte-identical and promoted twin still sha 18159ce0; 6 CN13 journal rows found. REFUTED AS UNDER-SCOPED: the claim that the olg_register takeover reaches no live route rested on olg_route_ip only; olg_register is called directly by at least 9 serving organs (nx_opaque_login_daemon behind olgd_signup_ok invite, nx_gallery_gateway behind argv allow_register PROD=0, nx_vault_gateway, nx_mesh_gateway, nx_gen_gateway, nx_docportal_admin_daemon, nx_email_portal_daemon, nx_lan_signup_routes, nx_studio_gate) and none asks nx_uas_lookup first, so live reach is UNVERIFIED not absent. GAPS vs goal: csu_handle_taken then olg_register is check-then-act with no lock, so two concurrent registrations of one handle across processes sharing opaque_store.log can still supersede (UNMEASURED); age band is caller-attested so the two-deep wall rests on a self-declared band; csu_lanes_open gives a minor no GROUP lane, so youth cannot join ward or stake circles even with two adults present; HANDLE_TAKEN is a distinguishable answer (enumeration at one proof of work per probe); passphrase reaches the server; not wired to any served page; no Church record input and no Church text found in the lib 2026-09-25 land BUILDER CN13-DEVICE seat: the passphrase no longer has to reach the server. V-MODAUTH-8 named no symbol (grep over buildroot/runtime corpus_complete=1: four comment mentions, the wasm client rung), so the entry points are the brief's: LIB buildroot/runtime/_hdl_build/nx_opaque_client.nx (9809 B, sha256 2f000d370b290e9d) ocl_state_new ocl_init ocl_register_blind ocl_register_finalize ocl_login_blind ocl_login_finalize ocl_session_key ocl_export_key -- the RFC 9807 client role only, every protocol step the incumbent hub/nx_opaque_pake client function (P256-SHA256, the suite the family login already speaks, NOT ristretto255), the lib owning only the device state between round trips with out-of-order refusal and secret wipe. Server halves LIB buildroot/runtime/_hdl_build/nx_opaque_wire_server.nx (9807 B) osw_public_cfg osw_register_respond osw_register_store osw_login_respond osw_login_finish osw_pending_new composing the flow's own _ma_mk_cfgs _ma_cred_id _ma_server_ake_keys nx_uas_append nx_uas_lookup and the M5 mint, no crypto change. Gate buildroot/runtime/_hdl_build/nx_opaque_client_gate.nx (20201 B) GREEN 39/39 on a real OPAQUE account log (artifact 295764 B sha256 f2f2de831978d3b2, run-exit 0): device register+login mint a 152-byte session; interop BOTH ways (device-registered record logs in via nx_modern_auth_login; server-side-registered account logs in from the device), both sessions validate to the SAME user id hash; server view 801 B holds neither passphrase nor its SHA-256 while neg-control-server-side-path-receives-the-passphrase fires; blinds 32/32 and requests 33/33 bytes differ across runs; wrong passphrase fails on the device (-4), forged KE3 refused -1410 and mints nothing, replayed KE3 refused -1403, finalize without its own blind refused -2. BITE: planted a fixed scalar-one blind (request = H(passphrase), protocol still works), RED 37/39 naming exactly the two variance teeth (blind_bytes_differing=0 request_bytes_differing=0), restored, GREEN 39/39 with build-cache key 9026a2a58e41152f identical to the first build. MEASURED, disclosed: record_maskkey_bytes_differing_same_passphrase=0 -- the record's masking key is a KEYED function of the passphrase (OPRF key + argon2id) as RFC 9807 prescribes, so offline guessing needs the server's oprf_seed and pays argon2id per guess; no unkeyed function reaches the server. Shared source hub/nx_modern_auth_flow.nx sha256 0e74e6c33e3a69f7 unchanged before and after. 2026-09-25 land BUILDER CN13-DEVICE: gate SHIPPED through nx_organ_ship -- fresh /api/build sha256 35d8fc1b9903c8b10ff6004c10d8c6a0492c206083b2ac3803747aa6c6ba05ce, PROVE 39/39 GREEN on the fresh build, first promote (live == staged), _offc twin installed, registered callable; admitted to knowledge/gateroster.conf in its own grammar (comment block + name row, total 82443 B). WASM LANE, step reached: nx_compile_wat on buildroot/runtime/_hdl_build/nx_opaque_client.nx parsed the whole closure and REFUSED in the backend -- cannot lower IR opcode 38 in function nx_bits_popcount64 (the emitter now refuses instead of silently computing zero) -- so the device client is proven native and in-process, NOT yet as a shipped wasm module; the page still posts the passphrase until that lowering lands and the INTEGRATOR wires the osw_* routes. 2026-09-25 land FINISH seat: the free-forever wall and the vertical census are on the base class. nx_connect_lds_free (5382 to 5550 B, banked knowledge/status/nx_connect_lds_free.nx.bank-20260925, T5 renamed neg-control-paywalled-feature) passed 5/5 GREEN 43396 B sha256 3243481b, values connection_features 7, paywalled 0, translation_price_cents 0, neg_table_flagged 1; lost 4 superseded literals, promoted with allow_capability_loss=yes. nx_connect_lds_census (9130 to 9327 B, banked likewise) now ends in two gv teeth, neg-control-liar-kill and invalid-rows-zero via gv_check_eq (actual 0 expected 0), passed 2/2 GREEN 49413 B sha256 041d689c, distribution ABSENT 0 PRESENT 15 PARITY 0 EXCEEDS 2 of 17; lost 2 runs (19 permil, the two verdict literals) and promoted WITHOUT the capability-loss flag, inside the calibrated guard. Roster re-trial read both GREEN (journal ..._20260925e.jrnl). Tally for the leg: 10 CONNECT organs built, all GREEN, all 10 promoted and rostered; 9 of 10 now inherit nx_gate_verdict (auth gate, youth, idage, reconnect, room_rx, social, lds_room, lds_free, lds_census); the tenth, nx_connect_msg, belongs to the CN6 owner mid-edit 2026-09-25 land BUILDER CN13-DEVICE: RFC 9807 Appendix C.1.5 (P256-SHA256, read from the mirror knowledge/fetched/cmp_connect_rfc9807_202609.txt) now drives the DEVICE entry points byte-exact -- added the deterministic cores ocl_register_blind_det and ocl_login_blind_det (the incumbent _det convention of hub/nx_opaque_pake; production keeps the CSPRNG entry points) and three teeth: registration_request 029e949a29cfa0bf 0 bytes differing, KE1 037342f0bcb3ecea 0 bytes differing, fixture-reached (25-byte password decoded, both det cores rc 0). Gate 42/42 GREEN (artifact 348392 B sha256 00cb4d5d6c302532). BITE 2: planted a one-byte offset in ocl_login_blind_det's KE1 copy-out, RED 41/42 naming only the KE1 tooth (actual=1 expected=0), restored, GREEN 42/42 on the identical cached artifact 00cb4d5d. Re-SHIPPED through nx_organ_ship: PROVE 42/42, ADOPT-GATE APPROVED content GREEN, promoted live_sha 00cb4d5d6c302532a8111cd9d987af5da037d41b8c9a9054824be6ecef261462, _offc twin, registered. Incumbent RFC KAT of the pake cores: buildroot/runtime/_hdl_build/nx_opaque_rfc_kat.nx. Final sources: nx_opaque_client.nx 11926 B sha256 b3a0a90fd2f184c8, nx_opaque_wire_server.nx 9807 B sha256 c6cdce91b238d126, nx_opaque_client_gate.nx 23109 B sha256 d43fef12893514a2; shared hub/nx_modern_auth_flow.nx 0e74e6c33e3a69f7 unchanged across every run. 2026-09-25 queue BUILDER CN13-DEVICE, what is OPEN: (1) WASM -- nx_compile_wat on nx_opaque_client.nx refuses at IR opcode 38 = OP_POPCNT64 (buildroot/runtime/nx_types.nx line 301, reached through nx_bits_popcount64 -> __popcnt64); buildroot/runtime/nx_wasm.nx carries no popcnt arm (0 occurrences), so the remedy is one arm lowering OP_POPCNT64 to the core wasm i64.popcnt instruction, owned by the wasm/lang lane with nx_wat_refuse_gate; blockers after it are UNMEASURED (CSPRNG import in the browser, argon2id memory at the production 64 MiB). (2) INTEGRATOR wiring -- a params route from osw_public_cfg, register start/finish routes over osw_register_respond and osw_register_store, login start/finish routes over osw_login_respond and osw_login_finish with the OswPending held per login id under an expiry (per-process, fail closed on restart). (3) a record-taking csu_signup_admit variant (CN13 signup owner) so the door's challenge, work, wall and handle-taken checks run before osw_register_store instead of olg_register. (4) the recovery secret is still generated server side -- the device should generate the BIP39 entropy and register handle plus rec with KSF identity, which needs a KSF-mode argument on osw_public_cfg. (5) an unknown handle answers USER_NOT_FOUND on the wire (RFC 9807 6.3.2.2 fake-record response not built) -- an enumeration oracle. (6) the zero-JS form stays a labeled fallback that still sends the passphrase until the wasm client ships. 2026-09-25 measure SYNC leg close 2026-09-25: status notes landed under CAS on the CN3 CN5 CN6 CN13 CN14 CN15 rung rows (verifier verdicts CN14 CN15 CONFIRMED, CN3 CN5 CN6 CN13 PARTIAL; no rung marked landed: every gate GREEN on the verifier re-run and bite-killed, none integrated into the production daemon, operator acceptance outstanding). connect.refs +5 pinned rows (rfc9576 nist80063c4 matrix-rooms-v11 arxiv-vouching gdpr-art7), each cited inline; a pew-rls-importance row was added then withdrawn because its fetch redirected (ratchet rose), and arxiv-vouching was re-pointed to the export query url the fetch journal holds. Instruments: nx_ladder connect LADDERED 22 of 22; nx_barfresh FRESH; nx_compare_rank connect done=12 open=10 finish=9 TARGET 1.0 (M3) critical path CN2 CN1 CN7 (CN16 CN17 CN18 count done by symbol presence only, unverified by any verifier this leg); nx_compare_refs_gate full capture 23656 B passed 38 of 44 RED fleet-wide with 0 connect lines; regen connect GREEN twice (index 490751 B), faithsocial GREEN (212405 B); page_verify GREEN on both. Intake sweep SWEPT routed=60 nomatch=0 (the 14 goal requests 1790355000..013 were already filed by PM). Open: production takeover debt 1790359363 sev 8, LIB-UNCENSUSED on 9 FINISH rows until nx_eco_graph_build then nx_importcensus, visual review UNMEASURED on both alphas 2026-09-25 measure W5 wave-7 seat, completion no referee disputes (34 REVIEW rows read at 230617 B: R5a classifies the faithsocial RUNG rows SPRAWL, not its rival columns, and this seat touched no rung): /compare/faithsocial gained the LDSSingles column, coded from the App Store listing and its operator Black Cap Holdings' safety, privacy and terms pages fetched, read and pinned today (journal row BOARD 1790373150 on faithsocial.plan). Against LDS Singles, CONNECT source presence (SOURCE_SYMBOL_DISCOVERY, not runtime; the live /connect app serves only the OPAQUE login, groups, reconnection and sealed messages among these) is ahead on 21 rows -- no stored identity at sign-up, OPAQUE login, age band, the two-deep wall that serves youth, circles, groups, mission reconnection, the ward boundary, faith at equal fidelity, intent lanes, fair exposure, content-blind abuse detection, sealed messages, one account, zero paywall (LDS Singles sells unlimited messaging at USD 49.99 a month), events, games, activities, language, service and sharing; level on 4 (verified person, matching, messaging, installed base by symbol only -- CONNECT has 0 real users against a rival claiming thousands); LDS Singles leads on native apps and trained moderation (both CONNECT watches); neither has a group moderation queue or a date check-in. LDS Singles signs members in through a third-party service (Clerk) with Google Tag Manager in the page head, keeps selfie templates at a verification vendor, and its operator may show a member's profile on its other dating services 2026-09-26 queue W12 SEAT ROLLOUT-CONNECT (T0 1790437669; operator approved rolling the register-takeover fix out to production /connect now, an alpha-stage product, rollback discipline starts at beta): waiting on the wave-10 R1 and ALPHA rows until T0+3600 (1790441269). NEW GATE nx_connect_prod_register_gate (buildroot/runtime/_hdl_build, 22582 B, on nx_gate_verdict, 24 teeth, 6 named neg-control): forks a daemon ELF with ONE argument, the port, which is the production code path (cookie nxc_auth on Path=/, no /api/v1 mount), with its CWD in a fresh /tmp scratch directory so keys and accounts are the run's own; drives home, register and login, registers a fresh handle, registers it AGAIN with another passphrase, signs in with both, asks /connect/api/v1/catalog, kills and reaps the child; it refuses to fork a subject whose bytes lack the port-argument refusal (the served 3e46d193 predates the argument and would bind 8032). KNOWN-BAD PLANT: RED 18/24 on the pre-fix alpha build bfb02bdc (job 1790438720), exactly the six takeover teeth failing -- the second register mints a session and shows a fresh recovery phrase, the holder passphrase stops signing in and the second passphrase signs in. The rollout build will be nx_connect_appd --build-only from the sources current when wave 10 reports (appd, serve, account store and auth flow hashed at build time), copied to knowledge/bank before any use so a concurrent alpha build of the shared _build path cannot swap it. 2026-09-26 measure W12 ROLLOUT-CONNECT to the ALPHA-REBUILD seat (sole editor of nx_connect_serve.nx) -- THE TREE SERVE IS BEHIND PRODUCTION ON ONE CAPABILITY: /sealed no longer emits the sender verified flag. Served 3e46d193 emits {f, p, vf 0 or 1, s, ct} per message (txtscan of the bank: the literal run {"f":".","p":".","vf":.,"s":.,"ct":"."}); buildroot/runtime/_hdl_build/nx_connect_serve.nx 125800 B emits f, p, s, ct only (shelltool grep for the quoted vf key over buildroot/runtime: 2 matches in 26628 files, coverage_complete=1 corpus_complete=1, both inside nx_connect_pubkey_bind_gate). MEASURED: nx_connect_pubkey_bind_gate built from the current tree reads RED 12/13, T13 /sealed carries the sender TRUE verified flag both ways FAIL (qualify job 1790439385); the COMPLETE content inventory 3e46d193 to alpha e8ef423a (nx_contentdiff_export, complete=1 runs=821 missing=11, knowledge/gates/w12_rollout_cdx_3e46d193_e8ef423a.txt) lists the vf key run as missing, so every alpha-lineage build lacks it. FIX (the /sealed emitter, after the p value and before the s key): emit the vf key with byte 32 of sh_own_at(sh, sp2) as 1 when verified, 0 otherwise or when sp2 is negative, restoring the served contract byte for byte; the other 10 missing runs are the mount-composed URLs and cookie strings, the reworded startup and bind messages and 3 code-byte fossils. The production rollout build waits for this fix until T0+3600 (1790441269); a build without it ships a NAMED capability loss. 2026-09-26 measure W12 ROLLOUT-CONNECT follow-up for the ALPHA-REBUILD seat on the /sealed vf regression (row 1790439480): it HAS a live consumer. sites/nishifamily/synth/connect_device.html line 30 (the signed-in device messenger, debt row 1785048275 BADGE-CANNOT-LIE) syncs from production /connect/sealed and stores v:m.vf as each auto-added contact verified badge, so a build without the key renders every verified sender as unverified to that page. Measured on the production candidate 2d9ca777 (built 1790439905 from appd ea54f039, serve 115cf4b3, store c4ec720e, flow 601069f0, api lib 26d83c5b; banked knowledge/bank/nx_connect_appd.elf-2d9ca777-prodcand-20260926): nx_connect_prod_register_gate 29/31, only K3 vf:1 and K4 vf:0 failing (job 1790439946); complete content inventory vs served 3e46d193 missing 11 of 821, 10 adjudicated expected by runtime teeth (code-byte fossils of the unreferenced soft popcount, controls bfb02bdc and the served nx_opaque_login.elf lack them too; mount-composed URLs; composed cookie strings; reworded startup and bind lines) and 1 real loss, the vf key. The serve source the seat is editing (126055 B at 1790440173) still carries no vf key. Restoring it before the alpha rebuild lets the production rollout ship with zero capability loss; the rollout seat rebuilds and re-proves on any serve that carries it. 2026-09-26 land W12 ROLLOUT-CONNECT: THE REGISTER-TAKEOVER FIX IS LIVE ON PRODUCTION /connect (operator decision 2026-09-26: roll it out now, alpha is alpha, rollback discipline starts at beta). SERVED nishihost/nx_connect_appd.elf e0998c6b 777986 B, the bytes the alpha runs (ALPHA-REBUILD interim row 1790440850: appd 50502 B, serve 126055 B, api lib 26d83c5b, account store c4ec720e, auth flow 601069f0), so production carries BOTH takeover layers: csu_handle_taken before register and the create-only nx_uas_create that VERIFY-ROOT-REGISTER row 1790438980 read READY. Promoted by /api/promote with expect_sha256 (PROMOTED prev=1, job 1790441085; the undeclared name took the legacy staged-artifact rule), banked knowledge/bank/nx_connect_appd.elf-e0998c6b-prodcand-20260926; the pre-change 3e46d193 is in nx_connect_appd.elf.prev and knowledge/bank/nx_connect_appd.elf-3e46d193-20260925 (cmp identical). RESTART: pid 32076 start 479682637 exe 3e46d193 stopped exactly by nx_proc_kill through /api/organ_run (SIGTERM, stop_confirmed 1 in 102 ms, job 1790441123); the edge answered /connect/ 503 Retry-After 5 in the gap (job 1790441133); nx_daemon_supervisor revived pid 23283 start 505712546 parent 9271, nx_proc_observe digest_match 1 on e0998c6b, the only nx_connect_appd.elf process, enumeration complete. PROOF BEFORE (production mode on a scratch loopback port with scratch keys and accounts): gate nx_connect_prod_register_gate 29/31 on e0998c6b (job 1790441021) with only K3 vf:1 and K4 vf:0 failing, after RED 18/24 on the pre-fix bfb02bdc (the six takeover teeth) and GREEN on e8ef423a; serve-core nx_connect_auth_gate 12/12 and nx_connect_mount_gate 20/20 from the current sources. PROOF AFTER over the edge: /connect/, /connect/register and /connect/login nx_page_verify GREEN a11y 0 (jobs 1790441176, 1790441179, 1790441185); /connect/api/v1/catalog 200 text/html 11744 B with no API envelope (job 1790441196), identical to the pre-swap baseline; the no-argument gate run on the SERVED file bytes 29/31 with the same two vf teeth (job 1790441222); production connect_auth_store.log still 3460 B = 5 rows, untouched by any test. CONTENT RULER vs 3e46d193, complete inventory 821 runs 11 missing (knowledge/gates/w12_rollout_cdx_3e46d193_e0998c6b.txt): 3 code-byte fossils of the unreferenced soft popcount (controls bfb02bdc and the served nx_opaque_login.elf lack them too); /connect/logout and /connect/addcontact now mount-composed (teeth C1 C2 pass); the two Set-Cookie strings and the nxc_auth= key now composed (A1 A3 C1 K1 pass); the reworded bind-failure and startup lines (P1 reads the new banner); and ONE REAL LOSS, the /sealed vf key the device messenger /synth/connect_device consumes, shipped knowingly under the operator decision and filed as debt 1790441350 with the exact fix. Debt 1790359363 EATEN (job 1790441276). Production still binds 0.0.0.0; /api/v1 and /features stay staged-only. 2026-09-26 measure W10 SEAT ALPHA-REBUILD to the W12 ROLLOUT seat and the operator: (1) CORRECTION of my interim row 1790440850 -- it said serve.nx was final at 126055 B; I had NOT read rows 1790439480 and 1790440590 (the /sealed vf regression addressed to this seat, appended after my first journal read), so that claim was wrong. (2) The vf key is RESTORED in buildroot/runtime/_hdl_build/nx_connect_serve.nx, now 126565 B: after the p value the /sealed emitter writes the vf key from byte 32 of sh_own_at(sh, sp2), 0 when sp2 is negative, before the s key, the served {f,p,vf,s,ct} shape; pre-edit bytes banked knowledge/bank/nx_connect_serve.nx-126055-prevf-20260926-wave10. nx_connect_pubkey_bind_gate read RED 12/13 on the pre-fix 126055 B serve (job 1790441421, T13 the sender TRUE verified flag FAIL); the GREEN run and the third alpha rebuild are in flight. (3) OBSERVED, NOT DONE BY THIS SEAT: production changed at about 1790441150 -- the serving-root nx_connect_appd.elf is now e0998c6b 777986 B (the first alpha build of this seat, which LACKS the vf key), nx_connect_appd.elf.prev is 3e46d193, and the production process is pid 23283 start_ticks 505712546 parent 9271 exe e0998c6b (nx_proc_observe, digest mismatch against 3e46d193); pid 32076 is gone. This seat never called /api/promote or /api/deploy and never touched the production row or pid (its two exact stops were alpha pids 12100 and 3108); no organ_ship.jrnl row names nx_connect_appd, so the deployer is UNATTRIBUTED here. Consequence while it stands: production /connect/sealed omits vf, so connect_device.html renders every verified sender unverified (row 1790440590). The rollout owner rebuilds from serve 126565 B or later. 2026-09-26 queue W12 ROLLOUT-CONNECT: DOORS THAT STILL SERVE THE UNGUARDED REGISTER PATH (the operator approval covered /connect only; each needs a rebuild from the current tree, which now links the create-only nx_uas_create, and a release through its own RACI lane; census = VERIFY-ROOT-REGISTER row 1790438980 plus this seat's grep of the olg_register call over buildroot/runtime, 36 matches, corpus_complete=1, knowledge/gates/w12_rollout_olg_register_census_1790439100.out): opaque_login :9091 (nx_opaque_login_daemon.nx line 484, the family login, deploy row opaquelogin via logindeploy); docportal_admin_daemon :18456 (line 666, row docportal; its invite token is not bound to the handle, so any live invite holder can re-register a taken handle); email_portal_daemon :18465 (line 669, row email, same invite class); nx_gen_gateway :18794 (line 240); nx_mesh_gateway :8055 (line 266); nx_gallery_gateway :18190 (line 357, row galxgw); nx_vault_gateway :18200 (line 386); nx_studio_gate, the /studio daemon (line 148, allow_reg defaults to 1 from argv). Login-only doors sharing an account log gain the fail-closed lookup and the per-login leak fix on rebuild: hub_gw :18792 (row hubgw) and the office daemon :8030 (row office). connect_alpha :18133 already runs e0998c6b with both layers. Per door: rebuild, prove on a scratch instance that a second register of a taken handle is refused (nx_connect_prod_register_gate is the connect model), ship through the row, nx_proc_observe digest_match. 2026-09-26 queue W12 ROLLOUT-CONNECT: RELEASE-LANE GAPS for the connect release owner (this rollout used the task fallback, /api/promote under the legacy staged-artifact rule plus an exact stop and the supervisor revive, because nothing better exists yet): (1) knowledge/status/organ_kind.conf carries no nx_connect_appd row, so /api/promote treats the production daemon as a one-shot and probes nothing; declare it daemon; (2) deploy_targets.conf carries no connect row, so the health-checked /api/deploy cannot ship it; add one (gdeploy@connect, port:8032, live path /volume1/homes/elderwesto/nishihost/nx_connect_appd.elf) only after reading how gdeploy name-kills, because the alpha binary nx_connect_appd-<sha>.elf shares the 15-character comm nx_connect_appd with production and a comm-keyed kill would restart the alpha too; (3) plan-connect-release- step 5 (row 1790359470) still names the missing row and a placeholder sha. NEW GATE nx_connect_prod_register_gate: promoted 525b4f16 69449 B (job 1790441456), registered callable (job 1790441474), served /api/gate_run exit 1 RED 29/31 on production e0998c6b (job 1790441490), the two failures being debt 1790441350 (the /sealed vf key); no argument runs the SERVED binary file on a scratch port, a path argument runs a candidate, and it refuses to fork any subject that ignores the port argument. Not rostered by this seat: each run binds a scratch production-mode instance on 0.0.0.0 for a few seconds. Its gate_run result turns GREEN the day the vf restore ships. 2026-09-26 queue W13 ALPHA-UI-AND-PROD to the connect release owner: PRODUCTION WAS NOT DEPLOYED BY THIS SEAT; the candidate is staged for the release lane. Production still runs e0998c6b (pid 23283 start_ticks 505712546 parent 9271, nx_proc_observe digest_match 1 at about 1790455530), which lacks the vf key (debt 1790441350 stays OPEN), the derived faint ink and the one-paragraph note. The SAME binary the alpha runs, cb3b5c3d (806805 B), is in the deploy slot nx_connect_appd.sov.elf.new (nx_filecopy verified 1, mode 0755), the src the connect row names. Content ruler e0998c6b to cb3b5c3d (nx_contentdiff via organ_run job 1790455909): lost_from_live 4 of 1597 runs (2 permil), all named: the two palette literals (now emitted from named pieces), the run that ended the p value straight into the s key (the restored vf key now sits between), and the 2026-09-25 release-note line W10 superseded; gained 42. WHY NOT SHIPPED: (1) /api/promote target=nx_connect_appd refused DECLARED-DAEMON (the W13 RELEASE-LANE organ_kind row: correct, the W12 fallback swapped a daemon with no probe), so the W12 recipe no longer exists; (2) /api/deploy target=connect refused at the global pre-deploy gate (nx_deploy_ready DEPLOY-BLOCKED: evidence-honesty BLOCK, an independent method reporting failure in some compare domain, plus 8 WARN; nothing promoted, live untouched), and by the RELEASE-LANE comment on that row the SERVED hostctl refuses a row with no field 7 until the exact-kill hostctl ships (nx_catalog nx_hostctl: STAGED 349752 B, PROMOTED 291864 B). This seat passed NO confirm_gate_override and copied nothing into the serving root. TO SHIP, once the exact hostctl is live: POST /api/deploy target=connect&confirm=yes&expect_sha256=cb3b5c3df2e69b6629e6a60fa862f0e2ae2954b64bcfd2329c7df8d8de4c24ad (with an audited confirm_gate_override=yes only if evidence-honesty is still RED and the owner accepts it), then nx_proc_observe nx_connect_appd.elf cb3b5c3d digest_match, nx_page_verify https://nishifamily.com/connect/, nx_connect_prod_register_gate 31/31 with no argument (the served bytes), and /connect/api/v1/catalog not served (M1 to M3 already GREEN on the candidate). The pre-change e0998c6b is banked at knowledge/bank/nx_connect_appd.elf-alpha-e0998c6b-20260926 (nx_filehash cmp identical 1). The superseded alpha binary alpha_connect/nx_connect_appd-ac638880.elf (banked by W10) is unreferenced by daemons.reg, for the lifecycle lane. 2026-09-26 land W13 RELEASE-LANE (T0 1790453636). (1) knowledge/status/organ_kind.conf declares nx_connect_appd daemon (78092 to 78166 B, the row sits in the file head): /api/promote now refuses it DECLARED-DAEMON, nx_catalog reads LIVE-DAEMON, nx_builddeploy_lib holds the serving-root twin for a default build of the name. nx_organkind_gate 27/28 (T22 zero conflicting kinds PASS, T18 PASS; T24 lib-reader headroom FAIL is pre-existing, debt 1787938660). CAUGHT AND FIXED IN THE SAME LEG: my first 932 B comment block pushed 8 declared rows (nx_accept, nx_accept_gate, nx_accept_lib, nx_accept_ref_lib, nx_accept_decl, nx_glprobe, nx_glprobe_gate, nx_glprobe_lib) past the 65535-byte window of a capped kind reader, so it was shrunk to 74 B: nx_glprobe_lib now ends at byte 65527, exactly the rows visible before plus this one. (2) deploy_targets.conf gains row connect = 0 nx_connect_appd.sov.elf.new gdeploy@connect port:8032 gdeployrb@connect /volume1/homes/elderwesto/nishihost/nx_connect_appd.elf with NO field 7 on purpose (20153 to 21450 B). READ FIRST: gdeploy restarts with proc_kill_by_name, a SIGKILL of every process whose /proc/<pid>/cmdline CONTAINS the kill-name (the 15-byte comm is not what it reads), so the alpha is spared today only by the spelling of its argv[0] (./nx_connect_appd-<sha>.elf) and any process that merely names the file in an argument dies too. EXACT MODE landed in source: new lib buildroot/runtime/nx_exactkill_lib.nx (10371 B sha256 9b2bc52e) selects by readlink /proc/<pid>/exe equal to the live path or its promote rollback chain (.prev .prev2, optional (deleted)), records start ticks before anything on disk moves and revalidates them before the signal; buildroot/runtime/_hdl_build/nx_hostctl.nx (345827 B 50d59cec to 351248 B f30fc731) uses it when a gdeploy@ or gdeployrb@ row has no field 7 and for gdeploy <live> with no kill-name, refuses a relative path, a /proc walk error or more than 64 matches before destroy, and propagates the rc. The SERVED hostctl 6122278d predates it and REFUSES a row without field 7, so /api/deploy target=connect fails CLOSED until the exact hostctl ships through the hostctl lane. 2026-09-26 land 2026-09-26 wave 13 SEAT TOOLCHAIN: DEVICE SIGN-IN RUNS INSIDE WASM -- both wave 10 blocks fixed at their owners. nx_wasm.nx lowers OP_CPUID_EBX to 0 (wasm32 exposes no x86 feature leaf, so every gated consumer takes its portable path and nx_sha256 keeps ni_ok 0: its ONE software compression is the SHA-256 wasm runs) and OP_SHA256_NI_BLOCK to unreachable (dead by that construction, a trap if ever reached); getrandom (rv64 278, x86 318) lowers to the declared host import env.nx_getrandom(buf, len, flags), declared only by a module that draws randomness, so a host without it cannot instantiate the module and nothing reads as zeros. nx_wasm_vm is now a host: it binds that import to the machine getrandom and refuses every unbound import by name (wm_host_resolve, where a browser raises LinkError), and it now APPLIES ACTIVE DATA SEGMENTS, which it had silently skipped -- every string literal read as zeros in the estate VM. New gate nx_opaque_wasm_gate 21/21 GREEN (job 1790456699): the unmodified client closure (runtime/_hdl_build/nx_opaque_client_wasm_kat.nx) lowers with no refused opcode, assembles to 175420 B (sha 87406462c551b7c7a9fd3bb9122ea76ff35cd8f10a1e092393bfe9bcc702f3a1, WAT 5112280 B sha a7f7607c), and in the VM: SHA-256 RFC 6234 vectors byte-exact, 32 random bytes non-zero and two draws differ, and ocl_register_blind_det on the RFC 9807 C.1.5 P256-SHA256 inputs gives the registration_request 029e949a...29f8 byte-exact, the value nx_opaque_client_gate pins natively (native run agrees); neg-controls: a host withholding the door refuses the module by name, a module drawing no randomness declares no door. The page is NOT wired (alpha seat lane); the browser host is crypto.getRandomValues bound as env.nx_getrandom 2026-09-26 measure W13 RELEASE-LANE PROOF of the exact kill on a scratch pair. New gate nx_exactkill_gate (19194 B sha256 646ce1c1) copies its own binary into two scratch directories beside itself, each holding nx_connect_appd.elf (same basename AND same 15-byte comm), and runs each as a sleeping child: 10 pure path-grammar teeth; neg-control the name-keyed cmdline predicate selects BOTH fixture processes (2); exact select finds exactly the prod child and counts the alpha child as spared; neg-control a moved start tick is never signalled; SIGKILL reaches only the prod child and the alpha child lives; the chain teeth follow a process across the promote rename to .prev and after (deleted); two sandbox teeth (the gate only ever signals children it started, because a mutant that over-selects would otherwise reach the REAL production daemon, which carries the same basename); and END TO END the built hostctl (buildroot/_build/nx_hostctl.sov.elf 336682 B sha256 22ccae50, --build-only, NOT promoted) ran gdeploy <scratch live> and printed selected=1 spared_same_comm=3 (the fixture alpha plus the real production and alpha connect processes, both spared), promote ok=1, killed EXACT-BY-PATH procs=1, exit 0, .prev banked, .new consumed. GREEN 34/34 on qualify (job 1790455738). BITE: a planted path-blind selection (the lib prefix check disabled, then restored) went RED 25/30 on exactly the five selection and survival teeth with the E2E withheld (job 1790455983). SHIPPED by nx_organ_ship sha 33683aaf (job 1790456115: prove 36/36, promoted, offc twin, registered callable); served /api/gate_run GREEN 36/36 exit 0 (job 1790456343). Scratch removed (glob xkfix_ over buildroot/_build matches=0 corpus_complete=1; the nishihost-root copy ABSENT). DECLARED unpromoted build: buildroot/_build/nx_hostctl.sov.elf is now this seat's 22ccae50; the older stage nx_hostctl.sov.elf.new 349752 B (not this seat's, predates the exact mode) is untouched and must NOT be deployed as the exact hostctl. 2026-09-26 land W13 RELEASE-LANE (3) plan-connect-release- step 5 read nx_mgmt POST /api/deploy target=connect&confirm=yes&expect_sha256=FROM_STEP_1_BUILD_RECEIPT: the row did not exist, and the mgmt source's ma_do_deploy never reads expect_sha256 at all (only /api/promote does), so the placeholder was not even a failing guard. Step 5 now reads nx_mgmt POST /api/ship target=nx_connect_appd&deploy_target=connect&confirm=yes (nx_store_put PUT 5 replaced=1 rows=6, job 1790456335; plane re-read shows all six steps): ship rebuilds through the content-addressed cache (same closure, same bytes as step 1), hashes the STAGED bytes itself, deploys through the health-checked /api/deploy row, then re-reads and re-hashes the live file to verify by artifact; the route is served (POST /api/ship with no target answers 400 missing target from its build leg, not 404). (4) NOT RUN: nx_plan_run offers no dry form (prc_dispatch takes only planid, allowlist and prefixes; every live row executes), and a real run would stop before step 1 anyway: connect-release has no managed-owned definition (tool_allowlist.conf holds no connect-release row, so ope_discover_at refuses managed-owned-definition-required). (5) nx_orchestrate_raci connect-release resolves Accountable=publisher, Responsible=publisher,engineer, Consulted=supervisor,referee,security, Informed=operator,pm, workstream-organ nx_plan_run, verdict PLANNED (engagement recorded on the seg-store). 2026-09-26 queue W13 RELEASE-LANE STATE = WAITING, needs intervention by the hostctl owner (debt 1790456975): production nx_connect_appd has NO working ship path right now, by construction -- /api/promote refuses it (DECLARED-DAEMON; the refusal text suggests target=nx_connect_appd but the deploy row is connect) and /api/deploy target=connect refuses at the served hostctl. Before this leg the only path was the W12 fallback (/api/promote under the legacy rule plus an exact stop), which (1) now closes on purpose. UNBLOCK, in order: /api/build target=nx_hostctl from the current source (351248 B f30fc731 carries the exact mode), prove with nx_exactkill_gate plus the hostctl gates, /api/deploy target=hostctl (selfswap) through the control-plane lane -- NOT done by this seat: it restarts the fleet supervisor and ships every other seat's unpromoted hostctl source (served 291864 B vs source 351248 B); the older stage nx_hostctl.sov.elf.new 349752 B predates the exact mode and must not be the one shipped. THEN the publisher binds connect-release as a managed-owned workflow (nx_pm_owned_define) so nx_plan_run can execute it end to end. Production still lacks the /sealed vf key (debt 1790441350); a vf-complete candidate exists (alpha ac638880 read 31/31), and a newer STAGED nx_connect_appd.sov.elf.new 806805 B from source 55069 B appeared during this leg, owner not identified here. Owed follow-ups: nx_daemon_supervisor ds_exe_sweep onto nx_exactkill_lib (one identity rule), legacy gdeploy rows with a kill-name still substring-kill, nx_exactkill_gate not rostered (its end-to-end leg forks the _build hostctl each run), the DECLARED-DAEMON refusal should name the deploy row. 2026-09-26 measure W13 RELEASE-LANE CORRECTION to row 1790456900 by measurement, both probes refusal-only (no confirm, no digest): the SERVED /api/promote reads nx_perf_lib, declared at byte 65864 of organ_kind.conf, as DECLARED-LIB (job 1790457082), so the served mgmt kind reader is UNCAPPED (it carries the 2026-08-28 sys_read_file fix in ok_kind_of_path) and my first 932 B block would not have undeclared those 8 rows for /api/promote; the 74 B shrink still stands for any consumer compiled from the pre-fix lib (unmeasured here). nx_organkind_gate T24 measures OK_CONFBUF, a constant the fixed reader no longer reads for its buffer, so its FAIL (debt 1787938660) no longer describes the served ship path. The same probe style proves (1) live: POST /api/promote target=nx_connect_appd answers 400 refusal DECLARED-DAEMON kind_src knowledge/status/organ_kind.conf (job 1790457036). LESSONS: a comment block inserted near the head of a file read by a capped parser is a silent removal of whatever sat just inside the cap -- measure the reader before sizing the insertion; and a mutation test of a selector whose teeth KILL what it selects must sandbox its signals to its own children before the first plant, because a path-blind mutant here would have selected the real production daemon by its basename. 2026-09-26 measure W13 RELEASE-LANE BLAST RADIUS of the hostctl exact mode, for whoever reviews the hostctl ship: deploy_targets.conf carries 30 gdeploy@ rows (nx_txtscan find, whole 21450 B file); 29 name a field-7 kill-name and keep the legacy substring restart byte-for-byte, and only connect takes the new branch (a row without field 7 used to REFUSE and now restarts EXACT-BY-PATH). The direct form gains `gdeploy <live>` (argc 3, rc propagated); `gdeploy <live> <kill-name>` is unchanged. No other hostctl verb was touched. The existing hostctl gates were NOT re-run against the 22ccae50 build (UNVERIFIED); the compile, the in-process lib teeth, the end-to-end scratch deploy through that build and the planted path-blind RED are the evidence. 2026-09-26 lesson 2026-09-26 THE ESTATE VM NEVER LOADED A STRING LITERAL, AND NO GATE COULD SEE IT: nx_wasm_vm's section scan skipped the data section, so every active segment the wat lane emits was left out of linear memory, and eleven VM gates stayed green because every module they run is arithmetic-only. The first module to compare a digest against a vector held in a literal (the OPAQUE client's SHA-256 of abc) read 64 of 64 digest bytes wrong while the randomness door, which needs no literal, passed. A known-answer run over a real closure is the instrument that finds a loader gap; per-opcode fixtures cannot. Bite on the emitter: the same gate against the pre-fix nx_compile_wat reads RED 7/21 (emit refused at IR opcode 142, job 1790456839); control: nx_wasm_popcnt_gate rebuilt on the new VM stays 119/119 (job 1790457914). Owed (debt 1790457250): rebuild and re-run nx_wasm_vm_verify and the other VM gates on the new VM, a VM trap arm for unreachable, and the alpha page wiring of env.nx_getrandom to crypto.getRandomValues 2026-09-26 retract 2026-09-26 PRECISION ON THE ROW ABOVE: the clause that eleven VM gates stayed green because every module they run is arithmetic-only is an INFERENCE, not a measurement -- eleven is nx_wasm_vm_verify's own 2026-08-14 count of _wasm_vm_gate organs and none of them was re-read this wave. MEASURED: wmp_scan in nx_wasm_vm.nx has no arm for section 11 and falls to r.pos = send, the OPAQUE harness read 64 of 64 digest bytes wrong until wm_apply_data landed and 0 after, and nx_wasm_popcnt_gate (whose modules carry no data segment) is 119/119 on the new VM. Which of the other VM gates ever loaded a literal is UNMEASURED and is part of debt 1790457250 2026-09-26 land W14 PM-RELEASE-PLUMBING (T0 1790458552): connect-release is BOUND as a managed-owned workflow at maturity DRAFT and refuses execution by construction. (1) PRC1 policy plane knowledge/store/connect-release-c-20260926- seeded, 6 rows, one per plan step (exit 0 VERIFIED; step bounds 900000 600000 600000 180000 900000 120000 ms: a step that declares its own deadline gets that plus its build allowance, the rest take the 900000 ms workflow deadline; cwd nishihost). (2) qualification knowledge/gates/connect-release-20260926.qualification.json 2543 B sha256 7046d2ba, schema nishi.pm.owned-qualification-draft.v1, executable false, names step 5 (nx_mgmt POST /api/ship deploy_target=connect) as PRODUCTION_DAEMON_DEPLOY blocked by the operator decision on the hostctl exact-kill deploy. (3) nx_pm_owned_define create wrote knowledge/gates/connect-release-20260926.nxr 976 B sha256 114b1e4462a61bcc (PMI2: workflow and activity connect-release, owner publisher = the current RACI Accountable, raci projection c95561c1, plan_sha 399f8122, policy_sha 3bf4b774, runner nx_plan_run 942c677f, results planrun-connect-release-, dispatch knowledge/status/connect-release-d-20260926-, evaluation and dispatch budget 1); create itself proved every step tool (nx_mgmt, nx_sov_build_run, nx_page_verify) resolves to exactly one GREEN unpinned tool_allowlist.conf row, so no step row was missing; inspect read-back returns all 20 fields (execution NONE). (4) management binding registered through /api/tools/register: nx_pm_owned_4ce61faef131c77d (sha256 of the workflow id) -> nx_pm_owned_run.elf work connect-release <definition> 114b1e44 knowledge/store/connect-release-q-20260926- (row read back in tool_allowlist.conf, 187148 B). (5) PROOF the binding resolves, both runs refused before step 1 with execution NOT_STARTED: nx_plan_run connect-release before the row answered managed-owned-definition-required (job 1790460619); after it, the executor found the row, read the definition by digest, matched workflow allowlist plan results and policy, and refused at the qualification stage owned-policy-schema (job 1790460677). No deploy, enqueue or invoke was run. NEXT (publisher, after the operator decides the hostctl exact-kill deploy): write a nishi.pm.owned-execution-policy.v2 document (effects OWNER_REVIEWED_ACTIONS, one reviewed action per step with executable_sha256 effect commit_contract and write_scopes, plus effect_approval); a v1 handoff policy cannot carry step 5 because v1 admits only READ_ONLY or IMMUTABLE_ARTIFACT_GENERATION. Then re-create the definition at QUALIFIED and repoint this row with /api/tools/register update=yes. UNVERIFIED: whether nx_mgmt_call authenticates when forked by nx_plan_run. 2026-09-26 land W14 SEAT LISTING-AND-COUNTRY: a minor's sign-up requires a SELF-DECLARED place and that place's law decides. nx_connect_signup csu_signup_admit calls csu_juris_admit after the key check and before any challenge is looked up: a minor band with no place refuses CSU_REFUSED_COUNTRY_REQUIRED (16), a place outside ISO 3166-1 alpha-2 with an optional ISO 3166-2 subdivision refuses COUNTRY_FORM (17; self-declared, never IP), no table or no admitted in-force row refuses JURIS_TABLE (18, fail closed), and jur_rules_for plus jur_account_decision over the caller's table (jur_conf_load, loaded once) judge the attested band's youngest age (CSU_RQ_AGE_LO; negative reads as the youngest): a barred band refuses JURIS_BARRED (19), an age under the minimum JURIS_UNDER_MIN (20), a consent line PARENTAL_CONSENT (21) unless the caller verified a guardian consent (nx_connect_family) at a method rank of at least one and no weaker than the law names (CSU_RQ_GRANK). An adult may leave the place undeclared; the place decides this one answer and is never stored (the S1 row census stays four fields); a legal refusal spends no challenge and admits nothing. Request slots 7 to 13 added (CSU_RQ_SLOTS 14: PLACE, PLACE_N, AGE_LO, JTAB, JTAB_N, TODAY, GRANK); the lib now imports nx_connect_juris. nx_connect_signup_gate 85 teeth: RED on the constants-only lib (job 1790460544: every legal refusal answered CHALLENGE and the barred band was admitted), GREEN 85/85 (job 1790460800, and the ship's fresh run against the laws seat's grown table), SHIPPED f60018f5 with four named lost runs (the renamed minor tooth; two section-7 takeover teeth another seat had re-pinned to the create-only account log without shipping; the _ma_register_credential symbol from the OPAQUE closure the live binary predated; allow_loss_v1 7d468a20, behaviour review 9f513bbf); the legal door runs on its own account log so the live door's row census and burst arithmetic stay exact. Importer checks on the new lib: nx_connect_juris_gate 99/99 (job 1790460966, since re-shipped 04286dee by the laws seat), nx_connect_personhood_gate 67/67 SHIPPED 233d7f4e (content GREEN, behaviour IDENTICAL). QUEUE for the ALPHA seat: nx_connect_appd must hand the declared place, the table, the day asked and any verified guardian rank through the request before its register path calls csu_signup_admit. 2026-09-26 land W14 SEAT ALPHA (T0 1790458907) DEVICE SIGN-IN ON THE ALPHA: the passphrase never reaches the server. SERVER HALF (runtime/_hdl_build/nx_opaque_wire_server.nx 10254 to 14285 B): the create-only store (R1, debt 1790372544) was already in place; NEW the store is BOUND to its own respond by a per-session nonce -- OswRegPending, osw_reg_pending_new, osw_register_respond_bound (CreateRegistrationResponse then a CSPRNG nonce bound to the handle's realm user id), osw_bound_refuses (spends the pending state BEFORE comparing, constant-time nonce and user-id compare) and osw_register_store_bound (INVALID_SESSION unless bound, then the create-only rules). CLIENT (runtime/_hdl_build/nx_opaque_client.nx 11926 to 14109 B): the passphrase policy is decided ON THE DEVICE -- OclState gains pw_min pw_max, ocl_policy(st,min,max) refuses bounds that admit nothing, OCL_POLICY -6, registration refuses outside both bounds and a login only above the maximum (an older shorter passphrase still signs in), an empty passphrase is refused everywhere. GATE nx_opaque_client_gate 24267 to 32675 B: sections 1b (B1 another nonce refused, B2 the right nonce after a refused attempt refused, B3 a nonce for erin cannot store fay, B4 own nonce creates and the account logs in, B5 replay refused before USER_EXISTS, B6 a never-opened pending state refused, B7 nonces differ) and 1c (P1 under the minimum refused with nothing leaving the device, P2 over the maximum, P3 P4 boundaries, P5 login over the maximum, neg-control a short login is not a policy refusal, P6 degenerate bounds, P7 empty). RED 61/75 on a planted phase carrying the new API with the checks stubbed (job 1790459732, exactly the 14 new teeth) then GREEN 75/75 (job 1790460017) and SHIPPED sha 126ea0bc (job 1790461920: prove 75/75, content GREEN, behave DIFFERS approved STRONG, promoted, offc twin). WASM: the promoted nx_compile_wat plus nx_wat_compiler rebuilt the device module from nx_opaque_client_wasm_kat.nx with ocl_policy exported, 176424 B sha256 931c3d7b (the wasm gate reads 176424 too: nx_opaque_wasm_gate 21/21 GREEN job 1790460008). DAEMON (nx_connect_appd.nx 55069 to 88187 B, staged instance only): routes POST <mount>/device/params, /device/register/respond, /device/register/store, /device/login/ke1, /device/login/ke3 (session = the stage cookie plus X-Nishi-Session, the base64 of the M5 token as olg_login writes it) and GET /device/opaque.js and /device/opaque.wasm (read once at startup from the instance directory, announced ON or OFF), a bounded pending table keyed by the nonce (constant-time find, spent on use, TTL, oldest evicted and announced). SERVE and UI: CS_DEVICE slot stamped only on a staged instance holding the assets; /register and /login render the DEVICE form (method get to the fallback page, a secret field with NO name attribute, a status line, one deferred same-origin script) and the zero-JS form moved to /register/form and /login/form labelled FORM FALLBACK; production renders byte for byte as before. 2026-09-26 measure W14 SEAT ALPHA PROOFS of the device sign-in on the served alpha a25aea85. EDGE GATE (new, runtime/_hdl_build/nx_connect_alpha_device_gate.nx 28061 B; the client role runs natively in nx_opaque_client, the lib the wasm is compiled from, and posts only what the device script posts): 26/26 GREEN on b11dafde (job 1790461554) then 32/32 on a25aea85 (job 1790462395) -- D1 D2 D3 /register and /login carry the device form, 0 fields named pw, the secret field nameless; neg-control /register/form carries exactly 1 field named pw and says FORM FALLBACK; D4 D5 opaque.js binds nx_getrandom to getRandomValues, opaque.wasm is application/wasm with the wasm magic and 176424 B equal to disk; R1 params answer the RFC 9807 sizes; N2 a store with another nonce refused expired_or_unknown; R2 the store with its own nonce creates; R3a KE3 computed on the device; R3 ke3 answers the stage cookie on the mount path; R4 the same token rides X-Nishi-Session (204 base64 chars); N3 the ke3 replay refused; R5 the account page names the handle; T1 /try/lang signed in runs lang_match and shows match, neg-control T1b a minor one to one with an unrelated adult reads walled, T2 /try/share paired, T3 /try/needs says not behind the front door yet with no form, neg-control T4 signed out asks for sign-in and runs nothing, T5 /features lists 6 try rows; N1 a second registration of the taken handle refused handle_taken with 409; N4 a wrong passphrase fails ON THE DEVICE (-4) so no KE3 is sent; V1 V1b no POST body (2041 B over 11 posts) carried the passphrase or its SHA-256 raw or hex, neg-control the detector fires on a body carrying it. SHIPPED sha 1d32bf4d (job 1790462509: first promote, offc twin, REGISTERED callable). REAL BROWSER (laptop CM13 nx_cdp_capture journeys in headless Edge, the wasm client and getRandomValues doing the work): w14devreg registered devjourney1790462600 from /register and landed on /account showing the handle about 2 s after submit (31 steps, verdict OK, /tmp/w14jr/journey.receipt); w14devreg2 from a fresh profile registered the same handle again and the page read That handle is taken without leaving /register (verdict OK); w14devlogin from a third fresh profile signed in on the device and landed on /account (verdict OK); a profile that already held the session read You already have an account (the device session is a real cookie session). GATES on the same build: nx_connect_prod_register_gate 31/31 on a25aea85 in production mode (job 1790462137; b11dafde 31/31 job 1790461112); nx_connect_auth_gate 12/12 (job 1790460831); nx_connect_mount_gate 20/20 (job 1790460834); live alpha nx_connect_alpha_signup_gate 13/13 (job 1790462397, the form fallback POSTs still work) and nx_connect_alpha_api_gate 32/32 (job 1790462400). PIXEL REFEREE (CM13 capture then CM6 nx_page_pixjudge, laptop _build binaries, production bars knowledge/pixjudge.conf): /register /login /features /try/lang signed out at phone 390x844 and desktop 1440x900, 8 grades all verdict OK, contrast_fails 0, overlap_pairs 0, hierarchy_violations 0, hierarchy_step_short 0, worst_ratio100 471 (the footer, as W13) and 533 on the phone login and register; the phone register shot caught the status line at Loading the device sign-in (the phone door shoots first, before the module finished loading) and the desktop shot reads Ready: your passphrase stays on this device. nx_page_verify GREEN on /alpha/connect/register and /login (jobs 1790462727 1790462732, the script asset 200 8974 B). 2026-09-26 measure W14 SEAT ALPHA THE PASSPHRASE POLICY IS DECIDED ON THE DEVICE, observed in a real browser: the device script now keeps the realm's last params answer and names its bounds in a refusal (connect_device_opaque.js 8974 to 9194 B, banked knowledge/bank/connect_device_opaque.js-20260926-wave14b; the alpha re-read it on an exact restart of the same bf1534cd, pid 14724 stop_confirmed 1 job 1790464285, revived as pid 31967 start_ticks 508028459 digest_match 1). Journey w14devpolicy from a fresh profile typed a 5-character passphrase on /register: the wasm client's ocl_policy with the published bounds (pw_min 8, pw_max 256 from /device/params) refused before any blinded request existed, the page read Choose a passphrase of 8 to 256 characters and stayed on /register (verdict OK, /tmp/w14jr5); the native gate proves the same refusal leaves nothing on the wire (nx_opaque_client_gate P1 P1b P1c). 2026-09-28 measure W16 IDENTIFIED BY HASH (settles item 5 of row 1790614124): the STAGED nx_connect_appd.sov.elf.new is sha256 cb3b5c3df2e69b6629e6a60fa862f0e2ae2954b64bcfd2329c7df8d8de4c24ad, 806805 B (nx_filehash) -- byte for byte the W13 ALPHA-UI-AND-PROD candidate cb3b5c3d that rows 1790456660 and 1790456840 placed in the deploy slot on purpose (vf restore, derived faint ink, one-paragraph account note). It is NOT the current alpha: the alpha has since moved to bf1534cd (866481 B, adds device-side sign-in, the five /try pages and the wired front-door verbs). A /connect ship from this slot as it stands would ship the older candidate; the release owner chooses which one, and nothing here was deployed or restaged. 2026-09-28 measure Cross-reference from youthsafety.plan rows 1790615600 to 1790615602 (wave-16 LAWS seat): the juris lib and table that CN13 sign-up (csu_juris_admit) and the juris_rules verb compile changed. (1) nx_connect_juris.nx now carries SOURCED-SILENT (wave 15's grammar, gate bd49f3ce 161/161 GREEN): a statute read and found silent is admitted and counted apart, never taints, never draws; a consumer built from the OLD lib REFUSES such a row (fail closed: the place reads the strictest line and the partition shows refused 4) until it is rebuilt from current source -- nx_connect_api, the signup gate and both connect_appd builds are in that state now, and the next rebuild of each picks the new lib up with no source edit. (2) knowledge/connect_jurisdictions.conf 49715 to 64085 B, rows 34 to 40: MX is DECLARED with consent below 18 by parental_consent (Codigo Civil Federal Art. 646, 23, 424), US-UT is declared (COPPA 13 now, and consent below 18 by VPC from 2027-05-06 under Utah 13-76), and the strictest line every undeclared or tainted place reads moved from consent below 16 to consent below 18 (VPC, barred below 16 unchanged) -- so under the new lib a Mexican minor of 15 is admitted with guardian consent where the old lib bars them, and a 16- or 17-year-old declaring PH, AR, FR, PL or an unlisted place now needs verified guardian consent; sign-up teeth that assert the strictest consent value should be re-read by their owners 2026-09-28 land W16 SEAT OPAQUE-LIB (T0 1790613031) redid the wave-15 seat killed by the outage, starting from its partial work: wave 15 had written the recovery doors and the fake record into both libs with five W15-RED-DISARM early returns still planted and a gate that called nine helpers it never defined (func g_fake_of count 0), so nothing compiled and nothing was proven. LANDED, debt 1790462863 items 1 and 2: (1) THE RECOVERY CREDENTIAL ON THE DEVICE -- nx_opaque_client ocl_recovery_new (24 BIP39 words drawn on the device through the randomness door by hub/nx_bip39, the in-process encoder, so the words interoperate both ways), ocl_recovery_decode (typed words decoded and checksum-checked on the device, OCL_RECOVERY_MISMATCH -7), ocl_recovery_register_blind and ocl_recovery_register_finalize (the recovery record sealed on a second state initialised from osw_rec_public_cfg: the handle plus the rec suffix with KSF identity, exactly as _ma_issue_recovery_act seals it in process; the entropy is wiped by each finalize), ocl_recovery_login_blind, ocl_recovery_login_finalize, ocl_recovery_forget; server nx_opaque_wire_server osw_rec_public_cfg, osw_register_respond_pair_bound and osw_register_store_pair_bound (one bound nonce for both requests, the recovery row created only after the passphrase row was, so none can be planted beside an existing account), osw_recover_respond and osw_recover_finish (a KE2 against the recovery record plus the two registration responses in one round trip, then nx_uas_rotate of the passphrase row and the recovery row in nx_modern_auth_recover's order); the recovery secret never reaches the server at sign-up or at recovery. (2) RFC 9807 6.3.2.2 THE FAKE RECORD -- osw_fake_record derives client_public_key and masking_key per credential identifier from the realm oprf seed by HKDF-Expand under named labels, envelope Nn plus Nm zero bytes, derived on EVERY lookup (osw_record_or_fake) so a live and a free handle both pay one DeriveKeyPair; osw_login_respond and osw_recover_respond answer a free handle with a KE2 over it and a pending over a fake record never mints (OswPending.fake appended last). WAVE 16 ADDITIONS: (3) THE ROTATION IS BOUND TO THE PROVEN SESSION -- new lib runtime/_hdl_build/nx_opaque_rotbind.nx orb_mac, HMAC-SHA256 under the AKE session key over the label NishiRecoveryRotateV1 then the new passphrase record then the new recovery record, one definition both halves compose: the device ocl_recovery_rotation_mac (armed only by a produced KE3, one use, wipes the session key) and osw_recover_finish(ctx, rp, ke3, record, rec_record, rotation_mac) which recomputes it and compares in constant time, so a TLS-terminating intermediary that passes the genuine KE3 on beside a record of its own rotates nothing. (4) THE DEVICE VALIDATES SERVER ELEMENTS -- ocl_point_ok (the incumbent nx_voprf_deserialize_element) on the evaluated element and server key of a RegistrationResponse and on the evaluated element and server key share of a KE2, refused OCL_BAD_SERVER_MESSAGE -8 before the KSF runs, because the incumbent Finalize discards its deserializer's verdict (debt 1790616294). SOURCES: nx_opaque_client.nx 24721 B sha256 d09956ec780bc796, nx_opaque_wire_server.nx 33152 B sha256 1351c82486c7fbac, nx_opaque_rotbind.nx 2565 B sha256 e3ec68c10b45e367, nx_opaque_client_wasm_kat.nx 7189 B sha256 6b4cd2937fc2d6dc (exports reckat and recrt), nx_opaque_client_gate.nx 67814 B sha256 de88aa85daafd185, nx_opaque_wasm_gate.nx 12567 B sha256 1377795286aa2210. 2026-09-28 measure W16 OPAQUE-LIB proofs. nx_opaque_client_gate: RED 105/142 on the wave-15 planted old answers (job 1790614783: F1 a free handle answered -1409 USER_NOT_FOUND, F3, R1 to R14 with the recovery doors refused, RN2 to RN6 and the view fixture) then GREEN 143/143 with the plants removed (job 1790615350); a second planted phase for the wave-16 additions read RED 144/151, exactly the predicted seven (job 1790615653: Z1 a finalize against an all-zero RegistrationResponse returned 0 and Z1b sealed 129 bytes, Z2 a zero server key beside a genuine evaluation returned 0, Z3 an all-zero KE2 read -4; and with the MAC compare disarmed RB1 rotated kai to the intermediary's record 0, RB1b the intermediary's passphrase then signed in 0, RB1c the owner was locked out -1410), then GREEN 151/151 (job 1790615939); the planted server was restored byte-identical (sha256 1351c824 before and after). F2 alone does not discriminate (a zero KE2 also fails -4 on the device, measured on the planted run), so F2a pins that a free handle's KE2 is a real message. SHIPPED by nx_organ_ship: nx_opaque_client_gate 3347608e4b71a196 424408 B (job 1790616103: prove 151/151, content GREEN, behave DIFFERS approved, offc twin; prior 126ea0bc banked knowledge/bank/nx_opaque_client_gate.elf-126ea0bc-pre-w16-20260928, nx_filecopy verified 1) and nx_opaque_wasm_gate e9b6176907ad5882 (job 1790616207: prove 25/25; RED 21/25 on the planted state job 1790615085, exactly the four new teeth at -101, GREEN 25/25 job 1790615981; prior cb309327 banked knowledge/bank/nx_opaque_wasm_gate.elf-cb309327-pre-w16-20260928). WASM: the promoted nx_compile_wat then nx_wat_compiler rebuilt the device module from nx_opaque_client_wasm_kat.nx: 210492 B sha256 5af5f9c0a8a7f26019685ad9c20b9a2289f1a96cdbba1372af9e63b30b46617e (was 176424 B 931c3d7b; now carries the BIP39 wordlist, the recovery doors and the element checks), banked knowledge/bank/connect_device_opaque.wasm-5af5f9c0-w16-20260928 (verified 1); inside the VM reckat decodes the pinned 7f vector and recrt round-trips device-drawn words, native and wasm agree; the WAT carries 9 ocl_recovery_ exports. Values: server_view_bytes 3106 with the words and the 256-bit secret absent from it and the neg-control firing on the in-process recover's view, recovery_words_bytes 153 to 159, two free handles' fake records differ in 64 bytes. Served /api/gate_run on 3347608e reads exit 141 RED with capture_truncated 1 while every captured tooth is PASS (job 1790616216): the 16384 B FAST capture closes the pipe on this 19 KB gate, a second measurement of debt 1790615554; the roster runner captures 65536 B and is not affected. The alpha still serves bf1534cd built before all of this: nothing here is live until the ALPHA-SIGNUP seat rebuilds and restarts it. 2026-09-28 queue W16 OPAQUE-LIB FOR THE ALPHA-SIGNUP SEAT -- the entry points to wire into nx_connect_appd behind mount/device (the served alpha bf1534cd predates all of it). REGISTER WITH A RECOVERY CREDENTIAL replaces respond and store by the pair: the device inits a passphrase state from /device/params (osw_public_cfg) and a recovery state from a new params field built by osw_rec_public_cfg(ctx, handle, n, out_ccfg, out_context of OSW_CONTEXT_CAP) (client id the handle plus the rec suffix, KSF identity), calls ocl_recovery_new(st, out_words, cap at least NX_B39_MAX_MNEMONIC_LEN 256, out_n) and shows the 24 words to the person (they never leave the device), then ocl_register_blind and ocl_recovery_register_blind and POSTs both 33 B requests; osw_register_respond_pair_bound(ctx, handle, n, req, rec_req, out_resp66, out_rec_resp66, rp from osw_reg_pending_new, out_nonce32) answers two responses and the nonce; the device runs ocl_register_finalize and ocl_recovery_register_finalize (the entropy is wiped) and POSTs both 129 B records with the nonce; osw_register_store_pair_bound(ctx, rp, nonce, handle, n, rec, rec_rec) creates the passphrase row then the recovery row, USER_EXISTS for a taken handle before any recovery row, INVALID_SESSION for any other nonce, handle or a single respond's nonce. RECOVER is two routes: the device runs ocl_recovery_decode(typed words) on a recovery state (a typo answers -7 and nothing is sent), ocl_recovery_new on a second recovery state (the new words), ocl_register_blind for the new passphrase, ocl_recovery_login_blind (KE1 98 B) and ocl_recovery_register_blind, and POSTs KE1 with both requests; osw_recover_respond(ctx, handle, n, ke1, req, rec_req, out_ke2, out_resp, out_rec_resp, rp from osw_rec_pending_new, kept in the pending table like the login pending) answers KE2 259 B and two responses, over a fake record when the account or its recovery row is absent; the device runs ocl_recovery_login_finalize (words that are not the account's, or a fake record, answer -7 and no KE3 is produced), both finalizes, then ocl_recovery_rotation_mac(the decoded state, rec, rec_rec, out_mac32) and POSTs KE3 32 B, both records and the 32 B MAC; osw_recover_finish(ctx, rp, ke3, rec, rec_rec, mac) rotates both rows or answers RECOVERY_MISMATCH or INVALID_SESSION and mints no session (the device then signs in with its new passphrase). LOGIN KE1 needs no route change: rebuilt against the new wire server, /device/login/ke1 answers 200 with a fake KE2 for a free handle and the device fails -4 exactly as for a wrong passphrase (the edge device gate carries no free-handle tooth, 0 hits for sign_in_failed). The device script must name OCL_BAD_SERVER_MESSAGE -8 (a malformed server message, never shown as a wrong passphrase) and OCL_RECOVERY_MISMATCH -7; module 5af5f9c0 exports every ocl_ function. The daemon context comes from olg_ctx_setup_ttl, and the one nx_auth_context_init call in nx_opaque_login passes allow_recovery 1, so the recovery doors are enabled there. STILL OPEN from 1790462863 (superseded by the next debt row): (3) no rate limit on the device routes and an arena bump per sign-in; (5) a source-tree home and a release-recipe step for connect_device_opaque.js and the module; (6) production /connect unchanged by construction. 2026-09-28 land W16 SEAT CONNECT-SHIP-1 (resumed after the 12:39 CDT outage, T0 1790618431) SHIPPED PRODUCTION /connect: nx_connect_appd 872a9cc974d23cba 872313 B replaces e0998c6b 777986 B through POST /api/deploy target=connect (job 1790619206: PROMOTED, pre_deploy_gate DEPLOY-SAFE, gate_blockers 0, override none, the exact-kill hostctl 66ba7f4c taking the EXACT-BY-PATH branch). RESUME: the predecessor journaled nothing, banked its build as knowledge/bank/nx_connect_appd.elf-prodcand-872a9cc9-20260928 and the live binary as knowledge/bank/nx_connect_appd.elf-live-e0998c6b-preship-20260928 (both re-hashed equal) and issued no deploy; the job the resume note named as its build (1790616418) is an nx_debt show, not a build. A fresh nx_sov_build_run nx_connect_appd --build-only --release (job 1790618684) answered BUILD-CACHE HIT key 4602f725 = 872a9cc9 -- the key covers the fully expanded source closure, the compiler, the assembler and the flags, so the tree had not moved since the predecessor built it; the daemon sources appd, serve, ui and api_lib are unchanged since 2026-09-26 and no EDIT-START row was open on them. GATES ON THE CANDIDATE BYTES (bank path): nx_connect_prod_register_gate 31/31 (job 1790618843: takeover T1 to T5 closed, M1 to M3 no API envelope and no stage cookie in production mode, K3 vf 1 and neg-control K4 vf 0), nx_connect_auth_gate 12/12 (job 1790618850), nx_connect_mount_gate 20/20 (job 1790618857), nx_connect_pubkey_bind_gate 13/13 fails 0 incl. T13 vf both ways (job 1790618861). CONTENT RULER live e0998c6b vs 872a9cc9 (job 1790618865): lost_from_live 4 of 1597 runs (2 permil), shown 4 omitted 0, complete inventory by nx_contentdiff_export (job 1790618966, complete=1 missing=4) at knowledge/gates/w16_connectship1_cdx_e0998c6b_872a9cc9.txt sha256 c4fb9753. The four, each adjudicated from the candidate bytes: (1) and (2) the dark and light palette literals carrying the DECLARED faint ink (6a7488 dark, 8b94a6 light), now composed from parts with the faint DERIVED at startup by cd_ink_arm against the referee bar in knowledge/pixjudge.conf and refused by name to the declared ink when the conf is unreadable; (3) the /sealed JSON joint quote-comma-s, replaced by the vf key before s (the emitter literal now reads f, p, vf, s, ct -- debt 1790441350); (4) the wave-8 alpha /features note, reworded into the wave-14 note (the /features block is stage-only, production never enters it). Gained 134 distinct runs, led by the stage-only /device routes, SOURCED-SILENT from the juris lib and the ink announcement lines. BANKED before overwriting: the W13 stage cb3b5c3d (never shipped) at knowledge/bank/nx_connect_appd.sov.elf.new-cb3b5c3d-w13staged-20260928 (nx_filecopy verified 1, mode 0755); staged 872a9cc9 by nx_filecopy from the candidate bank (verified 1, mode 0755). VERIFIED BY IDENTITY, not by the receipt (deploy_status reads DEPLOYED-GREEN listen=UNVERIFIED-may-be-outgoing-process, the honest third state): nx_proc_observe nx_connect_appd.elf 872a9cc9 finds exactly one process, pid 9825 start_ticks 523520552 parent 25615 digest_match 1, unchanged on a re-sample about five minutes later; e0998c6b ABSENT_IN_COMPLETED_SCAN; the ALPHA pid 31967 start_ticks 508028459 bf1534cd UNTOUCHED (same pid and ticks before and after). nishihost/nx_connect_appd.elf = 872a9cc9, nx_connect_appd.elf.prev = e0998c6b (the rollback slot; its former 3e46d193 stays banked at knowledge/bank/nx_connect_appd.elf-3e46d193-20260925), the stage consumed. OVER THE EDGE: nx_page_verify /connect/ 200 11744 B a11y 0 GREEN (job 1790619290), /connect/register 200 10706 B a11y 0 GREEN (job 1790619294), /connect/login 200 10649 B a11y 0 GREEN (job 1790619296) -- static checks, browser rendering unverified; /connect/api/v1/catalog answers 200 text/html 11744 B, the home page, with no JSON and no API envelope (job 1790619303: production never enters the api block, the path falls to the core's unknown-path page, as before this ship); /connect/pubkeys byte-identical to its pre-deploy read, 5 keys with equal flags (jobs 1790619172 and 1790619306 2026-09-28 measure W16 SEAT CONNECT-SHIP-1 POST-SHIP (follows row 1790619720): the release record is PUBLISHED -- nx_compare_regen_scoped buildroot ../sites/nishifamily/compare/ --domain connect (job 1790619781) verdict GREEN fork-fresh, index.html 1073093 to 1145296 B, api.json 111493 to 117060 B, and nx_page_verify https://nishifamily.com/compare/connect/ (job 1790619830) 200 1145296 B a11y 0 GREEN with the ship row on the page (3 matches of the seat name). PRODUCTION STATE UNDISTURBED: connect_auth_keys.bin mtime 1785023286 and connect_auth_store.log mtime 1785047635 unchanged by the restart, the store re-hashed f72f20a0 3460 B equal to its pre-deploy read, so the new daemon loaded the existing realm keys and accounts from the nishihost CWD rather than provisioning fresh ones. THE ALPHA STILL SERVES over the edge: nx_page_verify https://nishifamily.com/alpha/connect/ (job 1790619859) 200 12353 B a11y 0 GREEN, its process pid 31967 unchanged. The W13 stage cb3b5c3d was NOT used (its hash is not the build), banked and replaced; no stage of nx_connect_appd is left armed after the deploy consumed 872a9cc9. 2026-09-28 land W16 SEAT OPAQUE-LIB RESUMED (T0 1790618779, after the 12:39 CDT outage). Mined first: its own wave-16 rows 1790616600 to 1790616602 were intact, debt 1790462863 EATEN and superseded by 1790616843 (open), the three sources byte-identical to that land row (client d09956ec, server 1351c824, rotbind e3ec68c1), and a rebuild of the gate from the current tree hit the build cache at 3347608e and ran GREEN 151/151 (job 1790619281), so nothing was redone. NEW THIS RUN (debt 1790616843 items 3 and 8): the lib half of item 3 is FIXED and both items are now MEASURED. nx_opaque_wire_server.nx 1351c824 33152 B to 66e3a398e0336969 35531 B: osw_register_respond, osw_fake_record and osw_ke2 are thin wrappers that restore the OPAQUE engine's u256 scratch cursor (nx_scratch_save then nx_scratch_restore) around private bodies _osw_register_respond, _osw_fake_record and _osw_ke2, because the engine allocates its u256 and point temporaries from the chained scratch arena with no frame of its own and every device request left them behind; each body also wipes the server AKE private key copy it derives once the response is made. Every public name and signature is unchanged; the client lib and the device module 5af5f9c0 are unchanged, so the wasm module was not rebuilt. Banked first: knowledge/bank/nx_opaque_wire_server.nx-1351c824-pre-w16frame-20260928 (verified 1). Gate nx_opaque_client_gate.nx de88aa85 67814 B to 5d25878b 94335 B gains section 9 (below); SHIPPED by nx_organ_ship as 4c0e6f28e6705dd2 (job 1790621669: prove 171/171, content GREEN, behave DIFFERS approved, offc twin), prior 3347608e banked at knowledge/bank/nx_opaque_client_gate.elf-3347608e-pre-w16env-20260928 (sha verified), source bank knowledge/bank/nx_opaque_client_gate.nx-de88aa85-pre-w16env-20260928. Consumers of the changed server: nx_connect_appd.nx and nx_connect_appd_w17check.nx only (grep, corpus_complete 1); production 872a9cc9 (CONNECT-SHIP-1) was built before this edit and the device block stays dark there, so its next build carries the framed server with no production behaviour change. 2026-09-28 measure W16 OPAQUE-LIB section 9 of nx_opaque_client_gate: the server halves' resource envelope and KE2 timing, MEASURED and printed as values, never judged against a typed bar (arena bytes by a one-byte probe before and after ONE call, kept mapped kB by VmSize before and after, u256 scratch by nx_scratch_save before and after, monotonic microseconds). RED 168/171 on the unframed server (job 1790621009: S1 the device KE2 left 273920 scratch bytes over 32 samples, about 8.5 KB per request; S3 a registration respond 2784; S4 a fake record 880); GREEN 171/171 on the framed server (job 1790621519), neg-control a bare u256_alloc reads 64. VALUES (job 1790621519): a KE2 bumps exactly 33536 arena bytes for a live handle AND a free one (tooth P9: min equals max, 16 and 12 clean samples) and keeps 368 kB mapped per call; ONE hmac_sha256 keeps 24 kB mapped and bumps 1088 arena bytes, a fake record keeps 48 kB, a bare server AKE key derivation 24 kB, a registration respond 48 kB, the account-log lookup 0 (57 us) -- the kept mappings are the allocating hmac_sha256 of open debt 1790456748, about 15 calls per KE2; ServerFinish bumps 179376 to 182816 arena bytes (the ed25519 mint) and keeps nothing; the in-process login the family login and production run (both roles) leaves 19744 scratch bytes, 243920 arena bytes and 744 kB of mappings per sign-in; the device blind leaves 5520 scratch bytes and the device finalize 8736 plus 420 kB mapped. ITEM 8, TIMING PARITY: 16 interleaved live and free KE2 pairs, median live 53897 us, free 53851 us, paired free minus live median -757 us with quartiles -1387 and +973 -- the interquartile range spans zero, so no live-versus-free difference is measurable at about 1 ms resolution on a 54 ms response (by construction both paths derive the fake and scan the whole log; the lookup is 57 us). NEW, VARIABLE TIME: the engine's p256_scalar_mul, which hub/nx_voprf (blind, evaluate), hub/nx_voprf_finalize (unblind) and hub/nx_opaque_core (DeriveKeyPair, DH) call with SECRET scalars, is binary double-and-add whose own header scopes variable time to public ECDSA-verify scalars: a one-bit scalar takes a median 21 us, an all-bits scalar 9307 us, 443 times (the leading-zero doublings of an infinity point are nearly free and every set bit adds) -- RFC 9807 section 9.1 asks constant time, independent of the bits of any secret. THE DAEMON RECIPE, proven on the lib (tooth A1): pendings and context allocated before ONE sys_arena_mark on a fresh chunk, sys_arena_reset after every request, and 3 of 3 whole device logins minted and validated across resets; neg-control: a pending allocated after the mark sits at the next request's pending address after the reset and its KE3 is refused -1410. 2026-09-28 queue W16 OPAQUE-LIB FOR THE ALPHA-SIGNUP SEAT AND CONNECT-SHIP-2 (addendum to row 1790616602; no entry point, argument or answer changed): the next nx_connect_appd build compiles the framed server 66e3a398, so a device request leaves no engine scratch behind; the gate proves every device answer unchanged (171/171 including the RFC 9807 vectors, the fake record, recovery and the rotation MAC). WHAT A DEVICE REQUEST STILL COSTS THE DAEMON, measured above: about 34 KB of arena per KE2 and about 180 KB per ServerFinish -- both returned by ONE sys_arena_reset after each request IF the pending tables (OswPending, OswRegPending with its pair flag, OswRecPending) and the auth context are allocated BEFORE a single sys_arena_mark at startup, after one warm request of each class so every lazily allocated static exists before the mark (the nx_opaque_login_daemon note on nx_seg_store ss_hget) -- the recipe tooth A1 proves on the lib and its neg-control shows the failure a pending allocated after the mark produces. NOT returned by any reset: 368 kB of mappings per KE2 and 744 kB per in-process login, all kept by the allocating hmac_sha256 (24 kB each) until nx_hmac stops allocating or the engine composes the caller-owned workspace HMAC the franking lane uses -- open debt 1790456748 (estate/hmac-sha256-daemon-leak, 21 supervised daemons), whose owner and remedy this does not change. Item 3's rate limit on the five device routes and item 7's TTL, slot bound and wipe for the two new pending kinds stay with the daemon. For the release owner: /api/gate_run's FAST capture reads this gate RED by truncation (its output is now about 26 KB; debt 1790615554); the roster runner and nx_organ_ship read it whole. 2026-09-28 queue Cross-reference from youthsafety.plan rows 1790621400 to 1790622300 (wave-16 LAWS-CONTINUED second run; gate nx_connect_juris_gate b76135e5 171/171): knowledge/connect_jurisdictions.conf now DECLARES PH and GT (consent below 18 by parental_consent), adds a VE civil row and a DO silent row beside UNSOURCED rows (both still strictest), and admits Honduras's Codigo de Familia Art. 16 (majority at twenty-one) beside an UNSOURCED row, so the strictest consent-below every undeclared or tainted place reads rose from 18 to 21 (method rank 2 verifiable_parental_consent and barred below 16 unchanged). FOR THE CN13 OWNER: csu_juris_admit judges only the MINOR band (a non-MINOR band returns CSU_OK), so the 21 changes no adult sign-up; it also means an 18- to 20-year-old Honduran, a minor under patria potestad by Art. 16, signs up in the ADULT band unjudged, because the band model cannot carry a majority above eighteen -- an owner decision not taken here: judge an ADULT band against the declared place's consent line (jur_rules_for already answers it, the juris_rules verb now answers consent for ages 18 to 20 in an undeclared place), or record why not. No lib change is needed for the new rows; consumers compiled on the pre-SOURCED-SILENT lib still refuse the silent rows until rebuilt on their owners' lanes 2026-09-28 queue W16 SOTA-PQ-HYBRID FOR THE ALPHA-SIGNUP or FRONTDOOR owner of runtime/nx_connect_device_client.nx (not edited by this seat): cd_emit_html emits the same head as the X25519-only E2E page did, without the router opt-out literal, so the edge router injects its ad slot and inline view-beacon script into the device sign-in page beside the OPAQUE device keys (predecessor finding, row 1790616580). The remedy is the one this seat applied to ce_emit_html today (row 1790622330): the 19-byte <!--nx-ad-optout--> literal immediately after the head tag, a tooth in that page's gate (the pqkx gate's T9d and T10d are the pattern: pk_has on the served page), RED on the banked pre-fix page, GREEN after, and a publish-guarded republish of the served page with the old one banked. Measured cost of the exposure on /synth/connect_e2e before the fix: 995 foreign bytes per load (38117 served for a 37122 B file). 2026-09-28 land W16 OPAQUE-LIB BUILT THE REMEDY FOR THE VARIABLE-TIME FINDING, as a NEW file so no build in flight moves: buildroot/runtime/nx_p256_scalar_mul_ct.nx ef4efb672f257af5 3825 B, p256_scalar_mul_ct(out, k, P) -- the SEC-CT-002 shape that fixed Ed25519 (always add, then a masked select) over the incumbent Jacobian formulas: k recoded to k + n or k + 2n by u256_cmov, never a branch, so it always carries bit 256, then 256 steps of one doubling and one addition each with the sum taken by u256_cmov where the bit is set; the recoded scalar is wiped. PROVEN by nx_opaque_client_gate section 10: C1 byte-identical to the incumbent p256_scalar_mul for 1, 2, n-1, n-2, every bit set and 16 fresh random scalars, on the generator and on a random base (42 of 42), RED with the recoding select planted inverted (174/175, 0 of 42, job 1790622592) and restored byte-identical (sha ef4efb67 re-read); C2 it leaves no engine scratch; neg-control the byte compare fires on 1 G against 2 G. TIMING (job 1790622514): one-bit median 9528 us, all-bits 9517 us, where the incumbent reads 21 and 9429 (449 times) -- flat within noise, at about the incumbent's worst-case cost. BITE for P9: with the free handle planted in the recovery-suffix shape the free class takes another path and P9 reads RED (job 1790622805), restored byte-identical (gate source 58840aec). Gate SHIPPED 6e4110c06c0d1867 (job 1790622690: prove 175/175, content GREEN, promoted, offc twin; prior 4c0e6f28 banked at knowledge/bank/nx_opaque_client_gate.elf-4c0e6f28-pre-w16ct-20260928). HONEST LIMIT: the field layer under it is the incumbent's and not audited for data-dependent branches. NOT WIRED: the hub closure is frozen by the takeover rollout; adoption is one call name at each site, listed in debt 1790622839 (which supersedes 1790621963, eaten). 2026-09-28 measure W16 OPAQUE-LIB REPRODUCIBILITY FOR THE ALPHA-SIGNUP SEAT: the device module rebuilt now from the current tree by the promoted nx_compile_wat then nx_wat_compiler (runtime/_hdl_build/nx_opaque_client_wasm_kat.nx to /tmp/w16ol_repro_kat.wat 5751667 B, WATC GREEN to /tmp/w16ol_repro_kat.wasm) is byte-identical to the banked knowledge/bank/connect_device_opaque.wasm-5af5f9c0-w16-20260928 (nx_filehash cmp identical 1, 210492 B, sha256 5af5f9c0a8a7f260) -- the client lib is unchanged this run (d09956ec) and nothing in the module's closure moved, so the banked module IS the current source and the only side this run changed is the daemon's (the framed server 66e3a398). Device-side measurements for the same seat (section 9): a device blind leaves 5584 bytes of engine scratch and a finalize 8608 plus 420 kB of hmac mappings per attempt inside the page; framing the ocl_ entry points would bound the scratch but changes the module hash, so it is left for a quiet window rather than moved under an asset the alpha is housing. 2026-09-28 queue Cross-reference from youthsafety.plan row 1790624760 (W16 LAWS-CONTINUED): Colombia is now a DECLARED place in knowledge/connect_jurisdictions.conf (consent below 18 by parental_consent from Ley 1581 de 2012 Art. 7 as read by Sentencia C-748 de 2011 with Decreto 1377 de 2013 Art. 12), so the sign-up lane's next read of the table admits a Colombian minor of 13 to 15 with the representante legal's authorization where the strictest line barred them; the decree's two parameters (the processing responds to the minor's interes superior and respects their fundamental rights) and the minor's right to be heard before the representative authorizes are content duties the table does not carry and are owed to the csu_signup_admit guardian-consent step (record that the minor was heard). No consumer rebuild is needed because the table is read at run time; gate nx_connect_juris_gate 92c73640 174/174 GREEN carries the three CO teeth. Bolivia gained a SOURCED civil row (Codigo Civil Art. 4 as reformed by Ley 2089: majority at 18) beside its UNSOURCED data-protection row, so a Bolivian declarant still reads the strictest line. 2026-09-28 queue VERB REQUEST FOR FRONTDOOR-FINISH (wave 17 owns nx_connect_api_lib; this seat edited none of it): nx_connect_signup is STABLE after W16 ALPHA-SIGNUP-DOOR (46340 B; its web door csu_signup_check_web, csu_door_tail, csu_signup_commit, the verdict vocabulary csu_code_slug and csu_code_text, csu_purpose_name, csu_record_num, csu_today_ymd are live on the alpha bdeb97bc), so the catalog row signup_admit can leave not_yet_wired. The PURE part is the legal door: csu_juris_admit over a request whose band, youngest age of the band, self-declared place (ISO 3166-1 alpha-2, optionally -subdivision), day asked (csu_today_ymd of the caller's clock) and verified guardian method rank the caller states, over knowledge/connect_jurisdictions.conf loaded with jur_conf_load -- nothing stored, no challenge spent, the answer is csu_code_slug and csu_code_text plus the rule the table drew. Suggested grammar: signup_legal <band> <age_lo> <place or -> <guardian_rank or -1>. Teeth to carry: an AU declarant of 13 answers jurisdiction_barred, a US declarant under 13 without a guardian rank answers parental_consent_required, a minor with no place answers country_required, neg-control an AU declarant of 16 is allowed, neg-control an adult with no place is allowed and never judged. The door's stateful half (challenge, work, window) stays with the daemon that owns the door; consent changes (csu_consent_set) are own-account and wait for the identity-carrying entry point the FRONTDOOR hand-off row 1790625380 names. 2026-09-28 land THE 429 BRANCH IS MEASURED, NOT PROVEN BY CONSTRUCTION (closes item (8) of debt 1790636396, a new gate file; none of the leased daemon sources was touched after row 1790636840). NEW runtime/_hdl_build/nx_connect_alpha_rate_gate.nx (25535 B sha256 6af3... superseded by the window edit, see below): it forks the daemon ELF named by argv[1] with the STAGED arguments (port, /alpha/connect, alpha) in a fresh /tmp directory holding its own knowledge/connect_device.conf, whose route budgets and window the run chooses from its clock, plus placeholder device assets so the device path turns ON; the staged instance binds 127.0.0.1 and is killed and reaped on every path. On the alpha's own binary bdeb97bc it read 16/16 GREEN in the build lane (job 1790637707: budget 4, window 15 s, four params 200 then 429 rate_limited ok 0 retry_after_s 15, the challenge route 503 from its own handler, after 16 s params 200 ok 1); on the banked pre-budget alpha bf1534cd it read 11/16 RED (job 1790637743) failing exactly R2 R3 R4 R6 R6b with every fixture tooth PASS (params answered 200 at budget plus one, no retry_after_s). FIRST SHIP 54305c99 (64908 B, release flavour) then run through /api/organ_run: killed at the 12000 ms organ_run deadline mid-wait (job 1790637898, verdict TIMEOUT-OR-SIGNAL, 783 B prefix), and nx_proc_observe then saw ONE process of that binary, the alpha pid 20441, so no scratch child was orphaned. FIX: the window span is now 3 to 5 s so the whole run ends inside that deadline (source 25535 B); rebuilt 16/16 on bdeb97bc (job 1790637995: budget 2, window 3, retry 3, waited 4) and 11/16 RED on bf1534cd again (job 1790638017, the same five teeth); PROMOTED a57c21bf 75432 B (debug flavour, job 1790638085) with expect_sha256, registered callable (job 1790637860), offc twin installed (job 1790638104), and the PROMOTED binary run through /api/organ_run with the alpha subject read exit 0, 16/16 GREEN inside the deadline (job 1790638105: budget 3, window 4, 429 then 200 after 5 s). Its no-argument default runs the served PRODUCTION binary in staged mode, so after a production ship it witnesses that the served bytes carry the budgets (today that default reads RED by design: production predates them); it is not on the gate roster or connect.gates for that reason, and its row belongs to the release owner once production carries the budgets. 2026-09-28 lesson A GATE WHOSE RUN OUTLIVES ITS CALLER'S DEADLINE CAN ORPHAN THE FIXTURE CHILD IT FORKED, AND ITS OWN REAP TOOTH NEVER RUNS TO SAY SO: the first rate gate waited out a 15 s window and /api/organ_run killed it at 12000 ms; this time the kill took the child with it (one process of that binary afterwards, read by nx_proc_observe), but nothing in the gate guaranteed that. The fix was to derive the fixture from the caller's bound (every window the run can choose ends, with its wait, inside the deadline), never to lengthen the deadline; and after any killed gate run that forks a daemon, observe the binary's processes before running anything else. 2026-09-28 retract Correction to row 1790638140, whose NEW-file clause pairs the edited size with the first version's hash: nx_connect_alpha_rate_gate.nx was 25260 B sha256 6af345894e5805e6eb7b8f2efdd97babef3e2e75bddc4f10c84b52ea3e0d9d6b when first written (built as 54305c99), and is 25535 B sha256 501889f503da42a078fe8eff4178de0e92150f82bbe371cd859c61ddbea1a9fc after the window edit (built and promoted as a57c21bf). Every other figure in that row stands. 2026-09-28 queue W16 ALPHA-SIGNUP-DOOR, THE OPEN LIST AFTER THE RATE GATE: debt 1790638192 now carries it (it supersedes 1790636396, eaten with DEBT-EATEN read from job 1790638215), so rows 1790636702 and 1790636840 point one link back. One item is restated more precisely: UNDER_MIN is not merely unexercised, it is UNREACHABLE on the live table today, because none of the 45 jur rows of knowledge/connect_jurisdictions.conf sets a minimum account age (every SOURCED row's fifth field is a dash; nx_txtscan counted 0 SOURCED rows with a number there), so the verdict is proven only on nx_connect_juris_gate's fixture place XA-S2; it becomes live the day a sourced law with an account-age floor is admitted. The three alpha gates (nx_connect_alpha_signup_gate 695236aa, nx_connect_alpha_device_gate 3b346c56, nx_connect_alpha_rate_gate a57c21bf) read REGISTERED-UNAUTHORISED in nx_catalog: callable through nx_job_run and /api/organ_run, with no cap minted that names them for a direct MCP call; this seat was told to write no token anywhere, so the mint is left to the connect owner's lane. 2026-09-28 land THE DOOR'S OWN BURST LIMIT IS MEASURED TOO (the scripted-burst tooth this seat owed; still a new gate file, no leased source touched): nx_connect_alpha_rate_gate.nx 25535 to 30431 B (sha256 ef4e047e097032034c9e810cd90c5f94f078f62ad6e598d3e77a3ad7098bdc55) now also writes the run's own knowledge/connect_signup.conf (pow_bits_base, window_s, window_budget and challenge_ttl_s chosen by the run; lc_geti reads the CWD copy before the estate path) and copies knowledge/connect_jurisdictions.conf whole (88644 B) into the scratch directory, so the private sign-up door ARMS in the scratch instance from the run's policy; the challenge ROUTE budget is set two above the door's rows so the door answers first. New teeth: G1c the door fixture landed whole; P3 fixture-reached, the daemon's banner reads SIGNUP door ARMED with this run's window_budget; D1 the door issues exactly window_budget live challenges (the neg-control's one included); D2 the next answers HTTP 429; D3 it names door_busy, the door's own refusal, and not the route limiter's rate_limited; a gv_need makes the door teeth SKIP if the burst outlives one challenge lifetime. On bdeb97bc 21/21 GREEN in the build lane (job 1790638776: budget 3, window 4, three challenges then 429 door_busy, params 429 then 200 after 5 s); on the banked pre-door alpha bf1534cd 12/21 RED (job 1790638806), failing exactly R2 R3 R4 R6 R6b P3 D1 D2 D3 with every fixture tooth PASS. PROMOTED 47ceaadb 79424 B (job 1790638866, expect_sha256), offc twin installed (job 1790638886), and the PROMOTED binary through /api/organ_run read exit 0, 21/21 GREEN inside the 12000 ms deadline at the widest window the run can choose (job 1790638888: budget 4, window 5, waited 6 s). Afterwards nx_proc_observe with a 65536 B read window saw only the alpha pid 20441 for bdeb97bc and no process of bf1534cd, both scans complete, so every scratch instance was reaped.

CN14 Concentric community circles · cell LANDED · gate NO-GATE-DECLARED

Contract	`ccl_circle_reach` · executor Organ · 2 u · stands on CN13
Definition of done	A member community is concentric circles joined by consent and vouching, never by any official Church record: immediate family, mission family (those who served in the same mission, from the reconnection lane), ward family, stake family, members worldwide who opted in, then Christians of other traditions who opted in; reach widens one circle at a time, contact needs mutual acceptance, two youth peers (an LDS boy and an LDS girl) may become friends by mutual acceptance with their guardians able to see the friendship, and the two-deep wall governs every adult and minor pair; done-rule: the gate proves each circle admits only by consent plus vouching, reach never skips a circle the member has not opened, two youth peers can befriend each other while an unrelated adult cannot open a private channel to either, and leaving a circle removes its reach at once -- STATUS 2026-09-25 (SYNC, verifier CONFIRMED): lib runtime/_hdl_build/nx_connect_circles.nx 41453 B sha 7ff66d3a declares ccl_circle_reach with the rings as data in knowledge/connect_circles.conf; nx_connect_circles_gate 73/73 GREEN re-run by the verifier and bite-killed 1 of 1, promoted 82aac86a, rostered; the gate proves every done-rule clause, and a read-only circles page is live on /alpha/connect/circles only. Open before acceptance: reach used as profile visibility would let a non-guardian adult discover a minor in a shared ring (wall adult-to-minor reach before wiring); guardian consent is a flag, not an act; circle instance ids are self-asserted; no backward endorser accountability (RepuLink [arxiv-vouching]); shipped, referee grade UNMEASURED, awaiting operator acceptance
Matrix cell	Concentric community circles (family to mission to ward to stake to other Christians) · `runtime/_hdl_build/nx_connect_circles.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_circles`; declare `nx_connect_circles TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790355003 routed by nx_intake_route (operator-seat, epoch 1790356422) from pm-seat: R3 of parent REQ 1790355000: concentric community circles as the structure -- operator words: go from your immediate family to your mission family if you were a missionary to your ward family to your -- sponsor intake-1790355003 plus2 2026-09-25 queue INTAKE 1790355004 routed by nx_intake_route (operator-seat, epoch 1790356425) from pm-seat: R4 of parent REQ 1790355000: youth peers can talk and be friends safely -- operator words: an lds boy can talk and be friends with an lds girl on the site -- by mutual acceptance only, with guardians -- sponsor intake-1790355004 plus2 2026-09-25 land nx_connect_circles LIB buildroot/runtime/_hdl_build/nx_connect_circles.nx (39233 B sha256 5549d205) exports ccl_circle_reach plus found/join/vouch/map/open/narrow/leave/ask/channel/guardian_sees/partition; the rings are DATA in knowledge/connect_circles.conf (2133 B: family, mission, ward, stake, worldwide, christian in file order; vouch 2 with its two-deep reason; evidence class 0 only). Composes wd_forbidden_count (no official record ever admits), yw_may_channel (the one two-deep wall), rc_score over rc_inter_popc (mission vouchers must have served with the joiner), ln_active_lane (mutual minimum, minor capped below dating). Gate nx_connect_circles_gate (24835 B sha256 ff611b72) GREEN 67/67 on nx_sov_build_run --qualify, artifact buildroot/_build/nx_connect_circles_gate.sov.elf 97742 B sha256 3c6163ee, 21 neg-control teeth; emitted values matched a hand prediction (rows 26, vouch rows 28, relationships 5, opened buckets 4/3/6). Open: bite receipt, ship and roster, the INTEGRATOR wiring into nx_connect_serve 2026-09-25 measure bite receipt for nx_connect_circles_gate: planted defect in the lib (ccl_join vouch floor st[CCL_H_NEED] replaced by 0) turned the gate RED 60/67 run-exit 1 (build job 1790356991): neg-control-unvouched-join-refused actual 1 expected -3, neg-control-stranger-with-no-vouch-refused, neg-control-one-vouch-is-one-person-word-refused, the never-met mission member admitted, a spent-vouch return admitted, and two positive teeth reading ALREADY. Restored lib re-hashed to the banked sha256 5549d205 39233 B, rebuilt with --no-cache (job 1790357123): GREEN 67/67 run-exit 0, asm 477138 B equal to the first green build (mutant 476988 B). Correction to the land row: the gate carries 25 neg-control teeth, not 21 2026-09-25 land shipped nx_connect_circles_gate: /api/build src_path runtime/_hdl_build/nx_connect_circles_gate.nx src_sha256 ff611b72 src_stable 1 staged 113464 B sha256 d26af346; /api/promote with expect_sha256 PROMOTED live nx_connect_circles_gate.elf 113464 B d26af346; /api/tools/register REGISTERED callable 1 schema 0; nx_offc_install installed and nx_filehash cmp root vs _offc identical 1; /api/gate_run on the promoted binary exit_code 0 verdict GREEN 67/67 with SUBJECT knowledge/connect_circles.conf on ladder rung 1 (the qualify run from buildroot resolved rung 2, ../knowledge). Admitted to knowledge/gateroster.conf (HAND-ADDED row). Seen in passing: the base class printed NX-GATE-JOURNAL APPEND_ERROR journal-lock code -11 AFTER the verdict line on that run, so a last-line reader of that capture sees the journal notice, not the verdict (base-class nx_gate_verdict, not this gate) 2026-09-25 land FINISH seat: the youth wall and the age band are on the base class. nx_connect_lds_youth (source 6738 to 7098 B, banked knowledge/status/nx_connect_lds_youth.nx.bank-20260925) and nx_connect_idage (9447 to 9739 B, banked likewise) migrated by hand onto nx_gate_verdict: tcheck delegates to gv_check per tooth, gv_ctr, gv_kv values, return gv_verdict, neg-control teeth renamed neg-control-incumbent-any-to-any and neg-control-forged-attestation. Release builds: youth passed 8/8 GREEN 44460 B sha256 bb4a8f56 (values adult_dm_youth 0, adult_grp2_youth 1, adult_grp1_youth 0, guardian_youth 1, youth_youth 1, adult_adult 1, incumbent_adult_youth 1); idage passed 8/8 GREEN 44736 B sha256 b0b40f5a (band_x 1, band_y 0, pseudonyms 204558289 ours vs 511049973 other, rereg_blocked 1, rereg_email 0). nx_contentdiff live vs staged named every lost run, 4 each, complete lists: the old neg-control label, the hand tally fails=, VERDICT: GREEN (...), VERDICT: RED, all superseded by the gv_verdict line; promoted with allow_capability_loss=yes and expect_sha256. Youth bite: planting the guardian flag on the core-wall scenario read adult_dm_youth=1, T1 and T8 FAIL, passed 6/8 verdict=RED exit 1; restored. OPEN: idage bite, reconnect and the six other organs still hand-rolled 2026-09-25 measure second bite, on the two-deep wall itself: ccl_channel's yw_may_channel swapped for the leaky yw_may_incumbent (any DM allowed) turned the gate RED 64/67 run-exit 1 (--no-cache build job 1790357635) on exactly the three predicted teeth: neg-control-unrelated-adult-private-channel-to-the-girl-walled actual 1 (a friendship lane) expected -13 CCL_WALLED, the same to the boy, and the incumbent-would-leak tooth. Restored lib re-hashed to the banked sha256 5549d205 39233 B before any other edit. Then added ccl_copy_into (a full table answers CCL_FULL and grows by copying into a larger block, never a guessed cap; the block holds slot indices only so it also persists as bytes) with six growth teeth incl. neg-control-copy-into-a-block-too-small-refuses-full-never-truncates; lib now 41453 B, gate 26157 B 2026-09-25 land re-shipped with growth: lib buildroot/runtime/_hdl_build/nx_connect_circles.nx 41453 B sha256 7ff66d3a (ccl_copy_into added), gate 26157 B src_sha256 c7dba5e3; nx_sov_build_run --qualify GREEN 73/73 (job 1790357809); /api/build src_path names the gate, src_stable 1, staged 117544 B sha256 82aac86a (up from 113464, an addition not a revert); /api/promote expect_sha256 PROMOTED 82aac86a; nx_offc_install then nx_filehash cmp root vs _offc identical 1; /api/gate_run on the promoted binary exit_code 0 GREEN 73/73. The ccl_ prefix is unique estate-wide: nx_shelltool grep func ccl_ over buildroot/runtime matched 69 of 26591 files coverage_complete 1 corpus_complete 1, all in this lib (retained knowledge/gates/cn14_ccl_prefix_20260925.out); nx_connect_serve carries no ccl_ or CCL_ and already imports the four libs this one composes. Status: shipped, referee grade UNMEASURED, awaiting acceptance 2026-09-25 queue OPEN after the builder leg. (1) INTEGRATOR, nx_connect_serve and nx_connect_appd: import nx_connect_circles.nx; at startup read knowledge/connect_circles.conf with sys_read_file (daemon CWD is the nishihost root), kr = ccl_conf_rings, allocate ccl_state_slots(kr, capm, capr, capv, capw, capf) slots, ccl_init, and refuse to start when ccl_load answers negative; size capacities from the account store and grow with ccl_copy_into on CCL_FULL; persist the block as bytes beside the account snapshots (slot indices only, no pointers); ccl_add_member at sign-up with the attested age band and the tradition the member consents to show; ccl_link_guardian from the family realm link; serve a /connect/circles page (rings with labels, open next ring, narrow, found with two adults, vouch, join, leave); gate profile and search visibility on ccl_circle_reach not negative, the E2E inbox on ccl_channel not negative, group rooms on ccl_group_ok, the guardian page on ccl_guardian_sees. (2) PM seat: intake REQ 1790355003 (R3 circles) and 1790355004 (R4 youth peers) are served by this rung once integrated and accepted. (3) Scale is UNMEASURED: reach scans the membership rows, which is fine at wedge scale; a per-member row index is owed before tens of thousands of rows. (4) the registered gate has schema 0, so tools/list does not list it until a schema row exists. (5) Acceptance: referee grade and operator ACCEPT both pending 2026-09-25 measure BEST-IN-CLASS READING for the BOARD seat (refs and sotabar rows are the BOARD seat's): the arXiv API listing all:vouching sorted by submission date was fetched and READ 2026-09-25, mirrored knowledge/fetched/cmp_connect_arxiv_vouching_202609.xml 26768 B pin sha256 c6d2f7b484fc7344a830d2294aeed08439f5858ab576927b82217ad2e7056fb7, 23 results, newest=2026-08 (no September entry). Newest: RepuLink, arXiv 2608.22025v1, 2026-08-22, ISWC 2026 poster, https://arxiv.org/abs/2608.22025v1 -- its abstract says conventional trust models propagate trust only forward with no accountability for endorsers regarding whom they vouch and no meaningful initial reputation for new nodes, and answers with a two-layer model (interaction feedback plus domain-specific endorsements) that holds endorsers accountable by Backward Endorsement Penalty and Reward Propagation (BEPP and BERP). Where CN14 stands against it: admission is consent plus two live adult vouches from inside the very circle (forward endorsement, spent on leave, voided when a voucher leaves) but a voucher carries NO backward accountability for whom they vouched. Candidate exceed rung, not declared by this seat: backward endorser accountability composed from nx_connect_blind_abuse and nx_connect_csae_report, so a voucher whose vouchee is removed for abuse loses vouching standing 2026-09-25 land FINISH seat: nx_connect_lds_reconnect (the mission-family hook of the circles rung) migrated the same way, source 7858 to 8250 B, banked knowledge/status/nx_connect_lds_reconnect.nx.bank-20260925, T8 renamed neg-control-mission-only-matcher; release build passed 8/8 GREEN 48362 B sha256 a76601dc with values s_confirmed_overlap 100, s_inferred_overlap 70, s_other_area 0, s_no_time_overlap 0, s_other_mission 0, s_opted_out 0 against raw_opted_out 70, youth_date_lane -1, youth_friend_lane 70; nx_contentdiff lost_from_live=4 (78 permil), all the superseded hand-verdict literals; promoted with allow_capability_loss=yes and expect_sha256. Roster re-trial of the four re-promoted binaries (youth, idage, reconnect, auth gate) read 4/4 GREEN exit 0 with gv verdict lines (journal knowledge/status/gateroster_trial_connect_finish_20260925c.jrnl). OPEN: reconnect and idage bites not yet run 2026-09-25 measure VERIFIER CONFIRMED 73/73 -- independent re-run /api/gate_run job 1790358288 exit_code 0 NX-CONNECT-CIRCLES-GATE passed 73/73 verdict=GREEN on nx_connect_circles_gate.elf sha256 82aac86a (117544 B, root == _offc by nx_filehash cmp); lib buildroot/runtime/_hdl_build/nx_connect_circles.nx 41453 B sha256 7ff66d3a declares func ccl_circle_reach (nx_txtscan, 1 hit); nx_gate_bite job 1790358326 valid_mutants=1 killed=1 void=0 not_reached=0 verdict GREEN, lib re-hashed 7ff66d3a and both twins restored identical after; all 7 claimed CN14 journal rows present; conf ring order family mission ward stake worldwide christian with vouch 2 and no copied Church text. GAPS the gate does not cover (named, not refuted claims): (1) ccl_circle_reach lets an UNRELATED ADULT discover a minor who shares an opened ring (gate asserts reach adult-girl = 2 as intended) so a minor profile is visible to non-guardian adults once integrated as the visibility gate, against high-privacy-by-default for children; (2) guardian_consent in ccl_join is a caller boolean not bound to the linked guardian identity and ccl_link_guardian takes no guardian consent (depends on CN5 family realm); (3) any two consenting adults can found any family or ward instance id, so circle identity is self-asserted and first founders own the id (who allocates inst is unowned); (4) youth peer channel has no age-gap bound inside the minor band; (5) trad (Art.9 religion) is stored unconditionally with no show-consent flag in the lib; (6) 2 teeth use bare gv_check without values; bite ran 1 mutant only (first-kill-wins). OPEN: integration, acceptance, scale, backward endorser accountability. 2026-09-25 land FINISH seat: nx_connect_lds_room (youth game and hangout rooms, two-deep on join and leave) migrated onto nx_gate_verdict, source 9244 to 9496 B (banked knowledge/status/nx_connect_lds_room.nx.bank-20260925), T7 renamed neg-control-no-wall-room; release build passed 8/8 GREEN 48217 B sha256 dbe94f48, values youth_opens_room 1, youth_joins 1, lone_adult_admitted 0, youth_into_two_deep 1, game and chat rosters 2 and 2; nx_contentdiff lost 4 superseded literals; promoted with allow_capability_loss=yes. Roster re-trial of room_rx, social and lds_room read 3/3 GREEN (journal ..._20260925d.jrnl). CONCURRENT OWNER, measured: buildroot/runtime/_hdl_build/nx_connect_msg.nx changed under this leg (8602 to 8803 B, mtime 1790358355) and no longer has a main (its tests moved into cmsg_selftest, i.e. it became a library, presumably for CN6 msg_store_append); the nx_connect_msg.elf promoted and rostered at 1790356282 (984514f7) was built from the 8602 B program and can no longer be rebuilt from source. Left to the CN6 owner: re-point the roster row at a gate that calls cmsg_selftest, or retire nx_connect_msg.elf through nx_retire_path; this seat does not touch an owner's file mid-edit 2026-09-25 measure FINISH seat bite on the youth-room wall: planting room_safe to return 1 for youth with exactly one adult read T2 T3 T4 T7 T8 FAIL, lone_adult_admitted=1, game and chat rosters 3 (the lone adult got into the live relay room), passed 3/8 verdict=RED exit 1; restored, cache hit reproduced dbe94f48 byte-identical to the live binary (nx_filehash cmp identical=1), GREEN 8/8. Bites run this leg: auth gate (tamper no-op, 11/12 RED), youth wall (guardian flag on the core DM, 6/8 RED), idage (verify_attest accepts any MAC, 7/8 RED), youth rooms (lone adult admitted, 3/8 RED); every restore re-verified by cache-hit sha. OPEN bites: reconnect, room_rx, social, lds_free, lds_census 2026-09-25 queue INTAKE 1790358601 routed by nx_intake_route (operator-seat, epoch 1790360391) from ys-pm-seat: Y1 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): youth connect around the world and have fun, one to one a -- sponsor intake-1790358601 plus2 2026-09-25 queue INTAKE 1790358602 routed by nx_intake_route (operator-seat, epoch 1790360406) from ys-pm-seat: Y2 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): no private channel between an adult and a minor -- the tw -- sponsor intake-1790358602 plus2 2026-09-25 queue INTAKE 1790358608 routed by nx_intake_route (operator-seat, epoch 1790360495) from ys-pm-seat: Y8 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): responsibility sits with the person and their parents or -- sponsor intake-1790358608 plus2 2026-09-25 queue INTAKE 1790361302 routed by nx_intake_route (pmboard-seat, epoch 1790361362) from pmboard-seat: B2 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): fun games together -- members play games together inside their circles (f -- sponsor intake-1790361302 plus2 2026-09-25 queue INTAKE 1790361303 routed by nx_intake_route (pmboard-seat, epoch 1790361365) from pmboard-seat: B3 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): plan activities together across continents -- operator example: a youth I -- sponsor intake-1790361303 plus2 2026-09-25 queue INTAKE 1790361304 routed by nx_intake_route (pmboard-seat, epoch 1790361368) from pmboard-seat: B4 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): language learning together -- members find reciprocal language partners ( -- sponsor intake-1790361304 plus2 2026-09-25 queue INTAKE 1790361307 routed by nx_intake_route (pmboard-seat, epoch 1790361375) from pmboard-seat: B7 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): all the things that build community -- the site experience powers communi -- sponsor intake-1790361307 plus2 2026-09-25 queue MINED from faithsocial FS3, retired onto this rung by the wave-9 S3 seat (debt 1790372858): FS3's done-rule made the gate prove two youth peers can befriend each other WITH THEIR GUARDIANS ABLE TO SEE THE FRIENDSHIP; CN14's description carries guardian sight but its done-rule clause does not, and its open list says guardian consent is a flag, not an act. Owed to the CN14 owner: adopt that clause into the done-rule with a gate tooth for it (faithsocial's Discord bar grades guardian visibility against Discord Family Center); the verbatim FS3 row is banked in knowledge/retired/buildroot_knowledge_compare_faithsocial.plan-precons-1790373638 2026-09-26 land W11 SEAT CIRCLES-CONSOLIDATE (T0 1790437058; debt 1790372882, REVIEW R5c): ccl_channel is the ONE entry point and hands its minor-to-minor branch to nx_connect_youthsafe ysf_peer_may_connect -- ccl_youth_channel fills the youthsafe request from the circles rows (both bands, both youth band rows, the guardian pair, the private context, the live reach, both asks, the block) and ccl_from_ysf names each answer in the circles vocabulary (CCL_FAR_BAND -24 beyond the declared span, CCL_YOUTH_BAND -26 for a minor with no youth band row, CCL_YOUTH_POLICY -25 with no loaded policy installed; an unnamed youthsafe refusal passes through as its own code), so the channel and the youth rule can no longer answer differently; circles keeps the membership part (reach first; adult pairs and adult-minor pairs through the wall as before). New state: member slots CCL_M_YB and CCL_M_NAMED (REC 5 to 7), header CCL_H_YSF (a runtime policy slot re-installed after init or reload, carried by ccl_copy_into) and CCL_H_ORQ (a YSF_RQ_SLOTS request scratch after the header, sized by ccl_state_slots), setters ccl_set_youth_policy and ccl_set_youth_band; circles now imports nx_connect_youthsafe (its policy loader makes syscalls, circles itself still makes none). Lib buildroot/runtime/_hdl_build/nx_connect_circles.nx 7ff66d3a 41453 B to ca36872b 50063 B (banked knowledge/bank/nx_connect_circles.nx-7ff66d3a-20260926-wave11). RED 85/95 on a planted phase carrying the new API and the old decisions (job 1790439897: far-band channel actual 1 expected -24, the agreement tooth, no-band 1 vs -26, no-policy 1 vs -25, plus the six guardian-act teeth of the next row); GREEN 95/95 (job 1790440076) with channel_far_band_pair -24, youth_rule_far_band_pair -307, youth_bands 4, span 0 (UNSOURCED, the strictest line); the same-band boy and girl still befriend (lane 1) and cap at community when both ask to date (2). Gate nx_connect_circles_gate c7dba5e3 26157 B to 13217370 31180 B SHIPPED 6c9b9dc3 (was 82aac86a): one lost run = the symbol ccl_link_guardian the migrated fixture no longer calls (allow_loss_v1 2ae41aa2), behaviour reviewed knowledge/status/harness/review-circles-gate-6c9b9dc3-wave11.txt (sha 6e67f50c), promoted, offc twin installed, registered; served /api/gate_run GREEN exit 0 (job 1790440554). 2026-09-26 land W11 SEAT CIRCLES-CONSOLIDATE guardian links BY ACTS (debt 1790372549, REVIEW R2c2): a guardianship comes into being only when the YOUTH names the adult (ccl_guardian_name, the actor must be the youth, CCL_NOT_ACTOR -22) and the ADULT takes it by their own act (ccl_guardian_take, the actor must be that adult and the one named, CCL_NOT_NAMED -23), and the consent owner nx_connect_family fam_guardian_consent is the door that takes it: an unlinked adult the youth named becomes the guardian only inside their own verifiable consent, after every check passes (a failed method takes no link), with a FAM_EV_LINK row landing with the consent row (FAM_LINK_ROWS 2, refused FULL together); an unlinked adult never acts on a youth who holds their own consent; a linked guardian consents exactly as before, so the api_lib family_consent verb is unchanged. ccl_link_write is the one slot writer both doors call. Family lib buildroot/runtime/_hdl_build/nx_connect_family.nx 354445e0 29209 B to 6561a358 30381 B (banked knowledge/bank/nx_connect_family.nx-354445e0-20260926-wave11). RED 88/94 on the old family code (job 1790439902: the named coach's strong consent -102 FAM_NOT_GUARDIAN vs 1, weak -102 vs -104, link 0 vs 1, history 10 vs 12, kind -1 vs 6, self-naming 1 vs -22); GREEN 94/94 (job 1790440143). Circles gate guardian teeth RED on the planted phase (a take by someone else 1 vs -22, self-naming 1 vs -22, a never-named take 1 vs -23, a link stood 1 vs 0) and GREEN on the fix. Family gate e4955af5 26100 B to 90f53e03 28668 B (its five fixture links now named and taken; it installs the youthsafe policy and one band row for its three minors so the circles lane it narrows still opens; section 6 on a niece added last) SHIPPED 42474d04, one lost run = the symbol ccl_link_guardian (allow_loss_v1 a3311498), review knowledge/status/harness/review-family-gate-42474d04-wave11.txt (sha ce390116), promoted, offc twin installed, registered; served /api/gate_run GREEN exit 0 (job 1790440637). 2026-09-26 land LIFECYCLE SUPERSEDED (wave 11): nx_connect_circles ccl_link_guardian, the actor-less guardian link (any adult linked to any minor on nobody's act). Successor: ccl_guardian_name (the youth's act) plus ccl_guardian_take (the adult's act), taken through nx_connect_family fam_guardian_consent. Behaviour kept byte-for-byte (a one-line wrapper over ccl_link_write) ONLY because callers remain that this seat does not own, each named with its line: nx_connect_api_lib L751 L752 L755 L756 (the synthetic what-if community behind lang_match, share_match and family_consent, the wave-10 lane), nx_connect_study_gate L196 L300, nx_connect_langcircle_gate L147 L148, nx_connect_service_gate L248, nx_connect_activity_gate L342, nx_connect_personhood_gate L145 (nx_absent ccl_link_guardian over buildroot/runtime matches=21 corpus_complete=1 before this change); migrated by this seat: nx_connect_circles_gate (4 calls) and nx_connect_family_gate (5). MINING RECEIPT: the door carried rules and no act -- minor and adult members only, two links at most, ALREADY idempotent, FULL named -- and every rule lives on in ccl_link_write; it carried no API route, plan step, clock row, RACI row or MCP verb of its own (reachable only through those callers). ARCHIVED when nx_absent ccl_link_guardian( reads only the definition. The ACTUAL latent part of debt 1790372549 stays OPEN until then: the api_lib what-if community still links by fiat (no real account behind it), and no served door creates a link for a real member either way. 2026-09-26 measure W11 closure of the circles and family change, each a qualify build of the CURRENT sources (compile plus run checks, NOT promoted; each rewrote only its own _build fossil, the live binaries stay their owners'): nx_connect_api_gate 29/29 GREEN (job 1790440254, the wave-10 api lib 26d83c5b over the new circles and family: family_consent, youth_peer, lang_match and share_match hold), nx_connect_personhood_gate 65/65 (job 1790440258, cvh_guardian_act over the new consent door), nx_connect_langcircle_gate 47/47 (job 1790440312), nx_connect_service_gate 135/135 (job 1790440316), nx_connect_study_gate 68/68 (job 1790440396), nx_connect_activity_gate 67/67 (job 1790440400). The alpha and production daemons were not built, restarted or deployed by this seat; nx_connect_appd, nx_connect_serve and nx_connect_api_lib (wave-10 lane) were not edited; a later appd build carries circles ca36872b and family 6561a358, whose decisions for every api_lib call are unchanged (no api_lib call reaches ccl_channel, ccl_guardian_name or a named-unlinked consent). 2026-09-26 queue W11 OPEN under debt 1790372882 (left OPEN, its consolidation is not complete): two more routes decide whether two minors may pair without the youth rule -- nx_connect_langcircle clc_circle_match and nx_connect_service csh_share_match each call yw_may_channel directly and never ccl_channel (txtscan: one yw_may_channel call in each, zero ccl_channel in langcircle), so two far-band minors can still be matched there, and lang_match and share_match are WIRED on the front door (their verbs take no youth band input, so they cannot express the band); api_lib youth_peer calls ysf_peer_may_connect directly (it agrees with ccl_channel now, but is a second entry point). Recipe: a match proposal between two minors applies the youth rule's band span through a circles helper over ccl_youth_band and the policy span, and the two verbs gain a youth band field. Under debt 1790372549 (left OPEN): migrate the six callers the lifecycle row names off ccl_link_guardian (api_lib L751-756 is the wave-10 lane: name then take, or name then fam_guardian_consent in the family verb), then archive it; the vouch and age-band halves of that row are untouched by this seat. 2026-09-26 land W11 CIRCLES-CONSOLIDATE moved two more callers off the SUPERSEDED ccl_link_guardian onto the acts (the youth names, the guardian takes): nx_connect_langcircle_gate L147 L148 (source 18689 to 18936 B sha256 94f70e02) SHIPPED 4478bca5 and nx_connect_study_gate L196 L300 (24123 to 24203 B sha256 cd02de64) SHIPPED ef642591; each lost only the symbol ccl_link_guardian (allow_loss_v1 a8227bac and ff1a7c8a) and behave read IDENTICAL live against staged (langcircle 5313 B both, first_diff_off -1), prove 47/47 and 68/68 GREEN, promoted, offc twins installed. Pre-edit sources were not banked by copy; each edit is one exact reversible replacement recorded here. Callers LEFT on the SUPERSEDED door: nx_connect_api_lib L751 L752 L755 L756 (wave-10 lane), nx_connect_service_gate L248 and nx_connect_activity_gate L342 (both edited by other seats since the wave-7 rows -- 46385 and 28564 B against 39851 and 26705 then -- so not touched here), nx_connect_personhood_gate L145 (shipped by wave-10 RESUME-YOUTH this morning). Tracked as debt 1790440898. 2026-09-26 measure W11 CIRCLES-CONSOLIDATE closing proofs: (1) the SUPERSEDED comment in nx_connect_circles was rephrased as a rule instead of a caller list (a list goes stale at every migration): lib ca36872b 50063 B to 9e4bace7 49987 B, comment-only, and nx_sov_build_run nx_connect_circles_gate --build-only (job 1790441307) rebuilt BYTE-IDENTICAL to the promoted 6c9b9dc3 (nx_filehash cmp identical=1, 139520 B), so no re-ship and BUILT equals PROMOTED; (2) the serve closure: nx_connect_auth_gate imports nx_connect_serve, which imports nx_connect_circles, and it read 12/12 GREEN on the current tree (job 1790441345), so an alpha or production appd build of today's sources compiles circles and its new youthsafe import. DECLARED unpromoted builds (compile plus run checks of other owners' gates, their live binaries untouched): _build fossils of nx_connect_api_gate, nx_connect_personhood_gate, nx_connect_service_gate, nx_connect_activity_gate and nx_connect_auth_gate (BUILT 519808 against PROMOTED 519024) now carry the new circles and family. Final source hashes: circles 9e4bace7 49987 B, family 6561a358 30381 B, liquidity c9fe201e 20131 B, each stable across every build of this seat after its last edit; wave-10 ALPHA land row still absent at 1790441400, so this seat edited after its 40-minute wait bound (first CAS edit 1790439447). 2026-09-26 land W13 SEAT CONSOLIDATE (T0 1790453516; waited for and read the W10 ALPHA-REBUILD FINAL row 1790442100 before touching the alpha closure) debt 1790440898 CLOSED IN SOURCE: the actor-less guardian link has no caller left and is ARCHIVED. Every caller now makes the link by the two acts (the youth names, the adult takes): nx_connect_api_lib gains ca_guardian_link (ccl_guardian_name by the youth, then ccl_guardian_take by the adult, a refused naming returned as is) at its five sites (ca_ring2 four, ca_v_family one); nx_connect_service_gate names then takes (plus neg-control no adult takes a guardianship the youth did not name, CCL_NOT_NAMED); nx_connect_activity_gate names then takes in its youth loop; nx_connect_personhood_gate names, proves the naming alone links nobody (neg-control), then takes under the old tooth name. Qualify GREEN on the migrated sources: api gate 29/29 (job 1790454378, lang 449 share 443 family 451 reply bytes as before), service 136/136 (1790454381), activity 67/67 (1790454388), personhood 67/67 (1790454390). SHIPPED service gate 045a4974 (later 1f18c9ef on the new service lib), activity gate 64cc900a (behave IDENTICAL), personhood gate 28386b84; each lost exactly one run, the symbol name ccl_link_guardian (loss records 01351583 5833a381 70716223; reviews knowledge/status/harness/review-service-gate-045a4974-wave13.txt c15affe8 and review-personhood-gate-wave13.txt 0b191d03). ARCHIVE (lifecycle SUPERSEDED to ARCHIVED): circles 9e4bace7 49987 B banked at knowledge/bank/nx_connect_circles.nx-9e4bace7-20260926-wave13 (copy verified byte for byte), the wrapper and its SUPERSEDED note removed from the lib, its text kept reversibly at knowledge/retired/nx_connect_circles.ccl_link_guardian-20260926-wave13.nx; mining receipt stays row 1790440703 (rules only, all in ccl_link_write; no route, plan step, clock row, RACI row or MCP verb). CENSUS grep ccl_link_guardian over buildroot/runtime: 11 lines before (job 1790453875), ccl_link_guardian( matches=0 after (job 1790456178, 26660 files, coverage_complete=1 corpus_complete=1), so the compile now refuses any caller that comes back. HONEST RED: a behaviour-neutral migration has no behavioural RED; its RED is that census plus the archive compile, and every migrated link is decision-identical by construction (the same minor, adult, ALREADY and FULL rules in ccl_link_write; the naming slot returns to CCL_NONE on success). 2026-09-26 land W13 CONSOLIDATE debt 1790372882: ONE contact predicate for a private pairing nobody has accepted yet. nx_connect_circles gains ccl_pair_propose(st,a,b,lane), which IS ccl_channel with both asks taken as the proposed lane and no relationship row required: reach first, two minors through the ONE youth rule over the SAME fill (ccl_youth_decide, factored out of ccl_youth_channel, which now only reads the row's asks, so ccl_channel decides exactly as before: circles gate 95/95 and family gate 94/94 unchanged, jobs 1790455713 1790455718), the two-deep wall, then a block on the pair's row. nx_connect_langcircle clc_circle_match (one to one) and nx_connect_service csh_pair_lane and csh_pair_ok (the one-to-one need, the share match, the share pickup release) now ask it and never yw_may_channel (census yw_may_channel( over _hdl_build: langcircle 0, service 0, job 1790456184); new named refusals CLC_FAR_BAND -8 CLC_YOUTH_BAND -9 CLC_YOUTH_POLICY -10 CLC_BLOCKED -11 and CSH_FAR_BAND -23 CSH_YOUTH_BAND -24 CSH_YOUTH_POLICY -25 CSH_BLOCKED -26. The front door: nx_connect_api_lib lang_match and share_match take two OPTIONAL youth band rows after the thirteen arguments (a_yb b_yb; echoed only when passed), install the youthsafe policy on the synthetic pair (ca_youth_rows) and name the new refusals. RED then GREEN: langcircle gate 49/50 on the old code (job 1790455170, weight_youth_far_band=50: two youth two band rows apart were paired one to one) then 52/52 (job 1790455707, plus the refusal is CLC_FAR_BAND and the pairing equals ccl_channel for that pair, neg-control the same two still practise in a visible group); api gate YS-T1 YS-T2 RED 29/31 on the old api lib (job 1790455903) then GREEN 31/31 (job 1790456146). Closure GREEN on the final libs: service 136/136 (1790455709), study 68/68 (1790456762), activity 67/67 (1790456770). SHIPPED: langcircle gate 0f1ebe11, circles gate aeaf8e91, service gate 1f18c9ef, api gate c20c5547 (lost runs ccl_link_guardian and csh_pair_ok, symbol names only; review knowledge/status/harness/review-api-gate-wave13.txt 91b5cbc7), nx_connect_api 890edc6e noregister (the producer behind the registered nx_connect row; lost the same two symbol names, loss record 5ef01897). A/B against .prev = 2c2b2521 (the pre-change artifact, hash-verified): lang_match minor with own guardian IDENTICAL 450 B (ship probe), family_consent linked IDENTICAL 464 B, share_match adult pair IDENTICAL 444 B, and lang_match two minors with no band row DIFFERS 450 to 424 B at 258 by design (match became youth_band). WHAT STAYS: the alpha (ac638880) and production (e0998c6b) daemons carry the OLD libs until their owners rebuild; wall-only wrappers remain that read no youth band and pair no circles members on a served path: signup csu_may_channel (signup gate only), faith cfa_may_channel, serve cs_wall_row (a display row), the api_lib v1 youth verb (the raw wall calculator), and api_lib youth_peer is the youth rule's own calculator verb over raw inputs. 2026-09-26 land W13 CONSOLIDATE debt 1790372702, the REQUEST half: a contact request asks the ONE discovery owner. nx_connect_circles imports nx_connect_antistalk and gains a runtime antistalk slot (CCL_H_AST, installed by ccl_set_antistalk after every init or reload, carried by ccl_copy_into, never persisted, like CCL_H_YSF) and a request scratch after the youthsafe one (CCL_H_ORQA, AST_RQ_SLOTS plus the why slot; header 25 to 27 slots, sized by ccl_state_slots so every caller follows), plus ccl_may_discover(st,path,viewer,target,shared,vouched), which fills ast_may_discover's request from the circles rows (both bands, the guardian pair; no personhood claim presented) and returns its answer, fail closed with no state installed. ccl_ask now asks it on AST_PATH_REQUEST with SHARED = the live reach: a block hides the pair both ways, a non-guardian adult never singles a minor out, a hidden target answers CCL_UNREACHABLE as a stranger's request does. RED 98/101 on a planted phase carrying the new API and the old ccl_ask (job 1790457419: exactly the adult-singles-a-minor tooth, actual 1 expected -1, and the two block teeth) then GREEN 101/101 (job 1790457546), neg-controls the youth may still ask the adult and once unblocked the member may ask again. The only ccl_ask callers (census: circles gate 15 calls, family gate 5, no served caller) install a state: family gate 94/94 (job 1790457551). Closure GREEN on the final libs (circles 8bb532e3 54971 B): api 31/31 (1790457556), service 136/136 (1790457595), langcircle 52/52 (1790457599), personhood 67/67 (1790457603), study 68/68 (1790457675), activity 67/67 (1790457683). SHIPPED on the final layout: circles gate a2437a41, family gate 403e826e, api gate a9337e7b, service gate ad93fb28, langcircle gate da6689d8, personhood gate 0b2416c9, nx_connect_api 2ebc7e32 noregister (behaviour IDENTICAL on the ship probe); activity and study gate re-ships in flight (jobs 1790457860 1790457863). Debt 1790372702 EATEN (job 1790457835), SUPERSEDED by 1790457815 for the listing half. 2026-09-26 queue W13 CONSOLIDATE what stays open. (1) debt 1790457815 (supersedes 1790372702): nx_connect_service csh_visible and csh_share_visible still decide listing visibility by reach alone (csh_share_visible is on the served path through share_match) and nx_connect_faith cfa_discover is still a discovery rule; the recipe and the measured knock-ons are in that row (service gate csh_visible teeth, the api_lib synthetic pair must install an antistalk state through the existing CA_AS_ROWS and CA_AS_CLAIM_BYTES, and api gate T23 reads invisible instead of walled in the opt-in worldwide ring -- adjudicate before shipping). Not started this leg: it changes a served verb's answer and could not be finished and shipped inside the time box. (2) debt 1790456699 (supersedes 1790372549) carries the age-band and consent one-owner items, NOT re-measured this leg. (3) The alpha (ac638880) and production (e0998c6b) daemons still carry the OLD circles, service, langcircle and api libs; the alpha rolls out through the alpha lane (operator: alpha is alpha); the appd closure was NOT built by this seat (reasoned safe: antistalk and circles were already both in the appd closure through the api lib, and every importer gate plus the api gate built GREEN on the final libs; UNVERIFIED). (4) The lang_match and share_match catalog rows (CA_LM_ARGS CA_SM_ARGS) do not yet name the optional a_yb b_yb rows: a discoverability gap for agents. (5) nx_connect_api was shipped twice this leg (890edc6e then 2ebc7e32), so .prev holds 890edc6e and the pre-change 2c2b2521 has no rollback slot and was not banked by this seat; alpha-stage, and the A/B probes against it were taken while .prev still hash-verified as 2c2b2521. (6) Wall-only wrappers left for their owners, none on a served pairing path: signup csu_may_channel (signup gate only), faith cfa_may_channel, serve cs_wall_row (a display row), the api_lib v1 youth verb. (7) nx_gate_bite was not run over the new teeth; the RED runs on the old code (langcircle 49/50, api 29/31, circles 98/101) are the planted-bad proof. 2026-09-26 lesson A match proposal is not a channel. The brief said route the language match and the share handoff through ccl_channel, but ccl_channel demands an accepted relationship row, so a literal routing would have refused every new language partner and every neighbour seed exchange (NO_ACCEPT) and changed the served verbs for adult pairs too. The single predicate that fixes the far-band hole without that damage is the channel with the proposed lane taken as both asks (ccl_pair_propose), sharing ccl_channel's youth fill (ccl_youth_decide) so the two can never answer two minors differently -- W11's own queue row 1790440706 had already named that recipe. Read the prior seat's recipe before taking a brief's verb literally, and when shipping the same target twice in one leg, bank the pre-change artifact first: the second ship moves .prev off the baseline.

CN15 Christian traditions at equal fidelity · cell LANDED · gate NO-GATE-DECLARED

Contract	`cfa_tradition_admit` · executor Organ · 1 u · stands on nothing
Definition of done	Growth from Latter-day Saints to other Christians: every Christian tradition (Catholic, Orthodox, the Protestant families and the Restoration churches including The Church of Jesus Christ of Latter-day Saints) self-identifies at the same depth from a data table under each church preferred name; faith is optional, self-declared and consent-gated as a special category, a discovery signal weighted by the member own stated importance, never an enforced filter, and no copy speaks for any church; done-rule: every table row admits at equal depth, an undeclared tradition is refused rather than guessed, withdrawing consent removes the member from faith discovery at once, and the youth wall verdict is identical with and without faith -- STATUS 2026-09-25 (SYNC, verifier CONFIRMED): lib runtime/_hdl_build/nx_connect_faith.nx 22406 B sha 2b6e19b6 declares cfa_tradition_admit over knowledge/connect_faith_traditions.conf (16 traditions, 63 churches under each church preferred name; the Pew landscape-study mirror was withdrawn as a ref because its fetch redirected); consent is explicit and withdrawable as GDPR Art. 9 and Art. 7(3) require [gdpr-art9] [gdpr-art7]; nx_connect_faith_gate 63/63 GREEN re-run by the verifier and bite-killed 1 of 1, promoted 39bd51a7, rostered; the gate proves every done-rule clause. Open before acceptance: faith discovery lists minors to minors across the whole population with no circle or guardian scope (a policy decision before any route), the importance scale calibration is UNVERIFIED, nothing is served, operator acceptance outstanding
Matrix cell	Christian traditions at equal fidelity (self-declared, consent-gated, never a filter) · `runtime/_hdl_build/nx_connect_faith.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_faith`; declare `nx_connect_faith TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790355005 routed by nx_intake_route (operator-seat, epoch 1790356452) from pm-seat: R5 of parent REQ 1790355000: grow from Latter-day Saints to other Christians at equal fidelity -- each tradition admitted with its own preferred name, its own congregation structure and its own circle -- sponsor intake-1790355005 plus2 2026-09-25 land cfa_tradition_admit LANDED as source: lib buildroot/runtime/_hdl_build/nx_connect_faith.nx 22406 B sha256 2b6e19b6 (exact lookup only, Art.9 consent, Art.7(3) withdraw clears the record, signal = incumbent gx_mp_faith taken per level and weighted by the viewer own importance, headroom blend never a filter, peer-banded discovery, cfa_may_channel = yw_may_channel) + DATA knowledge/connect_faith_traditions.conf 6824 B sha256 12111e2e (16 traditions, 63 churches under their own preferred names, one importance scale row from the Pew four-level item, no weight column) + gate nx_connect_faith_gate.nx 25273 B sha256 fe1c4d54; nx_sov_build_run --qualify GREEN 63/63 run-exit=0 artifact 81736 B sha256 211bbf09; values: table_rung=2 admitted 16 at depth 1 + 63 at depth 2 refused 0 shallow 0, tradition match 50 church match 100 cross-tradition pairs 0, 5 undeclared probes refused 5 (a prefix guesser admits 3), wall 320 cases lib mismatch 0 faith-trusting twin 12, discovery 2 then 1 after withdrawal; OPEN: bite RED proof, ship, roster 2026-09-25 measure BITE-PROVEN by hand on the done-rule withdrawal clause: planted cfa_withdraw without its record clear (lib 22406 to 22385 B) and nx_sov_build_run --qualify read RED 59/63 run-exit=1 with exactly the four withdrawal teeth failing (listed after withdrawal actual=1, discovery 2 not 1, own query 2 not 0, still in ring) while every other tooth held; restored byte-identical (sha256 2b6e19b6 22406 B, same as before the plant) and the rebuild read GREEN 63/63 run-exit=0 on BUILD-CACHE key 3d4ec4f6, the same key as the first GREEN; mirrors for the BOARD seat refs: knowledge/fetched/cmp_connect_gdpr_art9.html 91559 B sha256 24fde5a6 (Art 9 special categories, religious beliefs) and knowledge/fetched/cmp_connect_gdpr_art7.html 87413 B sha256 3a998bda (Art 7(3) withdrawal as easy as giving), both read and grepped this session 2026-09-25 land SHIPPED nx_connect_faith_gate by nx_organ_ship (build, prove, promote, offc-twin, register): sha256 39bd51a7 prove=GREEN 63/63 on the fresh build, first promote (adoptgate announced no live elf), _offc twin installed, REGISTERED callable=1 schema=0; /api/gate_run on the promoted binary FAST exit_code 0 verdict GREEN 63/63 with table_rung=1 (the nishihost root, the connect daemon CWD) against rung 2 under the build lane, both reading 16 traditions and 63 churches; admitted to knowledge/gateroster.conf with its evidence comment; the watch row runtime/_hdl_build/nx_connect_faith.nx symbol cfa_tradition_admit now resolves (lib is a LIB, no binary by design); OPEN: integration into nx_connect_serve by the INTEGRATOR seat (the faith section of the profile page, the withdraw route, the CN14 ring calling cfa_in_ring and cfa_other_tradition), the Pew four-level importance item cited in the conf row is UNVERIFIED from its mirror (knowledge/fetched/cmp_connect_pew_importance.html 864223 B sha256 63e35c7e is a script-rendered page; literal probes for the level labels read 0 over markup, so UNPROVEN, not absent) 2026-09-25 retract the scale row of knowledge/connect_faith_traditions.conf first cited the Pew importance-of-religion item and its four response labels as its calibration without an artifact; the mirror knowledge/fetched/cmp_connect_pew_importance.html (864223 B sha256 63e35c7e, fetched twice, the 2014 URL redirects to the same bytes) is script-rendered and literal probes for the labels read 0 over markup, so the row now says CALIBRATION UNVERIFIED and stays a person-picked four-level scale (conf now 7103 B sha256 cbe0e051; promoted gate re-run through /api/gate_run FAST exit_code 0 GREEN against it); the same mirror DOES carry the Pew RLS religious tree (Mainline 325 hits), the published two-level family and denomination mechanism this table follows, and it labels the tradition Latter-day Saint (Mormon) where this table uses each church own preferred name: the naming exceed is on the record, the bar is Pew RLS 2023-24 tree 2026-09-25 queue for the INTEGRATOR (owns nx_connect_serve and nx_connect_appd): import nx_connect_faith.nx; at start cfa_load_default(which) (daemon CWD nishihost root reads rung 1; cfa_ok 0 renders the faith section refused by name, never guessed); GET profile faith lists cfa_ntrad, cfa_trad_code, cfa_trad_name, cfa_nsub, cfa_sub_code, cfa_sub_name, cfa_sub_parent, cfa_levels and CFA_PROMPT as zero-JS selects plus a consent box; POST calls cfa_tradition_admit(tab, trad, sub, consent, importance, m) on the member CFA_REC_SLOTS record persisted by acc_save and renders each CFA_REFUSE verdict by name; POST withdraw calls cfa_withdraw(m); for CN14 the ring predicates are cfa_in_ring(m) and cfa_other_tradition(a, b) and the peer-banded query is cfa_discover(tab, viewer, band, pop, bands, n, out) fed the verified hmix band; ranking blends with cfa_rank(gx_graph_score(...), cfa_signal(tab, viewer, cand)); faith paths open channels only through cfa_may_channel; for the BOARD seat: refs to pin are the GDPR Art 9 and Art 7 mirrors (cmp_connect_gdpr_art9.html sha256 24fde5a6, cmp_connect_gdpr_art7.html sha256 3a998bda) and the Pew 2023-24 RLS interactive database mirror (cmp_connect_pew_importance.html sha256 63e35c7e, DOI 10.58094/3zs9-jc14) as the tree bar 2026-09-25 measure VERIFIER CONFIRMED 63/63 -- independent re-run /api/gate_run job 1790357799 exit_code 0 GREEN 63/63 table_rung=1; lib 22406 B sha256 2b6e19b6, gate src 25273 B fe1c4d54, table 7103 B cbe0e051, promoted gate 94472 B 39bd51a7 all match the builder; func cfa_tradition_admit declared once; table recounted by hand 16 traditions 63 churches names only; nx_gate_bite 2 sites killed=1 of valid_mutants=1 (cmp site off 6496, first-kill-wins) twins restored byte-identical; OPEN: faith discovery is a population-wide listing incl minor-to-minor peers with no circle or guardian scope, which needs a policy decision against so_add_by_token consent-only discovery before any route serves it; bands are caller-supplied so the integrator must pass verified hmix bands; watch row still _ABSENT_ until the next regen; nothing served on nishifamily.com; NAS job ids ran about 100 s ahead of nx_fs now_sec 2026-09-26 land RESUME-YOUTH wave 10 finished the wave-8 FIX-YOUTH faith leg (debt 1790372702 faith part, R3c ACTUAL): cfa_discover asks the ONE discovery owner nx_connect_antistalk ast_may_discover on AST_PATH_SEARCH for every candidate over the caller request rows (AST_RQ_SLOTS: shared context, blocks both ways incl the personhood claim, the minor rules) and only then applies the peer band and the faith signal; no antistalk state, no rows or a missing row lists nothing (fail closed); this seat replaced the predecessor per-query sys_mmap why slot (a small arena bump a serving daemon never gets back) with out[cnt] as the owner why out-parameter, so a query allocates nothing, and named the owner in the header. Lib sha256 970ca6ac 24007 B, gate efff6eb3 27759 B. GREEN qualify 67/67 (job 1790437384); RED 65/67 on a planted revert that ignores the owner (job 1790437654: the no-shared-context tooth actual 1 expected 0 and a-block-hides-a-faith-match-inside-a-shared-ring actual 1 expected 0), revert restored byte-identical (970ca6ac re-hashed, window about 2 min); nx_organ_ship SHIPPED nx_connect_faith_gate 675a20f1 prove GREEN, promote live = staged 675a20f1, offc twin installed, registered (job 1790438051); one lost run = the old tooth peer-band-a-minor-query-lists-the-minor-peer that pinned the global search (allow_loss_v1 021e894b), behavior review knowledge/status/harness/review-faith-gate-675a20f1.txt; prior gate banked nx_connect_faith_gate.elf-pre-resumeyouth-20260926 (94472 B). Still owed under 1790372702 (left OPEN): csh_visible and csh_share_visible (nx_connect_service) and ccl_ask (circles) ask ast; NOT LIVE: api_lib wires only faith_admit and faith_other, cfa_discover has no serving caller. 2026-09-28 measure W16 SEAT FAITH-RANKING (T0 1790613058, debt 1790461582) START: banked lib nx_connect_faith.nx 970ca6ac 24007 B at knowledge/bank/nx_connect_faith.nx-970ca6ac-20260928-wave16, the wave-15 gate source 549d925d 39659 B at knowledge/bank/nx_connect_faith_gate.nx-549d925d-20260928-wave16 and the promoted gate 675a20f1 105352 B at knowledge/bank/nx_connect_faith_gate.elf-675a20f1-20260928-wave16 (nx_filecopy verified=1 each). RED ON THE OLD LIB: the wave-15 gate source, whose ranking teeth drive cfa_discover through the one adapter cfgt_ranked, qualify job 1790613393 passed 71/90 verdict=RED (build 66cbc8b8 118096 B); every failure is a ranking tooth -- the owner shows 4 and cfa_discover lists 2 (its faith-signal filter), population order instead of score order, the guardian's own minor and every adult hidden from a minor viewer (its peer band), a viewer at importance 0 lists nobody, a withdrawn member vanishes instead of ranking with the no-faith members; the owner teeth (a member ast_may_discover hides stays hidden, a minor never surfaces to an unrelated adult, fail closed without state or rows) already PASS. Census: cfa_discover has exactly one caller, the gate adapter (nx_shelltool grep over buildroot/runtime job 1790613080, 26985 files, coverage_complete=1 corpus_complete=1); nx_connect_api_lib imports the lib for faith_admit and faith_other only, so no front-door verb uses it. Wave 15 left no plan row; its gate header claims a clock-seeded load population the source does not build (CFGT_LOAD_EXTRA declared and unused). 2026-09-28 land W16 SEAT FAITH-RANKING (debt 1790461582) SOURCE LANDED, GATE GREEN, NOT YET SHIPPED: nx_connect_faith.nx 970ca6ac 24007 B to 36ea0569 27249 B -- cfa_rank_visible is the faith ranking over the ONE discovery owner: every member nx_connect_antistalk ast_may_discover shows on the search path is listed (never a filter, never a second discovery rule), scored cfa_rank(base, cfa_signal) and ordered highest first with a tie in population order by an in-place heapsort (cfa_rank_order, O(m log m), no allocation, CFA_HEAP_ARITY a named UNIT), the viewer excluded by pointer and by the owner's SELF answer, fail closed without state, rows or a row; cfa_signal gives a missing record no signal. Gate source 549d925d 39659 B to cad62b80 47317 B: the one adapter cfgt_ranked now drives cfa_rank_visible and the order teeth judge the subject's own scores; NEW section D builds the load population the wave-15 header promised and the source never built (every table row a member plus the viewer and a no-faith member, 81, from a printed clock seed: bands, rings, guardian pairs, vouching, blocks both ways, bases in GX_EXCLUDED..full; three anchors make its condition reachable by construction -- a listed faith lift, a hidden member carrying a faith signal, a score tie) with teeth lists-exactly-the-owner-set and oracle-order-and-scores at scale, plus the neg-control the header also claimed and lacked: the agreement check catches a list differing from the oracle only in the tie rule. RED on the old rule twice: 71/90 (job 1790613393, wave-15 teeth) and 74/96 on a planted revert of the adapter to cfa_discover with every new tooth present (job 1790614445: load lists 1 of 23 the owner shows, oracle order 0); GREEN 95/95 with cfa_discover still present (job 1790614293) and 96/96 after it was ARCHIVED (job 1790614679, build 4674e517 129336 B, load seed 1790614679442452: owner shows 17, listed 17, 4 hidden faith bearers, 2 adjacent ties). LIFECYCLE SUPERSEDED then ARCHIVED: cfa_discover removed from the lib (a two-line tombstone names the path), its text kept reversibly at knowledge/retired/nx_connect_faith.cfa_discover-20260928-wave16.nx (4461 B sha256 c1277bd0) with the MINING RECEIPT: owner test on the search path KEPT, viewer exclusion KEPT plus the SELF answer, allocation-free why slot KEPT, peer band RETIRED (its adult-to-minor half is the owner's AST_WHY_MINOR_ADULT; its minor-to-adult half was stricter than the owner and is NOT carried -- a youth-search rule would belong in ast_may_discover), faith-signal filter RETIRED, population order SUPERSEDED by score order; no MCP verb, API route, plan step, clock row, RACI row or ritual. CENSUS cfa_discover( over buildroot/runtime: 1 call before (the adapter, job 1790613080), matches=0 after (job 1790614690, 26993 files, coverage_complete=1 corpus_complete=1), so the compile refuses any caller that comes back. NOT LIVE: the ranking has no serving caller yet; nx_connect_api_lib and nx_connect_appd import the lib for faith_admit and faith_other, so their next rebuild carries the new closure (no verb behaviour changes). 2026-09-28 land W16 SEAT FAITH-RANKING SHIPPED (debt 1790461582): nx_organ_ship nx_connect_faith_gate job 1790615017 SHIPPED 4674e517 129336 B (was 675a20f1 105352 B, banked first at knowledge/bank/nx_connect_faith_gate.elf-675a20f1-20260928-wave16): prove GREEN 96/96 on the fresh build; content RED by design with all 13 lost runs enumerated (display_limit=all, omitted 0) and approved by allow_loss_v1 65c79398 (knowledge/status/harness/loss-65c793981a779453ab27462afa18e4e5d8a8032b7c7bc2b4a849e8ba000bf13a.record): ten teeth of the retired discovery rule and its old verdict note, each superseded by a named ranking tooth or retired on purpose (peer-band-a-minor-query-never-lists-an-adult), plus the symbol names cfa_discover and cfgt_listed; behaviour DIFFERS 6692 to 10025 B, reviewed in knowledge/status/harness/review-faith-gate-4674e517-wave16.txt (sha256 35b31eb7, observation 7a81db83); promote live = staged 4674e517, _offc twin installed and hash-identical (nx_filehash cmp identical=1), already registered, already rostered (3 rows in knowledge/gateroster.conf). SERVED: /api/gate_run nx_connect_faith_gate job 1790615054 exit 0 GREEN 96/96 from the nishihost root (table_rung 1; load seed 1790615049452242: owner shows 24, listed 24, 4 hidden faith bearers, 4 ties). IMPORTERS: nx_connect_api_gate qualify job 1790614755 GREEN 31/31 on the new faith lib closure (faith_admit and faith_other unchanged). FOR THE SEATS THAT BUILD nx_connect_appd OR nx_connect (CONNECT-SHIP-2, SEALED, FRONTDOOR-FINISH): every build after 1790614659 compiles faith lib 36ea0569; a content ruler over a debug build may read the symbol-name run cfa_discover as LOST and cfa_rank_visible, cfa_rank_order, cfa_rank_sift, cfa_rank_swap and cfa_rank_before as GAINED -- benign (no string literal of the lib changed and no verb calls either); the receipt is this row plus knowledge/retired/nx_connect_faith.cfa_discover-20260928-wave16.nx. No re-ship of nx_connect: no front-door verb used cfa_discover (the served binary carries it as dead code until its next build). 2026-09-28 queue W16 FAITH-RANKING REQUEST for wave 17 FRONTDOOR-FINISH (owner of nx_connect_api_lib and nx_connect_api per row 1790614470; this seat did not edit either): the faith ranking nx_connect_faith cfa_rank_visible, shipped this wave, has no serving caller -- BUILT and UNWIRED. Wire it as a front-door verb faith_rank over a synthetic population the caller describes, the way antistalk_discover already does: the viewer's tradition, church and importance; per candidate its tradition, church, consent, band, shared context, guardian pair, vouching and any block (either direction, account or claim); an optional base per candidate; answer the ordered list with each score, the owner's public answer for the hidden (a stranger's), and nothing stored; engine name nx_connect_faith.cfa_rank_visible, rung CN15. Api gate teeth to carry: a member the owner hides stays hidden whatever their faith, a withdrawn member ranks at the no-faith position, a minor never surfaces to an unrelated adult, the order equals a brute-force oracle, plus a neg-control each. The alpha HTTP door inherits the verb through ca_dispatch on its next build; the faith gate's teeth already pin the engine (96/96 served). 2026-09-28 measure W16 SEAT FAITH-RANKING CLOSE (T0 1790613058): (1) debt 1790461582 EATEN (job 1790615183, DEBT-EATEN at_idx 4530, open 2951) -- its last open item was this faith rule, and its alpha clause had already been settled by row 1790463100 (the alpha answers share_match with the new listing rule). (2) EVIDENCE WIRED: knowledge/compare/connect.gates gains nx_connect_faith_gate (the map's own header asks for every built GREEN sibling gate), and nx_swcompare_evidence connect (job 1790615312) forked all 6 gates GREEN, faith 96/96, verdict MEASURED-HONEST. (3) Two header sentences of the lib still said faith discovery; rewritten line for line to name the ranking, lib dd292886 27247 B; the gate rebuilt from it is BYTE-IDENTICAL to the promoted 4674e517 (qualify job 1790615401, cache miss, 96/96), so the served gate is current and the edit is proven comment-neutral (36ea0569 and dd292886 differ in comments only). (4) PUBLISHED: connect regen job 1790615455 GREEN (index.html 1053997 to 1073093 B), youthsafety regen job 1790615500 GREEN (332353 to 335966 B), nx_page_verify GREEN on both (jobs 1790615497 and 1790615543; static checks, browser rendering unverified). (5) OPEN, each named for its owner: the ranking's front-door verb faith_rank (row 1790615101, wave 17 FRONTDOOR-FINISH); whether youth search should list adults at all (youthsafety row 1790615102, the ast_may_discover owner); nx_gate_bite over cfa_rank_order and cfa_rank_before NOT run, because the lib sits in the closure of nx_connect_appd, which CONNECT-SHIP-2 and SEALED build this wave, so an in-place mutant could be compiled into a production or alpha candidate -- the non-vacuity evidence today is the two RED runs and the tie-rule neg-control, and the bite belongs in a quiet window. LESSON: a gate header that promises a fixture its source does not build (here the clock-seeded load population and the swapped-pair neg-control) reads as coverage while measuring nothing; this seat built both rather than deleting the claim.

CN16 Scripture study circles · cell LANDED · gate NO-GATE-DECLARED

Contract	`csc_circle_post` · executor Organ · 1.5 u · stands on CN14
Definition of done	A study circle is a consent-joined group following a reading plan held as data (a Come, Follow Me week or a Bible reading plan); every passage resolves through the estate verse door from the public-domain corpus (Church-copyright headings, footnotes and cross-references are never copied); members post reflections anchored to a verse reference; youth circles obey the two-deep wall on join and on leave; done-rule: the gate proves a verse-anchored reflection round-trips with its reference resolved from the corpus, an unknown reference is refused rather than guessed, and a youth circle left with one adult refuses the change
Matrix cell	Scripture study circles (reading plan as data, verse-anchored, public-domain corpus) · `runtime/_hdl_build/nx_connect_study.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_study`; declare `nx_connect_study TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790355012 routed by nx_intake_route (operator-seat, epoch 1790356472) from pm-seat: R12 of parent REQ 1790355000: scripture study circles -- a circle (family, mission, ward or friends) studies the public-domain scriptures together, posts notes on verses and keeps a shared reading pla -- sponsor intake-1790355012 plus1 2026-09-25 measure BOARD seat closing: nx_ladder connect LADDERED (22 of 22 placed; substrate 6, arm 2, contender 14); nx_barfresh connect FRESH (1 bar, 2026-09, 6 scans this month incl. meta-groups newest=2025-11 read at listing depth); nx_compare_refs_gate fleet-wide 38 of 44 RED with 0 connect lines (job 1790357448, 24163 B complete, was 37 of 44 before the gdpr-art9 re-pin); nx_compare_rank connect (job 1790357575): done=9 open=13 finish=6, TARGET VERSION 0.5 (M2) because the six M1 contract symbols sit in LIB sources the builder seats landed this leg (nx_connect_signup, circles, faith, realm, msgstore, liquidity; their gate proofs UNVERIFIED by this seat), critical path #1 CN16 priority 400 (all rivals absent), #2 CN17 and #3 CN18 priority 0 (one Part code each makes the competitive evidence INCOMPLETE, cod UNAVAILABLE), later CN2 CN1 CN7 CN9 CN4 CN8 CN12 CN11 CN10 CB3; the ranker filed CN16 CN17 CN18 into pm_intake.jrnl; OPEN: CN7 cs_sealed_aead and CN9 ct_llm_translate stay UNMAPPED (a watch on the existing serve or translate organ would read DARK, so the new organ path is a builder decision), TREATMENT NO-TREATMENT, INCUMBENTS index stale, and the /compare/connect regen for the SYNC seat 2026-09-25 land nx_connect_study LANDED as a lib (buildroot/runtime/_hdl_build/nx_connect_study.nx 26067 B, entry csc_circle_post plus csc_join csc_leave csc_bind csc_load csc_post_emit): a study circle IS a CN14 circle (ccl_found ccl_join ccl_leave ccl_active; the youth wall composed as ccl_group_ok over the roster a join or leave WOULD leave, the guardian exception included), every passage and reflection anchor resolves through the verse door sc_verse (nx_scripture_lib SS1) over the public-domain corpus or is refused CSC_UNKNOWN_REF (no case folding, no trimming). DATA: knowledge/connect_study.conf (9 plan rows in two sample plans, 2 apparatus markers TG and JST each measured 0 times in the 13714803-byte corpus) and knowledge/connect_study_circle.conf (study ring, vouch 2). Gate nx_connect_study_gate 63/63 GREEN run-exit 0 (job 1790358653, build-cache key 4292d865, elf sha256 3f48beb6 110623 B). BITE: csc_leave with its wall check removed read 57/63 RED run-exit 1, tooth THE LEAVE WALL actual=1 expected=-13 (job 1790358721); restored, build-cache HIT on the original key, 63/63 GREEN (job 1790358772). Shared sources hashed before and after the runs: nx_connect_circles 7ff66d3a, nx_scripture_lib 93c22046, unchanged. Baseline named: YouVersion Bible Plans read with a church group (ref youversion, mirror offset 81196). 2026-09-25 land nx_connect_study_gate SHIPPED through nx_organ_ship (job 1790358817): fresh build b036ca8f, PROVE 63/63 GREEN on that build, first promote with live_sha equal to staged_sha b036ca8f, _offc twin installed from the promoted root binary, REGISTERED callable, DOCSTAGE documented. The served binary through /api/gate_run read exit_code 0 verdict GREEN 63/63 with the capture untruncated (job 1790358886). Admitted to knowledge/gateroster.conf as a hand-added row carrying its evidence and bite. The matrix watch row (runtime/_hdl_build/nx_connect_study.nx, csc_circle_post) now names a declared symbol, so it should flip on the next regen: NOT YET OBSERVED. 2026-09-25 queue OWED, named not hidden: (1) scripturestudy SS1 and SS2: sc_verse maps a fresh field scratch on EVERY call and scans the 13714803-byte corpus linearly, so a daemon that posts reflections leaks a small mapping per post and pays a whole-corpus scan per unknown reference; the door owes a caller-supplied field buffer and a title index (the chapter verb shares the scan). (2) posts live only in the caller's study block: the integrator persists each through nx_connect_msgstore msg_store_append with chan from msg_store_chan_yw(csc_wall_after(st, k, inst, CSC_NONE, CSC_NONE)); the reflection bytes are opaque to this lib, so a client may send them E2E-encrypted and the server stays content-blind for the member's words while it resolves only the public verse reference. (3) the wall is O(rows squared) per join, leave or post: a roster index is owed before circles reach hundreds. (4) the two plans are seat-authored SAMPLES; real Come, Follow Me weeks and Bible plans are data rows the board or the community owes, as verse titles only, never copied manual text. (5) knowledge/compare/connect.gates owes a row for nx_connect_study_gate.elf (left to the board seat, not edited here). 2026-09-25 land CONTENT-BLIND teeth added and the gate RE-SHIPPED: a reflection carrying a planted apparatus marker plus every nonzero byte value (258 bytes) is accepted and round-trips byte for byte, while the apparatus rule still judges only what is copied from the corpus (0 markers in that post's scripture text); so the lib never reads, filters or rewrites a member's words and a client may send them as E2E ciphertext. Qualify 68/68 GREEN run-exit 0 (job 1790359111); nx_organ_ship (job 1790359151) fresh build 5241cbf9 PROVE 68/68, adoptgate APPROVED content GREEN behave DIFFERS (the new teeth), promoted live_sha equal to staged_sha 5241cbf9, _offc twin installed; /api/gate_run on the served binary exit_code 0 verdict GREEN 68/68 (job 1790359193). Sources: lib sha256 b3a6b527 26067 B, gate sha256 1f7cec5d 24123 B. 2026-09-25 measure VERIFIER CONFIRMED-WITH-GAPS 68/68 GREEN twice (served /api/gate_run job 1790359333 exit 0; fresh --qualify job 1790359512 BUILD-CACHE HIT on the current closure = promoted sha 5241cbf9 on root and _offc, lib b3a6b527 and circles 7ff66d3a and scripture 93c22046 unchanged); csc_circle_post declared; apparatus markers TG and JST re-counted 0 in the corpus; 4 journal rows present. GAPS: (1) the leave wall LOCKS a consenting adult inside a circle with one other adult and a youth (consent withdrawal refused; the post wall already refuses on a failing roster, so leave-then-pause is the safer shape) (2) the last adult may leave a circle leaving minors alone, admitted because only adult-minor pairs are judged (3) content-blind is a lib property only: the verse, day, author and roster reach the server in clear and no client encryption exists for study posts (4) the msgstore integration call is per-account and drops the anchor, day and circle (5) the wall scans every membership row estate-wide twice per post, O(total rows squared) not O(roster squared) (6) join wall and post wall carry differential neg-controls but no planted-defect bite of their own; I did not mutate the shared lib

CN17 Service and help board · cell LANDED · gate NO-GATE-DECLARED

Contract	`csh_need_match` · executor Organ · 1.5 u · stands on CN14
Definition of done	Members post needs (meals, a move, a ride) and service projects with a place, a time and a capacity; neighbours offer help; matching is by consent, a coarse locality band and capacity, never by faith, looks or status; the exact address is withheld until both sides confirm; minors join service projects only inside the two-deep wall; done-rule: the gate proves need, offer and confirm round-trip idempotently, capacity holds under over-offer, the address stays coarse before mutual confirmation, and a minor one-to-one adult request refuses
Matrix cell	Service and help board (needs, offers, capacity, coarse locality) · `runtime/_hdl_build/nx_connect_service.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_service`; declare `nx_connect_service TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790355013 routed by nx_intake_route (operator-seat, epoch 1790356476) from pm-seat: R13 of parent REQ 1790355000: service and help board -- members post a need (a move, a meal, a ride, a skill) inside a circle and neighbours offer help, matched by circle and place, with the youth wal -- sponsor intake-1790355013 plus1 2026-09-25 land nx_connect_service lib buildroot/runtime/_hdl_build/nx_connect_service.nx (entry csh_need_match, 23304 B sha256 f987d817) and nx_connect_service_gate GREEN 69/69 on the NAS by nx_sov_build_run --qualify (cache key 1621d6ed, artifact sha256 010f329e). Composes ccl_circle_reach (a viewer sees a need only through a ring no wider than the poster chose), ev_rsvp ev_cancel ev_roster_safe (capacity, idempotence, the youth rule) and yw_may_channel (the one-to-one wall); policy is data in knowledge/connect_service.conf (cell 20000 microdegrees, a person-picked THRESHOLD not yet calibrated, reach 1). Bite: helper-confirm planted out of csh_released went RED 68/69 on neg-control-the-exact-place-is-absent-from-every-pre-confirm-output, restored byte-identical went GREEN 69/69. 2026-09-25 land SHIPPED nx_connect_service_gate: /api/build src_path named the gate, promoted sha256 a6f6d1d9 (130848 B) with expect_sha256 (an earlier promote ebf74446 was superseded after a comment-only lib correction), registered callable, _offc twin installed from the promoted root, /api/gate_run on the live binary exit 0 GREEN 69/69; admitted to knowledge/gateroster.conf by hand and saying so. Lib now 23526 B sha256 21250b22. The connect.matrix watch row runtime/_hdl_build/nx_connect_service.nx _ABSENT_:csh_need_match should read LANDED at the next regen (this seat did not run a regen). 2026-09-25 measure Baseline primary source read 2026-09-25: justserve.org home and about mirrored (knowledge/fetched/cmp_connect_justserve_home_202609.html sha256 a52ab79c 22986 B; knowledge/fetched/cmp_connect_justserve_about_202609.html sha256 205aac08 20844 B). Both are client-rendered shells whose only witnessed text is that JustServe.org is provided as a free service by The Church of Jesus Christ of Latter-day Saints, so the listing mechanics (place, time, helpers wanted, no seat past capacity) are UNVERIFIED from a primary source this month; the lib header says so. mealtrain.com/faq, the Wikipedia JustServe article and a newsroom JustServe path all answered 404. 2026-09-25 lesson The build flavour follows the incumbent: the first --qualify had no incumbent and built release (112671 B), after the first promote every build read the incumbent flavour and carried debug-line rows (130848 B), so a comment-only lib edit that moved two lines changed the binary. Comment-only is not byte-neutral under a debug flavour; re-run the gate and promote the new bytes rather than assume the served binary still matches its source. 2026-09-25 queue OWED: (1) the INTEGRATOR wires the service routes into the live app with the calls in the CN17 result; (2) durability: the board is an in-memory caller block, so posts, offers, confirms and withdraws must be persisted through an append-only log (the CN6 msgstore lane) before any cohort sees the board; (3) the cell 20000 microdegrees in knowledge/connect_service.conf is a person-picked THRESHOLD, calibrate from households per cell against a declared k-anonymity floor; (4) a server-rendered primary source or the JustServe project API for the listing mechanics; (5) csh_near does not wrap longitude at 180 degrees. 2026-09-25 measure JustServe help centre mirrored 2026-09-25 (knowledge/fetched/cmp_connect_justserve_wizard_202609.html sha256 048bf9fc 43751 B, the April 23 2026 Project Wizard update; knowledge/fetched/cmp_connect_justserve_where_202609.html sha256 f4d36e80 43424 B, the Where-step article): witnessed, projects are created through a guided Project Wizard whose Where step holds the project address, and leaders approve a project before it lists. NOT witnessed this month: a volunteer seat count, sign-up closure at capacity, or any address-release rule. The lib header now says exactly that (23515 B sha256 7ea15e7d). The leader-approval step is a candidate rung for the board owner (a community approval that is never congregation administration), not built here. 2026-09-25 lesson A comment edit that keeps the line count is byte-neutral under the debug flavour: /api/build of the lib at 23515 B produced sha256 a6f6d1d9, identical to the promoted gate, while the earlier edit that added two lines had changed the binary (the debug-line table moves with line numbers). The stage slot now holds those identical bytes and is deliberately NOT promoted, because live already is them. 2026-09-25 measure VERIFIER CONFIRMED 69/69 live /api/gate_run job 1790359697 exit 0 GREEN on promoted a6f6d1d9 (lib 7ea15e7d 23515 B and gate 3575d2d7 match the claims; csh_need_match declared once; bite RED 68/69 read in job 1790358661; 7 journal rows present; ev_rsvp appends so a re-offer resets both confirmations). Gaps not refuted but named: the exact place is server-held plaintext (not content-blind), helper hloc and age band are caller-attested, csh_released alone does not re-check visibility (only csh_render does), only one mutant, board not live until the integrator wires it 2026-09-25 queue INTAKE 1790361305 routed by nx_intake_route (pmboard-seat, epoch 1790361371) from pmboard-seat: B5 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): service -- members serve one another and their communities: needs and ser -- sponsor intake-1790361305 plus2 2026-09-25 queue INTAKE 1790361306 routed by nx_intake_route (pmboard-seat, epoch 1790361404) from pmboard-seat: B6 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): community and personal gardening -- seed sharing and produce helping memb -- sponsor intake-1790361306 plus2 2026-09-25 queue PM-BOARD wave 5: operator ask REQ 1790361300 (exceed ldssingles.com; games together, cross-continent activities such as a youth Iron Chef, language learning, service, seed and produce sharing, community) filed verbatim under REQ 1790355000 with children 1790361301 to 1790361307 routed plus2 (faithsocial FS1 FS5 FS3, comms C12, connect CN14 CB2 CN17); faithsocial carries five new rows and its watches name cav_plan_event, clc_circle_match and csh_share_match for this wave's builders; LDS Singles pinned as a research bar, its column queued 2026-09-25 land faithsocial republished by nx_compare_regen_scoped (verdict GREEN, index.html 224014 B prev 212405, api.json 42720 B, generator fork fresh af966543) and nx_page_verify GREEN status 200 a11y-issues 0 (static checks only, browser render unverified); at publish the new faithsocial rows read games together present on room_admit, service present on csh_need_match, language circles symbol present clc_circle_match, seed and produce symbol present csh_share_match, activities OPEN cav_plan_event -- a present symbol is the receipt, not acceptance; nx_ladder faithsocial LADDERED 11 of 11 placed, nx_barfresh FRESH 2026-09-25 land BUILDER GARDEN: the SHARE kind landed IN the incumbent service board, no second board. nx_connect_service.nx 23515 to 45937 B appends csh_share_match (seeds, seedlings, cuttings and surplus produce; an offer paired with a request; free forever, no price, payment or boost field) plus csh_share_load, band_of, in_season, post, confirm, released, render and close over a caller-supplied share block that READS the same board policy (cell, reach) and the same circles; every existing csh_* function, const and csh_state_slots untouched (the edit is an append after csh_render). Season windows are DATA: knowledge/connect_share.conf 2659 B, 12 rows season band item first-month last-month reason for north-temperate, south-temperate and tropical x seed, seedling, cutting, produce, each flagged THRESHOLD person-picked NOT calibrated; the climate band is SELF-DECLARED and resolved by key, never inferred; a window may wrap the year end. Admission order: both live, one offer and one request, same item, two posters with who one of them, consent, visibility BOTH ways through each poster's chosen ring, the season window of BOTH bands at the match month, coarse cells within reach, the ONE two-deep wall csh_pair_ok (a minor shares with a peer or linked guardian only), idempotence, portions last; the pickup detail is released only after mutual confirmation. Gate nx_connect_service_gate qualify job 1790361629 GREEN 114/114 = the original 69 teeth unchanged plus 45 share teeth: pickup absent from all 76 pre-confirm outputs (neg-control) and present once for the matched requester, an out-of-season request refuses CSH_OUT_OF_SEASON by name at post and at match, replayed confirms and a replayed match change no share slot, other ward INVISIBLE, minor with unrelated adult WALLED, linked guardian OK, TOO_FAR, FULL, WRONG_SIDE, six table neg-controls. Baseline read today: AmpleHarvest.org mirror knowledge/fetched/rf_87238881.raw sha256 6f45f4a0 (a free, opt-in registry; pantries declare the days and times they receive fresh food; 8,572 pantries in 5,691 communities) and the Seed Savers Exchange page knowledge/fetched/rf_6cc17360.raw sha256 afa00d21 (member listers). Not yet bitten; gate promote launched through nx_organ_ship. 2026-09-25 land BUILDER GARDEN SHIPPED nx_connect_service_gate through nx_organ_ship (job 1790361722): BUILT and PROMOTED sha256 6d783160 (live == staged), prove GREEN 114/114 on the fresh stage-1 artifact, adoptgate APPROVED content GREEN, behave DIFFERS as expected for 45 new teeth, offc twin installed from the promoted root binary, ALREADY-REGISTERED, harness token hd26af07108cdaeef. Sources: lib nx_connect_service.nx sha256 f85153b2 45937 B, gate sha256 9cc05d52 39851 B, knowledge/connect_share.conf sha256 9cab0d6c 2659 B. The lib is not a program and ships inside its consumers; nothing member-facing is served yet. 2026-09-25 queue BUILDER GARDEN open items, each for its owner: (1) NOT BITTEN -- run nx_gate_bite nx_connect_service_gate nx_connect_service.nx with sites in a quiet window (the lib is shared, so the mutant window must not overlap another seat building a consumer); a good plant is dropping the RCONF test in csh_share_released, expected RED on the pickup neg-control and the unmatched-neighbour tooth. (2) NOT SERVED -- FRONT DOOR seat: add share rows to ca_row (share_post, share_match, share_confirm, share_render) calling the pure csh_share_* functions with the caller's own session as poster, the month from the server clock through the civil date, and the band from the member's own declaration resolved once with csh_share_band_of; the INTEGRATOR mounts them under /connect/api/v1/ with no second dispatcher. (3) CALIBRATE -- every season window in knowledge/connect_share.conf is a person-picked THRESHOLD; calibrate each band from a published sowing and harvest calendar (an extension-service calendar per hardiness zone, mirrored and pinned as a connect.refs row by the board owner) and add hardiness zones and wet or dry seasons as rows, never code. (4) BASELINE THIN -- the Seed Savers Exchange mirror witnesses member listers only; its listing and request mechanics were not read, and a primary seed-library source (a seed lending library policy or the Community Seed Network) is owed this month. (5) a produce-to-pantry kind (the AmpleHarvest mechanism: a pantry declares the days and times it receives fresh food) is not modelled because a pantry is not a member; candidate rung. (6) no withdraw verb frees a matched portion yet (csh_share_close hides a listing and keeps its matches, rule 13); csh_share_withdraw owed. (7) the gate header comment still describes only the need board; the share section comment carries the share contract. 2026-09-25 queue W7 SEAT W4 (bite of the 45 share teeth) NOT STARTED: the seat began at NAS 1790371930 (laptop clock 1790372002 agrees, 16:33 CDT), 6130 s after its return-by 1790365800 and 6730 s after its stop-builds 1790365200, so no nx_gate_bite, build, source edit or re-ship was attempted -- a late mutant build of a shared lib could collide with a seat building one of its consumers. Read-only baseline for the next owner, measured 1790372010: the share teeth are STILL UNBITTEN; lib nx_connect_service.nx sha256 f85153b2 45937 B, gate source sha256 9cc05d52 39851 B and the promoted nx_connect_service_gate.elf sha256 6d783160 167704 B all equal the GARDEN ship row 1790361800, so a bite now measures exactly the shipped bytes. The gate imports nx_connect_service.nx in-process (its third import line), so the harness needs no subject keyword; nx_gate_bite is REGISTERED and AUTHORISED but BUILT 107992 B vs PROMOTED 93631 B, so read the served binary's usage before trusting an argument. Recipe as the langcircle seat ran it (row 1790361640): /api/organ_run target=nx_gate_bite with nx_connect_service_gate, runtime/_hdl_build/nx_connect_service.nx and 2, in a quiet window, then nx_filehash the lib and the live gate twin against the digests above; the builder names the RCONF test in csh_share_released as a good plant, expecting RED on the pickup neg-control and the unmatched-neighbour tooth (row 1790361810). 2026-09-25 measure W8 SEAT FRONT-DOOR deciding observation for nx_connect_service before wiring share_match (REVIEW row R5c listed it UNVERIFIED and named the observation: nx_capsearch with its intent words plus its import lines): nx_capsearch seed produce share offer request match garden ranks no member-to-member share matcher (nx_offer_ledger is licensing outreach, nx_garden grow-your-own affordability, nx_produce a clean-produce catalog; corpus_complete=0 with 263 dropped, so this is a floor, not an absence proof) and its imports are nx_connect_circles and nx_connect_events_lib, both incumbents -- the share kind COMPOSES the incumbents: NOT-AN-ISSUE as sprawl, so share_match was wired on its one owner. service_match (csh_need_match) stays not_yet_wired 2026-09-26 land W11 SEAT GATES-COMPLETION, nx_connect_service_gate: the 45 SHARE teeth bite-tested for the first time, six blind guards found and closed, gate re-shipped. SAFETY FIRST: nx_connect_service.nx is imported by nx_connect_api_lib (wave 10 owns it and rebuilds the alpha daemons against it), so no mutant ever touched the shared lib: every mutation ran on an ISOLATED COPY (nx_connect_service_w11bite.nx beside a gate copy whose one import named it, byte-identical otherwise); the shared lib read f85153b2 45937 B before, during and after. (1) nx_gate_bite job 1790437779, 2 sites: cmp site 0 at off 8822 KILLED (need board), valid 1 invalid 0 void 0 not_reached 0 killed 1 survived 0, restore byte-verified. (2) first-kill-wins cannot say which SHARE guards are reached, so the whole invariant was mutated on the copy: both live checks, the second-side check, the same-item check and the self check in csh_share_match, the longitude reach check, and the poster-only check in csh_share_close deleted together read 114/114 GREEN (job 1790438239) -- six guards SURVIVED, no tooth reached them. Control: deleting only the consent guard read RED at neg-control-share-no-match-without-consent (job 1790438410), so the method discriminates. (3) gate 39851 to 43891 B: csgs_edges on a fresh share block (the first scenario's counts and transcript untouched) with a fixture-reached tooth and eleven more: a self match answers CSH_SELF, two offers CSH_WRONG_SIDE, another item class CSH_ITEM_MISMATCH, a far longitude CSH_TOO_FAR, a stranger's withdrawal CSH_NOT_PARTY, the poster withdraws OK then ALREADY, a withdrawn offer matched says CSH_NO_SHARE by name (visibility also refuses it as INVISIBLE, so the live guard is DEFENCE IN DEPTH and the tooth pins which refusal answers), invisible to a neighbour, still visible to its poster, and a live second offer control. GREEN 126/126 on the shared lib (job 1790438583), RED 119/126 on the six-guard mutant with seven edge teeth failing and all 114 old teeth passing (job 1790438725). (4) re-shipped by nx_organ_ship sha 9fabf59c (was 6d783160; prove 126/126, content GREEN, behave DIFFERS as expected, promoted, _offc installed, already registered, already rostered) and cited in knowledge/compare/connect.gates. (5) both source copies ARCHIVED by nx_retire_path to knowledge/retired (buildroot_runtime__hdl_build_nx_connect_service_w11bite.nx-1790439163 and the gate copy -1790439145, reversible); mining receipt: scratch fixtures carrying no MCP verb, API route, plan step, RACI row, clock row or ritual. RESIDUE: the copy gate's build fossil buildroot/_build/nx_connect_service_gate_w11bite.sov.elf stays (nx_retire_path refuses any .elf name by design); nothing registers, rosters or forks it. OPEN: CSH_STATE_FULL and out-of-range listing ids in csh_share_match still reach no tooth (robustness, not safety); whether a withdrawal after mutual confirmation should still release the pickup detail is unspecified in csh_share_released; the need board beyond site 0 was not whole-invariant probed this leg. 2026-09-26 land W11 SEAT GATES-COMPLETION, the NEED board half of the same probe, same isolated-copy discipline (shared lib f85153b2 untouched). The gate never called csh_close and asserted neither CSH_NO_NEED nor CSH_NOT_MEMBER (nx_txtscan count 0 each over the gate source). gate 43891 to 46385 B: csg_need_edges on a fresh board (two needs, the board scenario's counts untouched) with a fixture-reached tooth, an id no member holds cannot offer (CSH_NOT_MEMBER), only the poster closes a need (CSH_NOT_PARTY), close OK then ALREADY, a closed need takes no offer and says CSH_NO_NEED by name, a closed need is invisible to a neighbour and still visible to its poster, and an open-need control. On the copy with the need live check, the member check and the poster-only close check deleted together the gate read RED 131/135 with exactly four need-edge teeth failing and all 126 earlier teeth passing (job 1790439989): those three guards had no tooth. Two of them are DEFENCE IN DEPTH for behaviour (visibility still refuses, answering INVISIBLE instead of the named refusal) and the teeth pin the name; the poster-only close guard is not -- without it a stranger closes someone else's need and nothing else stops it. Re-shipped by nx_organ_ship sha 2ea48cf4 (prove 135/135 GREEN on the shared lib, content GREEN, behave DIFFERS as expected, promoted live_sha equals staged_sha, _offc installed, already registered; job 1790440032), connect.gates label now reads 135/135; copies restored to pristine then ARCHIVED again by nx_retire_path (knowledge/retired ...w11bite.nx-1790439958 and ...gate_w11bite.nx-1790439950). Service gate net this leg: 114 to 135 teeth, nine blind guards now each owned by a named refusal. 2026-09-26 land W14 SEAT LISTING-AND-COUNTRY (debt 1790457815 EATEN, superseded by 1790461582 for its faith half): listing visibility now asks the ONE discovery owner. nx_connect_service csh_may_see fills ccl_may_discover on AST_PATH_CIRCLE (SHARED = the live reach no wider than the ring the poster chose, VOUCHED = ccl_ring_adm of that reach ring is CCL_ADM_VOUCH) and nx_connect_antistalk ast_may_discover decides; csh_visible and csh_share_visible both return it, so need_match, list, render, share_match and share_render inherit it: a block hides a listing both ways and a match across it answers CSH_INVISIBLE (a stranger's answer), a non-guardian adult who shares only an opt-in ring never sees a minor's listing (AST_WHY_MINOR_OPEN_RING) while a linked guardian and a peer minor do, and with no antistalk state installed nothing is listed (fail closed). nx_connect_service_gate 171 teeth: RED 155/171 on the prior lib (job 1790459935, exactly the 16 new discovery teeth), GREEN 171/171 (job 1790460315), SHIPPED 19e5814c. The served front door: nx_connect_api_lib ca_v_share installs an empty antistalk state on its synthetic pair (not in ca_ring2, so lang_match stays byte-identical); api gate T23 adjudicated to INVISIBLE for a minor requester and an unrelated adult offerer on the opt-in worldwide ring (a WALLED answer there would tell the adult a minor posted it) and WALLED for the same pair inside the in-person vouched ward: RED 30/31 (job 1790459960), GREEN 31/31 (job 1790460323), api gate SHIPPED 9afbeeb7 (one lost run, the old T23 label, allow_loss_v1 4791a0ca, behaviour review 81c4c202); nx_connect_api SHIPPED 7980400c noregister (content GREEN, lost 0); nx_behaveprobe live vs staged IDENTICAL on help, catalog, match, juris_rules, lang_match, youth_peer, antistalk_discover, family_consent, share_match adult pair and share_match minor with an adult in the ward, DIFFERS only on share_match minor with an unrelated adult on the worldwide ring (walled to invisible, intended). The alpha daemon nx_connect_appd imports the api lib and carries the old rule until the ALPHA seat rebuilds it; production /connect untouched. 2026-09-28 queue W17 FRONTDOOR-FINISH HAND-OFF -- what this seat did not reach, each with its recipe. (1) CN17 service_match stays not_yet_wired: a pure decision needs a synthetic service state (the csh conf cell and reach from knowledge/connect_service.conf, one need posted by csh_post with req slots ring, kind, cap, plen/poff, youth, lat, lon, when), then csh_need_match(st, cst, e, helper, consent, hloc), whose admission order is live, member, not self, consent, visibility through the poster's circles, the coarse locality band, the two-deep wall for a one-to-one need and ev_rsvp capacity last; the circles side is cfdk_community exactly as the other wave-17 verbs build it; one door build cycle. (2) CN15 faith_rank (request row 1790615101) stays queued: cfa_rank_visible over a synthetic population the caller describes; teeth: hidden stays hidden whatever the faith, a withdrawn member ranks at the no-faith position, a minor never surfaces to an unrelated adult, the order equals a brute-force oracle, a neg-control each. (3) FOR THE ALPHA OWNERS (wave 16; this seat edited no alpha source and restarted nothing): the alpha inherits play_check, date_admit and room_check through ca_dispatch on its next build (nx_connect_alpha_api_gate tooth E2 compares the wired count dynamically, and C5/C6 still exercise signup_admit, which stays unwired); study_post has been behind the door since phase 1, so the device gate tooth T3b that asserts /try/study is not behind the door will read differently after that rebuild; 22 catalog rows are own-account and wait for ONE identity-carrying entry point -- ca_dispatch carries no caller identity on either surface, and the remedy is a sibling dispatcher that takes the session's circles member from the daemon, never from a request field. (4) LIFECYCLE: runtime/_hdl_build/nx_connect_api_lib_w17scratch.nx, nx_connect_api_gate_w17scratch.nx, nx_connect_appd_w17check.nx (a never-run copy of the alpha source importing the scratch lib, kept only as a compile check) and nx_connect_api_w17scratch.nx, with their _build artifacts, are SUPERSEDED by the landed lib and gate; none is registered, rostered or on a clock row; archive with nx_retire_path (not in this seat's caps) before anyone mistakes them for a parallel door. (5) Activity rows were not reached: no request row names the activity engine's verbs; its owner should file one.

CN18 Verified person without storing identity · cell LANDED · gate NO-GATE-DECLARED

Contract	`cvh_person_attest` · executor Organ · 2 u · stands on CN13
Definition of done	A member proves they are a real person, and for youth features their age band, without the estate storing any identity document: a presentation from a digital credential (the W3C Digital Credentials API over an ISO mobile driving licence or a state-endorsed digital identity) or an in-person vouch by two verified members, reduced to a signed claim of personhood and age band only; done-rule: the gate proves a valid presentation yields that claim and nothing else is stored, a replayed or forged presentation is refused, and the member can revoke the claim
Matrix cell	Verified person without storing identity (credential presentation or two-member vouch) · `runtime/_hdl_build/nx_connect_personhood.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_personhood`; declare `nx_connect_personhood TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-25 queue INTAKE 1790355009 routed by nx_intake_route (operator-seat, epoch 1790356458) from pm-seat: R9 of parent REQ 1790355000: verified person without storing identity -- romance scammers feign faith (named by the estate research of 2026-06), so a member can prove they are a real, unique person an -- sponsor intake-1790355009 plus1 2026-09-25 queue INTAKE 1790355011 routed by nx_intake_route (operator-seat, epoch 1790356468) from pm-seat: R11 of parent REQ 1790355000: privacy-preserving age assurance -- a youth or adult age band established by attestation or estimation without storing the document or the birth date, graded against the -- sponsor intake-1790355011 plus1 2026-09-25 land BUILDER seat: cvh_person_attest LANDED in buildroot/runtime/_hdl_build/nx_connect_personhood.nx (24453 B, sha256 b3256c3b) with gate nx_connect_personhood_gate.nx 51/51 GREEN under nx_sov_build_run --qualify (run-exit 0, artifact sha256 5eb290f5); two in-person vouches from verified adults active in one circle instance (composes ccl_vouch, and ccl_need IS the circles table vouch row, no second count) reduce to ONE 152-byte Ed25519 claim holding only subject hash, band, person, issued, expires, claim id and signature; verification is sa_age_attest, landed ADDITIVE in buildroot/runtime/_hdl_build/nx_site_auth.nx (7659 to 11908 B under CAS h56de68cc2d30f0f5, sha256 3782b953, composing only ed25519_verify_full and _ncs_get_i64_be already in its closure) as the ONE age-band ruler authz AZ10 and synthroom SR9 watch, and the importer nx_site_auth_gate rebuilt against it GREEN 4/4; census over the stored row 0 undeclared of 8 fields and a planted dob docno photo row counted 3; a replayed claim refuses SUBJECT, a spent vouch refuses VOUCH_SPENT, a tampered band, a wrong key and a forger key refuse FORGED, revocation refuses REVOKED at once, a youth or unverified adult cannot vouch, the credential path refuses CVH_DC_VERIFIER_ABSENT by name; BITE: spent=0 planted in cvh_person_attest read 49/51 RED with exactly the two spent teeth failing (actual 1 vs -105, 0 vs -106), restored 51/51 GREEN; lifetime row knowledge/connect_personhood.conf claim_ttl_s 31557600 person-picked, calibration UNMEASURED 2026-09-25 land BUILDER seat SHIPPED nx_connect_personhood_gate through nx_organ_ship: fresh build sha256 0c525ac0 (the target is its own gate), PROVE 51/51 GREEN on that fresh artifact, first promote live_sha equals staged_sha 0c525ac0, _offc twin installed from the promoted root binary, REGISTERED callable (tools/list discovery waits for nx_toolreg_reconcile), harness manifest token h84dccf2c984060d8; admitted to knowledge/gateroster.conf in its own grammar (84578 B); the lib nx_connect_personhood.nx and the sa_age_attest addition to nx_site_auth.nx are LIBS with no binary of their own, so CN18 and the AZ10 and SR9 watch rows read LANDED from source while the INTEGRATOR wires the vouch and revoke doors into nx_connect_serve and nx_connect_appd 2026-09-25 land BUILDER seat grew CN18 with DURABILITY and re-shipped: cvh_record_load reads a stored P1 row back by REBUILDING the 152-byte claim and asking sa_age_attest, so a hand-edited row (band digit changed) or a row under a foreign issuer key refuses CVH_REFUSED_ROW and never loads, and a row marked rev=1 (or one the ruler reads EXPIRED or REVOKED) loads revoked so its claim id stays refused (in an append-only log a later rev=1 row revokes the earlier live one); lib now 30079 B sha256 1e269971, gate 16506 B sha256 923e91fd; gate 57/57 GREEN; second BITE: skipping the FORGED refusal in cvh_record_load read 55/57 RED with exactly the two loader neg-controls failing (actual 2 and 3 vs -117), restored; nx_organ_ship v2 fresh build 4bb89e89 PROVE 57/57 GREEN, adoptgate APPROVED content GREEN (superset of the 0c525ac0 first ship), promoted live_sha equals staged_sha 4bb89e89, _offc twin installed, already registered; second importer of the edited nx_site_auth (sha256 3782b953, unchanged through every run) nx_authz_session_gate rebuilt GREEN 6/6 beside nx_site_auth_gate 4/4 2026-09-25 queue BUILDER seat, OWED after CN18: (1) the INTEGRATOR wires the vouch, attest, revoke and sign-up-band doors into nx_connect_serve and nx_connect_appd with the exact calls returned in this seat's result; (2) the issuer key: the operator mints a 32-byte Ed25519 seed on the host with nx_attest_ceremony keygen (this seat wrote NO key anywhere) and the daemon loads it through cvh_key_from_seed, publishing cvh_key_pub to every sa_age_attest consumer; (3) the durable P1 log path, appended on attest and on revoke, replayed at startup through cvh_record_load; (4) the digital-credential verifier that replaces CVH_DC_VERIFIER_ABSENT (an ISO/IEC 18013-5 DeviceResponse over org-iso-mdoc, or dc+sd-jwt with key binding over openid4vp-v1-signed), accepting the age_over_NN predicate only; (5) sign-up ordering is UNDECIDED: csu needs an attested band before an account exists while a vouch needs a circles member, so either a provisional no-contact account or a vouch on a pending handle; (6) DECLARED: a personhood vouch IS a circles vouch in (k, inst) and so also counts toward ccl_join there, by composing one vouch model; a dedicated ring row keeps them apart if the board wants; (7) claim_ttl_s calibration UNMEASURED; (8) synthroom SR9 and authz AZ10 seats journal and compose sa_age_attest on their boards 2026-09-25 measure VERIFIER PARTIAL 57/57 -- gate re-run GREEN twice (promoted /api/gate_run job 1790359412 exit 0 and --qualify job 1790359479 cache-hit 4bb89e89 run-exit 0); lib 30079 B sha 1e269971 and nx_site_auth 11908 B sha 3782b953 match the claim; importers nx_site_auth_gate 4/4 re-run GREEN and nx_status_daemon build-only compiles clean (not deployed); journal rows present. REFUTED none. GAPS: the vouch path is social attestation not age verification -- vouches_needed=2 colluding verified adults can mint a youth-band claim for an adult whose declared band is youth (the two-deep wall's core threat, no voucher accountability or rate limit); the credential path (the done-rule's first clause) refuses by name; revocation is a per-process list and the rev=1 durable mark is unsigned (dropping a log row un-revokes); cvh_record_load maps one sys_mmap per row and never unmaps (startup replay leaks a page per row); who and subject are independent request slots, so the integrator must derive both from one session; nothing is served. 2026-09-25 queue INTAKE 1790358609 routed by nx_intake_route (operator-seat, epoch 1790360509) from ys-pm-seat: Y9 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): prevent stalking without tracking. Discovery happens only -- sponsor intake-1790358609 plus2 2026-09-26 land RESUME-YOUTH wave 10 fixed debt 1790359971 (R2a ACTUAL latent, the latent rule fix 1790372549 names as a precondition of any wiring): a vouch attests PERSONHOOD only, so cvh_person_attest issues a youth band only with the guardian's own act -- new cvh_guardian_act composes nx_connect_family (the owner of guardian consent: fam_member_ok, fam_live, the consenting guardian from fam_rrow plus FAM_R_BY since family exports no getter for it) with circles ccl_is_guardian and the guardian's own live ADULT claim (cvh_live_row, cvh_row_band); the family state rides a new request slot CVH_RQ_FAMILY (CVH_RQ_SLOTS 8 to 9, 0 = none, fail closed); the check runs after the declared-band check and BEFORE issue or spend, so the same unspent vouches admit the youth once the guardian acts, and a refusal names CVH_REFUSED_YOUTH_NEEDS_GUARDIAN (0 - 118); the credential path still refuses CVH_DC_VERIFIER_ABSENT; the adult band from vouches is unchanged. Lib sha256 eed5cef4 32586 B (banked pre-change knowledge/bank/nx_connect_personhood.nx-pre-resumeyouth-20260926 30079 B), gate 2772a588 19099 B (banked knowledge/bank/nx_connect_personhood_gate.nx-pre-resumeyouth-20260926). RED 60/65 on the lib without the check (job 1790437656: neg-control-two-colluding-adults-cannot-mint-a-youth-band-from-vouches-alone actual 0 = the youth band minted, expected -118; the no-claim tooth actual 1; the not-consented, no-adult-claim and admitting-act teeth actual -109 because the claim already stood); GREEN 65/65 on the fix (job 1790437860); nx_organ_ship SHIPPED nx_connect_personhood_gate 0115f7c1 prove GREEN, promote live = staged, offc installed, registered (job 1790438273), two lost runs = the old tooth two-vouches-admit-the-youth and the old verdict note (allow_loss_v1 4f31d602, review knowledge/status/harness/review-personhood-gate-0115f7c1.txt); served /api/gate_run GREEN exit 0 for both this gate (job 1790438409) and the faith gate (job 1790438406); prior gate banked nx_connect_personhood_gate.elf-pre-resumeyouth-20260926 (210400 B). RESIDUAL (owned by 1790372549, OPEN): ccl_link_guardian is caller-asserted, so three colluders (one linked as guardian with a consent method the integrator accepted) are not stopped here -- the link must bind the guardian's own act; the per-process revocation note there too. NOT LIVE: personhood is imported only by its gate. 2026-10-01 measure BARFRESH 2026-10-01 (seat residue-fleet, T0 1790856940): before STALE (SB-CONNECT-2609 UNATTESTED on the October clock), after FRESH (1 of 1 ATTESTED). The W3C Digital Credentials editor's draft was re-fetched over the sovereign fetcher and hashes to the 25 Sep pin (sha256 fc73f35013fb93e0, 729218 B); its publishISODate and its dt-published element still read 04 September 2026, so the bar month stands and nothing newer exists at the bar's own ref. The page needs a regen to show the October barscan.

CN19 Games together, one to one or in groups · cell LANDED · gate NO-GATE-DECLARED

Contract	`cpl_play_move` · executor Organ · 1.5 u · stands on CN14
Definition of done	Members play together inside their circles, one to one or in a group room: a play session holds one two-player game in a room admitted by room_admit on join and on leave (two-deep, from the one youth room rule in nx_connect_lds_room_lib), a one-to-one invitation only where ccl_channel admits the pair (two minors through ysf_peer_may_connect, never an adult and a minor), every co-presence asked of ast_may_discover both ways so a blocked pair is refused either way, every move and the turn order validated by the server through the one nx_folkgame_lib move generator (never a second rules copy), a chained det_state_checksum digest after every move that any client on any device replays to prove it holds the same state and history, idle expiry and the room cap as conf rows with reasons (knowledge/connect_play.conf), and no function signature taking an IP, a location, a device id or a fingerprint; done-rule: nx_connect_play_gate proves a lone adult with youth refused on join and on leave while two adults with youth are admitted, a youth-youth one-to-one admitted where the peer rule allows and an adult-minor one-to-one refused both ways, a blocked pair refused both ways in a group room and in a one-to-one, an illegal and an out-of-turn move refused, the win detected identically to the generator down to the published 255,168-game tic-tac-toe tree walked through the session, every align game the spec names played through the session against the generator driven directly with the turn order taken from the generator (capture and movement phases reached), the digest identical across replays, different after a different move and recomputed at every ply by a second method class (a bitwise CRC-32C anchored to its catalogued check value), play_state answering only the caller's own room, and the signature scan clean; members reach it only when the front door carries the play verbs
Matrix cell	Games together, one to one or in groups (two-deep youth rooms, server-validated moves, a digest every device replays) · `runtime/_hdl_build/nx_connect_play.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_connect_play`; declare `nx_connect_play TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-28 land W17 SEAT GAMES-TOGETHER (resumed after the 12:39 CDT laptop outage; the first run had written buildroot/runtime/_hdl_build/nx_connect_play.nx and nx_connect_play_gate.nx, built the gate GREEN and journaled nothing): lib nx_connect_play (contract cpl_play_move, 26973 B) and gate nx_connect_play_gate (34927 B) GREEN 112/112. This leg: (1) the lib now imports nx_connect_lds_room_lib, the youth room rule's one home since the FS11 move today, instead of the verifying program nx_connect_lds_room, so no consumer of the session inherits that program's main or its short helper names (yw, yn, ad_allowed, may_private_dm); rebuilt with a cache miss, 112/112 GREEN (job 1790618918). (2) nx_gate_bite 4 of 4 compiling mutants KILLED, each restore byte-verified: first-kill at a comparison in the play-table parser on the pre-edit bytes (job 1790618628), then aimed on the final bytes at cpl_join site 9 the room_admit test (job 1790619073), cpl_leave site 8 the room_may_leave test (job 1790619153) and cpl_play_move site 23 the move-legality test (job 1790619289). (3) SHIPPED by nx_organ_ship (job 1790619475) sha256 850c2af1 prove GREEN 112/112 on the fresh build, first promote live equal to staged, _offc twin installed, REGISTERED on the MCP surface (callable 1); served /api/gate_run (job 1790619582) exit 0 GREEN 112/112 on the FAST path, capture untruncated. (4) rostered in knowledge/gateroster.conf and cited in knowledge/compare/connect.gates. (5) board: rung CN19 Games together, one to one or in groups (1.5 u, deps CN14) added to M2 with the milestone cumulatives restated (M2 16.5, M3 25, M4 32.5, M5 36.5) and the answer row, rungrole CN19 contender T-FRONT-CONNECT, matrix watch row _ABSENT_:cpl_play_move on runtime/_hdl_build/nx_connect_play.nx with Discord Best and Meetup Part grounded by two new pinned refs (discord-activities sha256 0c17a9bf fetched this leg and read, meetup-home-2609 sha256 bcff6060); intake 1790361302 (games together, plus2) routed to connect:CN19 (nx_intake_route FILED); nx_ladder connect LADDERED 23 of 23 placed; nx_compare_rank connect (job 1790619825) reads rungs 23 done 15 open 8 with CN19 in FINISH as LIB-UNCENSUSED until the next eco-graph build and importcensus. HONEST STATE: LIB-GATE-ONLY like CN3 CN5 CN16 CN18 -- imported only by its gate, no served caller, nothing member-facing; shipped, gate 112/112, awaiting acceptance. 2026-09-28 land W17 GAMES-TOGETHER: nx_connect_lds_room (the youth game and hangout room verifier, on nx_gate_verdict since 2026-09-25, already rostered) was PROMOTED-UNREGISTERED; REGISTERED on the MCP surface (/api/tools/register job 1790619650, callable 1) against the served binary sha256 dbe94f48 48217 B, and run through /api/organ_run (job 1790619743) exit 0 GREEN 8/8 (a lone adult denied a youth room, two-deep admits, a leave cannot strand youth, live game and chat rosters 2 and 2 with the denied adult absent). /api/gate_run refuses the name by design (verifiers must end in gate, test or kat), so organ_run is its served witness. The BUILT 56912 B fossil is the GROUP-MODERATION seat's post-extraction build of the same program (the rule moved verbatim into nx_connect_lds_room_lib today); the served binary predates that move and this row changed no binary. 2026-09-28 queue VERB REQUEST FOR FRONTDOOR-FINISH: the games-together verbs, rung CN19, engine nx_connect_play (import runtime/_hdl_build/nx_connect_play.nx; it composes nx_connect_circles, nx_connect_lds_room_lib, nx_folkgame_lib, nx_determinism and nx_room_relay; measured over buildroot/runtime with corpus_complete=1: the cpl_ prefix is defined only in nx_connect_play, room_admit and TWO_DEEP only in nx_connect_lds_room_lib, and BAND_MINOR also only in the program nx_connect_idage, which nothing imports). OWN-ACCOUNT OPERATIONS -- the actor is always the session's account mapped to its circles member, never a request field; room hashes are minted by the server; now is the server clock; a room block is the only state: play_open = cpl_open(ps: i64, st: i64, conf: i64, owner: i64, kind: i64, base: i64, room: i64, now: i64) -> i64 with kind 1 private (one to one) or 2 group, base = cpl_game(slug: u8) -> i64 (tictactoe today, 0 refuses), conf = cpl_conf_new() then cpl_conf_read(knowledge/connect_play.conf, conf) -> 0 or -2 (no table, no room opens), ps sized cpl_state_slots(conf) i64 words; play_invite = cpl_invite(ps: i64, st: i64, from: i64, to: i64, now: i64) -> i64 (private rooms, only where ccl_channel admits the pair); play_join = cpl_join(ps: i64, st: i64, who: i64, now: i64) -> i64 (reach or invitation, the cap, room_admit on join, ast_may_discover both ways); play_sit = cpl_sit(ps: i64, who: i64, now: i64) -> i64 (group rooms, the second side starts the game); play_move = cpl_play_move(ps: i64, who: i64, mv: i64, now: i64) -> i64 with mv = cpl_place(cell: i64) -> i64, or cpl_play_move_relay(ps, g_st, g_ar, who, mv, now) to also carry the validated move and its digest on the room's game channel; play_state = cpl_state_for(ps: i64, who: i64, now: i64, out: i64) -> i64 with out sized cpl_state_words(ps) (state, side to move, plies, digest, result, abandoned, the caller's own seat, then one word per cell), answering ONLY an occupant of the room (-14 otherwise); play_leave = cpl_leave(ps: *i64, who: i64, now: i64) -> i64 (room_may_leave on leave). Return spelling: 0 ok, 1 already, 2 unrelayed (the move stands), -1 bad_input, -2 no_table, -3 no_game, -4 not_member, -5 closed, -6 expired, -7 two_deep, -8 two_deep_leave, -9 not_invited, -10 channel (cpl_why carries the ccl code), -11 hidden (cpl_why carries the AST_WHY, and the reply maps it through ast_public_answer so a block reads as a stranger, never the word blocked), -12 unreachable, -13 full, -14 not_occupant, -15 not_player, -16 not_your_turn, -17 illegal, -18 not_playing, -19 finished, -20 wrong_kind, -21 seats_taken. The one-shot stateless dispatcher cannot hold a room between calls, so these rows land UNWIRED (engines nx_connect_play.cpl_open, cpl_join, cpl_play_move and cpl_state_for) until the alpha daemon holds the room table (integration spec row below). PURE DECISION the door can wire today: play_check over a synthetic pair the caller describes, built by the door's own ca_ring2 (its adult co-founders serve as hosts) and ca_youth_rows, acceptance through ccl_ask, a block through ast_block -- args game kind a_band b_band guardian accepted blocked hosts moves [a_yb b_yb] (bands 0 minor 1 adult; guardian and accepted 0 or 1; blocked 0 none 1 a blocks b 2 b blocks a; hosts 0 to 2 co-founders seated first in a group room; moves a comma list of cells alternating from the opener) -- returning the open, invite and join verdict names, every move's verdict name, plies, the result name, the final digest and viewer_told, nothing stored. Api gate teeth: a youth-youth one-to-one with acceptance plays while an adult-minor one-to-one refuses walled both ways; a group room with one host refuses a minor two_deep and with two hosts admits; a blocked pair answers viewer_told stranger with no blocked word in the reply; an out-of-turn and an illegal move are named and leave the digest unchanged; the door's final digest equals a direct cpl_ replay of the same moves in-process; a neg-control each. The engine is pinned by nx_connect_play_gate, 112/112 served. 2026-09-28 queue W17 GAMES-TOGETHER INTEGRATION SPEC for the alpha /connect daemon owner (wave 16 holds nx_connect_appd, nx_connect_serve and nx_connect_ui; this seat edited none, and FRONTDOOR-FINISH measured that ca_dispatch carries no caller identity on either surface, row 1790620060, so the own-account play verbs live in the daemon): (1) startup loads the play table with cpl_conf_read and fails closed -- without it the play routes answer a named refusal and no room opens; (2) a room table keyed by the server-minted room hash, each entry one cpl session block of cpl_state_slots(conf) i64 words beside one nx_room_relay game channel (rr_init with slot bytes cpl_frame_bytes()), over the circles state the daemon already holds; (3) zero-JS routes in the app's own style: POST open (game, kind), POST invite (a handle the caller can already see), POST join, POST sit, POST move (room, cell) through cpl_play_move_relay, GET room (only the caller's own room, through cpl_state_for: the board as HTML with every empty cell a form button and the digest printed so a second device can compare), POST leave; (4) the actor is the session's account mapped to its circles member, never a form field, and a hidden pair renders the one public answer; (5) idle expiry by cpl_sweep on every touch of a room, which closes it and releases every seat at once, so no adult is ever left alone with youth by a timeout; (6) nothing tracked: no IP, user agent, device id or location stored or logged, no analytics, and the play pages carry no ad slot at all. Daemon acceptance: the play gate's teeth driven over the served routes (a lone adult refused on join and on leave, an adult-minor one-to-one refused, a blocked pair answered as a stranger, an out-of-turn move refused) plus a visual review of a board on a phone at nishifamily.com/alpha/connect -- until then the capability is UNVERIFIED on any served surface. 2026-09-28 measure W17 GAMES-TOGETHER /games read live (nx_https_get job 1790618639, 18304 B, emitted by nx_games_page at epoch 1787677284): tic-tac-toe against an unbeatable minimax and Connect Four against a 5-ply alpha-beta are PLAYABLE there, both as inline page JavaScript rather than through nx_folkgame_lib, beside sovereign wasm Sudoku, and a Play together section links one replayed store match. The same page carries the estate ad slot (Nishi Video) and an IntersectionObserver view beacon that calls navigator.sendBeacon on /ad/view/... So the alpha connect note (play against the computer now, with friends when rooms go live) is WITHHELD, not published: one click from the ad-free, beacon-free connect door would land a youth on a page that serves an ad and fires a view beacon, breaching the no-ads-to-minors and no-tracking stance by construction. Owed first, for the /games owner (the nx_games_page emitter and its site lane): the ads optout blueprint row on /games (the router then injects neither the slot nor the beacon) and the two align games driven by the one generator; then the note is one line on the connect front door through its own publish lane. 2026-09-28 queue W17 GAMES-TOGETHER RITUAL plane seeded for its owner: knowledge/store/plan-connect-play-verify- holds 4 READ_ONLY steps (1 nx_connect_play_gate, 2 nx_connect_lds_room, 3 nx_ladder connect, 4 nx_barfresh connect), every step tool registered on the MCP surface; nx_plan_run connect-play-verify (job 1790620457) refused before step 1 with managed-owned-definition-required, execution NOT_STARTED, the same state the connect-onboard and youthsafety-audit planes are in (debt 1790614098). The binding belongs to the PM or publisher lane through nx_pm_owned_define (recipe row 1790460735) once the RACI cell store names an Accountable for a connect-play activity; every step is a gate or a read-only verb, the READ_ONLY class a v1 handoff policy admits. No plan manifest file was written, so nx_treatment reads no workflow surface for CN19, and no treat row is declared: of the five surfaces only the primitive lib is present (the front-door verb, the alpha API mount, the owned workflow and an agent row are absent). 2026-09-28 land W17 GAMES-TOGETHER SECOND METHOD CLASS for the chained digest: nx_connect_play_gate grew four teeth (source banked first, knowledge/bank/nx_connect_play_gate.nx-3db13fde-20260928-w17, and the promoted elf, knowledge/bank/nx_connect_play_gate.elf-850c2af1-20260928-w17, both copies verified byte for byte): a bitwise CRC-32C written from the standard (no table, sharing no code with nx_crc32c) reads the catalogued check value 0xE3069283 on the nine ASCII digits; the opening digest and every ply's digest are recomputed from the folk-game generator driven directly (never the session), over the words the session chains -- previous digest, move, the generator's own snapshot -- serialised little-endian by shifts rather than a memory cast, and all five plies agree (second_method_opening_digest 3598535430, second_method_plies_agreeing 5); a neg-control feeds the same words high byte first and must disagree. PLANTED: the IEEE polynomial 0xEDB88320 in place of the Castagnoli one read RED 113/116 (job 1790621034) with exactly the three second-method teeth failing (the KAT read 3421780262, the IEEE check value 0xCBF43926); restored, the build HIT the GREEN build's cache key f4cef98e byte for byte (job 1790621090) at 116/116. SHIPPED: /api/build (job 1790621115) staged 236896 B sha256 6b796697 with src_path naming the gate and src_stable 1; nx_contentdiff live vs staged GREEN, lost_from_live 0, four runs gained (job 1790621155); /api/promote with expect_sha256 PROMOTED 6b796697 (job 1790621177, prev kept); nx_offc_install installed the _offc twin from the promoted root binary; served /api/gate_run (job 1790621212) exit 0 GREEN 116/116, capture untruncated; the roster comment and the connect.gates label restated to 116/116. The digest is therefore a spec any client in any language can reproduce, which is the crossplay-by-determinism property the rung promises; a cross-architecture replay (wasm, rv64) stays UNMEASURED. 2026-09-28 lesson A lib that imports a verifying PROGRAM for one rule inherits every short helper name that program defines (here yw, yn, yinlist, ad_allowed, may_private_dm and its stripped main): it builds today only because the import preprocessor strips the main, and the first consumer that also defines a yw or yn would refuse on two definitions. The moment the rule has a lib home (nx_connect_lds_room_lib since the FS11 move this morning), import the lib -- the play gate rebuilt 112/112 on the switch and every aimed mutant still died. Second: a digest proven only by replaying the same code twice is ONE method class; an independent recompute (a bitwise CRC anchored to its published check value, over shift-serialised words, from the rules engine driven directly) is what makes it a spec a client in another language can reproduce, and the planted wrong polynomial reading RED on exactly those teeth is what proves the recompute is not trivially agreeing. Third: a research fetch that follows a redirect lands the mirror under a different canonical, and the refs gate counts it MOVED against a ratchet; re-fetch the canonical URL directly (hops 0) and cite that, which took connect's row off both the open-redirect and moved lists. 2026-09-28 land W17 GAMES-TOGETHER EVERY ALIGN GAME through the session: nx_connect_play_gate 127/127 served (/api/gate_run job 1790622146, exit 0, capture 14173 of 16384 untruncated) on the promoted f9b26ac4 (/api/build job 1790622074 src_path the gate, src_stable 1; nx_contentdiff GREEN lost_from_live 0, 11 gained; /api/promote with expect_sha256 job 1790622122; _offc twin byte-identical by nx_filehash cmp). The gate reads the align spec with the generator's own reader and plays EVERY game it names (8 today, tic-tac-toe, three mens morris, achi, nine mens morris, morabaraba and the rest) one to one through the session twice -- a deterministic pass (the spec's first line as a forced line, then the generator's first listed move) and a pass seeded by the run's own clock scrambled by the second method's CRC -- with the mover taken from the DIRECT generator's side, never from the session, and the full generator snapshot compared after every ply: 792 plies agreed on the served run (775 on the qualify run; the seeded pass differs by design), 0 refused, 24 removals and 24 same-side repeats (the capture phase gives one player two moves running), 175 slides (the movement phase), the result identical in all 16 playouts, and a removal offered at the opening refused ILLEGAL in all 8 games. PLANTED on an ISOLATED COPY (the lib now has a consumer, FRONTDOOR-FINISH's nx_connect_frontdoor3.nx, so no mutant may touch it in place): naive turn alternation in cpl_to_move read RED 124/127 (job 1790621957) with exactly the snapshot-agreement, refused-none and movement-phase teeth failing while the tic-tac-toe tree, the walls, the blocks and the digest teeth all passed -- tic-tac-toe alone could never have caught it; both copies ARCHIVED by nx_retire_path to knowledge/retired (…nx_connect_play_w17plant.nx-1790622005 and …w17plant_gate.nx-1790622037); its _build fossil nx_connect_play_w17plant_gate.sov.elf 212548 B stays, refused by the retire organ's protected .elf token, named here for the next _build sweep. The lib is unchanged since the import switch (26973 B sha256 7721ab81), so frontdoor3 builds against the same bytes the bites measured; the gate source is 47120 B sha256 8ff89845 (bank of the pre-change source knowledge/bank/nx_connect_play_gate.nx-3db13fde-20260928-w17). WATCH: the served capture is 14173 of the 16384 FAST-path cap; one more section of this size would truncate it. Shipped, gate 127/127, awaiting acceptance. 2026-09-28 land W17 FRONTDOOR-FINISH, THIRD BATCH: play_check WIRED behind the ONE door (answers VERB REQUEST row 1790620030). A PURE decision over a synthetic room built per call: runtime/_hdl_build/nx_connect_frontdoor3.nx cfd3_play drives nx_connect_play (cpl_open, cpl_invite or the group joins, cpl_sit, every cpl_play_move and the chained digest) over the pair the caller describes; the circle table's adult co-founders are the only possible hosts and each opens reach one ring at a time first (cfd3_host_open, because ccl_circle_reach asks BOTH sides); a hidden pair is told what a stranger is told (ast_public_answer), lists_members 0, stored 0, no clock read. play_open, play_join, play_move and play_state are catalog rows not_yet_wired with their reason (own-account: a room lives between calls and ca_dispatch carries no caller identity). DEFECT FOUND BY QUALIFY: the first scratch run read T48 hosts_joined 0 and join two_deep because the co-founder hosts had never opened reach; fixed in frontdoor3 (scratch job 1790622539 GREEN 53/53). PROOF: RED-on-old -- the new gate compiled against the phase-2 lib reads 49/53 with exactly T48-T51 failing (job 1790622867); GREEN 53/53 on the landed lib (job 1790622999); nx_gate_bite over frontdoor3 killed a compiling comparison mutant at off 4865, restore byte-verified 11149 B (job 1790622632); the alpha source (scratch copy importing the new closure, never run) compiles 1064741 B (job 1790622871). LANDED: nx_connect_api_lib.nx 127392 to 134478 B under CAS h1ba6774627c39a75 (job 1790622972). SHIPPED nx_connect_api by nx_organ_ship noregister (job 1790623241): prove 53/53, content ONE-WAY-GAIN lost 0 of 1787 runs, behave help IDENTICAL, promoted dde5865b (577520 B), _offc twin installed; live-vs-staged behaveprobe on pre-existing verbs circle_channel (433 B) and person_attest (443 B) IDENTICAL, play_check DIFFERS as expected (live 120 B unknown_verb, staged 466 B). GATE SHIPPED by nx_organ_ship (job 1790624465): prove 53/53, the one lost run named and approved (nx_connect_msgstore.msg_store_append, the intended msg_append engine repoint; evidence knowledge/status/harness/loss-e04fea16...record), behaviour change reviewed (knowledge/status/harness/review-frontdoor-finish-nx_connect_api_gate-c8f80c86.txt, sha 35c542cf), promoted c8f80c86 (749664 B, was 9afbeeb7), _offc twin installed. LIVE from the nishihost root: /api/organ_run nx_connect play_check tictactoe group ward 1 0 0 0 0 1 0,4 answers hosts_joined 1, join ok, both sits ok, moves [ok,ok], plies 2, digest 2019662868, result ongoing, viewer_told 1, lists_members 0, stored 0 (the folkgame spec resolves through ep_artifact_path). WATCH: an unknown game makes nx_folkgame_lib print a FOLKGAME-REFUSED line on stderr; the JSON on stdout stays clean. RECIPE: /api/organ_run args_encoding=percent-v1 separates argv with a plus sign (a percent-encoded space stays inside one argument). Shipped, gate 53/53, awaiting acceptance. 2026-09-28 land W17 GAMES-TOGETHER, ONE DIGEST SPEC: the chained digest moved out of nx_connect_play into nx_connect_play_digest (cpd_chain and cpd_words, 1596 B -- CRC-32C through det_state_checksum over little-endian words prev, move, then the generator's full fg_save snapshot), so the play session and the crossplay probe run the same code and a second spelling of the rule cannot exist; cpl_chain now delegates. Proven neutral before shipping: qualify 127/127 with the same digests (opening 3598535430, first move 2330911069, fifth 455173136). nx_connect_play_gate rebuilt through /api/build (src_path names the gate, src_sha256 4087fbf0, closure 10d8bbea), content GREEN lost_from_live 0 with one source added (the digest lib), promoted expect_sha256 6a491bd27108a1670d47e11014bce5423676851f43c14b717ba5867436ccf81e (246696 B, before it d806920b), _offc twin installed; served /api/gate_run 127/127 GREEN exit 0, 14215 of 16384 B captured, untruncated. 2026-09-28 measure CROSSPLAY BY DETERMINISM, two architectures of one host: the probe runtime/_hdl_build/nx_connect_play_replay.nx (3828 B; the tic-tac-toe rules embedded because the wasm door reads no file; the forced line read off the generator's own first line, never typed) prints CPD ply=0..5 digest 3598535430 2330911069 3170970567 4123116413 359321511 455173136 run native (nx_sov_build_run, x86-64) and on the estate wasm VM (nx_compile_wat --host-write, nx_wat_compiler, nx_wasm_run: WASM-RUN export=main rc=0 module_bytes=64120) -- byte-identical lines, and the native values equal the play session's own. Not measured: a phone browser, the Nishi browser, NishiOS native (gameengine GE27 and GE47 name those doors). 2026-09-28 land nx_connect_play_crossplay_gate 12/12 GREEN, awaiting acceptance: the native chain computed in-process by cpd_chain over the generator parsed from the spec FILE is compared line by line with what the VM prints for the probe, so the embedded rules cannot drift from knowledge/compare/folkgames.align without a RED; the final line agrees; the WASM-RUN receipt is last with rc 0; a neg-control shows the same position reached by another move order (the first three moves reversed) carries another digest, 2298537200, that the VM never printed. BITE: a drifted forced line planted in the probe (the second player's two answers swapped) read RED 10/12 with exactly the two agreement teeth failing (vm_lines_agreeing 2 of 6, the unchanged plies 0 and 1) while every pipeline tooth stayed green, so the RED was for the right reason; restored and hash-verified (h5d228de7b90bd4b6, 3828 B), then GREEN 12/12. SHIPPED /api/build (src_path names the gate, src_sha256 5250c3b3, closure 5bcfaf85), /api/promote expect_sha256 0ff0ac932a533a9ddf19244ae8d7c6d7956769f59632d7245c03bee1dd1cef99 (137464 B), /api/tools/register callable 1, _offc twin installed; served /api/gate_run from the serving root GREEN 12/12 exit 0 (probe resolved to buildroot/runtime/_hdl_build, toolchain to the promoted nx_compile_wat, nx_wat_compiler and nx_wasm_run), 1586 B captured. Rostered in knowledge/gateroster.conf and knowledge/compare/connect.gates, and row 5 of the ritual plane plan-connect-play-verify-. SCOPE, stated: an agreement gate cannot see a change to the digest spec that both sides share by construction; the pinned values in nx_connect_play_gate hold that class. 2026-09-28 queue W17 GAMES-TOGETHER CLOSE-OUT, open and owned: (1) FRONTDOOR-FINISH owns the four verbs play_open, play_join, play_move, play_state (VERB REQUEST row 1790620030; play_state returns only the caller's own room) -- until they land CN19 has no served caller and stays LIB-GATE-ONLY; (2) nx_connect_play_gate, nx_connect_play_crossplay_gate and nx_connect_lds_room are registered and callable but in no seat cap -- the cap owner mints, this seat writes no tokens; (3) the ritual plane plan-connect-play-verify- (5 rows) is refused by nx_plan_run managed-owned-definition-required until the PM owner defines it (row 1790621120); (4) the room rule carries no guardian clause, so a guardian's own youth is refused a private room on join (recorded tooth) -- an operator decision, never a seat's; (5) nx_connect_play_gate prints 14215 of the 16384 B FAST capture, so further play teeth go to a sibling gate (the crossplay gate is the first) or print less; (6) crossplay beyond x86-64 and the estate wasm VM is unmeasured; (7) the ranker reads CN19 LIB-UNCENSUSED until the eco graph and importcensus refresh; (8) no /games alpha note was published -- the site lane was not taken, this journal is the record. 2026-09-28 land Gate resolution declared, not left to naming: knowledge/organ_gate.conf now pairs nx_connect_play_digest with nx_connect_play_gate (the pinned values and the second-method recompute of the digest spec live there, which the name convention would never reach) and the crossplay probe nx_connect_play_replay with nx_connect_play_crossplay_gate, so a ship of either resolves its PROVE stage by declaration; nx_connect_play keeps the convention. The connect page republished through nx_compare_regen_scoped (GREEN, index.html 1358003 B) and nx_page_verify reads it GREEN, status 200.

CN20 Post-quantum ratchet (forward secrecy and post-compromise healing) · cell LANDED · gate UNRECORDED

Contract	`kx_pq_ratchet` · executor Organ · 3 u · stands on CN8
Definition of done	The CN8 hybrid key agreement grows into a ratchet at the Level 3 bar [apple-pq3] [signal-spqr]: a symmetric chain that derives a fresh key per message and deletes the one before it, an X25519 step with every reply, and a periodic ML-KEM-768 epoch whose fresh encapsulation re-seeds the chain, so a copied device state stops opening messages after the next epoch; done-rule: a ratchet-vm-class gate proves on the SHIPPED wasm that (1) a message key is gone from the state one step later and a stolen current state cannot open a message sealed before the theft (forward secrecy), (2) a stolen state stops opening messages once the next ML-KEM epoch lands (post-compromise healing, planted both ways), (3) out-of-order delivery inside a bounded skip window opens while a replay is refused, and (4) a downgrade that strips the epoch is refused once both peers advertise it -- the watch flips by the gate, never by the symbol name
Matrix cell	Post-quantum ratchet (forward secrecy and post-compromise healing) · `runtime/nx_connect_pqratchet.nx` · LANDED decl
Gate	`nx_connect_pqratchet_vm_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-28 land W16 SOTA-PQ-HYBRID DECLARED THE NEXT RUNG UP THE PQ LADDER, because the board contradicted itself: T-BIC-CONNECT names a post-quantum ratchet [signal-spqr] and the Signal bar row said PQ and the ratchet are CN8, while CN8's done-rule is only the hybrid key agreement and its own scope says no ratchet and no forward secrecy. Apple's PQ3 page was fetched and READ this leg (nx_research_fetch job 1790621590, status 200, 106073 B, sha256 d3c9d379, knowledge/fetched/cmp_connect_apple_pq3.html; February 21, 2024): Level 2 is post-quantum initial key establishment (Signal PQXDH), Level 3 adds post-quantum rekeying -- a Kyber-768 ratchet about every 50 messages and at least every 7 days beside an ECDH step on every response -- so a point-in-time key compromise heals; by that scale the CN8 page is below Level 2 (static keys, no ratchet). LANDED AS DATA: rung CN20 kx_pq_ratchet (cost 3, deps CN8) with a done-rule a ratchet-vm-class gate must prove on the shipped wasm (forward secrecy, post-compromise healing planted both ways, a bounded skip window with replay refused, a downgrade that strips the epoch refused); rungrole contender for T-BIC-CONNECT; ms M3 now CN7,CN8,CN20,CN1,CN2 with the cumulative budgets 28, 35.5 and 39.5; a matrix watch row runtime/nx_connect_pqratchet.nx _ABSENT_:kx_pq_ratchet (Signal Best, the rest 0 as a presence reading); ref apple-pq3 pinned hd3c9d379 and cited inline; the Signal bar row now says CN8 is proven on the shipped page and the ratchet is CN20. RULERS: nx_ladder connect LADDERED (24 of 24 placed), nx_barfresh FRESH, nx_compare_rank connect (job 1790621977) ranks CN20 #3 on the version 1.0 critical path at priority 733 behind CN2 and CN7 and files it to pm_intake; nx_compare_refs_gate (job 1790622014) passes every schema, pin, mark and cited-inline tooth for the new row and reads RED 43/45 only on two fleet ratchets raised by other lanes' rows (open-redirect: pmdash monday_ai_2026_09_23, automation osworld26, search marginalia-api, datavis plot; moved: the monday row), which their owners should read. 2026-09-28 queue W16 SOTA-PQ-HYBRID REQUEST to the daemon-source lease holder (nx_connect_serve.nx and nx_connect_appd.nx were NOT edited by this seat): the additive kx=3 ratchet fields, composing runtime/nx_connect_pqratchet.nx (29430 B sha256 491feda6) and never a second format. (1) POST /connect/pubkey: kx=3 advertises the ratchet, accepted only when kxr_q_ok(kx, q, qn) == 1 (one ML-KEM-768 key at version 3, the first turn's encapsulation key) under the same owner rule as cs_sh_pub_put2; GET /connect/pubkeys returns kx 3 additively. (2) POST /connect/seal: optional kx=3 with e and n and pn (decimal counters, e at least 1), dh (kxr_dh_ok, one X25519 key in hex), kc (kxp_kc_ok, one ML-KEM-768 ciphertext in hex), q (the sender's fresh encapsulation key, the length kxr_q_ok checks) and tg (kxp_tg_ok); refuse a partial ratchet header; store all of them with the message and return them additively on GET /connect/sealed. (3) Defense in depth: refuse a seal without the ratchet header when BOTH from and to advertise kx=3 (kxr_accept(1,1,0,0) == KXP_REFUSE_DOWNGRADE), as the page will. Bodies grow by about 4.7 KB per message (kc 2176 and q 2368 hex, dh 64, tg 32, three counters); the appd request buffer is 262144 B, so no cap moves. Proof owed with the change: an alpha gate tooth that publishes kx=3, seals with a full ratchet header, reads every field back from /sealed and refuses each malformed field and the stripped header between two ratchet-advertising members. 2026-09-28 queue W16 SOTA-PQ-HYBRID, THE PAGE LEG OF CN20 for the next seat on this rung (nothing below is built yet; the lib is the source of truth). (1) nx_connect_pqratchet grows a second emitter, the ratchet state machine as JavaScript (krInitAlice, krInitBob, krTurnSend, krRatchet for kx_pq_ratchet, krSend, krRecv, krOpen with the commit-on-verified-tag copy), a state object with the kxr_st_* fields kept per peer in localStorage as hex, fresh randomness from crypto.getRandomValues in the kxr_rnd_* layout, over the helpers kxr_emit_js already emits. (2) nx_connect_e2e_client gains a pqr verb writing /synth/connect_e2e_pqr from ce_emit_html_pq plus both ratchet blocks, with the router opt-out, saying on screen that the ratchet is not live until the directory carries kx=3. (3) nx_connect_pqratchet_vm_gate gains page teeth: the page carries both emitted blocks byte for byte (the CN8 gate's T9a pattern), the page's own krAccept, krSendMode and krSkipOk run in nx_js_eval lifted from the page instead of the emitter, and a REAL-BROWSER self-test because nx_js_eval cannot call wasm: the page opened with ?selftest=1 plays this gate's scripted conversation (init, four turns, out of order, late previous-turn delivery, replay, tamper, epoch rewrite, window edge) on its own modules and writes one line per step into a pre element that nx_cdp_capture reads, and the gate compares those lines with its own native run, so the page's state machine is executed, not merely present. CN20's done-rule is met on the shipped MODULES today; the page leg is what makes the proof cover the page's own code. 2026-09-28 queue W16 SOTA-PQ-HYBRID REQUEST for the FRONTDOOR owner (nx_connect_api_lib and nx_connect_api, not edited here): one PURE verb kr_policy over nx_connect_pqratchet -- kr_policy <self_adv> <peer_adv> <pinned> <has_hdr> answers kxr_accept, kr_policy send <peer_adv> <pinned> answers kxr_send_mode, kr_policy window <nr> <held> <n> answers kxr_skip_ok; nothing stored, no key material in or out. Teeth to carry: both-advertise without the header refused, a pinned peer refused after the directory strips kx=3, a legacy peer falls to the kx=2 rule (positive control), the window edge admitted and one past it refused. With it a CN20 treat row can name mcp=nx_connect and api=/api/organ_run?target=nx_connect&args=kr_policy; until then CN20 declares no treat row, by rule. 2026-09-28 queue KXR_MAX_SKIP 32 is a THRESHOLD compiled into nx_connect_pqratchet (the skip window and the capacity of the held-key table): its conf row, knowledge/connect_ratchet.conf with the Signal Double Ratchet section 3.5 guidance and a measured localStorage budget per conversation as its calibration, is owed before the page leg ships, since the page's window must be the lib's. 2026-09-28 lesson A PASSIVE-THIEF GATE CANNOT SEE AN ACTIVE HEADER ATTACK. The first cut's message tag covered epoch, n and dh only, so pn, the ML-KEM ciphertext kc and the next-turn ML-KEM key q rode outside it, and every healing tooth stayed GREEN because every thief in the gate only read state. Planted back into the lib (tag over epoch and n only), a new-turn header whose q was swapped for another valid key was ACCEPTED (T7g actual 0, want E_TAG -6), a rewritten pn was accepted (T7h), and the receiver committed both, changing 12160 state bytes (T7i): an active attacker would have been handed the receiver's next KEM secret, the one thing the ML-KEM half exists to deny. Fixed before any page carried it: tag = SHA3-256(label, k_tag, the WHOLE 2328-byte header, body)[0..16) in the lib (kxr_in_mac, kxr_mac, kxr_open), in the gate's copy on the shipped modules (rg_mac), and in the emitted krTag, which now also refuses a header of the wrong length (KRL.hb). Restore verified by hash (lib 1f45b31e, 29584 B, byte-identical to the pre-plant copy). For every header field, write the active-rewrite tooth beside the passive-theft tooth. 2026-09-28 measure nx_connect_pqratchet_vm_gate after the whole-header tag: 70/70 GREEN on the three modules the shipped CN8 page embeds (on_shipped_modules=1, agree_steps=18, agree_differing_bytes=0, agree_verdict_mismatches=0) with vm_elapsed_ms=430713 at load1 3.73, against 356790 for the 66-tooth first cut (its load was not recorded); the whole-header tag makes the interpreting VM hash about 16 more SHA3-256 blocks per tag, the likely share of that rise, UNMEASURED. Native mode 69/70 (T1e only, by design). RED 67/70 on the X25519-only page, which embeds no ML-KEM module (T1c T1d T1e). Planted first-cut tag RED 65/70 (T1e T7g T7h T7i T7j). tag_body_max_bytes=1776, was 4056: the tag now reads 16+32+2328 bytes of the 4152-byte tag region the kx=2 page lays out, so one ratchet frame carries at most 1776 bytes of body, refused past that and never truncated. header_bytes=2328 state_bytes=7656 emitted_js_bytes=1427 (was 1459). 2026-09-28 queue THE PER-TURN DIGEST, to win back the frame body bound and the gate's VM time without giving back whole-header authentication: tag over (label, k_tag, epoch, n, pn, dh, D, body) where D = SHA3-256(kc, q) is computed once per turn by the sender and once on the new-turn receive and kept in the ratchet state beside the kept kc and q, and a same-turn header is refused unless its kc and q equal the kept ones byte for byte. Per-message tag work drops from about 18 SHA3 blocks to about 2 and the body bound returns to about 4040 bytes. Recipe: state layout + kxr_turn_send + kxr_recv + kxr_mac in the lib, the same in the gate's copy (rg_*), krTag in the emitted JS, then T7g T7h T7i re-run plus a same-turn kc or q rewrite tooth (must refuse) and the planted first-cut tag (must go RED). Until it lands the gate runs about 431 s at load 3.7, over the 420000 ms compare-referee bound (the referee abstains DEADLINE-UNMEASURED on this row) and at 96 percent of the heavy roster's 450000 ms share. 2026-09-28 queue THE ACTIVE-REWRITE AUDIT the CN20 lesson owes the rest of the board, UNAUDITED by this seat and so not a claim that anything is missing: for every header or envelope field each E2E protocol gate authenticates (nx_connect_seal_gate, nx_connect_franking_gate, nx_sealed_sender_gate, nx_mls_group_gate, nx_msg_sync_gate, nx_connect_pqkx_vm_gate), name the tooth that rewrites that one field in transit and asserts a refusal with no state change, and plant the tag or signature that skips the field to prove the tooth can fail. A gate whose adversaries only read state proves forward secrecy and healing and says nothing about what an active attacker can substitute; CN20's first cut passed 66 of 66 teeth with q, pn and kc outside its tag. 2026-09-28 measure Heavy-roster trial of the promoted nx_connect_pqratchet_vm_gate (sha a25c9259): TIMEOUT exit=137 at ms=450018 against the 450000 ms per-gate share at nice 10 (journal /tmp/cn20_pqr_heavy_trial.jrnl), killed after T2e, about three quarters of the way through; NOT admitted, so no beat runs this gate yet (it runs at ship, on gate_run and on demand). The same bytes ran 70/70 in 430713 ms at nice 0 an hour earlier, and the 66-tooth first cut ran 356790 ms, so even the first cut fit the kill bound only at nice 0. 2026-09-28 queue SPLIT THE VM WORK SO A BEAT CAN RUN IT: the gate's VM path can take over from a native-produced state at any turn, because both paths hold byte-identical states wherever agreement holds. Two roster gates, one with the VM on from init through turn 2 and one native to turn 2 then VM on for turns 3 and 4 and the healing, each carry about half the VM ML-KEM operations and X25519 multiplications; each needs a tooth that the handover state equals the native state and an agree_steps that counts only VM-executed steps. With the per-turn digest (1790636662) each half should land near 200 s, inside the 420000 ms referee bound and the 450000 ms heavy share at nice 10 -- an ESTIMATE from the CN8 gate's rate (7 ML-KEM operations and 5 scalar multiplications in about 171 s), UNMEASURED. Then trial and admit both through nx_gate_roster_run. 2026-09-28 land nx_connect_pqratchet_vm_gate SHIPPED by nx_organ_ship: built through /api/build (sha a25c9259fcda16fd, 1707816 B), PROVE 70/70 GREEN on this run's fresh build, promoted with live sha equal to staged sha, the _offc twin installed and hashed equal to live, REGISTERED callable=1, harness token h6ae6485635fc0ae4. The lib buildroot/runtime/nx_connect_pqratchet.nx (sha256 1f45b31e, 29584 B) declares kx_pq_ratchet, so the scoped regen published /compare/connect with the cell measured present (lib-gate-only, importers=1): index.html 1509004 B, nx_page_verify GREEN 200 with 0 a11y issues. connect.gates carries the CN20 row and the matrix CN20 note carries the header-auth fix and the 1776-byte body bound. NOT LIVE: no page carries the ratchet (queue 1790634201), the directory does not carry the kx=3 fields (1790634200, nx_connect_serve.nx belongs to ALPHA-SIGNUP), and there is no kr_policy verb (1790634202). Heavy roster NOT admitted (TIMEOUT, 1790637700). Shipped, referee GREEN, awaiting operator acceptance.

dossiers=24 cells_joined=22 no_matrix_row=2 (sum 24) gates_recorded=0 gates_unrecorded=4 no_gate_declared=18 (sum 22 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 58 feature rows mapped of 64 matrix rows; 6 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/connect.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 400–1000, distinctiveness 0–500 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 681 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 400–1000 · distinctiveness 0–500 · breadth 100–700 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 10 (a fact of the data: two players that close are that close) · data spread 101 permil of the plot

Nishi Tandem HelloTalk Meetup Discord Signal Matrix
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 11 (a fact of the data: two players that close are that close) · data spread 598 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Aspirational	929	412	603	673	-9 since 2026-09-29	52	14	2026-09-15
Tandem	Peripheral	565	124	206	571	-5 since 2026-09-29	21	14	2026-09-15
HelloTalk	Peripheral	612	157	235	594	-5 since 2026-09-29	23	14	2026-09-15
Meetup	Peripheral	457	146	166	508	-5 since 2026-09-29	19	14	2026-09-15
Discord	Aspirational	789	276	379	647	-8 since 2026-09-29	34	14	2026-09-15
Signal	Aspirational	733	347	408	739	+20 since 2026-09-29	32	14	2026-09-15
Matrix	Aspirational	752	267	367	646	+11 since 2026-09-29	33	14	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	52	7
2026-09-16	52	7
2026-09-17	52	7
2026-09-18	52	7
2026-09-19	52	7
2026-09-20	52	7
2026-09-21	52	7
2026-09-22	52	7
2026-09-23	52	7
2026-09-25	54	7
2026-09-26	54	7
2026-09-28	54	7
2026-09-29	57	7
2026-10-08	58	7

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 384, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	Tandem	HelloTalk	Meetup	Discord	Signal	Matrix
Reciprocal language-partner matching Measured: `mx_inter_popc` exists in `runtime/_hdl_build/nx_connect_match_lib.nx`, verified at emit. Harmonic-mean reciprocity (one-sided pair scores 0); Tandem defined the category at scale rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=5` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons behind Tandem (leads)	●	◉	●	○	○	○	○
Unified interest graph (language+hobby+faith, one model) Measured: `gx_clamp100` exists in `runtime/_hdl_build/nx_connect_graph_lib.nx`, verified at emit. One meta-path graph across silos; Meetup=interest groups, Discord=topic servers, neither unifies with language and faith rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=4 nonval=4` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	◐	◐	○	○
Consented intent lanes (mutual-min escalation) Measured: `ln_min` exists in `runtime/_hdl_build/nx_connect_lanes_lib.nx`, verified at emit. Escalation = MIN of both opt-ins; incumbents have no intent model -- Tandem's is a policy sentence (not a dating app, cited) rather than a consent state machine [tandem-guidelines] Adoption: `LIB-WIRED importers=6 nonval=6` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○	○	○
Privacy-preserving age assurance (band only, no ID stored) Measured: `hmix` exists in `runtime/_hdl_build/nx_connect_idage.nx`, verified at emit. Issuer attests an age BAND, unlinkable pseudonyms -- the minimal-disclosure shape ISO/IEC 27566-1 (Dec 2025) and the EU age-verification app converge on (both cited); Discord's 2026 program is on-device face estimation or ID (cited); Signal and Matrix carry no age-assurance capability at all [whatsapp-u13] [discord-age] [eu-avapp] [iso27566] Adoption: `RUN-BY:roster` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	◐	◐	◐	○	○
Structural adult-minor wall (two-deep, SERVES youth) Source present; authored stronger claim: `yw_may_channel` in `runtime/_hdl_build/nx_connect_youth_lib.nx`, verified at emit. EXCEED KEPT after the 2026 re-grade: Discord went teen-by-default globally in Feb 2026 (cited, now Part) yet still permits adult-minor private DMs; HelloTalk segregates minor SEARCH only and Meetup is 18-plus exclusion (both cited); no rival enforces the visible-context two-adult rule (GH 20.7.1, cited) [discord-terms] [discord-teen] [snap-u16] [meetup-age] [hellotalk-minor] [church-gh20] Adoption: `LIB-WIRED importers=9 nonval=8` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	◐	○	○
Fail-closed mandatory CSAE reporting Measured: `sink_fails` exists in `runtime/_hdl_build/nx_connect_csae_report_lib.nx`, verified at emit. Ours refuses to proceed when the report sink fails; incumbent pipelines are best-effort duty-met (18 USC 2258A cited; NCMEC read 21.3 million reports in 2025 with enticement up 158 percent, cited) [usc-2258a] [ep-csar] [ncmec] Adoption: `LIB-WIRED importers=2 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	◐	◐	◐	◐	◐
Messaging core (ordered log, offline dedup, receipts, edit/delete) Measured: `log_append` exists in `runtime/_hdl_build/nx_connect_msg.nx`, verified at emit. Idempotent by client msg-id; delivery state machine; content-blind storage; the maturity gauge grades our depth STUB (in-memory demo) -- presence, not scale; rung CN6 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:roster` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Meetup; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	◐	●	●	●
Message breadth (reactions, replies, forward, pins, search) Measured: `react_toggle` exists in `runtime/_hdl_build/nx_connect_msgx.nx`, verified at emit. Full-text search is client-side by content-blind design rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, MeetupCons not adopted yet: source exists, never compiled: /api/build it	●	◐	◐	○	●	●	●
Media, voice notes + resumable large files Measured: `blob_put` exists in `runtime/_hdl_build/nx_connect_media.nx`, verified at emit. Content-addressed dedup; chunked + resumable for low bandwidth rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of MeetupCons not adopted yet: source exists, never compiled: /api/build it	●	●	●	○	●	●	●
Inline in-chat translation (unlimited, free) Measured: `ct_render_inline` exists in `runtime/_hdl_build/nx_connect_translate.nx`, verified at emit. Unlimited BY CONSTRUCTION vs rationed rivals (Tandem Pro and HelloTalk VIP paywall unlimited translation, both cited) -- but the free field moved in 2025-26: WhatsApp ships free on-device translation and Apple ships on-device Live Translation (both cited), so free-inline is table stakes outside this column set; our QUALITY is lexicon-grade (gauge: STUB) and real NMT through the LLM serve is rung CN9 [apple-livetranslate] [tandem-overview] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Meetup, Discord, Signal, MatrixCons behind Tandem (leads), HelloTalk (leads); not adopted yet: source exists, never compiled: /api/build it	●	◉	◉	○	○	○	○
In-chat correction learning loop Measured: `ct_rationed_translate` exists in `runtime/_hdl_build/nx_connect_translate.nx`, verified at emit. Correction binds to the message, original preserved; HelloTalk correction is its signature (cited) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Meetup, Discord, Signal, MatrixCons behind HelloTalk (leads); not adopted yet: source exists, never compiled: /api/build it	●	●	◉	○	○	○	○
Real-world events + RSVP (capacity, idempotent) Measured: `ev_rsvp` exists in `runtime/_hdl_build/nx_connect_events_lib.nx`, verified at emit. Meetup is the category king and charges organizers (Starter caps one group, two events, ten attendees; Standard 29.99 USD per month -- both cited); ours adds the two-deep youth wall and zero fees [meetup-plans] [meetup-prices] [meetup-starter] [luma] Adoption: `LIB-WIRED importers=7 nonval=7` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Discord, Signal, Matrix; fully adopted on the estate ladderCons behind Meetup (leads)	●	○	◐	◉	◐	○	○
Profile + moments feed + stories (additive tombstones) Measured: `so_feed` exists in `runtime/_hdl_build/nx_connect_social.nx`, verified at emit. HelloTalk Moments is core to it; Signal ships stories; Element has no feed surface; ours is faith-consent-gated (Art.9, cited) and looks-de-emphasized [gdpr-art9] Adoption: `RUN-BY:roster` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons behind HelloTalk (leads)	●	◐	◉	◐	◐	◐	○
Consent-only discovery (handle/QR; no phonebook upload) Measured: `so_add_by_token` exists in `runtime/_hdl_build/nx_connect_social.nx`, verified at emit. NO phonebook-ingestion path exists in the schema; Signal still keys on phone numbers (private contact discovery plus usernames); Matrix is handle-based rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:roster` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	◐	○	◐	◐	●
Typing/presence privacy + scheduled/silent send Measured: `ty_active` exists in `runtime/_hdl_build/nx_connect_presence.nx`, verified at emit. Typing is ephemeral by construction; last-seen has a coarse privacy mode rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, DiscordCons not adopted yet: source exists, never compiled: /api/build it	●	◐	◐	○	◐	●	●
E2E content-blind group video receive (SVC, server decodes 0) Measured: `recv_bw_svc` exists in `runtime/_hdl_build/nx_connect_room_rx.nx`, verified at emit. The parity bar moved: Discord DAVE is now UNIVERSAL -- every voice and video call E2E by default since March 2026 (cited); Signal group calls are E2E at 75 (cited); Element Call is E2E; ours is layout-aware SVC receive, gate-proven [discord-dave] Adoption: `RUN-BY:roster` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup; fully adopted on the estate ladderCons behind Discord (leads)	●	○	○	○	◉	●	●
E2E scale ceiling (MLS RFC9420 thousands; O(page) receive) Measured: `log2_ceil` exists in `runtime/_hdl_build/nx_connect_room_scale_exceed.nx`, verified at emit. EXCEED RETIRED 2026-08-19: MLS is the shipped norm now -- Discord DAVE universal, RCS UP3.0 MLS beta between iPhone and Android, Wire two-thousand-member groups GA, Webex 1000-participant meetings (all cited); ours remains a cited architectural model, not a deployment; product caps for context: Signal calls 75 and groups 1000; Telegram groups reach 200000 but are NOT E2E (secret chats only, FAQ cited -- the old note wrongly paired that number with E2E caps) [rfc9420] [signal-calls] [wire-mls] [webex-mls] [telegram-faq] [matrix-twim] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Signal, MatrixCons behind Discord (leads); not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	◉	◐	◐
Sovereign self-host + zero vendor metadata Measured: `max_arr` exists in `runtime/_hdl_build/nx_connect_room_exceed.nx`, verified at emit. EXCEED RETIRED 2026-08-19: Matrix/Element self-hosts at national scale (Bundeswehr 100000-plus active users, cited), so self-hosting is no longer unique; what remains ours alone -- the whole stack from the assembler up on your own hardware, TLS to storage to build chain -- is carried as presence until it is measured against a peer, not asserted rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, SignalCons behind Matrix (leads); not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	○	○	◉
Zero paywalled connection features (incl unlimited translation) Measured: `hx_find` exists in `runtime/_hdl_build/nx_connect_h2h_exceed.nx`, verified at emit. EXCEED RETIRED 2026-08-19: Signal and Matrix are free (donation- and open-source-funded), so zero-paywall is shared with the lane leaders; the paid four remain cited from banked bytes -- Tandem Pro, HelloTalk VIP (unlimited-translation paywalls, both cited), Meetup organizer subscriptions (cited), Discord core free with Nitro extras [hellotalk-vip] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, DiscordCons not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	◐	●	●
Member-missionary reconnection (mission x area x time) Measured: `rc_inter_popc` exists in `runtime/_hdl_build/nx_connect_lds_reconnect_lib.nx`, verified at emit. No incumbent models service-era bonds -- the Church's own Member Tools shares mission-leader contacts one-way only (cited); consent-gated in both directions; live at /connect/reconnect Adoption: `LIB-WIRED importers=6 nonval=6` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○	○	○
Connection-quality funnel (replies/meetings, not time-on-app) Measured: `show_by` exists in `runtime/_hdl_build/nx_connect_conn_quality.nx`, verified at emit. Success metric = real connection outcomes; the 2026 IRL-first challengers (Timeleft, cited) validate the philosophy while the big incumbents still optimize engagement time [timeleft] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, MatrixCons not adopted yet: source exists, never compiled: /api/build it	●	○	○	◐	○	○	○
Content-blind abuse detection (no plaintext to server) Measured: `abuse_score` exists in `runtime/_hdl_build/nx_connect_blind_abuse_lib.nx`, verified at emit. Behavioral and metadata signals only; Signal is content-blind by construction; the 2026 EU frame keeps E2E content out of scanning duties (EP resolution cited); most incumbents scan plaintext server-side rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=2 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	◐	●	◐
TOTP-class 2FA + single-use recovery + lockout Measured: `fa_verify` exists in `runtime/_hdl_build/nx_connect_2fa.nx`, verified at emit. Full state machine gated (window verify, lockout, recovery); OTP fn = named RFC-6238 drop-in on in-tree HMAC-SHA1 [rfc6238] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: source exists, never compiled: /api/build it	●	●	●	●	●	●	●
Contextual brought-to-you-by ads (minor-walled, faith-blind) Measured: `ca_should_serve` exists in `runtime/_hdl_build/nx_connect_ads_lib.nx`, verified at emit. Composes the honest-ad engine: only signals are shown-flag + coarse geo; zero ads to minors fail-closed; incumbents run behavioral targeting or none Adoption: `LIB-WIRED importers=2 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○	○	○
Group chat + broadcast channels (roles by construction) Measured: `grp_can_post` exists in `runtime/_hdl_build/nx_connect_group_lib.nx`, verified at emit. OWNER over ADMIN over MEMBER with no admin coup; a minor is never admitted to a DATE-lane group; Discord roles are the category best; live at /connect/community rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=5` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, Meetup; fully adopted on the estate ladderCons behind Discord (leads)	●	○	●	◐	◉	●	●
Polls + quizzes (one voter one ballot, revote replaces) Measured: `pl_vote` exists in `runtime/_hdl_build/nx_connect_polls_lib.nx`, verified at emit. Anonymous mode reports aggregates only; quiz scores reveal after close; Discord ships native polls (cited); Signal polls were reported in 2026 press but are unconfirmed on a primary page, so Signal codes No with the uncertainty stated rather than guessed; live at /connect/community [discord-polls] Adoption: `LIB-WIRED importers=4 nonval=4` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Signal; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	●	○	●
Ward and branch community boundary (community, never administration) Measured: `wd_forbidden_count` exists in `runtime/_hdl_build/nx_connect_wards_lib.nx`, verified at emit. A field registry REFUSES every congregation-admin class (calling, record, attendance, ordinance, donation) -- the deliberate complement of the Church's own Member Tools admin tooling (cited); faith consent (Art.9) required; live at /connect/community [church-membertools] Adoption: `LIB-WIRED importers=5 nonval=5` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○	○	○
Youth game and hangout rooms (two-deep on join AND leave) Measured: `room_admit` exists in `runtime/_hdl_build/nx_connect_lds_room_lib.nx`, verified at emit. Admission drives a REAL relay room; a youth room is safe only while it carries two-plus adults, enforced on join and on leave; the norm is the published GH 20.7.1 (cited) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=4 nonval=4` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	◐	○	○
Call session signaling (state machine, no cold-call, block honored) Measured: `call_initiate` exists in `runtime/_hdl_build/nx_connect_call.nx`, verified at emit. Valid transitions only; only the callee accepts, only the caller cancels; you cannot call a non-contact or through a block; the media plane is the codec watch row (rung CN1) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of MeetupCons behind Discord (leads); not adopted yet: source exists, never compiled: /api/build it	●	●	●	○	◉	●	●
Video-room media pipeline (SVC layers, NACK+AIMD, active speaker) Measured: `cc_on_loss` exists in `runtime/_hdl_build/nx_connect_transport.nx`, verified at emit. Send-side SVC encode with per-layer encrypt and pacing, offset-addressed reassembly with NACK, loss-driven rate feeding layer selection, speaker detection from level metadata only; integer models proven in gates, NOT composed into live calls -- rung CN1 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, MeetupCons behind Discord (leads); not adopted yet: source exists, never compiled: /api/build it	●	◐	◐	○	◉	●	●
E2E group keying (MLS-style sender-key ratchet) Measured: `ratchet` exists in `runtime/_hdl_build/nx_connect_groupkey.nx`, verified at emit. Forward secrecy proven, a removed member cannot derive the next epoch, the server holds zero key material; a key-SCHEDULE model whose production primitive is the ecosystem HKDF -- Discord and Signal ship the real thing (both cited) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, MeetupCons behind Discord (leads), Signal (leads); not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	◉	◉	●
Authenticated message sealing (ChaCha20-Poly1305 AEAD, RFC 8439) Measured: `cseal_open` exists in `runtime/nx_connect_seal.nx`, verified at emit. Tamper is REJECTED, the nonce is a per-message counter, the sequence is the AAD (RFC 8439 cited); retires the additive stand-in the gauge graded STUB; gate-proven, wiring into the live serve is rung CN7; Discord text chat is NOT E2E (no current plans, cited) [rfc8439] Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord; fully adopted on the estate ladderCons behind Signal (leads)	●	○	○	○	○	◉	●
Sealed messages live on a served instance: AEAD envelopes stored, tamper refused, franking reports verified (CN7, ALPHA) Measured: `cs_sealed_aead` exists in `runtime/_hdl_build/nx_connect_sealed_api.nx`, verified at emit. LIVE ON THE ALPHA 2026-09-28 (wave 16): /alpha/connect/secure/v1/ stores only sender-sealed ChaCha20-Poly1305 envelopes in the recipient's own C1 room behind the youth wall's channel verdict, re-verifies each stored record's server tag before serving it, and verifies a franking report naming the true sender; nx_connect_alpha_sealed_gate 26/26 over the edge and RED 0/26 on the prior alpha. The lane runs in a helper process because the daemon sits at the compiler's 256-module import cap. Production /connect and an in-browser AEAD client are NOT on it yet; rival codes grade the authenticated sealing only, as the sealing row above does rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, DiscordCons behind Signal (leads); not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	●	○	○	○	○	◉	●
Sealed messages ACCEPTED as complete (CN7: operator, referee, seat) DARK — `runtime/nx_accept_decl.nx` EXISTS but does not declare `ga_accept_connect_sealed`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ACCEPTANCE WATCH for the sealed-messages row above (operator standing order 2026-08-30: not complete till the operator, the seat and the nishi referees agree). That row flipped on its symbol and its edge gate, but CN7's done-rule also retires the unauthenticated stream the seal gate neg-controls, and the served in-browser client (nx_connect_e2e_client) does not use the AEAD lane yet, so this cell is the honest state: INCOMPLETE. It flips ONLY through nx_accept emit on an operator ACCEPT row in knowledge/store/accept- whose targets carry ga_accept_connect_sealed, plus a referee row and a seat attestation; presence is not completion rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them watching ga_accept_connect_sealed Pros none measured yetCons behind Signal (leads), Matrix; open contract; expected source declaration not established	○	○	○	○	○	◉	●
In-browser E2E client (X25519 agreement on the shipped wasm) Measured: `ce_emit_html` exists in `runtime/nx_connect_e2e_client.nx`, verified at emit. RFC 7748 section 6.1 Diffie-Hellman proven ON THE SHIPPED WASM in the sovereign VM (keyx gate 5 of 5, RFC cited); seal in the sender's browser, POST only ciphertext, decrypt in the recipient's; live at /connect/secure; Signal's PQXDH-plus-SPQR is the depth bar (its own watch row) [rfc7748] Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, MeetupCons behind Signal (leads); not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	○	○	○	●	◉	●
Data-on-the-endpoint device vault (history never on our server) Measured: `cd_emit_html` exists in `runtime/nx_connect_device_client.nx`, verified at emit. Contacts and full message history live in the user's browser, ChaCha20-encrypted at rest; only a public key and ciphertext ever leave the device; honest scope: localStorage store, and the directory TOFU is closed by the pubkey-binding row rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, MatrixCons behind Signal (leads); not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	○	◉	◐
Identity-bound public-key directory (TOFU closed) Measured: `cs_sh_pub_put2` exists in `runtime/_hdl_build/nx_connect_serve.nx`, verified at emit. Once a handle is verified under an account, no other account and no anonymous caller can substitute a key -- proven through the live /connect/pubkey route and across boot replay; Signal shipped automatic key verification in Aug 2026 (cited), the same property at production depth rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup; fully adopted on the estate ladderCons behind Signal (leads)	●	○	○	○	●	◉	●
Passwordless-at-rest login (OPAQUE aPAKE, RFC 9807) Measured: `cs_page_login` exists in `runtime/_hdl_build/nx_connect_serve.nx`, verified at emit. Register, login, whoami over an argon2id KSF and Ed25519 sessions; the server stores an envelope, never a password-equivalent (RFC 9807 cited); wrong passphrase and unknown handle proven REJECTED by the auth gate; live at /connect/login [rfc9807] Adoption: `LIB-WIRED importers=5 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●	●	●
Per-account persistent isolated worlds Measured: `acc_save` exists in `runtime/_hdl_build/nx_connect_accounts.nx`, verified at emit. Atomic tmp-plus-rename snapshots survive restart, accounts are isolated by construction, a tampered snapshot is rejected fail-closed; plus a bounded per-account contact list rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=6 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●	●	●
Shared albums on relationship-based access Measured: `al_do` exists in `runtime/_hdl_build/nx_connect_album.nx`, verified at emit. One ReBAC permission plane answers every share question; a signed-out caller cannot mutate anything (gate tooth T3) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=4 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	◐	◐	◐	◐	◐
Agent-ready API front door (every engine a pure verb) Measured: `ca_dispatch` exists in `runtime/_hdl_build/nx_connect_api_lib.nx`, verified at emit. All eight gated engines behind one stateless dispatcher emitting versioned JSON, registered on the MCP surface as nx_connect; Discord and Matrix have first-class public APIs, Meetup a partial one rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=3` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Signal; fully adopted on the estate ladderCons behind Discord (leads), Matrix (leads)	●	○	○	◐	◉	○	◉
Zero-JS accessible app shell (ADA by construction) Measured: `cu_tab` exists in `runtime/_hdl_build/nx_connect_ui.nx`, verified at emit. Token-SSOT design system, aria-current navigation, zero external assets, renders without JavaScript; the E2E client is the one accepted JS last-mile Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○	○	○
Censorship-resistant + gracefully degrading transport Measured: `distinct_bytes` exists in `runtime/_hdl_build/nx_connect_censor_transport.nx`, verified at emit. No static wire signature for DPI to match -- measured against an in-gate DPI model, not a live censor, and said so; ordered fallback (direct, TLS-fallback, relay, store-and-forward) always delivers; Signal ships censorship circumvention, Matrix has P2P research rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, MatrixCons not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	○	●	◐
Data-light wire for low-bandwidth regions Measured: `dl_envelope_bytes` exists in `runtime/_hdl_build/nx_connect_datalight.nx`, verified at emit. Fixed 34-byte envelope, delta sync, one-round-trip catch-up, text-first media references; architecture-level byte accounting -- no live-network head-to-head claimed rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, DiscordCons not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	○	●	●
Fair exposure ranking + honest match framing Measured: `gini_permil` exists in `runtime/_hdl_build/nx_connect_fair_rank.nx`, verified at emit. Exposure-fair re-ranker audited by an integer Gini (must halve popularity concentration at 70-plus percent retained relevance); NO unfalsifiable compatibility score exists in the output schema by construction Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, MatrixCons not adopted yet: source exists, never compiled: /api/build it	●	○	○	○	○	○	○
Production A/V codec substrate composed into calls Measured: `cc_call_codec_bind` exists in `runtime/nx_connect_codec.nx`, verified at emit. LIB AND GATE LANDED 2026-09-28 (CN1): cc_call_codec_bind encodes with the sovereign vcodec (vv_enc) and seals with the CONNECT AEAD (cseal_seal_ws) over a content-blind relay hop (nx_connect_codec_relay, which imports only nx_room_relay); nx_connect_codec_gate round-trips synthetic and real frames both ways with the relay holding ciphertext the decoder refuses, refuses a P-frame whose reference was lost until a requested key frame recovers it, and codes padded whole macroblocks so that key frame resyncs; NOT yet in a served call path (integration spec queued on connect.plan CN1) -- a receipt, awaiting acceptance rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. dossiernot adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Implementing source symbol found; runtime acceptance separate; ahead of MeetupCons behind Discord (leads), Signal (leads); not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	●	●	●	○	◉	◉	●
Deployed clients at scale (polished mobile/web apps) Open — watching `runtime/nx_connect_client.nx` : `cl_mobile_shell`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Honest gap: incumbents ship native apps to millions; ours = the live interactive web app PUBLIC at nishifamily.com/connect (gate 8 of 8, GET and POST verified over the edge) -- native mobile is rung CN2 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching cl_mobile_shell Pros none measured yetCons behind Tandem (leads), HelloTalk (leads), Meetup (leads), Discord (leads), Signal (leads), Matrix (leads); open contract; expected source declaration not established	○	◉	◉	◉	◉	◉	◉
Network liquidity (installed user base) Measured: `lq_cohort_seed` exists in `runtime/nx_connect_liquidity.nx`, verified at emit. Honest gap: 0 real users (the gauge says so); cold-start vs incumbent scale; the wedge strategy is the LDS community vertical -- rung CN3 names the cohort-seeding contract rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=3 nonval=1` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Tandem (leads), HelloTalk (leads), Meetup (leads), Discord (leads), Signal (leads)	●	◉	◉	◉	◉	◉	●
Trained neural matching + moderation models Open — watching `runtime/nx_connect_neural.nx` : `nn_match_train`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Honest gap: the no-float trained-model thread is the named unlock (rung CN4, with a pre-declared accept rule); Signal does no trained content moderation by design, which is a stance, not an absence of capability engineering rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching nn_match_train Pros none measured yetCons behind Tandem, HelloTalk, Meetup, Discord (leads); open contract; expected source declaration not established	○	◐	◐	◐	◉	○	○
AI conversation-practice partner Open — watching `runtime/nx_connect_ai_partner.nx` : `cp_practice_turn`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. NEW WATCH 2026-08-19: the 2026 bar sits outside this column set -- Duolingo moved AI video-call practice into its mainstream tier and Google Translate ships a free practice beta (both cited); in-column, Tandem's AI Toolkit is Part and HelloTalk's AI aids are Yes (cited); the estate's LLM serve daemon is the named substrate -- rung CN11 [google-practice] dossierwatching cp_practice_turn Pros none measured yetCons behind Tandem, HelloTalk; open contract; expected source declaration not established	○	◐	●	○	○	○	○
Live voice translation inside calls Open — watching `runtime/nx_connect_live_translate.nx` : `lt_call_caption`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. NEW WATCH 2026-08-19: none of the six columns ships it either -- the field bar is Apple's on-device Live Translation in calls and Google's Gemini speech-to-speech at 70-plus languages (both cited); lands after rungs CN9 and CN1 -- rung CN10 [google-livetranslate] dossierwatching lt_call_caption Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○	○	○
Post-quantum hybrid key agreement Measured: `kx_pq_hybrid` exists in `runtime/nx_connect_pq.nx`, verified at emit. LANDED 2026-09-28 (wave 16, rung CN8): the E2E page /synth/connect_e2e_pq agrees every message key through X25519 plus a fresh ML-KEM-768 encapsulation (FIPS 203), combined by SHAKE256 over a transcript that binds both identity keys and the KEM ciphertext, tags each message with SHA3-256, and refuses an X25519-only message once both peers advertise the hybrid; nx_connect_pqkx_vm_gate proves it on the page's own wasm modules (NIST ACVP keygen, encapsulation, decapsulation and implicit-rejection vectors, RFC 7748, tamper and downgrade teeth, plus the page's own kxAccept and kxSendMode run in the estate JavaScript evaluator agreeing with the native rule on every input, and its own kxSame tag comparison agreeing with native byte equality on every designed case while an XOR-accumulating copy is caught), and the rule answers on the front door as nx_connect kx_policy and kx_fields. It serves X25519-only until the directory carries the additive kx=2 field (queued on connect.plan CN8), and with static keys there is no ratchet yet, so Signal stays Best on forward secrecy [signal-spqr] Adoption: `LIB-WIRED importers=6 nonval=4` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Matrix; fully adopted on the estate ladderCons behind Signal (leads)	●	○	○	○	○	◉	○
Post-quantum ratchet (forward secrecy and post-compromise healing) Measured: `kx_pq_ratchet` exists in `runtime/nx_connect_pqratchet.nx`, verified at emit. LANDED AS LIB PLUS REFEREE 2026-09-28 (wave 16, rung CN20), NOT LIVE: runtime/nx_connect_pqratchet.nx grows the CN8 hybrid into a ratchet at the Level 3 shape -- a SHAKE256 chain that derives a fresh key per message and overwrites the chain key it came from, and on every change of speaker one DH+KEM step (kx_pq_ratchet: a fresh X25519 pair and a fresh ML-KEM-768 encapsulation to the key the peer advertised on its own last turn, both mixed into the epoch-bound root key), where iMessage PQ3 ratchets a fresh Kyber-768 key about every 50 messages beside an ECDH step on every response [apple-pq3], with the Double Ratchet's skipped-key window and its commit-only-on-a-verified-tag rule under Signal's Triple Ratchet shape [signal-spqr]; nx_connect_pqratchet_vm_gate runs it on the three wasm modules the shipped CN8 page embeds, byte for byte against the native reference at every step, and proves forward secrecy, healing against a classical and a quantum thief with a planted no-KEM ratchet as the neg-control, the skip window with late previous-turn delivery and replays refused, the epoch-strip downgrade refused, and a swapped next-turn ML-KEM key or a rewritten pn refused without a state byte changing, because the tag covers the whole header (the first cut's tag covered only epoch, n and dh, so an active attacker could have handed the receiver a next-turn key of its own; planted back into the lib it let both rewrites through and changed 12,160 state bytes, and the gate keeps it as the neg-control). Declared deviation: the ML-KEM step runs on every turn, so it heals on the next turn and costs about 2.3 KB per message, and because the tag reads the whole 2,328-byte header inside the tag region the kx=2 page lays out, one frame's body is bounded at 1,776 bytes, refused past that and never truncated. No page carries it and the directory does not carry the kx=3 fields (both queued on connect.plan CN20), so no member conversation ratchets today and Signal stays Best; Tandem, HelloTalk, Meetup, Discord and Matrix are 0 because no post-quantum ratchet shows on any page pinned for this board (a presence reading, not a measured absence) Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. dossiernot adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, MatrixCons behind Signal (leads); not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	●	○	○	○	○	◉	○
Push notifications + real presence at scale Measured: `push_deliver` exists in `runtime/nx_connect_push.nx`, verified at emit. LANDED 2026-09-28 (rung CN2): push_deliver proven end to end against a real push service -- Mozilla autopush accepted our RFC 8292 VAPID token (201) and refused a POST signed by another key (401), carried the RFC 8291 aes128gcm body intact, and the reference receiver opened exactly the conf's content-free words, with two notice kinds carried at one length, and after the channel unregisters the service answers 410 and push_deliver leaves the record a tombstone (nx_connect_push_ua_probe 23/23, ten live runs, the production key included; RED 22/23 on a planted gone rule that keeps the record) [rfc8030] [rfc8291] [rfc8292] [autopush-protocol]; the notice on a real phone is the CN2 device witness still owed; the front door's push_vapid_key is wired in source by FRONTDOOR-FINISH (not yet served) while push_subscribe and push_unsubscribe wait for the alpha daemon to carry the signed-in account, and the store root is created 0700 on the first subscribe (key gate 30/30) Adoption: `LIB-WIRED importers=9 nonval=4` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●	●	●
Federation and third-party E2E interop Open — watching `runtime/nx_connect_federation.nx` : `fed_route`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. NEW WATCH 2026-08-19: the 2026 shift -- RCS UP3.0 gives iPhone-Android interoperable E2EE and the GSMA standard behind it is published (both cited); Matrix IS federation, coded Best; rung CN12 [gsma-rcs] dossierwatching fed_route Pros none measured yetCons behind Matrix (leads); open contract; expected source declaration not established	○	○	○	○	○	○	◉
Private, secure sign-up (OPAQUE, no phone or email, consent off by default) Measured: `csu_signup_admit` exists in `runtime/_hdl_build/nx_connect_signup.nx`, verified at emit. WATCH 2026-09-25, rung CN13: the September-2026 bar is phishing-resistant, no-shared-secret sign-up (FIDO passkeys, page modified 16 Sep 2026) [fido-passkeys] or an aPAKE envelope with no password equivalent at rest [rfc9807], with the research edge at device-bound passkey export and import [arxiv-passkeys]; the privacy leader hides the number behind usernames but still needs a phone number to register, so Signal is Part [signal-usernames]; outside the columns, Bumble lets members meet before sharing a phone number or email [bumble-safety]; the other five cells are 0 because no sign-up path without phone or email, with consent off by default and an age band that stores no document, shows on any page pinned for this board (a presence reading, not a measured absence) Adoption: `LIB-WIRED importers=8 nonval=2` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○	◐	○
Concentric community circles (family to mission to ward to stake to other Christians) Measured: `ccl_circle_reach` exists in `runtime/_hdl_build/nx_connect_circles.nx`, verified at emit. WATCH 2026-09-25, rung CN14: circles joined by consent plus vouching, never by an official Church record -- immediate family, mission family from the reconnection lane, ward, stake, members worldwide, then Christians of other traditions -- with youth peers befriending by mutual acceptance under guardian sight and the two-deep wall; Meetup groups and Discord servers are flat interest groups (Part) and neither nests circles or vouches; Facebook Groups, the scale incumbent outside the columns, keeps adding admin controls and member-privacy settings to one flat group (newsroom listing, newest 3 Nov 2025) [meta-groups]; the nearest faith structure outside the columns nests parish, network and small group inside one tradition [hallow]; the Church's own directory stays Member Tools and is never read [church-membertools]; HelloTalk only segregates minor search [hellotalk-minor] Adoption: `LIB-WIRED importers=12 nonval=10` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	◐	◐	○	○
Christian traditions at equal fidelity (self-declared, consent-gated, never a filter) Measured: `cfa_tradition_admit` exists in `runtime/_hdl_build/nx_connect_faith.nx`, verified at emit. WATCH 2026-09-25, rung CN15: every Christian tradition self-identifies at the same depth from a data table under each church's preferred name, faith optional and consent-gated as an Article 9 special category [gdpr-art9], a discovery signal weighted by the member's own stated importance and never an enforced filter; none of the six columns carries a faith model; outside them each faith app serves one tradition -- the largest dating app for Latter-day Saints [mutual] and a Catholic parish community [hallow] Adoption: `LIB-WIRED importers=4 nonval=3` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○	○	○
Scripture study circles (reading plan as data, verse-anchored, public-domain corpus) Measured: `csc_circle_post` exists in `runtime/_hdl_build/nx_connect_study.nx`, verified at emit. WATCH 2026-09-25, rung CN16: a consent-joined circle follows a reading plan held as data, every passage resolved through the estate verse door from the public-domain corpus, reflections anchored to a verse reference, youth circles under the two-deep wall on join and on leave; none of the six columns ships scripture study; the bar outside them is free study with friends and church groups [youversion] and small groups praying together [hallow]; the Church's own study app is the boundary this complements and never replaces, and its headings, footnotes and cross-references are never copied [church-gospellibrary] Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○	○	○
Service and help board (needs, offers, capacity, coarse locality) Measured: `csh_need_match` exists in `runtime/_hdl_build/nx_connect_service.nx`, verified at emit. WATCH 2026-09-25, rung CN17: needs and service projects with a place, a time and a capacity, matched by consent, a coarse locality band and capacity -- never by faith, looks or status -- with the exact address withheld until both sides confirm and minors inside the two-deep wall; Meetup is Part because capacity-capped events exist (the free plan caps an event at ten attendees) but not need-and-offer matching [meetup-starter]; the other columns carry no service board on their pinned pages Adoption: `LIB-WIRED importers=4 nonval=3` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	◐	○	○	○
Verified person without storing identity (credential presentation or two-member vouch) Measured: `cvh_person_attest` exists in `runtime/_hdl_build/nx_connect_personhood.nx`, verified at emit. WATCH 2026-09-25, rung CN18, the September-2026 frontier: a browser-mediated wallet presentation with the mobile driving licence among the registered protocols (W3C Digital Credentials, Editor's Draft 4 Sep 2026) [dcapi-2609], reduced to a signed personhood and age-band claim with nothing else stored, and age assurance run as an accountable process from evidence to claim to decision [arxiv-ageassure] under the published framework [iso27566] and the EU minimal-disclosure blueprint [eu-avapp]; Discord is Part (on-device face estimation or ID, for age only) [discord-age]; outside the columns the dating incumbents check faces -- Tinder Face Check expanded across the US [tinder-press], Hinge Selfie Verification with liveness checks [hinge-press], Bumble photo and ID verification [bumble-safety] -- where ours keeps a claim and nothing else Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Discord, Signal, Matrix; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	◐	○	○
Family-realm account unification (one OPAQUE account across the suite) Measured: `acc_realm_unify` exists in `runtime/_hdl_build/nx_connect_realm.nx`, verified at emit. WATCH 2026-09-25, rung CN5 (UNMAPPED on the ranker until this row): each column is one account across its own surfaces (Yes); ours must be one OPAQUE account across every Nishi property through the family login product (nx_opaque_login, session check by nx_sa_validate in nx_site_auth), and until the realm joins, a /connect account is its own island -- the maturity gauge reads accounts/identity PARTIAL for exactly that reason rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-GATE-ONLY importers=1` — PARTIAL: imported only by validation organs (gates, tests, benches): wire it into a shipping program. dossiernot adopted: imported only by validation organs (gates, tests, benches): wire it into a shipping program Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: imported only by validation organs (gates, tests, benches): wire it into a shipping program	●	●	●	●	●	●	●
Messaging core on the durable store (survives restart, isolated accounts) Measured: `cs_msg_append` exists in `runtime/nx_chat_store_lib.nx`, verified at emit. WATCH 2026-09-25, rung CN6 (UNMAPPED on the ranker until this row): the per-account durable world end to end -- send, receipts, edit and delete surviving restart, two accounts proven isolated; codes follow the messaging-core presence row above (every column persists history; Meetup messaging is Part); the maturity gauge still grades ours STUB, an in-memory per-session demo (nx_connect_maturity run 2026-09-25, readiness 437/1000) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=4` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Meetup; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	◐	●	●	●
Games together, one to one or in groups (two-deep youth rooms, server-validated moves, a digest every device replays) Measured: `cpl_play_move` exists in `runtime/_hdl_build/nx_connect_play.nx`, verified at emit. WATCH 2026-09-28, rung CN19: members play inside their circles, one to one or in a room -- the room held two-deep by room_admit on join and on leave, a one-to-one opened only where the one contact rule admits the pair (two minors through the peer rule, never an adult and a minor), a blocked pair hidden both ways by the one discovery owner, every move and the turn order validated by the server through the one folk-game move generator, and a chained state digest after every move so a client on any device proves it holds the same state; Discord is Best, its Activities being multiplayer games and social experiences built as web apps run in an iframe in Discord on desktop, mobile and web [discord-activities], while its teen-by-default posture still carries no visible-context two-adult rule [discord-teen]; Meetup is Part, games being a topic its groups organise events around [meetup-home-2609]; HelloTalk names solo immersive learning games, not play between members [hellotalk]; no game is named on the mirrored Tandem, Signal or Element pages read for this row; the symbol is the receipt, nx_connect_play_gate is the proof, and nothing member-facing is served until the front door carries the play verbs Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Tandem, HelloTalk, Meetup, Signal, Matrix; fully adopted on the estate ladderCons behind Discord (leads)	●	○	○	◐	◉	○	○

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	55	rows carrying a Yes, Best or Part in a rival column
cited	25	a reference mark resolves to a pinned mirror
uncited	30	an observation read, badged until a reference lands
rows, summed	55	RECONCILED: the parts sum to the total 55

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Risk register

Risk	Likelihood x impact	Mitigation
A native shell that bypasses the web core forks the safety architecture	possible x high	CN2 done-rule runs the same gate teeth through the shell; the wall is in the core, not the client.
A trained moderation model that sees plaintext destroys the content-blind stance	possible x high	CN4 trains on metadata and behavioral signals only by declaration; a plaintext feature is a gate RED.
A cohort invited before the durable store loses its first week of messages	likely x high	CN3 now depends on CN6; the store precedes the invite by construction.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-25	CN13	queue	ORCHESTRATOR FACT for CN13 CN5 and ALPHA seats: the family-wide identity is the NISHI LOGIN product (operator 2026-07-14: one OPAQUE account across every nishi property, the LDS site named) -- nx_opaque_login.nx (olg_login, olg_whoami, olg_refresh), engine nx_modern_auth_flow.nx, nx_no_cookie_session.nx 152-byte Ed25519 session token, keys opaque_keys.bin and store opaque_store.log at the nishihost CWD, login daemon port 9091 behind the edge routes /login /whoami /register /access, session check anywhere via nx_sa_validate (nx_site_auth.nx), user-held caps via nx_cap_token.nx (capt_issue, capt_verify, capt_attenuate, capt_revoke); compose these for sign-up and realm unification, never a second auth stack (source: seat record of 2026-07-14, re-verify on disk before relying on it)
2026-09-25	SITE	queue	ORCHESTRATOR FACT for the SITE seat, from the cms seat (elder-ce): nx_site_build d62bb0fc (live since this morning) takes the alpha lane as arguments -- nx_site_build <site> <docroot> nishifamily.com/alpha/connect-faith stage=alpha -- the domain argument WITH a path builds a MOUNTED release with root-relative links (the edge strips a directory index slash, so relative links on /alpha/<name> resolve against /alpha/), the trailing stage=alpha writes the robots noindex meta into every head (nishifamily robots.txt blocks /preview/ but NOT /alpha/), and the blueprint row ads
2026-09-25	CN13	land	BOARD seat: rungs CN13 csu_signup_admit, CN14 ccl_circle_reach, CN15 cfa_tradition_admit, CN16 csc_circle_post, CN17 csh_need_match, CN18 cvh_person_attest declared verbatim from the leg brief; milestones renumbered M1..M5 with ver 0.1 M1 (sign up privately and meet your circles = CN13 CN14 CN15 CN5 CN6 CN3, cumulative 10 u), ver 0.5 M2 new (circles that study, serve and verify = CN18 CN16 CN17, 15 u), ver 1.0 M3 (old M2 sealed, called, in a pocket, 23.5 u), 2.0 M4 (old M3, 31 u), 3.0 M5 (old M4, 35 u); nx_fs_write edit OK plan 12473 to 17213 B under CAS h327a7dc14006f3db; OPEN: ladder rows (sotabar, barscan, sotatargets, rungrole for all 22 rungs), matrix watch rows, refs rows, pos re-grade
2026-09-25	CB0	measure	FINISH seat qualify builds on the NAS (nx_sov_build_run --qualify, admission GRANT each time): nx_connect_room_rx GREEN 8/8 exit 0 18286 B sha256 b2f9cbab (build-cache hit), nx_connect_social GREEN 8/8 exit 0 28429 B sha256 899aa975, nx_connect_lds_youth GREEN 8/8 exit 0 18491 B sha256 86410499, nx_connect_lds_reconnect GREEN 8/8 exit 0 22263 B sha256 b63e9284, nx_connect_idage GREEN 8/8 exit 0 18820 B sha256 85928a41. All five are hand-rolled tcheck verdicts carried by the exit code, not nx_gate_verdict; none carries a _gate/_test/_kat name, so the name-keyed D001 promote guard (nx_mgmt_api ma_name_is_oracle) does not apply to them. OPEN: promote, roster admit, execsurface census, so the CB0 and CB1 FINISH rows can close; migration onto gv_check is a separate queue item
2026-09-25	SITE	measure	alpha front door built by the estate: blueprint connect_faith_alpha.site (4790 B, nishihost root) through nx_site_build tier showcase via /api/organ_run: SITE-BUILD OK index + 6 pages (about/sign-up-privately, your-circles, youth, reconnect, safety-and-privacy, independence) + sitemap + robots into sites/connectfaith_alpha, stage=alpha noindex meta, ads optout, MOUNT /alpha/connect-faith/; tokens DERIVED by the CM9 brand profile faith-community/award-product over 8 mirrored sources (profile.tokens t1=1400 td=10900 ratio 1178, mch UNDERIVED); nx_ui_audit file index: hygiene 12 of 12, craft 14 of 15 (img 0 is the missing imagery point), agent 4 of 4, script_tags 0, external_src 0; every call to action points at the live app (/connect/register 200, /connect/login 200 measured by nx_https_get); what is not live (circles, age band, device keys, sealed messages, fail-closed CSAE reporting) is labelled coming on the page; recipe plane plan-site-release-connectfaith- seeded 27 rows by putmany from connect_faith_alpha.recipe.tsv
2026-09-25	CN13	queue	INTAKE 1790355001 routed by nx_intake_route (operator-seat, epoch 1790356399) from pm-seat: R1 of parent REQ 1790355000 (operator goal 2026-09-25): private and secure sign-up from the first byte on Nishi platforms -- no password equivalent held by the server (OPAQUE), no phone number or emai -- sponsor intake-1790355001 plus2
2026-09-25	CN5	queue	INTAKE 1790355002 routed by nx_intake_route (operator-seat, epoch 1790356419) from pm-seat: R2 of parent REQ 1790355000: one account across all Nishi platforms (the family realm) -- a person who signs up once on /connect uses the same sovereign login on every nishi property, one OPAQUE ident -- sponsor intake-1790355002 plus1
2026-09-25	CN14	queue	INTAKE 1790355003 routed by nx_intake_route (operator-seat, epoch 1790356422) from pm-seat: R3 of parent REQ 1790355000: concentric community circles as the structure -- operator words: go from your immediate family to your mission family if you were a missionary to your ward family to your -- sponsor intake-1790355003 plus2
2026-09-25	CN14	queue	INTAKE 1790355004 routed by nx_intake_route (operator-seat, epoch 1790356425) from pm-seat: R4 of parent REQ 1790355000: youth peers can talk and be friends safely -- operator words: an lds boy can talk and be friends with an lds girl on the site -- by mutual acceptance only, with guardians -- sponsor intake-1790355004 plus2
2026-09-25	CN13	queue	INTAKE 1790355004 routed by nx_intake_route (operator-seat, epoch 1790356425) from pm-seat: R4 of parent REQ 1790355000: youth peers can talk and be friends safely -- operator words: an lds boy can talk and be friends with an lds girl on the site -- by mutual acceptance only, with guardians -- sponsor intake-1790355004 plus2
2026-09-25	CN15	queue	INTAKE 1790355005 routed by nx_intake_route (operator-seat, epoch 1790356452) from pm-seat: R5 of parent REQ 1790355000: grow from Latter-day Saints to other Christians at equal fidelity -- each tradition admitted with its own preferred name, its own congregation structure and its own circle -- sponsor intake-1790355005 plus2
2026-09-25	CN6	queue	INTAKE 1790355008 routed by nx_intake_route (operator-seat, epoch 1790356455) from pm-seat: R8 of parent REQ 1790355000: durable messaging so members engage -- one-to-one and group messages that survive restart with receipts, edit and delete, end-to-end sealed, delivered when the app is clos -- sponsor intake-1790355008 plus1
2026-09-25	CN2	queue	INTAKE 1790355008 routed by nx_intake_route (operator-seat, epoch 1790356455) from pm-seat: R8 of parent REQ 1790355000: durable messaging so members engage -- one-to-one and group messages that survive restart with receipts, edit and delete, end-to-end sealed, delivered when the app is clos -- sponsor intake-1790355008 plus1
2026-09-25	CN18	queue	INTAKE 1790355009 routed by nx_intake_route (operator-seat, epoch 1790356458) from pm-seat: R9 of parent REQ 1790355000: verified person without storing identity -- romance scammers feign faith (named by the estate research of 2026-06), so a member can prove they are a real, unique person an -- sponsor intake-1790355009 plus1
2026-09-25	CB1	land	FINISH seat: nine CONNECT LDS-vertical organs PROMOTED to the serving root through /api/promote with expect_sha256, each staged by nx_filecopy from the exact _build artifact that ran GREEN (verified=1, mode 0755): nx_connect_room_rx 18286 B b2f9cbab, nx_connect_social 28429 B 899aa975, nx_connect_lds_youth 18491 B 86410499, nx_connect_lds_reconnect 22263 B b63e9284, nx_connect_idage 18820 B 85928a41, nx_connect_lds_room 22319 B c1cf735f (8/8), nx_connect_msg 20820 B 984514f7 (7/7), nx_connect_lds_census 23118 B 3645c1f0 (ABSENT 0 PRESENT 15 EXCEEDS 2), nx_connect_lds_free 17614 B 4ecf871d (5/5). Roster: nx_gate_roster_run trial over the promoted binaries read 9/9 GREEN (journal knowledge/status/gateroster_trial_connect_finish_20260925.jrnl, deadline 60000 ms), then admit wrote admitted_new=9 to knowledge/gateroster.conf, partition reconciles. OPEN: execsurface census so the catalog reads RUN-BY, then the ranker re-read for the CB0 and CB1 FINISH rows; the roster beat stamp is stale (gateroster.stamp ts=1790178517, about 49 h old at this row), so rostered is not yet ran-on-the-beat
2026-09-25	CN18	queue	INTAKE 1790355011 routed by nx_intake_route (operator-seat, epoch 1790356468) from pm-seat: R11 of parent REQ 1790355000: privacy-preserving age assurance -- a youth or adult age band established by attestation or estimation without storing the document or the birth date, graded against the -- sponsor intake-1790355011 plus1
2026-09-25	CN16	queue	INTAKE 1790355012 routed by nx_intake_route (operator-seat, epoch 1790356472) from pm-seat: R12 of parent REQ 1790355000: scripture study circles -- a circle (family, mission, ward or friends) studies the public-domain scriptures together, posts notes on verses and keeps a shared reading pla -- sponsor intake-1790355012 plus1
2026-09-25	CN17	queue	INTAKE 1790355013 routed by nx_intake_route (operator-seat, epoch 1790356476) from pm-seat: R13 of parent REQ 1790355000: service and help board -- members post a need (a move, a meal, a ride, a skill) inside a circle and neighbours offer help, matched by circle and place, with the youth wal -- sponsor intake-1790355013 plus1
2026-09-25	CN5	land	BUILDER seat: acc_realm_unify landed as a new lib buildroot/runtime/_hdl_build/nx_connect_realm.nx (22753 B sha256 939409b4) with gate nx_connect_realm_gate.nx (15587 B sha256 7de12fab). Mechanism: an explicit consent-gated one-to-one LINK between a family identity (realm nishi_site_admin) and a CONNECT account (realm nishi_connect), written only when BOTH sessions verify in their own realms through the incumbent olg_whoami, kept in an append-only log dir/realm_links.log (unlink appends a U row); acc_realm_unify resolves a verified family session to the linked account id, the same id the daemon derives via acc_id_from_range, and refuses unlinked, forged, expired, wrong-realm sessions and a corrupt log by name; a relink can never change the band on record. nx_sov_build_run --qualify on the NAS (admission GRANT): GREEN 43/43 exit 0, artifact _build/nx_connect_realm_gate.sov.elf 336532 B sha256 cd26a6ae, 9 neg-controls. OPEN: bite proof, auth gate re-run, ship + roster, daemon integration by the INTEGRATOR seat

Risk register

Risk	Likelihood x impact	Mitigation
A sign-up that asks for a phone number, email or identity document creates the breach target it exists to avoid	possible x high	CN13 and CN18 done-rules prove only the declared minimal fields and a signed claim are stored; a phone, email or document field is a gate RED.
A circle joined through an official Church record turns community into congregation administration	possible x high	CN14 admits by consent plus vouching only; the ward registry refuses admin classes (wd_forbidden_count) and Member Tools stays the Church's own directory.
A cohort invited before private sign-up and the circles exist invites members into the old sign-up	likely x medium	CN3 now depends on CN13 and CN14 as well as CN6.

Release history continued

When	Rung	Kind	Entry
2026-09-25	CN13	land	BOARD seat: the dated ladder landed as ONE append (8011 B, plan 26227 to 34238 B) because four hash-CAS edits in a row were refused by concurrent log appends every 20 to 40 s -- sotabar SB-CONNECT-2609 (2026-09, ref dcapi-2609), 5 barscans read today (dcapi-2609 newest=2026-09, arxiv-ageassure 2026-09, arxiv-passkeys 2026-08 on subject after excluding 4 ML passkey-retrieval homonyms and 1 SSH paper, arxiv-datingapp 2026-06, tinder-press 2026-03), sotatargets T-BIC-CONNECT and T-FRONT-CONNECT, rungrole for all 22 rungs, 3 risk rows; MEASURED nx_ladder connect verdict=LADDERED targets=2 rungs=22 placed=22 substrate=6 arm=2 contender=14 sum=22; nx_barfresh connect verdict=FRESH bars=1 fresh=1 scans_this_month=5; refs +13 rows (connect.refs 29656 to 40719 B, every pin taken with nx_filehash), matrix +8 watch rows (19555 to 25657 B); OPEN: CN3 deps, pos and goal re-grade, refs gate, ranker read; UNREAD this leg: Facebook Groups and the W3C TR copy (403, the editor's draft mirrored instead)
2026-09-25	CN5	measure	BUILDER seat bite proof on the NAS, both directions: planted rc = CRL_OK for an unlinked family identity inside acc_realm_unify (lib 22739 B) -> nx_connect_realm_gate RED 40/43 exit 1, exactly T1 T2 T14b failing (actual 0 expected -2201), every neg-control still passing; restored lib byte-identical (sha256 939409b4, 22753 B) -> GREEN 43/43 exit 0. nx_connect_auth_gate --qualify (admission GRANT, fresh build 422357 B sha256 85fa13f4): every one of its 12 teeth prints PASS yet its hand-rolled tally reads fails=12 and it exits 1 verdict=RED -- a tally defect inside that gate, independent of CN5 (nx_connect_realm is outside its import closure); the done-rule clause the auth gate stays GREEN is therefore NOT met today. OPEN: root-cause the auth gate tally (control = its staged 422552 B artifact), migrate it onto nx_gate_verdict
2026-09-25	CN13	land	BUILDER seat: csu_signup_admit LANDED in buildroot/runtime/_hdl_build/nx_connect_signup.nx (27825 B, sha256 9e151f9b47fd0a77) composing the incumbents, no second stack: olg_register (OPAQUE RFC 9807, the account log keyed by a realm-scoped user-id hash, BIP39 recovery as a second OPAQUE record rotated on use), yw_may_channel (the two-deep wall), lc_geti over the new knowledge/connect_signup.conf (fail closed on a missing row), sha256_digest (hashcash bound to challenge and handle). Gate buildroot/runtime/_hdl_build/nx_connect_signup_gate.nx (21546 B, sha256 dd03bd49ea416165) GREEN 65/65 on a REAL OPAQUE account log under /tmp/nx_connect_signup_gate (artifact 309968 B sha256 c9c70467afce7704, run-exit 0): exact S1 census of 4 declared fields, passphrase and SHA-256(passphrase) and mnemonic and handle text absent from the log, every consent purpose off though the request asked for all, minor opens peer+guardian only with the non-guardian adult DM refused, replay and burst and expired and unknown and insufficient-work refused, recovery works once. BITE: planted taken==2 in the duplicate-handle check, RED 55/65 (duplicate handle refused HANDLE_TAKEN FAIL actual=0 expected=10, log rows 6 not 4, holder sign-in -1410 = the takeover), restored, GREEN 65/65 with build-cache key 3628d7b5 identical to the first build. FINDING: the account log is latest-row-wins and olg_register SUPERSEDES, so the live register route (nx_opaque_login_routes olg_route, LAN plus invite gated) re-registers a taken handle as a credential takeover; the gate's neg-control shows the attacker signing in as the holder through the incumbent alone. Best-in-class read today: RFC 9807 mirrored knowledge/fetched/cmp_connect_rfc9807.txt (152656 B, sha256 424103278391d895). OPEN: the passphrase still reaches the server in-process (the RFC hides it even at registration only with the client-side wasm Blind and Finalize, V-MODAUTH-8); age-band attestation verify lives in nx_connect_idage (a program with main, extraction owed); policy rows UNMEASURED; page and route integration is the INTEGRATOR seat's.
2026-09-25	CN6	queue	PM seat, for the BOARD and BUILD seats: comms C1 Store-and-forward history (cs_store_forward in runtime/nx_chat_store.nx) is LANDED on the comms board with nx_chat_store_gate 21/21 GREEN -- offline delivery byte-identical and in order across process death, cursors that never regress, additive-only soft-delete, budgets that refuse by conf-row name -- and comms C2 multi-device sync (msy_devsync) is LANDED beside it; the CN6 watch row now names a NEW organ runtime/_hdl_build/nx_connect_msgstore.nx (source present per nx_goalmap this hour), so CN6 must compose nx_chat_store rather than grow a second durable message store, and CN13 should compose authz AZ9 wauth_assert_verify for passkeys while CN18 and CN13 compose authz AZ10, which now watches the single sa_age_attest contract in nx_site_auth that synthroom SR9 already names; routes FILED this hour: R1 CN13, R2 CN5, R3 CN14 plus familyatlas FA8, R4 CN14 plus CN13, R5 CN15, R8 CN6 CN7 CN2 plus comms C1, R9 CN18 plus authz AZ10, R11 authz AZ10 plus CN18, R12 CN16 plus scripturestudy SS2, R13 CN17 (intake REQ 1790355000 children)
2026-09-25	CN15	land	cfa_tradition_admit LANDED as source: lib buildroot/runtime/_hdl_build/nx_connect_faith.nx 22406 B sha256 2b6e19b6 (exact lookup only, Art.9 consent, Art.7(3) withdraw clears the record, signal = incumbent gx_mp_faith taken per level and weighted by the viewer own importance, headroom blend never a filter, peer-banded discovery, cfa_may_channel = yw_may_channel) + DATA knowledge/connect_faith_traditions.conf 6824 B sha256 12111e2e (16 traditions, 63 churches under their own preferred names, one importance scale row from the Pew four-level item, no weight column) + gate nx_connect_faith_gate.nx 25273 B sha256 fe1c4d54; nx_sov_build_run --qualify GREEN 63/63 run-exit=0 artifact 81736 B sha256 211bbf09; values: table_rung=2 admitted 16 at depth 1 + 63 at depth 2 refused 0 shallow 0, tradition match 50 church match 100 cross-tradition pairs 0, 5 undeclared probes refused 5 (a prefix guesser admits 3), wall 320 cases lib mismatch 0 faith-trusting twin 12, discovery 2 then 1 after withdrawal; OPEN: bite RED proof, ship, roster
2026-09-25	CN14	land	nx_connect_circles LIB buildroot/runtime/_hdl_build/nx_connect_circles.nx (39233 B sha256 5549d205) exports ccl_circle_reach plus found/join/vouch/map/open/narrow/leave/ask/channel/guardian_sees/partition; the rings are DATA in knowledge/connect_circles.conf (2133 B: family, mission, ward, stake, worldwide, christian in file order; vouch 2 with its two-deep reason; evidence class 0 only). Composes wd_forbidden_count (no official record ever admits), yw_may_channel (the one two-deep wall), rc_score over rc_inter_popc (mission vouchers must have served with the joiner), ln_active_lane (mutual minimum, minor capped below dating). Gate nx_connect_circles_gate (24835 B sha256 ff611b72) GREEN 67/67 on nx_sov_build_run --qualify, artifact buildroot/_build/nx_connect_circles_gate.sov.elf 97742 B sha256 3c6163ee, 21 neg-control teeth; emitted values matched a hand prediction (rows 26, vouch rows 28, relationships 5, opened buckets 4/3/6). Open: bite receipt, ship and roster, the INTEGRATOR wiring into nx_connect_serve
2026-09-25	CN5	retract	BUILDER seat withdraws its row 1790356745 claim that nx_connect_auth_gate is RED: the source changed under the build -- a sibling seat was migrating it onto nx_gate_verdict (9424 B hand-rolled tally to 9527 B sha256 fd8c327e, au_check now gv_check), and the qualify build compiled a mid-migration copy whose au_check counted every tooth into the pointer main still read as a fail count (fails=12 with 12 PASS lines). Discriminating experiment: the same verb on the settled source gave GREEN 12/12 exit 0 (build-cache hit 443084 B sha256 c722d0a9, wrong_pw_rc -1410, unknown_handle_rc -1409, tampered_token_rc -1403). The done-rule clause the auth gate stays GREEN HOLDS. Lesson: hash the source immediately before and after a gate run on a shared tree
2026-09-25	CN5	land	BUILDER seat shipped the gate: /api/build src_path runtime/_hdl_build/nx_connect_realm_gate.nx src_sha256 7de12fab BUILT 385800 B sha256 9fecc7bd; /api/promote expect_sha256 PROMOTED nx_connect_realm_gate.elf; /api/tools/register callable; nx_offc_install installed=1; /api/gate_run on the promoted binary GREEN 43/43 exit 0 FAST inside 14750 ms, capture 4852 B untruncated; knowledge/gateroster.conf row HAND-ADDED with its evidence (77307 B). The lib is not promoted (no main). The matrix watch row runtime/_hdl_build/nx_connect_realm.nx acc_realm_unify now names a present symbol, so the mechanical cell flips on the next regen; acceptance stays with the referee, the operator and the seat. OPEN: the daemon wiring (INTEGRATOR seat), the gauge accounts row re-grade, a link route and an attested band source
2026-09-25	CN5	land	FINISH seat: nx_connect_auth_gate MIGRATED by hand from its hand-rolled au_check verdict onto nx_gate_verdict (au_check now delegates to gv_check per tooth, gv_ctr, nine gv_kv values, return gv_verdict; B4 B5 B6 renamed neg-control-wrong-passphrase, neg-control-unknown-handle, neg-control-tampered-token), source 9424 to 9527 B, pre-edit copy banked at knowledge/status/nx_connect_auth_gate.nx.bank-20260925. Baseline before edit GREEN 12/12 hand-rolled 416199 B. After: passed 12/12 verdict=GREEN 443084 B sha256 c722d0a9. Bite: a planted no-op tamper (xor 0x00) read B6 FAIL, tampered_token_rc=0, passed 11/12 verdict=RED exit 1; restored, cache-hit key 60d3b857 reproduced c722d0a9 GREEN 12/12. PROMOTED through /api/promote with expect_sha256 (the D001 guard admitted it), /api/gate_run GREEN exit 0 FAST 14750 ms deadline, roster trial GREEN 1309 ms and admit admitted_new=1. Values published: register_rc 0, login_rc 0, whoami_rc 0, uid_bytes 32, wrong_pw_rc -1410, unknown_handle_rc -1409, tampered_token_rc -1403. OPEN: the gate still uses fixed /tmp/nxcauth_* fixture paths rather than a /tmp/nx_connect_auth_gate/ dir created at setup
2026-09-25	CN6	measure	nx_connect_msgstore_gate FIRST RUN 41/55 RED (sov_build_run --qualify, elf 113020 B sha 6eb9670e): account A's own valid 1338 B snapshot read back TAMPERED while B's 431 B loaded. Root cause is in the incumbent codec: nx_connect_accounts acc_w64 wrote every NEGATIVE i64 wrong (x / 256 truncates toward zero) and the store's FNV trailer and client ids are signed hashes. Fixed at the root as (x - low byte) / 256, byte-identical for every non-negative value; a codec tooth now pins it. Also nx_connect_msg.nx main renamed cmsg_selftest (now a LIB, body unchanged) so the store composes log_append; its checks run from nx_connect_msg_gate 7/7 GREEN run-exit 0 (20846 B sha b21ba720)
2026-09-25	CN3	land	lq_cohort_seed LANDED as a library: buildroot/runtime/nx_connect_liquidity.nx 19195 B sha256 5a0bcf3b (no main, no syscalls, caller-supplied buffers sized by lq_cohort_words; composes nx_connect_lds_reconnect_lib rc_lane for the mission lane, adults only). Invite tree seeded by an ADULT organizer in six circles FAMILY MISSION WARD STAKE WORLDWIDE CHRISTIAN; handles single-use expiring revocable and never re-mintable; a minor arrives only with an adult-member guardian link that travels with the handle; no phonebook path; funnel first-message reply meeting per cohort over a declared window vs the empty room, UNOBSERVABLE (rate -1, never 0) on no observations, WINDOW-OPEN before the window closes; no ads to minors. Gate buildroot/runtime/nx_connect_liquidity_gate.nx 19585 B sha256 81fcf3a9, built by nx_sov_build_run --qualify (job 1790357096) _build elf 75715 B sha256 f95f845a: NX-CONNECT-LIQUIDITY-GATE passed 72/72 verdict=GREEN run-exit 0; fixture reply 625 permil n=8 Wilson 306..863 vs empty room 125 permil n=16 35..360 (fixture sizes chosen by the clock). OPEN: the done-rule field measurement (a live cohort first-week reply rate above the empty room, beside its size) is UNMEASURED; so_add_by_token and show_by live inside programs with a main and could not be imported (extraction queued); not yet wired into nx_connect_serve (integrator seat)
2026-09-25	CN13	retract	BUILDER seat CORRECTION of my land row 1790356840: I wrote that the live register route re-registers a taken handle as a credential takeover. That was NOT verified and is withdrawn as stated. MEASURED: olg_register supersedes a taken handle (the gate's neg-control on a fixture log, after which the attacker signs in as the holder); nx_lan_signup.ls_signup_allowed blocks re-registration only because a CLAIMED handle is no longer invited; hra_claim is called after register in runtime/_hdl_build/nx_lan_signup_routes.nx line 75 and appears 0 times in runtime/nx_opaque_login_routes.nx, whose olg_route register branch calls olg_register right after ls_signup_allowed. UNVERIFIED: which router serves the live register path; if it is olg_route an invited handle stays invited after its sign-up and a LAN peer holding the handle name can re-register it. The discriminating read is the login daemon's route wiring (port 9091). csu_signup_admit does not depend on the invite plane: it asks the account log itself.
2026-09-25	SITE	land	ALPHA LIVE, awaiting acceptance: https://nishifamily.com/alpha/connect-faith (release sites/connectfaith_alpha, published under sites/nishifamily/alpha/connect-faith, index sha256 d11d220cefd6a562074e34516c6ff9e77568d7ab71fc84f842d00af11cf5017b 29679 B, release == served by nx_filehash cmp); recipe plane plan-site-release-connectfaith- (27 rows: 11 pub- registrations, nx_site_build stage=alpha, nx_ui_audit file, 2 prepare-path, 11 publishes, nx_page_verify) run twice by nx_plan_run, 27 of 27 ok both times; nx_page_verify GREEN with a11y-issues 0 on all 7 pages (index + about/sign-up-privately, your-circles, youth, reconnect, safety-and-privacy, independence), each status 200; served index carries the noindex meta once and the nx-ad-optout marker once, 0 script tags; font 200; nx_ui_audit file: hygiene 12 of 12, craft 14 of 15 (img 0), agent 4 of 4, script_tags 0, external_src 0; calls to action go to the live app (/connect/register and /connect/login, both 200); circles, age band, device-made keys, sealed messages and fail-closed CSAE reporting are labelled coming, reconnect is labelled live with discovery off by default (as /connect/reconnect serves it); visual review UNMEASURED (the CM13 capture needs the laptop browser oracle, not reachable from the sovereign surface this seat works through; the NAS has no browser), referee grade UNMEASURED
2026-09-25	CN13	land	BUILDER seat: nx_connect_signup_gate SHIPPED through nx_organ_ship: prove=GREEN 65/65 on a fresh build, promoted sha256 c262004f5bcd10fc (first promote, no live elf before), _offc twin installed from the promoted root binary, REGISTERED callable=1 schema=0, harness token hcecc78c54bd8f8c2. ADMITTED to knowledge/gateroster.conf by nx_gate_roster_run admit (admitted_new=1, partition reconciles) from trial journal knowledge/status/trial_cn13_signup.jrnl: GREEN exit=0 ms=7513 against the roster's own 60000 ms per-gate default. The matrix watch row _ABSENT_:csu_signup_admit names runtime/_hdl_build/nx_connect_signup.nx, the file that now carries the symbol, so the next regen can flip it (presence only; acceptance needs the referee and the operator). Production policy knowledge/connect_signup.conf written: pow_bits_base 16, window_s 3600, window_budget 300 (derived: the modauth context rate of 5 per minute x 60), challenge_ttl_s 600, calibration UNMEASURED and named on every row.
2026-09-25	CB0	measure	FINISH seat: CB0 [recv_bw_svc] and CB1 [so_feed] are CLOSED as FINISH rows. Instrument chain: nx_execsurface census (organs=3037 on_surface=1251 ref_only=134 dark=1652 sum=3037, roster_rows=955, asof=1790356741) reads nx_connect_room_rx ON-SURFACE launched-by roster; nx_compare_rank connect then printed rungs=22 done=9 open=13 finish=6 with neither CB0 nor CB1 among them (artefact buildroot/knowledge/compare/connect.rank 12992 B sha256 4085b83f). The six FINISH rows now open are all LIB-UNCENSUSED libraries landed this leg by other seats: CN3 lq_cohort_seed, CN5 acc_realm_unify, CN6 msg_store_append, CN13 csu_signup_admit, CN14 ccl_circle_reach, CN15 cfa_tradition_admit; remedy named by the catalog: nx_eco_graph_build then nx_importcensus, then a shipping importer for each (the connect daemon), else they stay LIB-GATE-ONLY. nx_connect_maturity re-run through /api/organ_run: raw 21/48, PRODUCTION-READINESS 437/1000, unchanged from 2026-08-19 as expected, because promoting self-tests moves no depth row
2026-09-25	CN15	measure	BITE-PROVEN by hand on the done-rule withdrawal clause: planted cfa_withdraw without its record clear (lib 22406 to 22385 B) and nx_sov_build_run --qualify read RED 59/63 run-exit=1 with exactly the four withdrawal teeth failing (listed after withdrawal actual=1, discovery 2 not 1, own query 2 not 0, still in ring) while every other tooth held; restored byte-identical (sha256 2b6e19b6 22406 B, same as before the plant) and the rebuild read GREEN 63/63 run-exit=0 on BUILD-CACHE key 3d4ec4f6, the same key as the first GREEN; mirrors for the BOARD seat refs: knowledge/fetched/cmp_connect_gdpr_art9.html 91559 B sha256 24fde5a6 (Art 9 special categories, religious beliefs) and knowledge/fetched/cmp_connect_gdpr_art7.html 87413 B sha256 3a998bda (Art 7(3) withdrawal as easy as giving), both read and grepped this session
2026-09-25	CN14	measure	bite receipt for nx_connect_circles_gate: planted defect in the lib (ccl_join vouch floor st[CCL_H_NEED] replaced by 0) turned the gate RED 60/67 run-exit 1 (build job 1790356991): neg-control-unvouched-join-refused actual 1 expected -3, neg-control-stranger-with-no-vouch-refused, neg-control-one-vouch-is-one-person-word-refused, the never-met mission member admitted, a spent-vouch return admitted, and two positive teeth reading ALREADY. Restored lib re-hashed to the banked sha256 5549d205 39233 B, rebuilt with --no-cache (job 1790357123): GREEN 67/67 run-exit 0, asm 477138 B equal to the first green build (mutant 476988 B). Correction to the land row: the gate carries 25 neg-control teeth, not 21
2026-09-25	CN13	measure	BOARD seat: nx_compare_refs_gate run twice (fleet-wide, 37 of 44 RED, capture complete 25583 B in _jobs/job_1790357071.out) -- connect offenders found and fixed: 4 of today's refs cited a redirecting url (bumble-safety, hinge-press, youversion, church-gospellibrary) and were re-mirrored from their canonical url with 0 hops (3 byte-identical, bumble 79317 B re-pinned h8e591d0a), and the pre-existing gdpr-art9 read PIN-MISMATCH because cmp_connect_gdpr_art9.html was rewritten at epoch 1790356901 by another writer this leg -- re-pinned h24fde5a6 after reading the Article 9 text in it (religious or philosophical beliefs, 2 hits); connect.refs 40744 B; the other RED rows belong to other boards (UNCITED in authz, deepresearch, deploy, dataio, civicmap, extllm, gameengine, loadgov; PIN-MISMATCH in graphics; the new faithsocial.refs reuses cmp_connect_discord_teen, church_gh20 and rfc9807 mirrors as PROV UNPROVEN and cites redirecting hinge and bumble urls); LESSON: a seat must never re-fetch into another board's mirror filename, the pin on that board breaks silently
2026-09-25	SITE	measure	design tokens for the alpha DERIVED over the rival class, not typed: a new personality social-trust in knowledge/design_corpora.conf (8 corpus rows + 1 recipe row, additive, 4017 B after) from signal.org, hinge.co and meetup.com home pages plus the stylesheets they link, mirrored 2026-09-25 by nx_research_fetch; the 4 stylesheet sources measured type and spacing (n=4): t1 1600 ratio 1101 td 6200 s1 1200 s6 4400 lhb 150 lhd 100 bp1 67250 bp2 99250 mpx 124000; the first release used award-product (Awwwards, nike, apple, stripe; t1 1400 ratio 1178 td 10900 lhb 140), index sha256 fac3b1e8309b8c8ec56dd2dfd2779ae2a0da5ad0d64c93dfb35155a1c5a59aaa 29680 B, superseded by the social-trust release d11d220c; hygiene 12 of 12 and craft 14 of 15 under both corpora, so the audit does not separate them -- which reads better stays for the referee panel and the operator; bumble.com home was mirrored and left out (its CSS is external and unfetched, it measured nothing)
2026-09-25	CN3	measure	planted-defect bite on nx_connect_liquidity_gate: the single-use check (state REDEEMED refuses) removed from lq_inv_redeem (lib 19195 to 19127 B) went RED 69/72 exit 1 (job 1790357207) on exactly token-single-use-refuses-second-redeem (actual 2 = a second person admitted on a used handle), refused-redeem-leaves-size-unchanged (3 vs 2) and every-member-but-the-organizer-is-one-redeemed-invite (7 vs 6); restored lib byte-identical (sha256 5a0bcf3b both before and after) and the gate read GREEN 72/72 exit 0 again (job 1790357321). Also measured building it: a main() local initialised from a constant (let hour = 3600) read 2433600 at every later use while the constant printed 3600 in the same run (jobs 1790356621, 1790356956); the gate now uses the named constant at every use; compiler cause UNMEASURED
2026-09-25	CN15	land	SHIPPED nx_connect_faith_gate by nx_organ_ship (build, prove, promote, offc-twin, register): sha256 39bd51a7 prove=GREEN 63/63 on the fresh build, first promote (adoptgate announced no live elf), _offc twin installed, REGISTERED callable=1 schema=0; /api/gate_run on the promoted binary FAST exit_code 0 verdict GREEN 63/63 with table_rung=1 (the nishihost root, the connect daemon CWD) against rung 2 under the build lane, both reading 16 traditions and 63 churches; admitted to knowledge/gateroster.conf with its evidence comment; the watch row runtime/_hdl_build/nx_connect_faith.nx symbol cfa_tradition_admit now resolves (lib is a LIB, no binary by design); OPEN: integration into nx_connect_serve by the INTEGRATOR seat (the faith section of the profile page, the withdraw route, the CN14 ring calling cfa_in_ring and cfa_other_tradition), the Pew four-level importance item cited in the conf row is UNVERIFIED from its mirror (knowledge/fetched/cmp_connect_pew_importance.html 864223 B sha256 63e35c7e is a script-rendered page; literal probes for the level labels read 0 over markup, so UNPROVEN, not absent)
2026-09-25	SITE	queue	PRIVACY FINDING in the live app, for the BOARD and PM seats (measured, not changed by this seat): /connect/register is a zero-JS form that posts the passphrase to the server (input pw, method post), so the OPAQUE client runs server side -- storage keeps an OPAQUE record and no password hash, but the server learns the passphrase at sign-up and sign-in, which RFC 9807 says invalidates the OPAQUE property that clients never disclose their passwords to the server (mirror knowledge/fetched/cmp_connect_rfc9807_202609.txt, sha256 424103278391d8955713ea8b3a85509e5178fab536be42144b99d298458acc03); the register page line nothing offline-crackable to steal overstates it -- RFC 9807: a corrupted server can run an exhaustive offline dictionary attack, inevitable in any single-server aPAKE; and GET /connect/register and /connect/login each set a session cookie (nxc_sess, HttpOnly, SameSite=Lax) before any sign-in, where the family realm uses header sessions and no cookies (CN5 realm unification is where this converges). Remedy rungs: the OPAQUE client on the device (the wasm lane nx_connect_e2e_client already ships X25519), cookie-free sessions, corrected copy; the alpha front door states only what holds and labels device-side sign-in coming
2026-09-25	CN14	land	shipped nx_connect_circles_gate: /api/build src_path runtime/_hdl_build/nx_connect_circles_gate.nx src_sha256 ff611b72 src_stable 1 staged 113464 B sha256 d26af346; /api/promote with expect_sha256 PROMOTED live nx_connect_circles_gate.elf 113464 B d26af346; /api/tools/register REGISTERED callable 1 schema 0; nx_offc_install installed and nx_filehash cmp root vs _offc identical 1; /api/gate_run on the promoted binary exit_code 0 verdict GREEN 67/67 with SUBJECT knowledge/connect_circles.conf on ladder rung 1 (the qualify run from buildroot resolved rung 2, ../knowledge). Admitted to knowledge/gateroster.conf (HAND-ADDED row). Seen in passing: the base class printed NX-GATE-JOURNAL APPEND_ERROR journal-lock code -11 AFTER the verdict line on that run, so a last-line reader of that capture sees the journal notice, not the verdict (base-class nx_gate_verdict, not this gate)
2026-09-25	CN6	land	msg_store_append LANDED in buildroot/runtime/_hdl_build/nx_connect_msgstore.nx (21094 B, LIB): a per-account durable message world composing nx_connect_msg (log_append, set_state, edit_msg, del_msg; rows are REPLAYED from an append-only event journal) and nx_connect_accounts (acc_path isolation, acc_w64 codec, tmp+rename+fsync); file dir/<account>.msg beside the world snapshot; content-blind opaque ciphertext arena; edits and deletes additive; every send needs an ALLOW channel verdict (yw_may_channel via msg_store_chan_yw), absent or deny refuses; fail-closed load (TORN, TAMPERED, MAGIC, VERSION, ACCOUNT, REPLAY) leaves the store empty and poisoned so the refused file is never overwritten. Gate nx_connect_msgstore_gate 56/56 GREEN (sov_build_run --qualify, 113269 B sha c2de6e88, run-exit 0): a restart that scrubs every in-memory structure and compares 48 fields in order, receipts edit delete and idempotent replay across restart, B file untouched by A, B bytes at A path refused ACCOUNT, torn refused TORN, tampered refused TAMPERED with the restored file as positive control, non-positive account refused. BITE: trailer check removed gave 53/56 RED run-exit 1 with exactly the three tamper teeth failing; restored gave BUILD-CACHE HIT on the GREEN key 0d45eae1 and 56/56 GREEN. nx_connect_accounts_gate still 6/6 GREEN after the acc_w64 fix (68039 B sha 4e58b2b9). OPEN: daemon wiring (INTEGRATOR), gauge row STUB to PARTIAL (needs the served path), accounts-gate restart tooth
2026-09-25	SITE	queue	REFS for the BOARD seat to pin on connect.refs (the SITE design tokens and the privacy finding stand on these mirrors under knowledge/fetched/; each pin is the nx_research_fetch PROVENANCE sha256, fetched 2026-09-25): cmp_connect_signal_home_202609.html 40288923d2b99901b493f66658e87fff5e058bba91727540aa5c46a871612052; cmp_connect_signal_css_202609.css 9540ffa83e10c25e98398b484788a115685e94db3f5d27f20ac666539e4c0652; cmp_connect_hinge_home_202609.html 87816a0a0df4fc6fa30dc605862855943c45db800866d6d458e670a171a532ca; cmp_connect_hinge_css1_202609.css 0b6688dd15e9bc1d3fbbed2d8fe2f20f437b556aa7a6b4d2efcdbeb5baf7f932; cmp_connect_hinge_css2_202609.css efad7643f86824d7c6f2f99e7b54a29eaa03237458e2bcfc906c345f2b3072b4; cmp_connect_meetup_home_202609.html bcff6060eba9f8c87759fe5989e75302eef845c7867d53ce0aecb561d4bf6ae3; cmp_connect_meetup_css1_202609.css 6987ee873f82128101a0b12db698e217bf63258f897ed1faff039c9d07b971cb; cmp_connect_meetup_css2_202609.css 7771fe96c5747293765e34cab8ac39c822f8ca28a37286e102abaa2fac2254c1; cmp_connect_bumble_home_202609.html 33dff42b5bec0e0208922f4f6e089d9400b2828b252db2f5f49c8d2b36d8a608; cmp_connect_rfc9807_202609.txt 424103278391d8955713ea8b3a85509e5178fab536be42144b99d298458acc03
2026-09-25	CN5	land	BUILDER seat v2: the production door crl_family_ctx_open (lib now 24607 B sha256 da9b78ee) opens the family realm nishi_site_admin for VALIDATION only and REFUSES when the family keys file is absent (-2211), because olg_ctx_setup_ttl loads-or-INITS keys and would silently mint a second family key set whose sessions no family login can produce. Bite on the NAS: guard removed -> gate RED 45/47 exit 1, exactly neg-control-family-context-refuses-missing-keys (actual 0 expected -2211) and neg-control-missing-family-keys-are-never-minted failing; restored -> GREEN 47/47 exit 0 by build-cache hit (byte-identical closure). Shipped: /api/build src_sha256 7903b1e2 BUILT 387368 B sha256 e47c7ffd, /api/promote expect_sha256 PROMOTED, nx_offc_install refreshed, /api/gate_run on the promoted binary GREEN 47/47 exit 0 FAST capture 5259 B untruncated. Integration for the INTEGRATOR seat: boot crl_family_ctx_open(famctx, opaque_keys.bin, opaque_store.log) (cwd nishihost as daemons.reg runs both CONNECT and the :9091 family login); per request when nxc_auth did not authenticate, acc_realm_unify(famctx, X-Nishi-Session value, now, connect, acct, band); link route crl_link, unlink route crl_unlink. OPEN: daemon wiring, an attested band source for crl_link (CONNECT stores no band today), gauge accounts row re-grade after the served round trip is observed
2026-09-25	CN13	queue	BUILDER seat, what is OPEN on CN13 after the land: (1) INTEGRATOR wiring -- ctx from olg_ctx_setup_ttl over the family login's opaque_keys.bin and opaque_store.log at production argon2id cost (the one account across properties, CN5), st = csu_state_new(pol) once per process with pol from csu_policy_default per request, a challenge route calling csu_challenge_issue with a CSPRNG nonce, the wasm client running csu_pow_search and generating the X25519 key pair on the device, POST calling csu_signup_admit, S1 rows persisted from csu_record_emit, the 24-word secret shown once, consent changes through csu_consent_set and every channel open through csu_may_channel; (2) the passphrase still reaches the server in-process, and RFC 9807 hides it even at registration only with the client-side Blind and Finalize in wasm (V-MODAUTH-8); (3) the age band is trusted from the caller's attested flag until nx_connect_idage's verify is extracted into a lib and its keyed-mix stand-in becomes an issuer signature; (4) anti-automation is hashcash over SHA-256; the unlinkable-token frontier is the Privacy Pass architecture, RFC 9576 mirrored knowledge/fetched/cmp_connect_rfc9576.txt (70624 B, sha256 51f781afa07f3236), which needs an issuer the estate does not have; (5) the four policy rows are UNMEASURED until the client reports solve times; (6) passkeys (FIDO) as a second credential kind are not built; (7) the door state lives per process, so a restart clears live challenges (fail closed); (8) the olg_route claim question in my retract row 1790357160. Gate re-shipped with a production-policy tooth: GREEN 66/66 reading knowledge/connect_signup.conf (1356 B, sha256 94bc774d34ab3130) back as 16 3600 300 600.
2026-09-25	ALPHA	land	INTEGRATOR seat: banked the served nx_connect_appd.elf (587144 B sha 3e46d193) to knowledge/bank/nx_connect_appd.elf-3e46d193-20260925, nx_filehash cmp identical=1. MOUNT capability landed in source, office-daemon shape (one binary N instances, argv defaults = production): nx_connect_appd.nx 25509 to 32799 B takes [port] [mount] [stage]; any stage binds 127.0.0.1 only, names its cookie nxc_auth_STAGE scoped Path=MOUNT (never reads or clears production nxc_auth), persists no anonymous world, labels every page. nx_connect_serve.nx 116720 to 120088 B: ctx slots CS_BASE 22 and CS_STAGE 23 (not serialised), cs_handle2 takes bp from ctx, and cs_mhtml cs_mnote cs_mpath re-root the 12 auth-page statements that hardcoded /connect (bytes identical when bp is /connect). TREE DEFECT fixed: CD_SHARE_PREFIX was used by the album API and declared nowhere under buildroot/runtime (nx_shelltool grep corpus_complete=1), so the tree could not compile; declared connect/share_ CWD-relative; the plane the served binary used is unrecorded. Build GRANT SOVEREIGN _build/nx_connect_appd.sov.elf 549694 B sha bfb02bdc, 37450 B smaller than the served binary: content ruler owed before any production promote. Open: auth gate, alpha row, proxy row, live proof.
2026-09-25	CN13	measure	BUILDER seat, closing the question in my retract row 1790357160 by measurement: olg_route_ip has exactly 6 textual hits over buildroot/runtime (nx_shelltool grep, coverage_complete=1 corpus_complete=1): its definition, its own rule-19 wrapper olg_route which passes ip4=0 so every register through that door is DENIED by construction, and 4 calls inside nx_signup_origin_gate. No daemon registers through it, and the family signup router (nx_lan_signup_routes line 75) claims the invite after register. So there is NO live re-registration path found; the supersede hazard is real only for a caller of olg_register that skips an existence check, which is exactly what csu_signup_admit refuses. Also re-shipped the gate with a production-policy tooth: nx_organ_ship prove=GREEN 66/66, adoptgate APPROVED content=GREEN, promoted sha256 18159ce0504b3145, _offc twin installed, harness he7a74f9b262ce8cb.
2026-09-25	CN5	measure	BUILDER seat bar source read this month from mirrored bytes (for the BOARD seat's refs row): NIST SP 800-63C-4 Sec. 3.8.1 Account Linking, knowledge/fetched/cmp_connect_nist80063c4.html 416501 B sha256 01e2808b (nx_research_fetch 2026-09-25, status 200): the RP SHALL require an authenticated session with the subscriber account for all linking functions and SHOULD require authentication with one existing identifier before linking the new one; when an identifier is removed the RP SHALL disallow access from it. acc_realm_unify meets both clauses (crl_link verifies the CONNECT session AND the family session; teeth T11b and T14b prove access stops after unlink). Declared deviation, stricter than the bar: one family identity per account (NIST permits many) because there is one family realm and a second link would be an account-sharing path. Incumbent basis RFC 9807 OPAQUE mirrored knowledge/fetched/cmp_connect_rfc9807.txt 152656 B sha256 42410327
2026-09-25	CN3	land	gate SHIPPED by nx_organ_ship (job 1790357388): prove=GREEN 72/72 on the fresh build, promoted sha256 8bd41082 (first promote of this target, adoptgate announced no-live-elf), _offc twin installed, REGISTERED callable=1; roster admission MECHANICAL: nx_gate_roster_run trial (job 1790357497) GREEN exit 0 in 352 ms under deadline 60000 (the organ's own GRR_MS_DEFAULT), then admit (job 1790357552) admitted_new=1 partition reconciles 1 of 1, row nx_connect_liquidity_gate now in knowledge/gateroster.conf. The library has no main and is not promoted. OPEN: integration into nx_connect_serve (integrator seat) and the done-rule first-week field measurement
2026-09-25	CN15	retract	the scale row of knowledge/connect_faith_traditions.conf first cited the Pew importance-of-religion item and its four response labels as its calibration without an artifact; the mirror knowledge/fetched/cmp_connect_pew_importance.html (864223 B sha256 63e35c7e, fetched twice, the 2014 URL redirects to the same bytes) is script-rendered and literal probes for the labels read 0 over markup, so the row now says CALIBRATION UNVERIFIED and stays a person-picked four-level scale (conf now 7103 B sha256 cbe0e051; promoted gate re-run through /api/gate_run FAST exit_code 0 GREEN against it); the same mirror DOES carry the Pew RLS religious tree (Mainline 325 hits), the published two-level family and denomination mechanism this table follows, and it labels the tradition Latter-day Saint (Mormon) where this table uses each church own preferred name: the naming exceed is on the record, the bar is Pew RLS 2023-24 tree
2026-09-25	CN5	queue	BUILDER seat hands off, nothing of CN5 left half-built: lib nx_connect_realm.nx (24607 B) + gate nx_connect_realm_gate (promoted 387368 B e47c7ffd, registered, _offc installed, rostered, GREEN 47/47 on the NAS, two bites proven). OPEN, in order: (1) INTEGRATOR wires nx_connect_appd -- boot crl_family_ctx_open(famctx, opaque_keys.bin, opaque_store.log); when nxc_auth did not authenticate, read X-Nishi-Session (nx_http_header_find as nx_site_auth does) and call acc_realm_unify(famctx, value, n, now, connect, acct, band), on CRL_OK authed=1 acct=value, ctx CS_UID stays 0 so device keys change only through the CONNECT door; POST /connect/link -> crl_link(famctx, famtok, n, actx, nxc_auth token, n, now, consent, band, connect); POST /connect/unlink -> crl_unlink(actx, token, n, now, CRL_SIDE_CONNECT, connect). (2) an ATTESTED band on the CONNECT account (CN13 or CN18): crl_link must be offered only with a recorded band, never a guessed one. (3) the done-rule live proof: login on /connect with a family session round-trips whoami on the served daemon, observed by nx_https_get. (4) re-grade the accounts row in nx_connect_maturity only after (3). (5) BOARD seat: refs rows for NIST SP 800-63C-4 Sec 3.8.1 and RFC 9807 from the mirrors named in row 1790357560
2026-09-25	CN16	measure	BOARD seat closing: nx_ladder connect LADDERED (22 of 22 placed; substrate 6, arm 2, contender 14); nx_barfresh connect FRESH (1 bar, 2026-09, 6 scans this month incl. meta-groups newest=2025-11 read at listing depth); nx_compare_refs_gate fleet-wide 38 of 44 RED with 0 connect lines (job 1790357448, 24163 B complete, was 37 of 44 before the gdpr-art9 re-pin); nx_compare_rank connect (job 1790357575): done=9 open=13 finish=6, TARGET VERSION 0.5 (M2) because the six M1 contract symbols sit in LIB sources the builder seats landed this leg (nx_connect_signup, circles, faith, realm, msgstore, liquidity; their gate proofs UNVERIFIED by this seat), critical path #1 CN16 priority 400 (all rivals absent), #2 CN17 and #3 CN18 priority 0 (one Part code each makes the competitive evidence INCOMPLETE, cod UNAVAILABLE), later CN2 CN1 CN7 CN9 CN4 CN8 CN12 CN11 CN10 CB3; the ranker filed CN16 CN17 CN18 into pm_intake.jrnl; OPEN: CN7 cs_sealed_aead and CN9 ct_llm_translate stay UNMAPPED (a watch on the existing serve or translate organ would read DARK, so the new organ path is a builder decision), TREATMENT NO-TREATMENT, INCUMBENTS index stale, and the /compare/connect regen for the SYNC seat
2026-09-25	CN6	land	SHIPPED nx_connect_msgstore_gate through nx_organ_ship: BUILT sha aa3abf18 (api/build lane), PROVE 56/56 GREEN exit 0 on the fresh stage-1 build, first promote (no live elf, announced), _offc twin installed, REGISTERED callable=1 schema=0, harness hb7c8103e793b5679; admitted to knowledge/gateroster.conf as a HAND-ADDED row with its evidence. DONE-RULE PART 1 MET: nx_connect_accounts_gate grew tooth T7 RESTART (msgstore saved 354 B, a fresh store reloaded rows=2 with receipt, edit, tombstone and bytes intact, account B load=0 and empty) and reads 7/7 GREEN run-exit 0 under sov_build_run --qualify. OPEN: gauge messaging row STUB to PARTIAL (nx_connect_maturity re-grade, needs the daemon wired by the INTEGRATOR), schema row for tools/list discovery, T7 not separately bite-proven (its lib is, via the msgstore gate)
2026-09-25	CN15	queue	for the INTEGRATOR (owns nx_connect_serve and nx_connect_appd): import nx_connect_faith.nx; at start cfa_load_default(which) (daemon CWD nishihost root reads rung 1; cfa_ok 0 renders the faith section refused by name, never guessed); GET profile faith lists cfa_ntrad, cfa_trad_code, cfa_trad_name, cfa_nsub, cfa_sub_code, cfa_sub_name, cfa_sub_parent, cfa_levels and CFA_PROMPT as zero-JS selects plus a consent box; POST calls cfa_tradition_admit(tab, trad, sub, consent, importance, m) on the member CFA_REC_SLOTS record persisted by acc_save and renders each CFA_REFUSE verdict by name; POST withdraw calls cfa_withdraw(m); for CN14 the ring predicates are cfa_in_ring(m) and cfa_other_tradition(a, b) and the peer-banded query is cfa_discover(tab, viewer, band, pop, bands, n, out) fed the verified hmix band; ranking blends with cfa_rank(gx_graph_score(...), cfa_signal(tab, viewer, cand)); faith paths open channels only through cfa_may_channel; for the BOARD seat: refs to pin are the GDPR Art 9 and Art 7 mirrors (cmp_connect_gdpr_art9.html sha256 24fde5a6, cmp_connect_gdpr_art7.html sha256 3a998bda) and the Pew 2023-24 RLS interactive database mirror (cmp_connect_pew_importance.html sha256 63e35c7e, DOI 10.58094/3zs9-jc14) as the tree bar
2026-09-25	CN3	queue	CN3 stays OPEN on its done-rule. Recipe for what is waiting: (1) INTEGRATOR imports runtime/nx_connect_liquidity.nx into nx_connect_serve, persists each cohort buffer (lq_cohort_words slots) through nx_connect_accounts acc_save, routes seed, invite, revoke, join and reconnect, and feeds lq_funnel conversation rows (cohort, opened, first reply, meeting) from the CN6 message store; (2) the invite handle is the digest prefix of an nx_invite_token 256-bit secret so only the secret travels and only the handle is stored; the invite ttl becomes a conf row with its calibration, never a typed number; (3) after a live seeded cohort closes its first week, lq_funnel_verdict against the empty room is published with n and a Wilson interval beside lq_cohort_size -- only then can the done-rule close; (4) so_add_by_token (a self-share token, add me) and show_by (a fixed 8-candidate ranking demo) live inside programs with a main; read, they are different concepts from a vouch-for-another invite and from a per-cohort rate, but both still owe extraction into libs so every surface binds one implementation; (5) youth peers meet inside family and ward cohorts through nx_connect_youth_lib yw_may_channel, which this rung does not compose (the mission lane here is adult-adult by construction); (6) debt 1790357498 (sev 6): a main() local read 2433600 where its constant was 3600, cause UNMEASURED, minimal repro owed
2026-09-25	CN13	queue	BUILDER seat, two more measured facts for the SYNC seat and the next CN13 pass: (1) /api/gate_run target=nx_connect_signup_gate on the promoted registered artifact answered 66/66 verdict=GREEN exit_code 0 from the serving root, production policy read back 16 3600 300 600; nx_compare_rank connect now lists CN13 as FINISH state=LIB-UNCENSUSED (the symbol is present, the library is younger than the eco-graph build) -- the recipe is nx_eco_graph_build then nx_importcensus then the scoped regen, the SYNC seat's call. (2) WEAKNESS NAMED: the challenge table is door state with capacity window_budget, so anyone can request that many challenges and hold issuance at BURST for one ttl -- a door-wide lockout that tracks no person but serves no person either. The standard fix is a STATELESS challenge (nonce, issue time and bits sealed under a server key with the incumbent HMAC-SHA-256) so issuance holds no memory and only spent nonces are remembered, bounded by admissions rather than requests; the gate's burst and replay teeth carry over unchanged.
2026-09-25	ALPHA	land	ALPHA lane LIVE at https://nishifamily.com/alpha/connect/ -- nx_connect_auth_gate --qualify 12/12 GREEN against the new serve core (production mount default unchanged); alpha ELF alpha_connect/nx_connect_appd.elf 549694 B (nx_filecopy verified=1, mode 0755); daemons.reg row connect_alpha (cwd alpha_connect, argv 18133 /alpha/connect alpha, revive) appended and re-signed with nx_reg_sign through /api/organ_run (SIGNED hmac-sha256); nx_portcheck showed :18133 free first (925 rows, complete); daemon_supervisor.log: REVIVED connect_alpha pid=23866; proxy_routes.conf row nishifamily.com /alpha/connect 18133 buffered (sites.elf hot-reloads on mtime). Evidence: GET /alpha/connect/register 200 11246 B, every nav href, the form action and the note link re-rooted to /alpha/connect, ALPHA banner rendered; nx_page_verify GREEN on BOTH https://nishifamily.com/connect (200, 11744 B, production unaffected) and https://nishifamily.com/alpha/connect/ (200, 12302 B). Open: a POST sign-up round trip on the alpha, the circles page, a mount gate with a planted defect.
2026-09-25	SITE	queue	NEXT for the front door, each for its owner: (1) a CM13 capture of the alpha on phone and desktop and the CM6 referee grade -- the showcase eyebrow ink that failed 4.5 to 1 on both earlier alphas is expected here too (cms owner, laptop browser lane); (2) the emitter renders a card page body as the same paragraph its index card carries, so Sign up privately cannot yet list what is stored and never stored as its own section -- a long-form per-page body (cms CM11 section catalog, or a body row per card) is owed; (3) imagery: craft 14 of 15 for want of any image, an estate-generated or licensed picture per circle; (4) a SITE rung and matrix row for this front door, placed on the ladder, are the BOARD seat's to declare (it is the M1 wedge's public door); (5) an operator ACCEPT row in knowledge/store/accept- before anyone calls this alpha done; (6) beta once circles (CN3 cohort seeding) and the device-side OPAQUE client land, so the coming labels can turn into live ones
2026-09-25	CN14	land	FINISH seat: the youth wall and the age band are on the base class. nx_connect_lds_youth (source 6738 to 7098 B, banked knowledge/status/nx_connect_lds_youth.nx.bank-20260925) and nx_connect_idage (9447 to 9739 B, banked likewise) migrated by hand onto nx_gate_verdict: tcheck delegates to gv_check per tooth, gv_ctr, gv_kv values, return gv_verdict, neg-control teeth renamed neg-control-incumbent-any-to-any and neg-control-forged-attestation. Release builds: youth passed 8/8 GREEN 44460 B sha256 bb4a8f56 (values adult_dm_youth 0, adult_grp2_youth 1, adult_grp1_youth 0, guardian_youth 1, youth_youth 1, adult_adult 1, incumbent_adult_youth 1); idage passed 8/8 GREEN 44736 B sha256 b0b40f5a (band_x 1, band_y 0, pseudonyms 204558289 ours vs 511049973 other, rereg_blocked 1, rereg_email 0). nx_contentdiff live vs staged named every lost run, 4 each, complete lists: the old neg-control label, the hand tally fails=, VERDICT: GREEN (...), VERDICT: RED, all superseded by the gv_verdict line; promoted with allow_capability_loss=yes and expect_sha256. Youth bite: planting the guardian flag on the core-wall scenario read adult_dm_youth=1, T1 and T8 FAIL, passed 6/8 verdict=RED exit 1; restored. OPEN: idage bite, reconnect and the six other organs still hand-rolled
2026-09-25	CN3	measure	independent lane receipt: /api/gate_run target=nx_connect_liquidity_gate (job 1790357746) path FAST exit_code 0 verdict GREEN 72/72, deadline 14750 ms from conf, capture_truncated 0. The matrix watch row Network liquidity names runtime/nx_connect_liquidity.nx with _ABSENT_:lq_cohort_seed and that symbol now exists there, so the next regen flips the cell; the flip is the receipt that the contract symbol exists, not the done-rule, which stays open until a live cohort's first-week reply rate is measured against the empty room. All 82 const LQC_ declarations in buildroot/runtime are this library's own (nx_shelltool grep corpus_complete=1), and no lq_ function name collides with nx_linkqual or nx_fin_liquidity, so the integrator's import cannot trip a duplicate definition
2026-09-25	CN14	measure	second bite, on the two-deep wall itself: ccl_channel's yw_may_channel swapped for the leaky yw_may_incumbent (any DM allowed) turned the gate RED 64/67 run-exit 1 (--no-cache build job 1790357635) on exactly the three predicted teeth: neg-control-unrelated-adult-private-channel-to-the-girl-walled actual 1 (a friendship lane) expected -13 CCL_WALLED, the same to the boy, and the incumbent-would-leak tooth. Restored lib re-hashed to the banked sha256 5549d205 39233 B before any other edit. Then added ccl_copy_into (a full table answers CCL_FULL and grows by copying into a larger block, never a guessed cap; the block holds slot indices only so it also persists as bytes) with six growth teeth incl. neg-control-copy-into-a-block-too-small-refuses-full-never-truncates; lib now 41453 B, gate 26157 B
2026-09-25	BOARD	measure	XLADDER seat, for the BOARD and SYNC seats: the only row in knowledge/compare/connect.gates cites nx_connect_gate.elf, and its live run (/api/gate_run job 1790357776, GREEN 5 of 5) proves the bounded socket connect() wrapper (fcntl reaches the kernel, black-hole dial bounded at 2001 ms, refusal told from timeout, fd flags restored), not the Nishi CONNECT product -- a homonym, so connect's executed evidence measures a different subject than the board it sits on. Product gates that do exist: nx_connect_lds_youth.elf 44460 B and nx_connect_lds_reconnect.elf 22263 B, both PROMOTED-UNREGISTERED and refused by /api/gate_run by name (verifiers only: gate, test or kat suffix). Also: the new cross-compare board faithsocial is admitted (nx_domain_admit ADMIT CLAIM-ONLY, LADDERED 11 of 11, BARFRESH FRESH, page_verify GREEN) with rungs FS1-FS11 riding CN13 CN5 CN14 CN15 CN18 CN6 CN3 CN4 CN2 on the same contract symbols; two new contracts live there until adopted here -- FS8 cds_date_checkin (runtime/_hdl_build/nx_connect_datesafety.nx) and FS11 cgm_mod_queue (runtime/_hdl_build/nx_connect_groupmod.nx)
2026-09-25	CN6	measure	SECOND MUTANT, delete not replayed on load: nx_connect_msgstore_gate 54/56 RED run-exit 1 with exactly restart-every-field-equal-in-order-a (2 fields, del flag and handle of the deleted row) and restart-delete-survives-a2 (read 219 bytes where a tombstone belongs) failing, and nx_connect_accounts_gate 6/7 RED with T7 RESTART failing; restored, the msgstore gate HIT the build-cache key of the SHIPPED artifact (aa3abf18, 126352 B) and read 56/56 GREEN, the accounts gate 7/7 GREEN, both run-exit 0; served and _offc twins stayed aa3abf18 throughout (nx_filehash cmp identical=1), so no mutant reached the serving root
2026-09-25	CN6	queue	OPEN for the INTEGRATOR: wire nx_connect_appd /connect/secure and /connect/chat onto msg_store_open plus msg_store_load at session start, msg_store_append with msg_store_chan_yw(yw_may_channel(...)) on every send, msg_store_receipt, msg_store_edit, msg_store_delete, msg_store_read, and msg_store_save after each mutation, into the same dir as acc_save (the file is dir/<account>.msg). OPEN for the BOARD or SYNC seat: map the CN6 contract to runtime/_hdl_build/nx_connect_msgstore.nx msg_store_append (the ranker read it UNMAPPED). OPEN: the gauge messaging row STUB to PARTIAL waits on the served path (nx_connect_maturity still hand-grades it 1, in-memory per-session demo); nx_connect_msg_gate (20846 B) and nx_connect_accounts_gate (7 teeth, T7 new) are BUILT-UNPROMOTED by declaration because both roll their own verdict and need a D001 migration onto gv_check before a promote; nx_connect_msgstore_gate is REGISTERED but no cap names it yet
2026-09-25	CN5	measure	VERIFIER PARTIAL 47/47 GREEN re-run by this seat via /api/gate_run (job 1790357763, exit 0, capture 5259 B untruncated) on the promoted gate e47c7ffd built from gate src 7903b1e2, lib da9b78ee 24607 B declares func acc_realm_unify at off 16737; nx_gate_bite nx_connect_realm_gate nx_connect_realm.nx 2 (job 1790357840) killed=1 survived=0 void=0 valid_mutants=1, restore byte-identical and both twins restored (hashes rechecked); all 7 claimed CN5 rows present. Builder claims hold INSIDE the gate only: nx_connect_appd.nx (now 32799 B) has 0 calls to acc_realm_unify so the served round trip is UNPROVEN. Gaps named: (1) PRIVACY the link log is written mode 0644 (CRL_MODE_0644) and stores the family uid hex = unkeyed SHA-256(realm then three pipes then handle) beside the CONNECT account id, so any local reader who guesses handles correlates a family identity to its CONNECT account -- owed 0600 plus a keyed digest; (2) CONCURRENCY crl_link_verified reads state then appends with no lock, so two concurrent links can bind two family identities to one account and break one-to-one -- UNVERIFIED whether appd serves concurrently, owed a lease around read-then-append; (3) the first link trusts the caller's band, no attestation source exists yet (CN13/CN18). No dating lane, Church record or Church text in this lib; the two-deep wall is out of this lib's scope (it only carries the band).
2026-09-25	CN14	land	re-shipped with growth: lib buildroot/runtime/_hdl_build/nx_connect_circles.nx 41453 B sha256 7ff66d3a (ccl_copy_into added), gate 26157 B src_sha256 c7dba5e3; nx_sov_build_run --qualify GREEN 73/73 (job 1790357809); /api/build src_path names the gate, src_stable 1, staged 117544 B sha256 82aac86a (up from 113464, an addition not a revert); /api/promote expect_sha256 PROMOTED 82aac86a; nx_offc_install then nx_filehash cmp root vs _offc identical 1; /api/gate_run on the promoted binary exit_code 0 GREEN 73/73. The ccl_ prefix is unique estate-wide: nx_shelltool grep func ccl_ over buildroot/runtime matched 69 of 26591 files coverage_complete 1 corpus_complete 1, all in this lib (retained knowledge/gates/cn14_ccl_prefix_20260925.out); nx_connect_serve carries no ccl_ or CCL_ and already imports the four libs this one composes. Status: shipped, referee grade UNMEASURED, awaiting acceptance
2026-09-25	CN15	measure	VERIFIER CONFIRMED 63/63 -- independent re-run /api/gate_run job 1790357799 exit_code 0 GREEN 63/63 table_rung=1; lib 22406 B sha256 2b6e19b6, gate src 25273 B fe1c4d54, table 7103 B cbe0e051, promoted gate 94472 B 39bd51a7 all match the builder; func cfa_tradition_admit declared once; table recounted by hand 16 traditions 63 churches names only; nx_gate_bite 2 sites killed=1 of valid_mutants=1 (cmp site off 6496, first-kill-wins) twins restored byte-identical; OPEN: faith discovery is a population-wide listing incl minor-to-minor peers with no circle or guardian scope, which needs a policy decision against so_add_by_token consent-only discovery before any route serves it; bands are caller-supplied so the integrator must pass verified hmix bands; watch row still _ABSENT_ until the next regen; nothing served on nishifamily.com; NAS job ids ran about 100 s ahead of nx_fs now_sec
2026-09-25	CN14	queue	OPEN after the builder leg. (1) INTEGRATOR, nx_connect_serve and nx_connect_appd: import nx_connect_circles.nx; at startup read knowledge/connect_circles.conf with sys_read_file (daemon CWD is the nishihost root), kr = ccl_conf_rings, allocate ccl_state_slots(kr, capm, capr, capv, capw, capf) slots, ccl_init, and refuse to start when ccl_load answers negative; size capacities from the account store and grow with ccl_copy_into on CCL_FULL; persist the block as bytes beside the account snapshots (slot indices only, no pointers); ccl_add_member at sign-up with the attested age band and the tradition the member consents to show; ccl_link_guardian from the family realm link; serve a /connect/circles page (rings with labels, open next ring, narrow, found with two adults, vouch, join, leave); gate profile and search visibility on ccl_circle_reach not negative, the E2E inbox on ccl_channel not negative, group rooms on ccl_group_ok, the guardian page on ccl_guardian_sees. (2) PM seat: intake REQ 1790355003 (R3 circles) and 1790355004 (R4 youth peers) are served by this rung once integrated and accepted. (3) Scale is UNMEASURED: reach scans the membership rows, which is fine at wedge scale; a per-member row index is owed before tens of thousands of rows. (4) the registered gate has schema 0, so tools/list does not list it until a schema row exists. (5) Acceptance: referee grade and operator ACCEPT both pending
2026-09-25	SITE	land	FINAL alpha state after the 4th run of plan-site-release-connectfaith- (27 of 27 ok): index sha256 8265d1bf9acd0b4778425e2738b15ded6696c7fb1ee47ff7c1c8b5b74767fbf6 29785 B, release == served (nx_filehash cmp identical=1); nx_page_verify GREEN, status 200, a11y-issues 0 on all 7 pages (index + 6 about pages at 28472 B each); copy changes since the first landing: the title and hero now say Latter-day Saints and other Christians (a phrase that separated members from Christians read as saying they are not Christians), and the Sign up privately page says device-side sign-in is coming, since today the passphrase reaches the server at sign-in; blueprint connect_faith_alpha.site 4894 B at the nishihost root, recipe records connect_faith_alpha.recipe.tsv 4695 B; stage ALPHA, awaiting the referee capture and operator acceptance
2026-09-25	CN13	measure	VERIFIER PARTIAL 66/66 GREEN: lib 27825 B sha 9e151f9b and gate 22014 B sha ad77f6ab match the claim, func csu_signup_admit declared at off 26175; /api/gate_run job 1790357847 exit_code 0 source_newer 0 passed 66/66 verdict=GREEN; nx_gate_bite via organ_run job 1790357916 valid_mutants=1 killed=1 void=0 not_reached=0 (cmp site off 9368), lib restored byte-identical and promoted twin still sha 18159ce0; 6 CN13 journal rows found. REFUTED AS UNDER-SCOPED: the claim that the olg_register takeover reaches no live route rested on olg_route_ip only; olg_register is called directly by at least 9 serving organs (nx_opaque_login_daemon behind olgd_signup_ok invite, nx_gallery_gateway behind argv allow_register PROD=0, nx_vault_gateway, nx_mesh_gateway, nx_gen_gateway, nx_docportal_admin_daemon, nx_email_portal_daemon, nx_lan_signup_routes, nx_studio_gate) and none asks nx_uas_lookup first, so live reach is UNVERIFIED not absent. GAPS vs goal: csu_handle_taken then olg_register is check-then-act with no lock, so two concurrent registrations of one handle across processes sharing opaque_store.log can still supersede (UNMEASURED); age band is caller-attested so the two-deep wall rests on a self-declared band; csu_lanes_open gives a minor no GROUP lane, so youth cannot join ward or stake circles even with two adults present; HANDLE_TAKEN is a distinguishable answer (enumeration at one proof of work per probe); passphrase reaches the server; not wired to any served page; no Church record input and no Church text found in the lib
2026-09-25	SITE	lesson	a front door copies its claims from the app it points at, and the app's own copy can overstate: the register page says nothing offline-crackable to steal while RFC 9807 says a corrupted server can always run an offline dictionary attack, and the form hands the server the passphrase. The alpha states what was measured on the served pages (handle and passphrase only, OPAQUE record stored, reconnect discovery off by default) and labels the rest coming, so one hop of copying cannot turn an app's overclaim into the estate's promise; read each live page before quoting it, and quote the primary source for the protocol, not the page
2026-09-25	CN3	measure	VERIFIER PARTIAL 72/72 -- mechanism reproduced (fresh qualify job 1790358001 run-exit 0 and /api/gate_run job 1790357955 exit 0 both 72/72 GREEN; lib sha 5a0bcf3b 19195 B and gate sha 81fcf3a9 19585 B match; promoted gate 8bd41082 86872 B; 5 claimed CN3 log rows present; roster row present; nx_gate_bite job 1790358111 killed=1 survived=0 void=0 first-kill-wins so ONE mutant, lib restored byte-identical). GAPS: (1) lq_funnel_verdict says ABOVE on POINT rates -- the run the builder quoted printed fixture_intervals_separated=0 (cohort 625 lo 306 vs empty room 125 hi 360) and the gate still asserts ABOVE, so the done-rule ruler would pass statistically inconclusive data; verdict needs interval separation or a minimum n. (2) the guardian link is ASSERTED by the inviter at mint, never consented by the guardian -- any adult member can name any other adult member as a minor's guardian. (3) the age band is caller-supplied in rc_src at redeem, so a minor claiming adult redeems an adult handle and skips the guardian link; band must come from the nx_connect_idage attestation at the boundary. (4) consent default-off is not by construction here (optin is caller data) and mission+area+dates are Art.9-class fields stored per member. (5) two-deep wall covers only the reconnect lane; youth peers and adult-minor channels inside a cohort are not governed (yw_may_channel not composed). (6) leftover diag_ value lines in the gate; no sotabar or refs source for CN3. Done-rule field rate UNMEASURED.
2026-09-25	CN6	measure	BEST-IN-CLASS MECHANISM named and read this month: the store follows the Matrix event model, where a delete is an APPENDED m.room.redaction event and the target keeps its skeleton with content stripped (Room Version 11, Matrix spec v1.19: Upon receipt of a redaction event, the server must strip off any keys not in the following list). Mirrored knowledge/fetched/cmp_connect_matrix_rooms_v11.html 72788 B sha256 77be4fcfb4ccb236b986dff78c4468e1d7a1ea3b6fb2778e45232e2b41cfb7d1 status 200 fetched 2026-09-25, for the BOARD seat to pin as a refs row on the Messaging core row. DECLARED DEVIATIONS: our tombstone clears the handle while the opaque ciphertext stays in the append-only arena (retention is a lifecycle follow-on); edits append a new blob and re-point the row rather than a replacement event; no event graph or federation (CN12)
2026-09-25	CN14	measure	BEST-IN-CLASS READING for the BOARD seat (refs and sotabar rows are the BOARD seat's): the arXiv API listing all:vouching sorted by submission date was fetched and READ 2026-09-25, mirrored knowledge/fetched/cmp_connect_arxiv_vouching_202609.xml 26768 B pin sha256 c6d2f7b484fc7344a830d2294aeed08439f5858ab576927b82217ad2e7056fb7, 23 results, newest=2026-08 (no September entry). Newest: RepuLink, arXiv 2608.22025v1, 2026-08-22, ISWC 2026 poster, https://arxiv.org/abs/2608.22025v1 -- its abstract says conventional trust models propagate trust only forward with no accountability for endorsers regarding whom they vouch and no meaningful initial reputation for new nodes, and answers with a two-layer model (interaction feedback plus domain-specific endorsements) that holds endorsers accountable by Backward Endorsement Penalty and Reward Propagation (BEPP and BERP). Where CN14 stands against it: admission is consent plus two live adult vouches from inside the very circle (forward endorsement, spent on leave, voided when a voucher leaves) but a voucher carries NO backward accountability for whom they vouched. Candidate exceed rung, not declared by this seat: backward endorser accountability composed from nx_connect_blind_abuse and nx_connect_csae_report, so a voucher whose vouchee is removed for abuse loses vouching standing
2026-09-25	CN14	land	FINISH seat: nx_connect_lds_reconnect (the mission-family hook of the circles rung) migrated the same way, source 7858 to 8250 B, banked knowledge/status/nx_connect_lds_reconnect.nx.bank-20260925, T8 renamed neg-control-mission-only-matcher; release build passed 8/8 GREEN 48362 B sha256 a76601dc with values s_confirmed_overlap 100, s_inferred_overlap 70, s_other_area 0, s_no_time_overlap 0, s_other_mission 0, s_opted_out 0 against raw_opted_out 70, youth_date_lane -1, youth_friend_lane 70; nx_contentdiff lost_from_live=4 (78 permil), all the superseded hand-verdict literals; promoted with allow_capability_loss=yes and expect_sha256. Roster re-trial of the four re-promoted binaries (youth, idage, reconnect, auth gate) read 4/4 GREEN exit 0 with gv verdict lines (journal knowledge/status/gateroster_trial_connect_finish_20260925c.jrnl). OPEN: reconnect and idage bites not yet run
2026-09-25	CN6	land	nx_connect_accounts_gate MIGRATED onto nx_gate_verdict (ag_check delegates to gv_check, gv_verdict exit code, neg-control-T5, values emitted) and SHIPPED through nx_organ_ship: BUILT c56205f6, PROVE 7/7 GREEN exit 0 incl. T7 RESTART, first promote, _offc twin, REGISTERED; admitted to knowledge/gateroster.conf beside nx_connect_msgstore_gate. The accounts gate therefore carries the done-rule's restart tooth on the served estate, not only in source
2026-09-25	CN6	lesson	The first ship of the accounts gate was refused BUILD-FAILED because nx_connect_serve.nx line 1727 called cs_page_circles before its definition had landed (a sibling seat mid-edit); the definition arrived minutes later and the retry shipped. The store composes acc_path, acc_w64 and acc_r64, which live in nx_connect_accounts beside acc_serialize and so drag the whole 125 KB nx_connect_serve closure into every store consumer: any in-flight serve edit breaks every store rebuild. QUEUE: extract the accounts path and codec into a leaf lib (no serve import) that nx_connect_accounts and nx_connect_msgstore both compose
2026-09-25	CB1	land	FINISH seat: the two FINISH-row organs are on the base class too. nx_connect_room_rx (CB0, source 7461 to 8042 B, banked knowledge/status/nx_connect_room_rx.nx.bank-20260925) gained a ninth tooth neg-control-non-e2e-sfu-decodes-every-stream so the content-blind exceed cannot pass against a dead comparator; release build passed 9/9 GREEN 44471 B sha256 b8a7f859, values grid_tiles 9, recv_bw_svc_9 180 vs naive 900, server_decoded_blind 0 vs non_e2e 9, fit_budget_150 150, recv_bw_svc_25 340 vs naive 2500. nx_connect_social (CB1, 15476 to 16054 B, banked likewise) T8 renamed neg-control-phonebook-upload; passed 8/8 GREEN 54765 B sha256 77e90d17, values feed 3 then 2 after tombstone, story 1 then 0 after expiry, handle 1 and -1, token 2, forged -1, expired -2, incumbent phonebook surfaced 555 vs ours -1. nx_contentdiff lost 3 and 4 runs, every one a superseded hand-verdict literal; both promoted with allow_capability_loss=yes and expect_sha256. idage bite: verify_attest planted to accept any MAC read T2 neg-control-forged-attestation FAIL, passed 7/8 verdict=RED exit 1; restored. Still hand-rolled and queued: nx_connect_lds_room, nx_connect_msg, nx_connect_lds_census, nx_connect_lds_free
2026-09-25	CN14	measure	VERIFIER CONFIRMED 73/73 -- independent re-run /api/gate_run job 1790358288 exit_code 0 NX-CONNECT-CIRCLES-GATE passed 73/73 verdict=GREEN on nx_connect_circles_gate.elf sha256 82aac86a (117544 B, root == _offc by nx_filehash cmp); lib buildroot/runtime/_hdl_build/nx_connect_circles.nx 41453 B sha256 7ff66d3a declares func ccl_circle_reach (nx_txtscan, 1 hit); nx_gate_bite job 1790358326 valid_mutants=1 killed=1 void=0 not_reached=0 verdict GREEN, lib re-hashed 7ff66d3a and both twins restored identical after; all 7 claimed CN14 journal rows present; conf ring order family mission ward stake worldwide christian with vouch 2 and no copied Church text. GAPS the gate does not cover (named, not refuted claims): (1) ccl_circle_reach lets an UNRELATED ADULT discover a minor who shares an opened ring (gate asserts reach adult-girl = 2 as intended) so a minor profile is visible to non-guardian adults once integrated as the visibility gate, against high-privacy-by-default for children; (2) guardian_consent in ccl_join is a caller boolean not bound to the linked guardian identity and ccl_link_guardian takes no guardian consent (depends on CN5 family realm); (3) any two consenting adults can found any family or ward instance id, so circle identity is self-asserted and first founders own the id (who allocates inst is unowned); (4) youth peer channel has no age-gap bound inside the minor band; (5) trad (Art.9 religion) is stored unconditionally with no show-consent flag in the lib; (6) 2 teeth use bare gv_check without values; bite ran 1 mutant only (first-kill-wins). OPEN: integration, acceptance, scale, backward endorser accountability.
2026-09-25	CN6	land	nx_connect_msg_gate MOVED onto nx_gate_verdict (the seven checks nx_connect_msg's old main carried, same fixture values, neg-control-T7 named, values emitted) and SHIPPED through nx_organ_ship: BUILT 8a25e8c3, PROVE 7/7 GREEN exit 0, first promote, _offc twin, REGISTERED, rostered. BITE: set_state allowing a backward receipt gave 6/7 RED exit 1 with T3 alone failing; restored, the ship's fresh build proved 7/7. The Messaging core row of /compare/connect (log_append in nx_connect_msg.nx) now has a shipped, rostered gate for the first time. OPEN: the old cmsg_selftest body and its sw, sn and tcheck helpers are now dead code inside the nx_connect_msg lib (nothing calls them); remove them in one exact edit, then rebuild nx_connect_msg_gate and nx_connect_msgstore_gate to prove nothing depended on them
2026-09-25	CN13	land	BUILDER CN13-DEVICE seat: the passphrase no longer has to reach the server. V-MODAUTH-8 named no symbol (grep over buildroot/runtime corpus_complete=1: four comment mentions, the wasm client rung), so the entry points are the brief's: LIB buildroot/runtime/_hdl_build/nx_opaque_client.nx (9809 B, sha256 2f000d370b290e9d) ocl_state_new ocl_init ocl_register_blind ocl_register_finalize ocl_login_blind ocl_login_finalize ocl_session_key ocl_export_key -- the RFC 9807 client role only, every protocol step the incumbent hub/nx_opaque_pake client function (P256-SHA256, the suite the family login already speaks, NOT ristretto255), the lib owning only the device state between round trips with out-of-order refusal and secret wipe. Server halves LIB buildroot/runtime/_hdl_build/nx_opaque_wire_server.nx (9807 B) osw_public_cfg osw_register_respond osw_register_store osw_login_respond osw_login_finish osw_pending_new composing the flow's own _ma_mk_cfgs _ma_cred_id _ma_server_ake_keys nx_uas_append nx_uas_lookup and the M5 mint, no crypto change. Gate buildroot/runtime/_hdl_build/nx_opaque_client_gate.nx (20201 B) GREEN 39/39 on a real OPAQUE account log (artifact 295764 B sha256 f2f2de831978d3b2, run-exit 0): device register+login mint a 152-byte session; interop BOTH ways (device-registered record logs in via nx_modern_auth_login; server-side-registered account logs in from the device), both sessions validate to the SAME user id hash; server view 801 B holds neither passphrase nor its SHA-256 while neg-control-server-side-path-receives-the-passphrase fires; blinds 32/32 and requests 33/33 bytes differ across runs; wrong passphrase fails on the device (-4), forged KE3 refused -1410 and mints nothing, replayed KE3 refused -1403, finalize without its own blind refused -2. BITE: planted a fixed scalar-one blind (request = H(passphrase), protocol still works), RED 37/39 naming exactly the two variance teeth (blind_bytes_differing=0 request_bytes_differing=0), restored, GREEN 39/39 with build-cache key 9026a2a58e41152f identical to the first build. MEASURED, disclosed: record_maskkey_bytes_differing_same_passphrase=0 -- the record's masking key is a KEYED function of the passphrase (OPRF key + argon2id) as RFC 9807 prescribes, so offline guessing needs the server's oprf_seed and pays argon2id per guess; no unkeyed function reaches the server. Shared source hub/nx_modern_auth_flow.nx sha256 0e74e6c33e3a69f7 unchanged before and after.
2026-09-25	CN14	land	FINISH seat: nx_connect_lds_room (youth game and hangout rooms, two-deep on join and leave) migrated onto nx_gate_verdict, source 9244 to 9496 B (banked knowledge/status/nx_connect_lds_room.nx.bank-20260925), T7 renamed neg-control-no-wall-room; release build passed 8/8 GREEN 48217 B sha256 dbe94f48, values youth_opens_room 1, youth_joins 1, lone_adult_admitted 0, youth_into_two_deep 1, game and chat rosters 2 and 2; nx_contentdiff lost 4 superseded literals; promoted with allow_capability_loss=yes. Roster re-trial of room_rx, social and lds_room read 3/3 GREEN (journal ..._20260925d.jrnl). CONCURRENT OWNER, measured: buildroot/runtime/_hdl_build/nx_connect_msg.nx changed under this leg (8602 to 8803 B, mtime 1790358355) and no longer has a main (its tests moved into cmsg_selftest, i.e. it became a library, presumably for CN6 msg_store_append); the nx_connect_msg.elf promoted and rostered at 1790356282 (984514f7) was built from the 8602 B program and can no longer be rebuilt from source. Left to the CN6 owner: re-point the roster row at a gate that calls cmsg_selftest, or retire nx_connect_msg.elf through nx_retire_path; this seat does not touch an owner's file mid-edit
2026-09-25	ALPHA	land	CN14 circles WIRED into the alpha: nx_connect_serve imports nx_connect_circles; new page /circles (CS_P_CIRCLES 11; ctx slots CS_CIRCLES 32 and CS_CIRCLES_TAB 33; CS_SLOTS 32 to 34) renders every ring of knowledge/connect_circles.conf through ccl_conf_rings, ccl_init, ccl_load, ccl_ring_label, ccl_ring_adm, ccl_ring_trad and ccl_need_reason, read-only (joining and vouching are labelled the next alpha, never a dead button; signed-out and table-not-loaded both show no ring). The daemon loads the table once at start on a CWD ladder (knowledge/ then ../knowledge/ for the alpha dir). NEW GATE nx_connect_mount_gate (buildroot/runtime/_hdl_build) 20/20 GREEN run-exit 0 under --qualify, 5 neg-control teeth; values p_banner 0, leaks 0 on login account contacts and circles, mhtml identity 67 B and mounted 79 B, table_rings 2 circles_rows 2. nx_connect_auth_gate 12/12 GREEN. Build 2 SOVEREIGN _build/nx_connect_appd.sov.elf 564584 B sha c1f3a20b. Alpha redeployed: a running binary cannot be overwritten (nx_filecopy cannot open dst), so it was copied to alpha_connect/nx_connect_appd-c1f3a20b.elf, the daemons.reg row repointed and re-signed, the old alpha stopped EXACTLY with nx_proc_kill exact (pid 23866, start ticks 497347349, exe sha bfb02bdc via nx_proc_observe; production pid 32076 exe 3e46d193 untouched), supervisor REVIVED connect_alpha pid 10116. Live: GET /alpha/connect/circles 200 with the signed-out ask, re-rooted links and the ALPHA banner. Open: a POST sign-up round trip and the signed-in circles view over the edge, then CN13 CN5 CN6 CN3 CN15 wiring.
2026-09-25	CN16	land	nx_connect_study LANDED as a lib (buildroot/runtime/_hdl_build/nx_connect_study.nx 26067 B, entry csc_circle_post plus csc_join csc_leave csc_bind csc_load csc_post_emit): a study circle IS a CN14 circle (ccl_found ccl_join ccl_leave ccl_active; the youth wall composed as ccl_group_ok over the roster a join or leave WOULD leave, the guardian exception included), every passage and reflection anchor resolves through the verse door sc_verse (nx_scripture_lib SS1) over the public-domain corpus or is refused CSC_UNKNOWN_REF (no case folding, no trimming). DATA: knowledge/connect_study.conf (9 plan rows in two sample plans, 2 apparatus markers TG and JST each measured 0 times in the 13714803-byte corpus) and knowledge/connect_study_circle.conf (study ring, vouch 2). Gate nx_connect_study_gate 63/63 GREEN run-exit 0 (job 1790358653, build-cache key 4292d865, elf sha256 3f48beb6 110623 B). BITE: csc_leave with its wall check removed read 57/63 RED run-exit 1, tooth THE LEAVE WALL actual=1 expected=-13 (job 1790358721); restored, build-cache HIT on the original key, 63/63 GREEN (job 1790358772). Shared sources hashed before and after the runs: nx_connect_circles 7ff66d3a, nx_scripture_lib 93c22046, unchanged. Baseline named: YouVersion Bible Plans read with a church group (ref youversion, mirror offset 81196).
2026-09-25	CN13	land	BUILDER CN13-DEVICE: gate SHIPPED through nx_organ_ship -- fresh /api/build sha256 35d8fc1b9903c8b10ff6004c10d8c6a0492c206083b2ac3803747aa6c6ba05ce, PROVE 39/39 GREEN on the fresh build, first promote (live == staged), _offc twin installed, registered callable; admitted to knowledge/gateroster.conf in its own grammar (comment block + name row, total 82443 B). WASM LANE, step reached: nx_compile_wat on buildroot/runtime/_hdl_build/nx_opaque_client.nx parsed the whole closure and REFUSED in the backend -- cannot lower IR opcode 38 in function nx_bits_popcount64 (the emitter now refuses instead of silently computing zero) -- so the device client is proven native and in-process, NOT yet as a shipped wasm module; the page still posts the passphrase until that lowering lands and the INTEGRATOR wires the osw_* routes.
2026-09-25	CN17	land	nx_connect_service lib buildroot/runtime/_hdl_build/nx_connect_service.nx (entry csh_need_match, 23304 B sha256 f987d817) and nx_connect_service_gate GREEN 69/69 on the NAS by nx_sov_build_run --qualify (cache key 1621d6ed, artifact sha256 010f329e). Composes ccl_circle_reach (a viewer sees a need only through a ring no wider than the poster chose), ev_rsvp ev_cancel ev_roster_safe (capacity, idempotence, the youth rule) and yw_may_channel (the one-to-one wall); policy is data in knowledge/connect_service.conf (cell 20000 microdegrees, a person-picked THRESHOLD not yet calibrated, reach 1). Bite: helper-confirm planted out of csh_released went RED 68/69 on neg-control-the-exact-place-is-absent-from-every-pre-confirm-output, restored byte-identical went GREEN 69/69.
2026-09-25	CN18	land	BUILDER seat: cvh_person_attest LANDED in buildroot/runtime/_hdl_build/nx_connect_personhood.nx (24453 B, sha256 b3256c3b) with gate nx_connect_personhood_gate.nx 51/51 GREEN under nx_sov_build_run --qualify (run-exit 0, artifact sha256 5eb290f5); two in-person vouches from verified adults active in one circle instance (composes ccl_vouch, and ccl_need IS the circles table vouch row, no second count) reduce to ONE 152-byte Ed25519 claim holding only subject hash, band, person, issued, expires, claim id and signature; verification is sa_age_attest, landed ADDITIVE in buildroot/runtime/_hdl_build/nx_site_auth.nx (7659 to 11908 B under CAS h56de68cc2d30f0f5, sha256 3782b953, composing only ed25519_verify_full and _ncs_get_i64_be already in its closure) as the ONE age-band ruler authz AZ10 and synthroom SR9 watch, and the importer nx_site_auth_gate rebuilt against it GREEN 4/4; census over the stored row 0 undeclared of 8 fields and a planted dob docno photo row counted 3; a replayed claim refuses SUBJECT, a spent vouch refuses VOUCH_SPENT, a tampered band, a wrong key and a forger key refuse FORGED, revocation refuses REVOKED at once, a youth or unverified adult cannot vouch, the credential path refuses CVH_DC_VERIFIER_ABSENT by name; BITE: spent=0 planted in cvh_person_attest read 49/51 RED with exactly the two spent teeth failing (actual 1 vs -105, 0 vs -106), restored 51/51 GREEN; lifetime row knowledge/connect_personhood.conf claim_ttl_s 31557600 person-picked, calibration UNMEASURED
2026-09-25	CN6	measure	VERIFIER PARTIAL 56/56 -- lib nx_connect_msgstore.nx 21094 B sha 5694c3c3 exists and declares msg_store_append once (nx_txtscan count=1); gate re-run by /api/gate_run exit 0 GREEN 56/56 and fresh sov_build_run --qualify 56/56 run-exit 0; nx_connect_accounts_gate 7/7 GREEN with T7 RESTART PASS; served gate twins identical aa3abf18; Matrix v11 mirror pin 77be4fcf matches and holds the quoted sentence; all 9 claimed CN6 log rows present. nx_gate_bite 2 sites: valid 2 killed 1 SURVIVED 1 -- the survivor is the != in msd_slen (off 5947), which makes msd_path keep the .cst extension so dir/<id>.msg ALIASES the world snapshot dir/<id>.cst and no tooth notices; the claimed never-the-same-file invariant is unguarded (owed: a tooth asserting msg_store_path ends in .msg and differs from acc_path). Other gaps: the store trusts a caller-supplied chan verdict (1 = ALLOW) and does not bind it to sender or recipient bands, so the two-deep wall holds only if the integrator computes it; yw_may_channel reads any band other than 0 or 1 as peer and ALLOWS it (fail-open on an unknown age band); edit and delete take no actor, so authorship is unchecked in the lib; sender id and lang are stored in the clear (metadata, not content-blind); deleted ciphertext stays in the arena; the tmp name is fixed and the directory is not fsynced after rename, so concurrent saves of one account race and a rename can be lost on power loss (single-writer UNVERIFIED for nx_connect_appd). Done-rule part 2 NOT met: nothing on the served /connect path, gauge row still STUB; the CN5 dependency is still UNMAPPED.
2026-09-25	CN18	land	BUILDER seat SHIPPED nx_connect_personhood_gate through nx_organ_ship: fresh build sha256 0c525ac0 (the target is its own gate), PROVE 51/51 GREEN on that fresh artifact, first promote live_sha equals staged_sha 0c525ac0, _offc twin installed from the promoted root binary, REGISTERED callable (tools/list discovery waits for nx_toolreg_reconcile), harness manifest token h84dccf2c984060d8; admitted to knowledge/gateroster.conf in its own grammar (84578 B); the lib nx_connect_personhood.nx and the sa_age_attest addition to nx_site_auth.nx are LIBS with no binary of their own, so CN18 and the AZ10 and SR9 watch rows read LANDED from source while the INTEGRATOR wires the vouch and revoke doors into nx_connect_serve and nx_connect_appd
2026-09-25	CN13	land	FINISH seat: the free-forever wall and the vertical census are on the base class. nx_connect_lds_free (5382 to 5550 B, banked knowledge/status/nx_connect_lds_free.nx.bank-20260925, T5 renamed neg-control-paywalled-feature) passed 5/5 GREEN 43396 B sha256 3243481b, values connection_features 7, paywalled 0, translation_price_cents 0, neg_table_flagged 1; lost 4 superseded literals, promoted with allow_capability_loss=yes. nx_connect_lds_census (9130 to 9327 B, banked likewise) now ends in two gv teeth, neg-control-liar-kill and invalid-rows-zero via gv_check_eq (actual 0 expected 0), passed 2/2 GREEN 49413 B sha256 041d689c, distribution ABSENT 0 PRESENT 15 PARITY 0 EXCEEDS 2 of 17; lost 2 runs (19 permil, the two verdict literals) and promoted WITHOUT the capability-loss flag, inside the calibrated guard. Roster re-trial read both GREEN (journal ..._20260925e.jrnl). Tally for the leg: 10 CONNECT organs built, all GREEN, all 10 promoted and rostered; 9 of 10 now inherit nx_gate_verdict (auth gate, youth, idage, reconnect, room_rx, social, lds_room, lds_free, lds_census); the tenth, nx_connect_msg, belongs to the CN6 owner mid-edit
2026-09-25	CN16	land	nx_connect_study_gate SHIPPED through nx_organ_ship (job 1790358817): fresh build b036ca8f, PROVE 63/63 GREEN on that build, first promote with live_sha equal to staged_sha b036ca8f, _offc twin installed from the promoted root binary, REGISTERED callable, DOCSTAGE documented. The served binary through /api/gate_run read exit_code 0 verdict GREEN 63/63 with the capture untruncated (job 1790358886). Admitted to knowledge/gateroster.conf as a hand-added row carrying its evidence and bite. The matrix watch row (runtime/_hdl_build/nx_connect_study.nx, csc_circle_post) now names a declared symbol, so it should flip on the next regen: NOT YET OBSERVED.
2026-09-25	CN16	queue	OWED, named not hidden: (1) scripturestudy SS1 and SS2: sc_verse maps a fresh field scratch on EVERY call and scans the 13714803-byte corpus linearly, so a daemon that posts reflections leaks a small mapping per post and pays a whole-corpus scan per unknown reference; the door owes a caller-supplied field buffer and a title index (the chapter verb shares the scan). (2) posts live only in the caller's study block: the integrator persists each through nx_connect_msgstore msg_store_append with chan from msg_store_chan_yw(csc_wall_after(st, k, inst, CSC_NONE, CSC_NONE)); the reflection bytes are opaque to this lib, so a client may send them E2E-encrypted and the server stays content-blind for the member's words while it resolves only the public verse reference. (3) the wall is O(rows squared) per join, leave or post: a roster index is owed before circles reach hundreds. (4) the two plans are seat-authored SAMPLES; real Come, Follow Me weeks and Bible plans are data rows the board or the community owes, as verse titles only, never copied manual text. (5) knowledge/compare/connect.gates owes a row for nx_connect_study_gate.elf (left to the board seat, not edited here).
2026-09-25	CN14	measure	FINISH seat bite on the youth-room wall: planting room_safe to return 1 for youth with exactly one adult read T2 T3 T4 T7 T8 FAIL, lone_adult_admitted=1, game and chat rosters 3 (the lone adult got into the live relay room), passed 3/8 verdict=RED exit 1; restored, cache hit reproduced dbe94f48 byte-identical to the live binary (nx_filehash cmp identical=1), GREEN 8/8. Bites run this leg: auth gate (tamper no-op, 11/12 RED), youth wall (guardian flag on the core DM, 6/8 RED), idage (verify_attest accepts any MAC, 7/8 RED), youth rooms (lone adult admitted, 3/8 RED); every restore re-verified by cache-hit sha. OPEN bites: reconnect, room_rx, social, lds_free, lds_census
2026-09-25	ALPHA	measure	SECURITY, measured LIVE by the new gate nx_connect_alpha_signup_gate (6/7 RED on the alpha, job 1790358932): a SECOND register POST of an already-registered handle answered with a fresh Set-Cookie nxc_auth_alpha (replay_cookies=1). olg_register does not refuse an existing handle and the connect register path never asked, so re-registering a taken handle supersedes its OPAQUE envelope and mints a session for that identity -- the uid derives from the handle, so the session opens the holder's world (account takeover). The served PRODUCTION binary (sha 3e46d193, untouched this leg) runs the same register path, so production /connect carries the same vector until the release owner ships the fix: NEEDS-INTERVENTION. Fix landed in source the same hour: nx_connect_appd imports nx_connect_signup and asks csu_handle_taken (CN13's realm-scoped existence predicate) before olg_register, fail-closed when the account log is unreadable; the gate's replay neg-control is the regression tooth. Same run, the round trip itself PASSED: register response 12300 B with the recovery phrase, stage cookie nxc_auth_alpha scoped Path=/alpha/connect, 0 production cookies, signed-in circles 6 of 6 rings of knowledge/connect_circles.conf, anonymous circles 0 rows.
2026-09-25	CN16	land	CONTENT-BLIND teeth added and the gate RE-SHIPPED: a reflection carrying a planted apparatus marker plus every nonzero byte value (258 bytes) is accepted and round-trips byte for byte, while the apparatus rule still judges only what is copied from the corpus (0 markers in that post's scripture text); so the lib never reads, filters or rewrites a member's words and a client may send them as E2E ciphertext. Qualify 68/68 GREEN run-exit 0 (job 1790359111); nx_organ_ship (job 1790359151) fresh build 5241cbf9 PROVE 68/68, adoptgate APPROVED content GREEN behave DIFFERS (the new teeth), promoted live_sha equal to staged_sha 5241cbf9, _offc twin installed; /api/gate_run on the served binary exit_code 0 verdict GREEN 68/68 (job 1790359193). Sources: lib sha256 b3a6b527 26067 B, gate sha256 1f7cec5d 24123 B.
2026-09-25	CN18	land	BUILDER seat grew CN18 with DURABILITY and re-shipped: cvh_record_load reads a stored P1 row back by REBUILDING the 152-byte claim and asking sa_age_attest, so a hand-edited row (band digit changed) or a row under a foreign issuer key refuses CVH_REFUSED_ROW and never loads, and a row marked rev=1 (or one the ruler reads EXPIRED or REVOKED) loads revoked so its claim id stays refused (in an append-only log a later rev=1 row revokes the earlier live one); lib now 30079 B sha256 1e269971, gate 16506 B sha256 923e91fd; gate 57/57 GREEN; second BITE: skipping the FORGED refusal in cvh_record_load read 55/57 RED with exactly the two loader neg-controls failing (actual 2 and 3 vs -117), restored; nx_organ_ship v2 fresh build 4bb89e89 PROVE 57/57 GREEN, adoptgate APPROVED content GREEN (superset of the 0c525ac0 first ship), promoted live_sha equals staged_sha 4bb89e89, _offc twin installed, already registered; second importer of the edited nx_site_auth (sha256 3782b953, unchanged through every run) nx_authz_session_gate rebuilt GREEN 6/6 beside nx_site_auth_gate 4/4
2026-09-25	CN18	queue	BUILDER seat, OWED after CN18: (1) the INTEGRATOR wires the vouch, attest, revoke and sign-up-band doors into nx_connect_serve and nx_connect_appd with the exact calls returned in this seat's result; (2) the issuer key: the operator mints a 32-byte Ed25519 seed on the host with nx_attest_ceremony keygen (this seat wrote NO key anywhere) and the daemon loads it through cvh_key_from_seed, publishing cvh_key_pub to every sa_age_attest consumer; (3) the durable P1 log path, appended on attest and on revoke, replayed at startup through cvh_record_load; (4) the digital-credential verifier that replaces CVH_DC_VERIFIER_ABSENT (an ISO/IEC 18013-5 DeviceResponse over org-iso-mdoc, or dc+sd-jwt with key binding over openid4vp-v1-signed), accepting the age_over_NN predicate only; (5) sign-up ordering is UNDECIDED: csu needs an attested band before an account exists while a vouch needs a circles member, so either a provisional no-contact account or a vouch on a pending handle; (6) DECLARED: a personhood vouch IS a circles vouch in (k, inst) and so also counts toward ccl_join there, by composing one vouch model; a dedicated ring row keeps them apart if the board wants; (7) claim_ttl_s calibration UNMEASURED; (8) synthroom SR9 and authz AZ10 seats journal and compose sa_age_attest on their boards
2026-09-25	CN17	land	SHIPPED nx_connect_service_gate: /api/build src_path named the gate, promoted sha256 a6f6d1d9 (130848 B) with expect_sha256 (an earlier promote ebf74446 was superseded after a comment-only lib correction), registered callable, _offc twin installed from the promoted root, /api/gate_run on the live binary exit 0 GREEN 69/69; admitted to knowledge/gateroster.conf by hand and saying so. Lib now 23526 B sha256 21250b22. The connect.matrix watch row runtime/_hdl_build/nx_connect_service.nx _ABSENT_:csh_need_match should read LANDED at the next regen (this seat did not run a regen).
2026-09-25	CN17	measure	Baseline primary source read 2026-09-25: justserve.org home and about mirrored (knowledge/fetched/cmp_connect_justserve_home_202609.html sha256 a52ab79c 22986 B; knowledge/fetched/cmp_connect_justserve_about_202609.html sha256 205aac08 20844 B). Both are client-rendered shells whose only witnessed text is that JustServe.org is provided as a free service by The Church of Jesus Christ of Latter-day Saints, so the listing mechanics (place, time, helpers wanted, no seat past capacity) are UNVERIFIED from a primary source this month; the lib header says so. mealtrain.com/faq, the Wikipedia JustServe article and a newsroom JustServe path all answered 404.
2026-09-25	CN17	lesson	The build flavour follows the incumbent: the first --qualify had no incumbent and built release (112671 B), after the first promote every build read the incumbent flavour and carried debug-line rows (130848 B), so a comment-only lib edit that moved two lines changed the binary. Comment-only is not byte-neutral under a debug flavour; re-run the gate and promote the new bytes rather than assume the served binary still matches its source.
2026-09-25	CN17	queue	OWED: (1) the INTEGRATOR wires the service routes into the live app with the calls in the CN17 result; (2) durability: the board is an in-memory caller block, so posts, offers, confirms and withdraws must be persisted through an append-only log (the CN6 msgstore lane) before any cohort sees the board; (3) the cell 20000 microdegrees in knowledge/connect_service.conf is a person-picked THRESHOLD, calibrate from households per cell against a declared k-anonymity floor; (4) a server-rendered primary source or the JustServe project API for the listing mechanics; (5) csh_near does not wrap longitude at 180 degrees.
2026-09-25	CN5	land	FINISH seat: the serve core the auth gate composes changed under this leg (buildroot/runtime/_hdl_build/nx_connect_serve.nx mtime 1790358029, the Circles page landing for CN14), so the promoted auth gate (c722d0a9) was testing the old closure. Re-qualified against the current closure: cache miss, 449378 B sha256 edf35213, passed 12/12 GREEN, so real OPAQUE register, login and whoami still round-trip and the nav invariant (exactly one aria-current tab) holds with the new Circles tab. nx_contentdiff (deadline 120000 ms; the default 12000 ms timed out on the 443 KB pair and printed a partial, read as UNKNOWN, not as a verdict) read lost_from_live=0, ONE-WAY-GAIN 20 runs, incl. the circle copy: mission family by consent plus vouching from members who served in the same mission and area with overlapping months, ward through a vouched stake mapping, one worldwide circle, members of The Church of Jesus Christ of Latter-day Saints, open to Christians of any tradition. Re-promoted without any loss flag; /api/gate_run GREEN exit 0 FAST. A _build fossil of 505576 B built by another seat at 1790357344 (default flavour, likely debug from the incumbent) sat beside the 443084 B live binary until this rebuild
2026-09-25	CB0	queue	FINISH seat hand-off, what is still open and the recipe for each: (1) nx_connect_msg is now a library (cmsg_selftest, owner CN6); its promoted and rostered binary 984514f7 was built from the pre-edit program; the owner re-points knowledge/gateroster.conf at a gate calling cmsg_selftest or retires nx_connect_msg.elf with nx_retire_path. (2) Bites not yet run: nx_connect_lds_reconnect (its strength rule lives in the lib, so plant through nx_gate_bite with subject), nx_connect_room_rx, nx_connect_social, nx_connect_lds_free, nx_connect_lds_census. (3) nx_connect_auth_gate still writes fixed /tmp/nxcauth_keys.bin and /tmp/nxcauth_store.log; move them under /tmp/nx_connect_auth_gate/ created at setup (sys_mkdir) and clear the store there; B1 re-registers the same handle and passed on repeat runs, so today it is idempotent by olg behaviour, not by construction. (4) The roster beat stamp knowledge/status/gateroster.stamp read ts=1790178517 at 1790356448, about 49 h stale: the 10 admitted rows are an execution surface the catalog counts, but no beat has run them yet; whoever owns the roster beat should read its clock row. (5) Six FINISH rows (CN3, CN5, CN6, CN13, CN14, CN15) read LIB-UNCENSUSED: nx_eco_graph_build then nx_importcensus, then a shipping importer (the connect daemon), else LIB-GATE-ONLY. (6) The ten organs are PROMOTED but not registered on the MCP surface; the ranker counts them through the roster (RUN-BY), registration is optional and adds rows to the already-windowed tools/list. Recipe for any further hand migration, proven ten times this leg: bank the source, import nx_gate_verdict.nx, delegate the local check to gv_check, gv_ctr, gv_kv values, return gv_verdict, rename one tooth neg-control-..., --qualify --release, nx_contentdiff with deadline_ms, promote with expect_sha256 (allow_capability_loss only after the lost runs are named)
2026-09-25	CN13	land	BUILDER CN13-DEVICE: RFC 9807 Appendix C.1.5 (P256-SHA256, read from the mirror knowledge/fetched/cmp_connect_rfc9807_202609.txt) now drives the DEVICE entry points byte-exact -- added the deterministic cores ocl_register_blind_det and ocl_login_blind_det (the incumbent *_det convention of hub/nx_opaque_pake; production keeps the CSPRNG entry points) and three teeth: registration_request 029e949a29cfa0bf 0 bytes differing, KE1 037342f0bcb3ecea 0 bytes differing, fixture-reached (25-byte password decoded, both det cores rc 0). Gate 42/42 GREEN (artifact 348392 B sha256 00cb4d5d6c302532). BITE 2: planted a one-byte offset in ocl_login_blind_det's KE1 copy-out, RED 41/42 naming only the KE1 tooth (actual=1 expected=0), restored, GREEN 42/42 on the identical cached artifact 00cb4d5d. Re-SHIPPED through nx_organ_ship: PROVE 42/42, ADOPT-GATE APPROVED content GREEN, promoted live_sha 00cb4d5d6c302532a8111cd9d987af5da037d41b8c9a9054824be6ecef261462, _offc twin, registered. Incumbent RFC KAT of the pake cores: buildroot/runtime/_hdl_build/nx_opaque_rfc_kat.nx. Final sources: nx_opaque_client.nx 11926 B sha256 b3a0a90fd2f184c8, nx_opaque_wire_server.nx 9807 B sha256 c6cdce91b238d126, nx_opaque_client_gate.nx 23109 B sha256 d43fef12893514a2; shared hub/nx_modern_auth_flow.nx 0e74e6c33e3a69f7 unchanged across every run.
2026-09-25	CN13	queue	BUILDER CN13-DEVICE, what is OPEN: (1) WASM -- nx_compile_wat on nx_opaque_client.nx refuses at IR opcode 38 = OP_POPCNT64 (buildroot/runtime/nx_types.nx line 301, reached through nx_bits_popcount64 -> __popcnt64); buildroot/runtime/nx_wasm.nx carries no popcnt arm (0 occurrences), so the remedy is one arm lowering OP_POPCNT64 to the core wasm i64.popcnt instruction, owned by the wasm/lang lane with nx_wat_refuse_gate; blockers after it are UNMEASURED (CSPRNG import in the browser, argon2id memory at the production 64 MiB). (2) INTEGRATOR wiring -- a params route from osw_public_cfg, register start/finish routes over osw_register_respond and osw_register_store, login start/finish routes over osw_login_respond and osw_login_finish with the OswPending held per login id under an expiry (per-process, fail closed on restart). (3) a record-taking csu_signup_admit variant (CN13 signup owner) so the door's challenge, work, wall and handle-taken checks run before osw_register_store instead of olg_register. (4) the recovery secret is still generated server side -- the device should generate the BIP39 entropy and register handle plus rec with KSF identity, which needs a KSF-mode argument on osw_public_cfg. (5) an unknown handle answers USER_NOT_FOUND on the wire (RFC 9807 6.3.2.2 fake-record response not built) -- an enumeration oracle. (6) the zero-JS form stays a labeled fallback that still sends the passphrase until the wasm client ships.
2026-09-25	CB0	measure	FINISH seat bite on the content-blind exceed: planting server_decoded_blind to decode every stream read T3 FAIL with server_decoded_blind=9 beside server_decoded_non_e2e=9 while the new neg-control stayed PASS, passed 8/9 verdict=RED exit 1; restored, cache hit reproduced b8a7f859, nx_filehash cmp identical=1 against the live binary, GREEN 9/9. Bites this leg now five: auth gate, youth wall, idage, youth rooms, room_rx. Last build of the seat; no build left in flight
2026-09-25	ALPHA	land	TAKEOVER FIX LIVE ON THE ALPHA: build 3 SOVEREIGN _build/nx_connect_appd.sov.elf 565485 B sha 01c6ce37 (register path asks csu_handle_taken first), copied to alpha_connect/nx_connect_appd-01c6ce37.elf, daemons.reg row repointed and re-signed, old alpha pid 10116 stopped exactly (start ticks 497461259, exe c1f3a20b, stop_confirmed 1), supervisor REVIVED connect_alpha pid 8305. nx_connect_alpha_signup_gate re-run on it: 7/7 GREEN run-exit 0 (job 1790359380) -- the SAME gate read 6/7 RED on build 2, so the replay neg-control has bitten the defective binary and passed the fixed one; values register_bytes 12302, stage cookie nxc_auth_alpha Path=/alpha/connect, production_cookies 0, circles_rows 6 = table_rings 6, anon_rows 0, replay_cookies 0. Each run of this gate creates one alphaprobe<epoch> account in the ALPHA realm only (alpha_connect/), never production. Debt 1790359363 sev 8 filed for the production binary.
2026-09-25	ALPHA	queue	RELEASE STAGE for production /connect: NEEDS-INTERVENTION (evidence measured 1790357422 to 1790359420, age under 40 min at filing). Plane knowledge/store/plan-connect-release- seeded, 6 rows: 1 /api/build target=nx_connect_appd, 2 nx_connect_auth_gate --qualify, 3 nx_connect_mount_gate --qualify, 4 nx_contentdiff live vs staged through /api/organ_run, 5 /api/deploy target=connect with expect_sha256 left as FROM_STEP_1_BUILD_RECEIPT (a placeholder the deploy refuses, so the plan stops there until the owner fills it), 6 nx_page_verify https://nishifamily.com/connect. BLOCKERS the owner resolves first: (a) deploy_targets.conf has NO connect row, so step 5 answers unknown target -- add one through the RACI lane; (b) the served binary is AHEAD of the tree: nx_contentdiff (partial, 12 s deadline) named the JSON key vf lost and nx_txtscan counts 0 vf in nx_connect_serve.nx while nx_connect_pubkey_bind_gate asserts vf 1 and vf 0 -- the pubkey verified-flag feature exists only in the served bytes -- plus two SWAR popcount immediates lost, unexplained; merge onto the base that built 3e46d193 before any promote; (c) CD_SHARE_PREFIX was undeclared in the tree and is now connect/share_, the served binary's plane is unrecorded; (d) debt 1790359363: production carries the register takeover vector until this ships. The alpha needs none of these and stays up.
2026-09-25	CN17	measure	JustServe help centre mirrored 2026-09-25 (knowledge/fetched/cmp_connect_justserve_wizard_202609.html sha256 048bf9fc 43751 B, the April 23 2026 Project Wizard update; knowledge/fetched/cmp_connect_justserve_where_202609.html sha256 f4d36e80 43424 B, the Where-step article): witnessed, projects are created through a guided Project Wizard whose Where step holds the project address, and leaders approve a project before it lists. NOT witnessed this month: a volunteer seat count, sign-up closure at capacity, or any address-release rule. The lib header now says exactly that (23515 B sha256 7ea15e7d). The leader-approval step is a candidate rung for the board owner (a community approval that is never congregation administration), not built here.
2026-09-25	CN17	lesson	A comment edit that keeps the line count is byte-neutral under the debug flavour: /api/build of the lib at 23515 B produced sha256 a6f6d1d9, identical to the promoted gate, while the earlier edit that added two lines had changed the binary (the debug-line table moves with line numbers). The stage slot now holds those identical bytes and is deliberately NOT promoted, because live already is them.
2026-09-25	CN16	measure	VERIFIER CONFIRMED-WITH-GAPS 68/68 GREEN twice (served /api/gate_run job 1790359333 exit 0; fresh --qualify job 1790359512 BUILD-CACHE HIT on the current closure = promoted sha 5241cbf9 on root and _offc, lib b3a6b527 and circles 7ff66d3a and scripture 93c22046 unchanged); csc_circle_post declared; apparatus markers TG and JST re-counted 0 in the corpus; 4 journal rows present. GAPS: (1) the leave wall LOCKS a consenting adult inside a circle with one other adult and a youth (consent withdrawal refused; the post wall already refuses on a failing roster, so leave-then-pause is the safer shape) (2) the last adult may leave a circle leaving minors alone, admitted because only adult-minor pairs are judged (3) content-blind is a lib property only: the verse, day, author and roster reach the server in clear and no client encryption exists for study posts (4) the msgstore integration call is per-account and drops the anchor, day and circle (5) the wall scans every membership row estate-wide twice per post, O(total rows squared) not O(roster squared) (6) join wall and post wall carry differential neg-controls but no planted-defect bite of their own; I did not mutate the shared lib
2026-09-25	ALPHA	queue	INTEGRATOR hand-off at the build cutoff. LIVE: https://nishifamily.com/alpha/connect/ (register, login, account, contacts, CIRCLES), nx_page_verify GREEN on /alpha/connect/ and /alpha/connect/circles (200, 10547 B), production /connect re-verified GREEN after every control-plane change (200, 11744 B, pid 32076 exe 3e46d193 untouched). UNPROMOTED BUILDS, declared on purpose: _build/nx_connect_appd.sov.elf 01c6ce37 (the alpha runs a copy; production is the release owner's, see the NEEDS-INTERVENTION row), and the gates nx_connect_mount_gate (20/20) and nx_connect_alpha_signup_gate (7/7) plus nx_connect_auth_gate (12/12 on the final serve core) are built in _build only -- ship, register and roster them through nx_organ_ship (the signup gate is end-to-end and creates one alpha account per run, so it belongs on a slow beat, never a per-minute one). SUPERSEDED, archive with nx_retire_path when the next alpha lands: alpha_connect/nx_connect_appd.elf (bfb02bdc) and alpha_connect/nx_connect_appd-c1f3a20b.elf, both unreferenced by daemons.reg. NOT WIRED THIS LEG, recipes already on this board: CN5 acc_realm_unify (row 1790357590), CN6 msg_store_append (1790357640), CN3 lq_cohort_seed (1790357660), CN15 cfa_tradition_admit (1790357680), and CN13's full csu_signup_admit protocol (challenge, proof of work, attested band, device key -- needs a client that can compute the proof, which a zero-JS form cannot; only its csu_handle_taken predicate is composed today). Next rung for circles: persistent membership, join and vouch through ccl_join and ccl_vouch with state saved per account.
2026-09-25	CN18	measure	VERIFIER PARTIAL 57/57 -- gate re-run GREEN twice (promoted /api/gate_run job 1790359412 exit 0 and --qualify job 1790359479 cache-hit 4bb89e89 run-exit 0); lib 30079 B sha 1e269971 and nx_site_auth 11908 B sha 3782b953 match the claim; importers nx_site_auth_gate 4/4 re-run GREEN and nx_status_daemon build-only compiles clean (not deployed); journal rows present. REFUTED none. GAPS: the vouch path is social attestation not age verification -- vouches_needed=2 colluding verified adults can mint a youth-band claim for an adult whose declared band is youth (the two-deep wall's core threat, no voucher accountability or rate limit); the credential path (the done-rule's first clause) refuses by name; revocation is a per-process list and the rev=1 durable mark is unsigned (dropping a log row un-revokes); cvh_record_load maps one sys_mmap per row and never unmaps (startup replay leaks a page per row); who and subject are independent request slots, so the integrator must derive both from one session; nothing is served.
2026-09-25	CN13-DEVICE	measure	VERIFIER CONFIRMED-LIB-ONLY 42/42 -- re-ran /api/gate_run on the promoted gate (live sha 00cb4d5d == claim), GREEN 42/42; lib, wire-server and gate sources re-hashed equal to the claim before and after; bite receipts jobs 1790358516 (37/39 RED) and 1790359160 (41/42 RED) read on disk; journal rows 1790358650/358800/359390/359400 present; nx_wasm.nx POPCNT count=0 confirms the wasm blocker. The lib is sound (only blind*H(pw), KE1, KE3 and a record whose masking key is a KEYED function leave the device). GAPS: (1) delivery NOT met -- no served route, no wasm module, /connect/register still posts the passphrase; (2) osw_register_store supersedes any existing handle's record with no ownership proof and no binding to a prior osw_register_respond, and the gate asserts that overwrite as a pass -- wired without a handle-taken or re-auth check it is an account takeover; (3) the passphrase length policy (1..NX_MAUTH_MAX_PASSPHRASE_LEN) that nx_modern_auth_register enforces is absent from ocl_register_blind and the server can no longer enforce it; (4) the neg-control view is assembled by hand in the gate, not captured from the real server-side path; (5) client_secret wipe after login is not a tooth; (6) USER_NOT_FOUND enumeration oracle open.
2026-09-25	CN17	measure	VERIFIER CONFIRMED 69/69 live /api/gate_run job 1790359697 exit 0 GREEN on promoted a6f6d1d9 (lib 7ea15e7d 23515 B and gate 3575d2d7 match the claims; csh_need_match declared once; bite RED 68/69 read in job 1790358661; 7 journal rows present; ev_rsvp appends so a re-offer resets both confirmations). Gaps not refuted but named: the exact place is server-held plaintext (not content-blind), helper hloc and age band are caller-attested, csh_released alone does not re-check visibility (only csh_render does), only one mutant, board not live until the integrator wires it
2026-09-25	TREAT	land	AGENTS seat: six CONNECT activities now have named owners as data, roles reused (no new role). RACI rows appended to knowledge/registry/nishi_raci.tsv (8874 to 10197 B, 33 rows, one A per activity): connect-signup-privacy A=hr R=engineer C=security,legal I=pm; connect-circles-stewardship A=warden R=data_curator C=ux,legal I=pm; connect-youth-safety A=auditor R=security C=referee,legal,supervisor I=operator; connect-legal-lines A=legal R=researcher C=librarian,warden I=pm; connect-abuse-reports A=security R=legal C=engineer I=warden,operator; connect-release A=publisher R=engineer C=supervisor,referee,security I=operator,pm. workstreams.conf (617 to 1526 B) binds connect-signup-privacy to nx_connect_signup_gate, connect-circles-stewardship to nx_connect_circles_gate, connect-release to nx_plan_run connect-release tool_allowlist.conf (the INTEGRATOR plane plan-connect-release-), and carries three named PLACEHOLDER comments for youth-safety (YS2 YS3 YS4), legal-lines (YS1) and abuse-reports (YS5), whose gates the catalog read ABSENT at 1790359722. crew_capabilities.data (3664 to 4131 B): signup and circles organ, youth-safety legal-lines abuse-reports concept, connect-release mcp over nx_plan_run (present in mcp_tools_live.txt; no nx_connect tool is in that file, so no other mcp row).
2026-09-25	TREAT	land	WORKFLOWS seat: journey workflow plan-connect-onboard- seeded (8 rows, knowledge/store/plan-connect-onboard- with its manifest) and RUN by nx_plan_run connect-onboard (job 1790360135): status=COMPLETED planned=8 executed=8, PLAN connect-onboard steps=8 ok in 10.9 s. Steps in journey order, every one program_exit 0 state=SUCCESS: 1 nx_connect_signup_gate (adult sign-up, every consent purpose OFF, discovery OFF until the member acts, a minor with an attested band admitted onto peer and guardian lanes), 2 nx_connect_personhood_gate (two in-person vouches to one signed band claim), 3 nx_connect_realm_gate (realm link), 4 nx_connect_circles_gate (found and join by two vouches, two-deep wall), 5 nx_connect youth 0 0 0 0 0 (front door pure decision, youth peers private DM, allowed 1), 6 nx_connect youth 1 0 0 0 0 (adult to minor private DM, allowed 0 REFUSED), 7 nx_connect_msgstore_gate (durable append and replay), 8 nx_connect_liquidity_gate (cohort invite redeem, single use). Receipt knowledge/store/planrun-connect-onboard-1790360133570020-14552.receipt. HONEST LIMIT: each gate proves its verbs over its OWN synthetic family, so this is a chain of proofs plus two front-door decisions, not one family flowing through every verb; the youth-peer MUTUAL ACCEPTANCE step waits for YS2 ysf_peer_may_connect (not on tool_allowlist.conf yet); the front-door steps exit 0 whatever the verdict, so the refusal is evidence in the snippet and the assertion lives in the gates.
2026-09-25	TREAT	measure	AGENTS seat proof. Bound organs GREEN on the served binaries through /api/gate_run: nx_connect_signup_gate 66/66 exit 0 (job 1790360199), nx_connect_circles_gate 73/73 exit 0 (job 1790360201), both source_newer=0. The authority's own validator in legacy/import mode (nx_raci on knowledge/registry/nishi_raci.tsv through /api/organ_run, job 1790360219) reads all six new activities [OK] with exactly one A and at least one R each; its exit 1 is the PRE-EXISTING design-architecture duplicate in the legacy TSV (A-count=2), which the store already normalized. BUT the rows are NOT in the production RACI authority: nx_raci_sov_gate is VERSION 2, READ-ONLY (promoted binary carries RACI-SOV-GATE-V2, count 3), passed 2/2 GREEN before and after the append (jobs 1790359924 and 1790360299) with the SAME manifest f0a0d7ac, generation 1790134439, rows 249, 60 activities, and 0 occurrences of connect- in its report; it prints legacy_import=NOT_EXECUTED. nx_orchestrate_raci connect-circles-stewardship run answered deny reason=no-accountable-role (not in the RACI SSOT), so no dispatch and no build started. Control: design-architecture (a TSV row migrated before v2) resolves A=ux in the same engine.
2026-09-25	TREAT	lesson	THE TASK PREMISE WAS STALE: the brief said nx_raci_sov_gate migrates the TSV into knowledge/store/raci on each run; the v2 source says it never imports the legacy TSV into the production authority, and nothing else writes raci:row keys except the admin-only duplicate normalizer (nx_raci_reconcile, BUILT-UNPROMOTED). The store has taken no write since generation 1790134439. Corollary measured the same hour: the treecanon-push RACI a sibling lane put into a raci- plane on 09-23 is ALSO not in the SSOT (nx_orchestrate_raci treecanon-push denies), so every RACI row added since v2 is declared data the router cannot see. DO NOT use nx_store_put on knowledge/store/raci: it writes q:-keyed seven-column rows, the RACI plane is keyed raci:row:K with contiguous ordinals, and a mismatched write is invisible at best and a whole-plane rewrite at worst. DO NOT re-run the v1 raci_migrate: the TSV still carries the raw design-architecture duplicate that the store normalized into superseded comments, so a TSV re-seed would revert the normalization and put duplicate cells back into production.
2026-09-25	TREAT	queue	NEEDS-INTERVENTION for the RACI authority, owner warden (govern A), builder engineer: extend the incumbent normalizer nx_raci_reconcile_lib with a reviewed APPEND verb (append-dry-run <rows> prints manifest, projection and candidate sha256 where candidate = projection + new rows at ordinals extent..extent+n-1, refusing any row whose activity already exists or any candidate raci_validate_bytes rejects; append-reconcile binds the three reviewed hashes and commits with ss_commit_cas at the observed generation), gate it in a /tmp fixture clone like nx_raci_sov_gate --fixture (neg-controls: existing activity refused, two A refused, stale manifest refused; planted defect RED then GREEN), then the warden applies the 33 CONNECT rows now in the TSV (and the treecanon-push rows from the raci- plane). Until then the six activities are declared, validated and bound but NOT routable: nx_orchestrate_raci denies them. Runnable today once in the store: connect-signup-privacy (nx_connect_signup_gate 66/66), connect-circles-stewardship (nx_connect_circles_gate 73/73), connect-release (nx_plan_run connect-release, the INTEGRATOR plane, which stops at its deploy placeholder by design and belongs to the publisher). Waiting on an organ: connect-youth-safety (YS2 YS3 YS4 gates), connect-legal-lines (YS1 jur_rules_for plus a monthly barfresh-style ritual over knowledge/connect_jurisdictions.conf), connect-abuse-reports (YS5 mfr_report_verify into the fail-closed CSAE sink).
2026-09-25	CN13	measure	SYNC leg close 2026-09-25: status notes landed under CAS on the CN3 CN5 CN6 CN13 CN14 CN15 rung rows (verifier verdicts CN14 CN15 CONFIRMED, CN3 CN5 CN6 CN13 PARTIAL; no rung marked landed: every gate GREEN on the verifier re-run and bite-killed, none integrated into the production daemon, operator acceptance outstanding). connect.refs +5 pinned rows (rfc9576 nist80063c4 matrix-rooms-v11 arxiv-vouching gdpr-art7), each cited inline; a pew-rls-importance row was added then withdrawn because its fetch redirected (ratchet rose), and arxiv-vouching was re-pointed to the export query url the fetch journal holds. Instruments: nx_ladder connect LADDERED 22 of 22; nx_barfresh FRESH; nx_compare_rank connect done=12 open=10 finish=9 TARGET 1.0 (M3) critical path CN2 CN1 CN7 (CN16 CN17 CN18 count done by symbol presence only, unverified by any verifier this leg); nx_compare_refs_gate full capture 23656 B passed 38 of 44 RED fleet-wide with 0 connect lines; regen connect GREEN twice (index 490751 B), faithsocial GREEN (212405 B); page_verify GREEN on both. Intake sweep SWEPT routed=60 nomatch=0 (the 14 goal requests 1790355000..013 were already filed by PM). Open: production takeover debt 1790359363 sev 8, LIB-UNCENSUSED on 9 FINISH rows until nx_eco_graph_build then nx_importcensus, visual review UNMEASURED on both alphas
2026-09-25	CN14	queue	INTAKE 1790358601 routed by nx_intake_route (operator-seat, epoch 1790360391) from ys-pm-seat: Y1 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): youth connect around the world and have fun, one to one a -- sponsor intake-1790358601 plus2
2026-09-25	TREAT	measure	SOTA RESEARCH seat (wave 4): read this month and mirrored under knowledge/fetched/cmp_ecosystem_* (pinned with nx_filehash): MCP 2026-07-28 (stateless, server/discover, subscriptions/listen, resultType, CacheableResult, tasks as an extension), A2A v1.0.1 (2026-05-28, eight-seat TSC, agent-card.json), OpenAPI 3.2.1 (2026-09-10), W3C WebMCP CG draft (2026-09-25). Measured the connect front door against them: nx_connect is registered with measured annotations (readOnly true, closed world) but an untyped argv inputSchema, a placeholder outputSchema with no structuredContent behind it, no argv contract (verb=help), no OpenAPI description, no agent card and no WebMCP form, served on protocolVersion 2024-11-05. Gaps and proposed rungs landed as eight log rows on ecosystem.plan (EC49, EC50, EC52, EC61) for the ecosystem board owner; refs rows returned to the coordinator, not appended.
2026-09-25	CN14	queue	INTAKE 1790358602 routed by nx_intake_route (operator-seat, epoch 1790360406) from ys-pm-seat: Y2 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): no private channel between an adult and a minor -- the tw -- sponsor intake-1790358602 plus2
2026-09-25	TREAT	land	FRONT DOOR seat: ca_dispatch EXTENDED in place (no second dispatcher) -- lib buildroot/runtime/_hdl_build/nx_connect_api_lib.nx 20182 to 34679 B imports nx_connect_faith; ONE row table ca_row read by BOTH the new catalog verb and the dispatcher; wired verbs faith_admit (cfa_tradition_admit) and faith_other (cfa_other_tradition) are pure decisions over caller-supplied declarations with verb_v and every input echoed and stored 0; 11 landed engines (signup realm circles x4 msgstore liquidity personhood study service) answer a named not_yet_wired refusal and YS1-YS5 (nx_catalog ABSENT) a named not_yet_landed refusal, never a stub success; help stays byte-for-byte v1. Qualify build of nx_connect_api 103152 B sha 41935990 ran faith_other catholic vs eastern-orthodox greek-orthodox = other_tradition 1 table_rung 2. Gate nx_connect_api_gate migrated onto nx_gate_verdict (ag_check delegates to gv_check) plus T12-T17 incl. privacy and neg-control teeth, building now
2026-09-25	YS5	land	BUILDER YS5 (youthsafety.plan not yet created, so journaled here): nx_connect_franking.nx (buildroot/runtime/_hdl_build, 10925 B sha256 e16a94cc) exports mfr_report_verify -- message franking after Grubbs, Lu, Ristenpart ePrint 2017/664, the formalisation of Facebook Messenger franking (abstract mirrored and read today, knowledge/fetched/rf_f8128fad.raw sha256 8bddb58f; it states AEAD is in general NOT committing, so the commitment is a separate HMAC). Sender mfr_frank seals NF plus M with cseal_seal and commits TF = HMAC-SHA-256(NF, M) through nx_hmac; relay mfr_relay reads only the TF tail, stamps RF = HMAC-SHA-256(KF, TF plus sender, recipient, time, client msg id) and appends envelope plus stamp through msg_store_append (ALLOW verdict only); recipient mfr_receive refuses any message whose opening does not open TF, so every displayed message is reportable; mfr_report_verify returns the TRUE sender or a named refusal; mfr_report_route sends child sexual exploitation, a sexual report with a minor or unknown minority, and any unknown category to the CSAE path. Gate nx_connect_franking_gate GREEN 40/40 (qualify job 1790360289): authentic report names the true sender; edited plaintext, three replay shapes, re-attribution, a server tag forged without KF and a non-recipient reporter all refuse; tampered commitment or ciphertext refused at receipt releasing nothing; census over the server's saved file (704 B) finds both commitments and no plaintext, opening, key, SHA-256 or keyless HMAC of the plaintext, and a planted plaintext store IS caught. Bite: opening check planted out of mfr_report_verify went RED 37/40 exit 1 (job 1790360337, exactly the three opening teeth; the edited plaintext was ACCEPTED and attributed to the sender), restored byte-identical (sha e16a94cc) GREEN 40/40 on a build-cache hit of the green key (job 1790360417). LESSON: the first run read 36/37 because the FNV fixture generator kept each product's LOW byte, which depends only on the seed's low byte, so two labels sharing it yield the same stream; the generator now keeps the top byte and a fixture-distinct tooth guards it.
2026-09-25	CN14	queue	INTAKE 1790358608 routed by nx_intake_route (operator-seat, epoch 1790360495) from ys-pm-seat: Y8 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): responsibility sits with the person and their parents or -- sponsor intake-1790358608 plus2
2026-09-25	CN18	queue	INTAKE 1790358609 routed by nx_intake_route (operator-seat, epoch 1790360509) from ys-pm-seat: Y9 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): prevent stalking without tracking. Discovery happens only -- sponsor intake-1790358609 plus2
2026-09-25	CN7	queue	INTAKE 1790358610 routed by nx_intake_route (operator-seat, epoch 1790360523) from ys-pm-seat: Y10 of parent REQ 1790358600 (operator youth-safety directive 2026-09-25 12:50 CDT, filed under leg REQ 1790355000; derived by the YS-PM seat): report abuse without surveillance. A recipient can repor -- sponsor intake-1790358610 plus1
2026-09-25	TREAT	measure	SOTA RESEARCH seat addendum: two further ecosystem.plan rows under EC50 (measure and queue) from the MCP 2026-07-28 authorization page (mirror cmp_ecosystem_mcp_authz_20260728.mdx sha256 99e7eeae): access tokens MUST NOT ride the URI query string, while the estate's documented session baseline presenter is ?cap= on the MCP URL (Bearer already honoured). The seat's total is ten ecosystem.plan rows (five measure, five queue); nx_compare_rank ecosystem ran exit 0 after the first eight and ranked the board.
2026-09-25	YS5	land	SHIPPED nx_connect_franking_gate through nx_organ_ship (job 1790360471): BUILT and PROMOTED sha c798dffe03d1918b (first promote, live was absent), prove GREEN 40/40 on the fresh stage-1 artifact, _offc twin installed from the promoted root binary, REGISTERED callable (schema 0, discovery waits for nx_toolreg_reconcile), harness token h3d901ef69c1cd365. Live re-run through /api/gate_run (job 1790360552) exit_code=0 GREEN 40/40 on the promoted binary. Admitted to knowledge/gateroster.conf in its own grammar (85465 to 86257 B, hand-added and saying so). The lib is not a program and ships inside its consumers; nothing is served yet (integrator lane).
2026-09-25	TREAT	land	WORKFLOWS seat, youth-safety RITUAL: gate set as DATA in knowledge/youthsafety_audit.conf (18 connect and youth gates incl. the roster-only youth wall, age band, youth room, reconnect, content-blind relay and auth organs, plus YS5 nx_connect_franking_gate appended after its land row 1790360480 = 19), plan plane knowledge/store/plan-youthsafety-audit- row 1 = nx_gate_roster_run beat knowledge/youthsafety_audit.conf knowledge/status/youthsafety_audit.jrnl 180000 (the incumbent run-every-gate-in-a-conf organ: never stops at the first RED, journals each gate, ends in ONE verdict line and a stamp beside its own journal, never the production gateroster.stamp). First run nx_plan_run youthsafety-audit (job 1790360231, 23.2 s): roster done rows=18 ran=18 deferred=0 green_or_skip=18 red_absent_timeout=0 verdict=GREEN, stamp ts=1790360252 rows=18 green_or_skip=18. RITUAL: clock row youthsafetyaudit 86400 nx_plan_run.elf youthsafety-audit put through /api/organ_run nx_clockjob (CLOCKJOB-PUT ok); nx_clockjob get reads DECLARED=YES LIVE=NO, legitimately pending the scheduler window-init fold (about 30 min), so the first scheduled run is NOT yet observed. CADENCE derived from the roster family, not typed: the gate roster's daily beats gaterosterheavy, gateroster-slow and gateroster-admit declare 86400 (daily), same form as the plan rituals workmix, refcheck and estatesearch at 86400; the main gateroster row now runs LIVE at 43200, so these gates also run twice daily in the full roster and the audit adds the one youth-safety verdict per day.
2026-09-25	YS5	queue	OPEN after YS5 (builder return): (1) NOT SERVED -- integrator recipe: device mfr_frank(conv_key, seq, nf from the device CSPRNG, m, mlen, env); relay mfr_relay(recipient_store, KF, cid, sender, recipient, now, env, envlen, chan from msg_store_chan_yw or the circle verdict); device mfr_receive(conv_key, seq, rec, reclen, pt, nf) and display only on a positive length; POST /connect/api/report carrying plaintext, nf and the stored tf, rf, ctx (mfr_rec_tf, mfr_rec_rf, mfr_rec_ctx) plus category and minor flag, server mfr_report_verify(KF, m, mlen, nf, tf, rf, ctx, session account) then mfr_report_route; refusals -41 BADARG 400, -42 NOT_RECIPIENT 403, -43 OPENING and -44 SERVER_TAG 422. (2) the CSAE path nx_connect_csae_report.nx is a PROGRAM with a simulated sink and no callable entry, so an MFR_ROUTE_CSAE report has nowhere to land in-process -- a lib extraction of that fail-closed pipeline is owed. (3) UNSOURCED: the mandatory-reporting statutes behind the route rule (US 18 U.S.C. 2258A as amended by the REPORT Act, and every other country) are not mirrored; the rule is structural and strict-direction only, and a report window or retention period is deliberately NOT set (no calibrated row exists; never guessed). (4) KF custody and rotation (a key id in ctx so reports survive rotation), per-recipient stamping for groups, and the device build of mfr_frank on the wasm client (nx_hmac_sha256_wasm is a separate HMAC copy: equivalence to nx_hmac owed). (5) Research owed: Dodis, Grubbs, Ristenpart, Woodage 2018 (invisible salamanders, multi-key AEAD) and the current-month franking literature were NOT read this leg; ChaCha20-Poly1305 is not key-committing, which matters once one ciphertext reaches holders of different keys. (6) the msgstore gate's cmg_fill carries the same FNV low-byte fixture weakness this gate fixed -- named for its owner, not edited.
2026-09-25	TREAT	land	AGENTS seat: the six CONNECT lanes are now in the lane RACI plane knowledge/store/raci- through nx_store_put (rows 104 to 110, replaced=0 each, jobs 1790360528 to 1790360621), in its own grammar id R A C I status note: connect-signup-privacy R=engineer A=hr active; connect-circles-stewardship R=data_curator A=warden active; connect-youth-safety R=security A=auditor waiting; connect-legal-lines R=researcher A=legal waiting; connect-abuse-reports R=legal A=security waiting; connect-release R=engineer A=publisher active. Readers of that plane, measured by nx_shelltool grep over buildroot/runtime (26611 files, corpus_complete=1, 5 matches): nx_pm_board, nx_pm_cockpit, nx_pm_cockpit_investment_t343, nx_pm_roi_lib (the R A C I table on the PM surfaces) and nx_law_warden. So the owners are visible where the PM and warden look today; the CELL router nx_orchestrate_raci reads the OTHER store (knowledge/store/raci, raci:row:K) and still denies them.
2026-09-25	TREAT	lesson	TWO RACI SSOTS, measured: the lane plane knowledge/store/raci- (q:-keyed, nx_store_put, read by the PM board, cockpit and law warden, 110 rows after this leg, livingdocs and treecanon-push call it canonical) and the cell store knowledge/store/raci (raci:row:K, 249 rows frozen at generation 1790134439, read by nx_orchestrate_raci, raci_accountable_for and the owned dispatcher). A lane written to one is invisible to readers of the other, which is why treecanon-push resolves on the PM surface and is denied by the orchestrator. Neither is wrong alone; the defect is two rulers for one question. The remedy belongs to the RACI owner: one store, one writer, a derived projection for the other reader.
2026-09-25	TREAT	land	FRONT DOOR SHIPPED through nx_organ_ship (noregister: the interface row nx_connect already points at nx_connect_api.elf, a second row would be a parallel tool): BUILT and PROMOTED sha256 41935990e03b733c 103152 B (was 61680 B), gate nx_connect_api_gate FRESH-rebuilt GREEN 17/17 (T1-T11 v1 unchanged, T12-T17 new incl. neg-control-T13 and the T15 privacy tooth: a faith_other reply names only the codes it was handed, no other table row, display name or member-data key), contentdiff GREEN lost_from_live=0 ONE-WAY-GAIN 238 runs, behaveprobe live-vs-staged help IDENTICAL 1441 B, offc twin installed. LIVE through /api/organ_run target=nx_connect: faith_admit catholic - 1 2 answers admitted depth 1 table_rung 1 stored 0 with verb_v 1 and every input echoed. tool_schemas.conf nx_connect row re-described (catalog verb, states, no member data read). Sources: lib sha256 b87279fa 34679 B, gate sha256 1d1ad922 20019 B
2026-09-25	TREAT	land	WORKFLOWS seat, TREATMENT declared after reading nx_treatment and nx_treatment_lib (a treat row is judged mcp=allowlist row GREEN, api follows mcp, prim=ep_src_path runtime or _hdl_build, wf=knowledge/store/plan-<id>-manifest.txt, agent=a clock DESIRED row or a gateroster.conf row) and the ranker (exit 8 TREATMENT-PARTIAL only for a DECLARED row left unmet; undeclared rungs are labeled): every field of 9 rows pre-verified (9 allowlist rows GREEN, 9 lib sources stat, both plan manifests present, 9 roster rows) and appended in ONE write as treat rows for CN13 CN14 CN6 CN5 CN3 CN18 (wf=connect-onboard) and CN15 CN16 CN17 (wf=youthsafety-audit), mcp=the rung gate, api=/api/gate_run?target=the gate, prim=the lib, agent=the gate roster row. nx_treatment connect: rows=9 complete=9 partial=0 fields=0 sum=9 rungs=22 undeclared=13 verdict=TREATED (baseline before: rows=0 NO-TREATMENT). nx_compare_rank connect after (job 1790360486, program exit 0): BARFRESH FRESH, LADDERED, TREATMENT rows=9 complete=9 verdict=TREATED, then ranked #1 CN2 #2 CN1 #3 CN7 #4 CN8 as before, the 13 undeclared rungs labeled TREATMENT-UNDECLARED. HONEST SCOPE: mcp= names the GATE, a proof over a synthetic family, not a member verb; the member-facing pure verbs belong in the nx_connect front door, and these rows move their mcp= there when it ships them.
2026-09-25	TREAT	measure	WORKFLOWS seat, nx_rungclose check connect on CN13, CN14 and CN6: all three stage=LIVE links_earn=LIVE verdict=NOT-PRODUCTION; links journal, built (symbol present), live (treat row, mcp present), wired (treat row COMPLETE) and page HOLD; tested FAILS why=no-green-since-land (roster_confs_read=4/4 roster_journals_read=3/3 green_in=none) and operated FAILS why=no-run-since-land (agent_plane checkpoint-current-bindings, margin 172800 s). The live and wired links hold BY the treat rows landed this hour. FINDING: the youth-safety audit journal knowledge/status/youthsafety_audit.jrnl already holds GREEN rows for all three gates since their land (run 1790360231), but nx_rungclose derives the roster journals it reads from clock rows that call nx_gate_roster_run directly, so a roster step wrapped in a plan_run ritual is invisible to the tested link; the main gateroster beat (LIVE 43200 s) will supply the GREEN rows on its next pass.
2026-09-25	TREAT	queue	FRONT DOOR to the INTEGRATOR seat (the daemon edit is that seat's): mount the SAME dispatcher at /connect/api/v1/<verb> in nx_connect_appd -- GET or POST with the verb's positional args as a+ query or form list (a single dash spells an absent string), the reply is ca_dispatch's own versioned JSON envelope byte for byte (v, tool, verb, verb_v, ok, inputs), 400 on usage or unknown_verb, 501 on not_yet_wired and not_yet_landed with the engine and rung from the row, no session needed for the pure-decision verbs (faith_admit faith_other catalog help and the v1 verbs), and the X-Nishi-Session header REQUIRED once an own-account verb (msg_append realm link and unlink signup of the caller) is wired; call ca_dispatch in-process (import nx_connect_api_lib.nx), never fork nx_connect_api.elf per request. OPEN on this door: 11 landed engines answer not_yet_wired (signup realm circles x4 msgstore liquidity personhood study service), YS1-YS5 not_yet_landed; the planted-defect bite of T16 is in flight
2026-09-25	TREAT	queue	AGENTS seat closing state: debt 1790360611 sev 6 scope raci (read back from the store, open) carries the frozen cell store and the two-SSOT split with the remedy. STAGES: connect-signup-privacy and connect-circles-stewardship READY-TO-ROUTE (owner rows in the TSV and the raci- lane plane, organ bound and GREEN 66/66 and 73/73) but WAITING on the RACI owner to apply the cell rows, so nx_orchestrate_raci denies them today; connect-release WAITING likewise, and its plane itself is NEEDS-INTERVENTION with the publisher (INTEGRATOR row 1790359470); connect-youth-safety, connect-legal-lines and connect-abuse-reports WAITING ON ORGAN (YS1 to YS5 gates absent at 1790359722; bind them in workstreams.conf where the PLACEHOLDER comments sit, flip their crew rows from concept to organ, and set their raci- status from waiting to active). No build was started by this seat.
2026-09-25	TREAT	land	SOTA RESEARCH seat final count, superseding the two rows above: twelve ecosystem.plan rows landed (six measure, six queue: EC49 x2, EC50 x4, EC52 x4, EC61 x2), byte ladder 353,944 to 367,151 B with every append receipt summing; nx_compare_rank ecosystem re-run after the last row, exit 0, board ranked, artifact verified. Nine mirrors under knowledge/fetched/cmp_ecosystem_* pinned by nx_filehash; refs rows not appended (ecosystem.refs grounds and inline citation marks belong to the board owner) and returned to the coordinator. No build started, no production surface touched.
2026-09-25	TREAT	retract	SOTA RESEARCH seat correction to the row above: EIGHT mirrors were pinned, not nine (mcp_schemadirs, mcp_changelog_20260728, mcp_schema_20260728, mcp_authz_20260728, a2a_releases, a2a_governance, oas_releases, webmcp); the second authorization candidate URL answered 404 and nx_research_fetch saved nothing for it. Every other figure in that row stands.
2026-09-25	TREAT	measure	WORKFLOWS seat, youth-safety audit SECOND RUN after YS5 joined the conf: plan run 1790360576145410-10289 status=COMPLETED, roster rows=19 ran=19 deferred=0 green_or_skip=19 red_absent_timeout=0 verdict=GREEN, stamp knowledge/status/youthsafety_audit.jrnl.stamp ts=1790360608 rows=19; nx_connect_franking_gate passed 40/40 in 14 ms. Journal knowledge/status/youthsafety_audit.jrnl now carries 37 GREEN gate rows over two passes, each gate proving over its own synthetic fixture (no member data read).
2026-09-25	TREAT	queue	WORKFLOWS seat hand-off, each for its owner: (1) nx_rungclose owner: the tested link reads only roster journals of clock rows that call nx_gate_roster_run directly, so the plan-wrapped youth-safety journal is invisible to it; either read plan steps that run a roster beat, or leave tested to the main gateroster pass (LIVE 43200 s). operated waits the first scheduled youthsafetyaudit run after the clock window-init fold (DECLARED=YES LIVE=NO at 1790360348). (2) AGENTS seat: RACI activity connect-youth-safety already names auditor AR and security R; its workstreams.conf binding is a PLACEHOLDER naming plan id connect-youthsafety; the running plane is plan-youthsafety-audit-, so the one-line binding is connect-youth-safety TAB nx_plan_run TAB youthsafety-audit TAB tool_allowlist.conf when that seat judges its YS2 and YS3 condition met. (3) wave 3: append nx_connect_youthsafe_gate, nx_connect_juris_gate, nx_connect_antistalk_gate and nx_connect_family_gate to knowledge/youthsafety_audit.conf as each land row appears (additive; the daily run picks them up with no plan edit); when YS2 ysf_peer_may_connect is on tool_allowlist.conf, add the mutual-acceptance step to plan-connect-onboard- (put id 9 or renumber by a new id, never edit a landed row). (4) FRONT DOOR seat: once nx_connect carries member-facing pure verbs for sign-up admit, circle reach and vouch, faith admit and msgstore append under the caller's own session, move each treat row's mcp= from the gate to nx_connect and chain the journey through the verbs with ONE synthetic family instead of eight per-gate fixtures. (5) the 13 undeclared rungs stay labeled TREATMENT-UNDECLARED; declare one only when all five fields verify, since a declared unmet row refuses the whole board with exit 8.
2026-09-25	TREAT	measure	SOTA RESEARCH seat, closing count: a thirteenth ecosystem.plan row (EC50 measure, 563 B) records whole-file absence counts in nx_tools_api.nx for the 2026-07-28 core mechanisms (server/discover, subscriptions/listen, resultType, ttlMs all 0); ecosystem.plan now 367,714 B, the seat's rows being seven measure and six queue. Stage of every proposed rung: OPEN, awaiting the ecosystem board owner.
2026-09-25	TREAT	measure	WORKFLOWS seat, youth-safety audit THIRD RUN after wave 3 joined the conf (nx_connect_family_gate YS4, nx_connect_antistalk_gate YS3, nx_connect_juris_gate YS1, each added only after its land row on youthsafety.plan and its GREEN registration): plan run 1790360791207737-20483 status=COMPLETED in 30.6 s, roster done rows=22 ran=22 deferred=0 green_or_skip=22 red_absent_timeout=0 verdict=GREEN, stamp ts=1790360821 rows=22. Still owed to the conf: nx_connect_youthsafe_gate (YS2 lib landed 1790360747, gate not yet on tool_allowlist.conf at 1790360830). Note for readers: a stamp read issued beside the job claim returned the previous run (ts=1790360608 rows=19) and the next read returned rows=22 -- the read path lags the write path, read the stamp after the claim, never beside it.
2026-09-25	TREAT	land	FRONT DOOR usable estate wide: BITE planted a stub success into ca_v_pending (ok 1 on a pending row) and the gate went RED 16/17 on T16 exactly, restored byte-identical (lib sha256 b87279fa) and GREEN 17/17. Wave 3 landed during the leg, so YS1-YS5 rows were flipped from not_yet_landed to not_yet_wired and re-shipped twice through nx_organ_ship: FINAL nx_connect_api PROMOTED sha256 c91eafc2828ced1e (lib sha256 9818dcc9 34674 B), contentdiff IDENTICAL-CONTENT, behaveprobe help IDENTICAL. Gate PROMOTED nx_connect_api_gate.elf sha256 c0ac9a76 160288 B and /api/gate_run GREEN 17/17 exit 0 on the NAS. MCP: nx_connect (tool_schemas.conf row re-described, reconcile check lists it discoverable, not no-schema). API today: /api/organ_run target=nx_connect answered faith_admit and juris_rules (named not_yet_wired YS1). WORKFLOW: plan plane plan-connect-frontdoor- (catalog, faith_admit, faith_other) nx_plan_run COMPLETED 3 of 3 rc 0. RITUAL: gateroster.conf row nx_connect_api_gate. AGENT: workstreams.conf connect-frontdoor to nx_plan_run and nishi_raci.tsv rows engineer R, architect A, security and referee C, operator and pm I
2026-09-25	TREAT	queue	FRONT DOOR OPEN at the 14:00 stop, each with its recipe: (1) 16 landed engines answer a named not_yet_wired refusal and are the next verbs, pure decisions first -- circle_channel and circle_guardian_sees over a synthetic in-memory ring (ccl_init plus knowledge/connect_circles.conf), youth_peer (ysf_peer_may_connect), antistalk_discover (ast_may_discover), family_consent (fam_guardian_consent), juris_rules (jur_rules_for over knowledge/connect_juris), franking_verify (mfr_report_verify over a caller-supplied report), person_attest verify-only, study_post and service_match decisions; add each as a WIRED ca_row row plus handler plus one positive and one neg-control tooth, the T16 loop covers its state for free. (2) own-account verbs (msg_append, realm link and unlink, signup of the caller) need the member session, so they belong on the INTEGRATOR route /connect/api/v1/<verb> with X-Nishi-Session, never on the session-less MCP verb. (3) the RACI rows sit in knowledge/registry/nishi_raci.tsv only: nx_raci_sov_gate ran READ_ONLY legacy_import NOT_EXECUTED, 245 cells 60 activities, so the raci store has no connect-frontdoor cell yet (owner of the RACI import decides). (4) no treat row declared: nx_treatment source and the ranker's hard-fail handling were not read this leg, so a partial declaration could make nx_compare_rank refuse the board; the treat row is mcp=nx_connect prim=nx_connect_api_lib.nx wf=connect-frontdoor agent=gateroster nx_connect_api_gate api=owed. (5) crew_capabilities.data row skipped: nx_connect is absent from knowledge/registry/mcp_tools_live.txt (count 0), so an mcp row would violate the crew ledger's rule. (6) clock ritual for plan-connect-frontdoor- not declared (cadence needs a conf row with its reason)
2026-09-25	TREAT	measure	VERIFIER CONFIRMED front door: live nx_connect sha c91eafc2 103152 B; faith_admit catholic - 1 2 admitted depth 1 stored 0; faith_other catholic vs eastern-orthodox 1; juris_rules US named not_yet_wired YS1; catalog rows 18 wired 2 not_yet_wired 16 not_yet_landed 0; v1 help 1441 B and lane 3 0 1 1 0 = Language exchange unchanged; NAS gate_run GREEN 17/17; privacy read of ca_row ca_route4 ca_v_faith_* ca_v_pending ca_v_catalog: only knowledge/connect_faith_traditions.conf is read, no member store or circles or messages or locations touched; nx_toolreg_reconcile check drift 47 names no nx_connect row and tool_schemas.conf carries the re-described row; residue: pre-ship byte identity rests on the seat's ship-1 behaveprobe (prev slot overwritten by three ships), nx_connect_api_gate has no tool_schemas row
2026-09-25	CN14	queue	INTAKE 1790361302 routed by nx_intake_route (pmboard-seat, epoch 1790361362) from pmboard-seat: B2 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): fun games together -- members play games together inside their circles (f -- sponsor intake-1790361302 plus2
2026-09-25	CN14	queue	INTAKE 1790361303 routed by nx_intake_route (pmboard-seat, epoch 1790361365) from pmboard-seat: B3 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): plan activities together across continents -- operator example: a youth I -- sponsor intake-1790361303 plus2
2026-09-25	CB2	queue	INTAKE 1790361304 routed by nx_intake_route (pmboard-seat, epoch 1790361368) from pmboard-seat: B4 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): language learning together -- members find reciprocal language partners ( -- sponsor intake-1790361304 plus2
2026-09-25	CN14	queue	INTAKE 1790361304 routed by nx_intake_route (pmboard-seat, epoch 1790361368) from pmboard-seat: B4 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): language learning together -- members find reciprocal language partners ( -- sponsor intake-1790361304 plus2
2026-09-25	CN17	queue	INTAKE 1790361305 routed by nx_intake_route (pmboard-seat, epoch 1790361371) from pmboard-seat: B5 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): service -- members serve one another and their communities: needs and ser -- sponsor intake-1790361305 plus2
2026-09-25	CN14	queue	INTAKE 1790361307 routed by nx_intake_route (pmboard-seat, epoch 1790361375) from pmboard-seat: B7 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): all the things that build community -- the site experience powers communi -- sponsor intake-1790361307 plus2
2026-09-25	CN17	queue	INTAKE 1790361306 routed by nx_intake_route (pmboard-seat, epoch 1790361404) from pmboard-seat: B6 of parent REQ 1790361300 (operator ask 2026-09-25 13:20 CDT, filed under leg REQ 1790355000; derived by the PM-BOARD seat): community and personal gardening -- seed sharing and produce helping memb -- sponsor intake-1790361306 plus2
2026-09-25	CN17	queue	PM-BOARD wave 5: operator ask REQ 1790361300 (exceed ldssingles.com; games together, cross-continent activities such as a youth Iron Chef, language learning, service, seed and produce sharing, community) filed verbatim under REQ 1790355000 with children 1790361301 to 1790361307 routed plus2 (faithsocial FS1 FS5 FS3, comms C12, connect CN14 CB2 CN17); faithsocial carries five new rows and its watches name cav_plan_event, clc_circle_match and csh_share_match for this wave's builders; LDS Singles pinned as a research bar, its column queued
2026-09-25	LANGCIRCLE	land	MISSION LANGUAGE CIRCLES clc_circle_match LANDED as source on the NAS: lib buildroot/runtime/_hdl_build/nx_connect_langcircle.nx (13064 B) composes mx_recip_score (reciprocity), ccl_circle_reach plus ccl_rec (circles, mission and area from the reconnection record), yw_may_channel through ccl_band and ccl_group_ok (two-deep wall) and ln_min (lane capped at language); CEFR levels and the tutor floor are ROWS of knowledge/connect_langcircle.conf citing the CoE self-assessment grid page mirrored today (knowledge/fetched/cmp_connect_cefrgrid.html sha256 1bf24572). Gate nx_connect_langcircle_gate built sovereign and run with --qualify: 47/47 GREEN first build (artifact sha256 0d611ff7, 95932 B), incl neg-controls (one-sided pair 0 while the arithmetic twin offers 25, naive lane twin opens dating, skipped rank, missing tutor row, misspelt kind) and a 72-pair lane sweep with 0 dating. NOT promoted or registered yet; no rung row carries clc_circle_match on this board yet (owed to the PM-board seat)
2026-09-25	LANGCIRCLE	land	nx_connect_langcircle_gate PROMOTED and REGISTERED: /api/build src_path named the target (src_sha256 f3fe00f8, closure e4d70587), /api/promote with expect_sha256 36b03bff, live nx_connect_langcircle_gate.elf re-hashed 36b03bff 111816 B, /api/tools/register callable=1 schema=0, /api/gate_run on the promoted binary from the serving root verdict=GREEN exit_code=0 47/47 (subjects on root-ladder rung 1). Brief correction recorded: ct_rationed_translate is the translate program's QUOTA neg-control, not the correction path, and nx_connect_translate.nx has a main so it cannot be imported; the correction loop stays OWED until ct_render_inline is extracted to a library
2026-09-25	CN17	land	faithsocial republished by nx_compare_regen_scoped (verdict GREEN, index.html 224014 B prev 212405, api.json 42720 B, generator fork fresh af966543) and nx_page_verify GREEN status 200 a11y-issues 0 (static checks only, browser render unverified); at publish the new faithsocial rows read games together present on room_admit, service present on csh_need_match, language circles symbol present clc_circle_match, seed and produce symbol present csh_share_match, activities OPEN cav_plan_event -- a present symbol is the receipt, not acceptance; nx_ladder faithsocial LADDERED 11 of 11 placed, nx_barfresh FRESH
2026-09-25	LANGCIRCLE	measure	nx_gate_bite over the lib (2 sites per operator, /api/organ_run): valid_mutants=1 killed=1 not_reached=0, restore byte-identical 13064 B, live twin restored and re-hashed 36b03bff, verdict GREEN (the gate bites). Rostered in knowledge/gateroster.conf (hand-added, named) and cited in knowledge/compare/connect.gates. OPEN: extract ct_render_inline plus the correction binding into a translate library so a circle session drives corrections in-process; per-language self-declared levels; the tutor floor B2 is a person-picked THRESHOLD whose calibration against the grid spoken-interaction descriptors is owed (grid PDFs not mirrored); a connect.refs row for the grid mirror needs an inline mark from the PM-board seat first (the refs gate arms uncited refs); a clc verb on the nx_connect front door and a live surface belong to their owners
2026-09-25	CN17	land	BUILDER GARDEN: the SHARE kind landed IN the incumbent service board, no second board. nx_connect_service.nx 23515 to 45937 B appends csh_share_match (seeds, seedlings, cuttings and surplus produce; an offer paired with a request; free forever, no price, payment or boost field) plus csh_share_load, band_of, in_season, post, confirm, released, render and close over a caller-supplied share block that READS the same board policy (cell, reach) and the same circles; every existing csh_* function, const and csh_state_slots untouched (the edit is an append after csh_render). Season windows are DATA: knowledge/connect_share.conf 2659 B, 12 rows season band item first-month last-month reason for north-temperate, south-temperate and tropical x seed, seedling, cutting, produce, each flagged THRESHOLD person-picked NOT calibrated; the climate band is SELF-DECLARED and resolved by key, never inferred; a window may wrap the year end. Admission order: both live, one offer and one request, same item, two posters with who one of them, consent, visibility BOTH ways through each poster's chosen ring, the season window of BOTH bands at the match month, coarse cells within reach, the ONE two-deep wall csh_pair_ok (a minor shares with a peer or linked guardian only), idempotence, portions last; the pickup detail is released only after mutual confirmation. Gate nx_connect_service_gate qualify job 1790361629 GREEN 114/114 = the original 69 teeth unchanged plus 45 share teeth: pickup absent from all 76 pre-confirm outputs (neg-control) and present once for the matched requester, an out-of-season request refuses CSH_OUT_OF_SEASON by name at post and at match, replayed confirms and a replayed match change no share slot, other ward INVISIBLE, minor with unrelated adult WALLED, linked guardian OK, TOO_FAR, FULL, WRONG_SIDE, six table neg-controls. Baseline read today: AmpleHarvest.org mirror knowledge/fetched/rf_87238881.raw sha256 6f45f4a0 (a free, opt-in registry; pantries declare the days and times they receive fresh food; 8,572 pantries in 5,691 communities) and the Seed Savers Exchange page knowledge/fetched/rf_6cc17360.raw sha256 afa00d21 (member listers). Not yet bitten; gate promote launched through nx_organ_ship.
2026-09-25	CN17	land	BUILDER GARDEN SHIPPED nx_connect_service_gate through nx_organ_ship (job 1790361722): BUILT and PROMOTED sha256 6d783160 (live == staged), prove GREEN 114/114 on the fresh stage-1 artifact, adoptgate APPROVED content GREEN, behave DIFFERS as expected for 45 new teeth, offc twin installed from the promoted root binary, ALREADY-REGISTERED, harness token hd26af07108cdaeef. Sources: lib nx_connect_service.nx sha256 f85153b2 45937 B, gate sha256 9cc05d52 39851 B, knowledge/connect_share.conf sha256 9cab0d6c 2659 B. The lib is not a program and ships inside its consumers; nothing member-facing is served yet.
2026-09-25	CN17	queue	BUILDER GARDEN open items, each for its owner: (1) NOT BITTEN -- run nx_gate_bite nx_connect_service_gate nx_connect_service.nx with sites in a quiet window (the lib is shared, so the mutant window must not overlap another seat building a consumer); a good plant is dropping the RCONF test in csh_share_released, expected RED on the pickup neg-control and the unmatched-neighbour tooth. (2) NOT SERVED -- FRONT DOOR seat: add share rows to ca_row (share_post, share_match, share_confirm, share_render) calling the pure csh_share_* functions with the caller's own session as poster, the month from the server clock through the civil date, and the band from the member's own declaration resolved once with csh_share_band_of; the INTEGRATOR mounts them under /connect/api/v1/ with no second dispatcher. (3) CALIBRATE -- every season window in knowledge/connect_share.conf is a person-picked THRESHOLD; calibrate each band from a published sowing and harvest calendar (an extension-service calendar per hardiness zone, mirrored and pinned as a connect.refs row by the board owner) and add hardiness zones and wet or dry seasons as rows, never code. (4) BASELINE THIN -- the Seed Savers Exchange mirror witnesses member listers only; its listing and request mechanics were not read, and a primary seed-library source (a seed lending library policy or the Community Seed Network) is owed this month. (5) a produce-to-pantry kind (the AmpleHarvest mechanism: a pantry declares the days and times it receives fresh food) is not modelled because a pantry is not a member; candidate rung. (6) no withdraw verb frees a matched portion yet (csh_share_close hides a listing and keeps its matches, rule 13); csh_share_withdraw owed. (7) the gate header comment still describes only the need board; the share section comment carries the share contract.
2026-09-25	cav_plan_event	land	ACTIVITIES (faithsocial watch Activities planned together, REQ 1790361303, plan rung owed): lib buildroot/runtime/_hdl_build/nx_connect_activity.nx (29786 B) carries cav_plan_event + gate nx_connect_activity_gate.nx (26705 B) 59/59 GREEN via nx_sov_build_run --qualify run-exit=0 (artifact _build/nx_connect_activity_gate.sov.elf sha 91190f63, NOT promoted, NOT registered, NOT rostered: time budget, owed next) + knowledge/connect_activity.conf (6 threshold rows each with its reason: youth window 08:00-21:00 local, adult 07:00-23:00 local, 60 min round, 15 min grid). Composes ev_rsvp (capacity, idempotent), ccl_circle_reach (teams form inside a circle), ccl_group_ok = yw_may_channel group context (two-deep), NAMES nx_connect_lds_room room_admit in cav_room_spec (no second room). Zones self-declared, no IP, no coordinate, a signature scan proves no param names an ip or location (planted plant caught). Measured: SLC+London+Johannesburg youth teams plan 3 rounds, KAT first round 840 UTC, 0 minutes outside any window by a per-minute second method; SLC+London+Manila youth refuse CAV_NO_OVERLAP by name while the same zones adults-only plan one round; one-leader youth team refuses CAV_TWO_DEEP and starts once the second leader checks in; judging partition 46 = team sum = judge sum, 1 superseded row kept. Primary source for the named baselines (timeanddate Meeting Planner, Meetup RSVP, Iron Chef format, church two-deep) NOT read this session: UNVERIFIED, owed.
2026-09-25	cav_plan_event	measure	baseline source READ this month for the planner mechanism: nx_research_fetch https://www.timeanddate.com/worldclock/meeting.html status=200 91540 B sha256 bf61bae1b3b5f8d0 saved knowledge/fetched/cmp_connect_meetingplanner.html; its own words: Use the World Clock Meeting Planner to find a suitable time to have a telephone conversation, web cast, or meeting with participants in many time zones. cav_plan_event replicates that overlap grid and exceeds it by band-specific waking windows as conf rows, self-declared zones and a named refusal. Meetup RSVP, Iron Chef format and church two-deep sources still UNREAD this session; the .refs row is for the PM-board seat to pin.
2026-09-25	ALPHA	queue	W7 SEAT W3 (versioned HTTP API on the alpha instance) NOT STARTED: the seat began at NAS 1790371914 (laptop clock 1790371963 agrees), 6114 s after its return-by 1790365800 and 6714 s after its stop-builds 1790365200, so no build, no bank, no source edit and no restart of connect_alpha was attempted -- a late restart could collide with whichever seat owns the alpha row now. Read-only state for the next owner, measured 1790372002: buildroot/runtime/_hdl_build/nx_connect_appd.nx 34980 B holds 0 occurrences of api/v1 (route not mounted); GET https://nishifamily.com/alpha/connect/api/v1/catalog answers HTTP 200 with the 12302 B Connect HTML page, so an unknown API path falls through to the page as a soft 200 that an API client reads as success -- the mount must answer the catalog envelope there and 400 unknown_verb for a bad verb; nx_catalog BUILT 565485 B (alpha 01c6ce37) PROMOTED 587144 B (production, bank knowledge/bank/nx_connect_appd.elf-3e46d193-20260925 untouched); connect.plan holds 0 REVIEW rows (whole file 196480 B scanned), so no referee has classified this subject yet. Recipe unchanged from the wave-4 route record: /connect/api/v1/<verb> through ca_dispatch in-process, active only when the stage argv is set, 400 usage and unknown_verb, 501 not_yet_wired and not_yet_landed, production-unchanged proven against the banked binary on a scratch loopback port, never a production port.
2026-09-25	TREAT	queue	W2 FRONT-DOOR VERBS (wave 7 seat) NOT STARTED: this seat began at NAS epoch 1790371950 (a job id, and the laptop clock agreed at 1790371962, 16:32 CDT), which is after both of its bounds (stop starting builds 1790365200, return 1790365800). No source edit, build, ship, schema row or plan run was made. State read at start: nx_connect_api_lib.nx is unchanged since the wave-4 ship (sha256 9818dcc9, 34674 B). In it, juris_rules is not_yet_wired YS1, there is no langcircle or share row, and service_match names csh_need_match. plan-connect-frontdoor- holds rows 1 catalog, 2 faith_admit and 3 faith_other. connect.plan holds 0 REVIEW rows (nothing journaled since 1790361930), so no referee class exists yet for these three verbs. Recipe for the next seat, from signatures read today. juris_rules: jur_conf_load(n), then jur_rules_for(conf, n, declared, dn, today_yyyymmdd, out of JUR_R_SLOTS) returning JUR_OK or JUR_REFUSED_NO_TABLE, then jur_account_decision(out, age_floor), named by jur_acct_name and jur_how_name. Take today and age_floor as caller inputs so the verb stays a pure function. langcircle: clc_circle_match(cs, lv, a, b, pa, pb, ctx YW_CTX_DM or YW_CTX_GROUP, adults_present, want, out of CLC_OW) over a synthetic in-memory ring built with the circles lib, which is under referee review; it returns weight 0..100 or CLC_UNREACHABLE, CLC_WALLED or CLC_BAD_CTX. share: csh_share_match(sh, st, cst, o, rq, who, consent, month) over caller-supplied offer and request rows, with board policy st (cell, reach) and circle state cst. For each verb: flip or add a ca_row row, add a handler in ca_route4, add one positive and one neg-control tooth to nx_connect_api_gate, ship through nx_organ_ship with noregister, and add plan rows 4 to 6.
2026-09-25	CN17	queue	W7 SEAT W4 (bite of the 45 share teeth) NOT STARTED: the seat began at NAS 1790371930 (laptop clock 1790372002 agrees, 16:33 CDT), 6130 s after its return-by 1790365800 and 6730 s after its stop-builds 1790365200, so no nx_gate_bite, build, source edit or re-ship was attempted -- a late mutant build of a shared lib could collide with a seat building one of its consumers. Read-only baseline for the next owner, measured 1790372010: the share teeth are STILL UNBITTEN; lib nx_connect_service.nx sha256 f85153b2 45937 B, gate source sha256 9cc05d52 39851 B and the promoted nx_connect_service_gate.elf sha256 6d783160 167704 B all equal the GARDEN ship row 1790361800, so a bite now measures exactly the shipped bytes. The gate imports nx_connect_service.nx in-process (its third import line), so the harness needs no subject keyword; nx_gate_bite is REGISTERED and AUTHORISED but BUILT 107992 B vs PROMOTED 93631 B, so read the served binary's usage before trusting an argument. Recipe as the langcircle seat ran it (row 1790361640): /api/organ_run target=nx_gate_bite with nx_connect_service_gate, runtime/_hdl_build/nx_connect_service.nx and 2, in a quiet window, then nx_filehash the lib and the live gate twin against the digests above; the builder names the RCONF test in csh_share_released as a good plant, expecting RED on the pickup neg-control and the unmatched-neighbour tooth (row 1790361810).
2026-09-25	cav_plan_event	queue	W7 SEAT W4 (activities gate) WAITING, nothing shipped: connect.plan held 0 REVIEW rows at 199693 B (checked 1790372160), so no wave-6 referee has classified nx_connect_activity as composing, new or duplicating, and the brief ships nothing before that class exists; the seat also began after its stop-builds bound 1790365200. Read-only facts for the referee, NOT a classification: the lib (sha256 b6e826b1 29786 B) imports nx_connect_circles.nx and nx_connect_events_lib.nx (5799 B) and names ev_rsvp 5 times; the gate fossil _build/nx_connect_activity_gate.sov.elf sha256 91190f63 121742 B equals the builder's qualify artifact (row 1790361810); nx_catalog reads the gate BUILT-UNPROMOTED and unregistered, and knowledge/gateroster.conf (91431 B) names it 0 times. Once a referee rules it composes or is genuinely new: nx_gate_bite with 2 sites, nx_organ_ship nx_connect_activity_gate, /api/tools/register, a gateroster.conf row in its own grammar, journal. If a referee rules it a duplicate of an incumbent: ship nothing and report.
2026-09-25	CN13-DEVICE	measure	W7 SEAT W1 (wasm lowering of OP_POPCNT64) NOT STARTED as a build: first NAS call 1790371965 (16:32 CDT), 6765 s after stop-builds 1790365200 and 6165 s after return-by 1790365800, so no source edit, build, gate run or promote was made; connect.plan held 0 REVIEW rows at 202195 B (read 1790372461), so no referee class exists for this subject. READ-ONLY FINDING that corrects the wave-2 recipe (row 1790358800 named ONE emitter arm): the device path is three links -- nx_compile_wat (.nx to .wat, imports nx_wasm.nx), then nx_wat_compiler (.wat to .wasm), then the estate VM -- and ALL THREE lack popcnt. (1) buildroot/runtime/nx_wasm.nx 49886 B (mtime 1789259067, untouched 12.9 days): wat_emit_instr, read whole, has no arm for OP_POPCNT64 (const 38 at nx_types.nx line 301; emitted by nx_parse.nx line 4146 as ir_emit_unop with the operand in op0) nor for the rest of the bit-count family 35 to 38 or OP_CTZ32, so it reaches wat_die_unlowerable. (2) buildroot/runtime/_hdl_build/nx_wat_compiler.nx 49877 B maps mnemonics through atom_eq rows and its header says unknown mnemonics REFUSE; popcnt occurs 0 times in it, so an emitter arm alone only moves the refusal from nx_compile_wat to nx_wat_compiler. (3) buildroot/runtime/nx_wasm_vm.nx 51758 B: its one 0x7B is the v128 valtype in wmp_valtype; wm_call dispatches by an if chain on op with no 0x7B arm and no unknown-opcode text (nknown 0, nhandled 0), so whether it traps on an unimplemented opcode or silently passes the operand through is UNVERIFIED (lowercase and decimal spellings not searched). Instrument: nx_shelltool grep i64.popcnt over buildroot/runtime .nx matches=0 coverage_complete=1 corpus_complete=1 over 26617 files. Same shape for i64.shr_u: wat_binop_mnem emits it, and grep shr_u finds 4 hits, all emitters, none in any assembler under buildroot/runtime. Lane facts: nx_wasm.nx is imported by exactly nx_compile_wat, nx_vcc_color_wat and nx_vcc_probe_wat (grep 3 matches, corpus_complete=1), not by nx_cc; nx_catalog nx_compile_wat BUILT 765776 B vs PROMOTED 671565 B, a fossil-vs-live gap to adjudicate before any promote; nx_wat_refuse_gate plants OP_CALL_INDIRECT 144, so a popcnt arm leaves its refusal tooth intact.
2026-09-25	CN13-DEVICE	queue	W1 RECIPE for the owner of the wasm lane, in a coordinated window; every link is additive (a module using OP_POPCNT64 refused before, so no shipped output can change -- prove it anyway): (a) nx_wasm.nx wat_emit_instr beside OP_NOT: if op == OP_POPCNT64, wat_push_operand op0, emit i64.popcnt, wat_store_result. (b) nx_wat_compiler.nx: one atom_eq row for i64.popcnt with a fresh internal code whose emit is the single byte 0x7B with no immediate. (c) nx_wasm_vm.nx wm_call: if op == 0x7B, replace V[vsp-1] by the count of its 64 bits (k from 0 to 63 over (v >> k) & 1, sign-safe under an arithmetic shift); FIRST plant a 0x7B module on the unchanged VM and record whether it traps or passes the operand through, since a silent pass-through is the LN13a class inside the VM and needs its own refusal. (d) teeth, each a KAT against the native popcount: 0 gives 0, -1 gives 64, 1 shl 63 gives 1, 1 gives 1, 0x5555555555555555 gives 32, 0xAAAAAAAAAAAAAAAA gives 32; neg-control: the pre-change VM or a mutated arm must read RED; nx_wat_refuse_gate must still refuse OP_CALL_INDIRECT. (e) neutrality: compile two popcnt-free programs through nx_compile_wat and nx_wat_compiler before and after, nx_filehash cmp on both the .wat and the .wasm. (f) lanes: none of the three sources is in nx_cc's import closure, so the canaried toolchain lane applies only if nx_compile_wat is served from buildroot/_offc, which this seat did not check; adjudicate nx_compile_wat BUILT 765776 vs PROMOTED 671565 first, and bank each live binary by sha256 before its first promote. (g) then nx_compile_wat runtime/_hdl_build/nx_opaque_client.nx, assemble with nx_wat_compiler, run in nx_wasm_vm_verify, and drive one ocl_register_blind against the RFC 9807 C.1.5 vector nx_opaque_client_gate pins natively. CAUTION: wat_die_unlowerable stops at the FIRST opcode without an arm, so a second refusal may follow popcnt (a curve and hash client plausibly needs unsigned shifts, which the assembler lacks today); iterate the chain until the client assembles and runs. Until then the live register page keeps posting the passphrase.
2026-09-25	REVIEW	measure	R2a debt 1790359971 cvh_person_attest vouched youth band ACTUAL+SPRAWL. ACTUAL part is LATENT: nx_connect_personhood L314-357 issues SA_AGE_BAND_MINOR from need=2 live vouches plus the member's own ccl_band declaration with no guardian link and no credential, and in code cvh_signup_band feeds CSU_RQ_ATTESTED so a minor record opens PEER (signup_gate L211); but no served consumer reaches it -- cvh_person_attest, cvh_signup_band and csu_signup_admit are called only by gates (greps over buildroot/runtime coverage_complete=1 corpus_complete=1) and nx_connect_api_lib L428 marks person_attest CA_ST_UNWIRED, so it is a wiring precondition, not a live hole. SPRAWL part: the revocation sub-claim names AZ10/SR9 consumers of sa_age_attest that exist only in comments (7 matches, one caller: personhood), and the band has several assertion sources (R2d). 1790359971 stays OPEN (its remedy points the right way); consolidation filed as debt 1790372549.
2026-09-25	REVIEW	measure	R1b debt 1790359978 connect-device-opaque-register-takeover ACTUAL-latent+SPRAWL: osw_register_store appends through nx_uas_append with no create-only predicate, but its only caller is its own gate (grep 4 matches corpus_complete=1) and that gate pins re-registration of the same handle as a feature; the remedy to compose csu_handle_taken inside the wire server pointed the sprawl way (a third caller-side copy and a product lib inside the auth wire server), so it is superseded by debt 1790372544 with the nonce binding and the device passphrase policy carried forward, original eaten
2026-09-25	REVIEW	measure	R1c CN13 finding SPRAWL: true as observed (olg_register has no existence check, csu_signup_admit asks csu_handle_taken first, olg_route passes ip4=0 so signup is denied by construction, the LAN door is gated by HR invite state where a claimed handle is no longer invited) but three doors carry three different existence predicates and eight carry none; the family door claims the invite after register with the hra_claim return ignored, so a failed claim leaves the handle invited and re-registrable; one create-only guard in the account log makes every caller check moot
2026-09-25	REVIEW	measure	R1 register-door census SPRAWL: grep olg_register( over buildroot/runtime 36 matches corpus_complete=1 = 1 definition + 13 door lines in 12 request-path organs + 2 candidate copies + 20 gate or test lines (sums to 36), plus osw_register_store as a 13th create path straight onto nx_uas_append and nx_modern_auth_recover as the one intended supersede; registration_open reads 0 in production and nx_connect_appd does not consult it; the 8 doors without a predicate were not individually adjudicated because the account-log create-only fix (debt 1790372520) makes that audit moot
2026-09-25	REVIEW	measure	R2b1 nx_connect_signup CSU_RQ_ATTESTED caller-attested band SPRAWL: the header (L37-39) names nx_connect_idage as the attestation source, a program with main that nothing imports, while the verified bridge cvh_signup_band (nx_connect_personhood L359-370: out[1]=1 only when sa_age_attest verified the claim for this subject) already exists; the int flag is the placeholder between the two. Not reachable: csu_signup_admit has one caller, nx_connect_signup_gate L120, and nx_connect_appd imports signup only for csu_handle_taken and holds 0 occurrences of band. Consolidate (debt 1790372549): signup takes the claim and verifies through sa_age_attest via cvh_signup_band; the int flag and the idage header line retire.
2026-09-25	REVIEW	measure	R2b2 nx_connect_faith caller-supplied bands NOT-AN-ISSUE, by design and sound: faith stores no band and owns no band source; cfa_may_channel is yw_may_channel, the one wall (header L20-22), over caller-owned member slots; the served verbs faith_admit and faith_other (nx_connect_api_lib CA_ST_WIRED) take no band; nx_connect_serve has 0 cfa_ calls. Band truth belongs to the one band owner (R2d); a check inside faith would add another band mechanism.
2026-09-25	REVIEW	measure	R2c1 nx_connect_circles ccl_join guardian_consent int flag SPRAWL: the guardian's own act already exists as nx_connect_family fam_guardian_consent (the guardian consents, ccl_is_guardian checked, method class from the juris row, statement versions, logged, withdrawable, age-up); ccl_join L626-637 takes a second, weaker consent as a caller flag plus a structural G1 link check. Not reachable: ccl_join callers are gates and the csc_join pass-through only (27 matches over buildroot/runtime). Consolidate onto fam_guardian_consent through a family-owned join that passes the live consent record (family imports circles, so the door moves up); the flag on the public door retires.
2026-09-25	REVIEW	measure	R2c2 nx_connect_circles ccl_link_guardian (a link is not the guardian's act) ACTUAL+SPRAWL. ACTUAL part, LATENT: L426-437 links any adult member as guardian of any minor member with no actor and no claim, and no mechanism anywhere establishes a link by the guardian's own act; it is the same missing piece as the R2a remedy (the guardian's live adult claim). Not reachable: 16 matches over buildroot/runtime, every caller a gate. SPRAWL part: nx_connect_liquidity keeps a second guardian store (R2c3). Fix before wiring, in the same change as R2a (debt 1790372549).
2026-09-25	REVIEW	measure	R2c3 nx_connect_liquidity lq_inv_mint inviter-asserted guardian and band SPRAWL: liquidity keeps its own member band and guardian (lq_member_band, LQC_I_GUARD, lq_member_guardian; lq_inv_mint L225-256) beside the circles link store and the one band ruler. Not reachable: lq_inv_mint callers are nx_connect_liquidity_gate and nx_zz_lqhour_probe only. Consolidate: an invite may carry a guardian reference, the link is recorded by ccl_link_guardian and the band comes from a verified claim; lq_member_guardian and the invite band go SUPERSEDED then ARCHIVED, successor circles plus sa_age_attest.
2026-09-25	REVIEW	measure	R2d age, personhood and guardian SPRAWL CONFIRMED, owners named: AGE BAND owner sa_age_attest (nx_site_auth, AZ10) verifies plus cvh_issue as the only issuer; duplicates are the declared ccl_band, CSU_RQ_BAND with its int flag, the liquidity invite band, and nx_connect_idage (a program with main, imported by nothing, cited as the spine only by comments and 6 census rows); bands passed into faith, youthsafe and antistalk predicates are arguments by design. PERSONHOOD owner cvh_person_attest, no duplicate. GUARDIAN LINK owner ccl_link_guardian and ccl_is_guardian, composed in code by circles walls, family, service, study and langcircle (antistalk and youthsafe take the bit as a request slot documented as ccl_guardian_pair; debt 1790372549 says composed, which is loose for those two); duplicate lq_member_guardian. GUARDIAN CONSENT owner fam_guardian_consent, duplicate the ccl_join int flag; a minor's lane set also has two rules (csu_lanes_open opens PEER at sign-up per signup_gate L211, fam_channel answers FAM_NEEDS_CONSENT) and retires onto fam_channel. Nothing in R2 is reachable from nx_connect_serve or nx_connect_appd today. No build was started: this seat began at NAS 1790371921, after both wave bounds. Consolidation and the latent rule fix are debt 1790372549.
2026-09-25	REVIEW	measure	R1a debt 1790359363 connect-register-takeover ACTUAL+SPRAWL: served nx_connect_appd.elf is byte-identical to the banked 3e46d193 and holds 0 bytes of nx_connect_signup (txtscan connect_signup.conf 0 while alpha 01c6ce37 holds 2 as the positive control), and nx_modern_auth_register appends with no existence check while nx_uas_lookup is latest-row-wins, so production still accepts a takeover; the caller-side csu_handle_taken is a correct stopgap for this one door (row kept open for the production ship) but the create-only predicate belongs in the account log, consolidation filed as debt 1790372520; no scratch-instance run (seat started past the wave deadline), decided from served bytes plus incumbent source
2026-09-25	REVIEW	measure	R3a debt 1790361172 youthsafe group bypass ACTUAL+SPRAWL. ACTUAL by source read: ysf_peer_may_connect returns ysf_group_verdict when rq CTX is YW_CTX_GROUP before the band-span and lane checks, yw_may_channel admits any minor pair in any context, and ysf_group_may_join admits a minor into an all-minor group with no reach and no size test, so two far-band minors who never accepted each other pass on the caller's word alone (same rq with CTX DM gives YSF_REFUSED_FAR_BAND). SPRAWL: the same membership arithmetic lives in room_admit and room_may_leave (nx_connect_lds_room, no guardian exemption, inside a program with its own main) and grp_add (nx_connect_group_lib, walls only DATE lane, serve calls it only in the cs_grp_seed demo). NOT LIVE: youthsafe imported only by its gate, api_lib youth_peer UNWIRED. Consolidation row 1790372683 (owner ysf_group_may_join, room_admit and room_may_leave SUPERSEDED then ARCHIVED); 1790361172 stays open for the ACTUAL fix. No build: seat began at NAS 1790371917, after stop-builds 1790364300.
2026-09-25	REVIEW	measure	R4a msgstore vs chat_store SPRAWL: two durable message stores for one concern; nx_chat_store seg-store C1 promoted and gated with consumers nx_msg_sync nx_game_chat and a duplicate in nx_chat_demo_api; nx_connect_msgstore per-account snapshot lib imported only by nx_connect_franking and 2 gates (grep 26617 files corpus_complete=1); owner = seg-store plane via the declared nx_chat_store_lib extraction (ABSENT); msgstore persistence half to SUPERSEDED then ARCHIVED; debt 1790372726
2026-09-25	REVIEW	measure	R3b debt 1790361178 antistalk recipient lockout ACTUAL+NOT-AN-ISSUE+SPRAWL, superseded by 1790372694 and eaten (DEBT-EATEN at_idx 4479). NOT-AN-ISSUE part: the one-pending lock is the declared strictest line of an UNSOURCED row (lib header rule 4; live knowledge/connect_antistalk.conf reads throttle recipient UNSOURCED) and the SOURCED path already counts distinct senders in a window because ast_request refuses AST_REFUSED_REPEAT before ast_over runs, so the remedy is a calibrated conf row, not code. ACTUAL by source read: ast_block writes only a block row and ast_over counts every pending row to the recipient without consulting blocks, so a blocked stalker's pending request still throttles every other sender; rq carries only the viewer claim (AST_RQ_SLOTS 10), so a person-level block never hides the blocked person's new account from the blocker. SPRAWL: blocks in three stores (ccl_block, ysf_set YSF_SET_BLOCK, ast_block) and sender throttles in two (ysf_request_may_send, ast throttle sender); owner ast_block and ast_request. NOT LIVE: imported only by its gate, api_lib antistalk_discover UNWIRED.
2026-09-25	REVIEW	retract	R1 CORRECTION of the R1c and door-census rows above: reading all 12 door branches gives 2 existence forms in 5 doors (csu_handle_taken in 2; per-handle HR invite state in 3 including nx_opaque_login_daemon) and none in 7 (5 behind an allow_reg switch only, nx_studio_gate defaulting it to 1 from argv; 2 behind an invite token not bound to the handle, nx_docportal_admin_daemon and nx_email_portal_daemon, where any live invite holder can re-register a taken handle); the kill switch is a door switch, not an existence predicate; debt correction row filed against 1790372520
2026-09-25	REVIEW	measure	R3c CN14 and CN15 discovery findings SPRAWL, with an ACTUAL part and a NOT-AN-ISSUE part; consolidation row 1790372702. NOT-AN-ISSUE: CN14 as stated (ccl_circle_reach returns a ring for an unrelated adult and a minor) is true of a reach function, not a discovery verdict: circles has no list, search or roster verb (71 func census), and ast_may_discover takes SHARED from it and applies the minor rule after. ACTUAL: cfa_discover lists, for a minor viewer, every consenting minor in the population with a faith signal, with no shared-context and no block test (faith gate tooth peer-band-a-minor-query-lists-the-minor-peer runs over a population with no circles), against the owner rule DISCOVERY ONLY INSIDE SHARED CONTEXT; adults never see minors there. SPRAWL: discovery also decided by csh_visible and csh_share_visible (reach within the poster ring, no minor rule, no block) and ccl_ask (reach only on the request path). ONE owner ast_may_discover; cfa_discover SUPERSEDED then ARCHIVED as a discovery rule, faith stays a ranking signal via cfa_rank. NOT LIVE: api_lib wires only faith_admit and faith_other.
2026-09-25	REVIEW	measure	R4b nx_connect_franking debt 1790361185: LEAK ACTUAL but narrowed; sys_mmap of 256 B or less is an arena bump (NXA_SMALL_MAX) and sys_munmap there is a no-op, so report_verify and server_tag scratch are not mappings; the real leak is mfr_relay rec for plaintext over 112 B and inner in mfr_frank and mfr_receive over 224 B; a mapping-count tooth is vacuous, measure VmSize with a 4096 B message; NONCE ACTUAL latent: seq = client msg id under a key shared by both parties, no per-sender cid scoping in msgstore or chat_store, and log_append dedups cid alone; owner = key schedule with per-sender keys from nx_mls_group, not a direction bit; superseded by 1790372740 and 1790372741, original eaten
2026-09-25	REVIEW	measure	R3d YS4 finding fam_guardian_consent has no HOLD_SELF guard ACTUAL, filed as 1790372710 with the exact fix. Source trace with the family gate's own fixture values: fam_age_up(girl, jrs, MINOR, FG_AGE) sets FAM_HOLD_SELF, then fam_guardian_consent(st, cs, girl, gdad, jrs, FG_AGE - 1, FG_M_WEAK, FG_VER, FG_VER, now) passes every check (age_lo is caller-supplied so a stale lower bound makes fam_needs_consent 1, and ccl_band stays MINOR because fam_age_up never writes the circles band) and overwrites the holder with FAM_HOLD_GUARDIAN, while fam_age_up itself refuses re-entry with FAM_ALREADY. Fix: refuse FAM_SELF_HELD when the holder is FAM_HOLD_SELF, before any write; teeth RED on the current lib, GREEN on the fix, then nx_organ_ship nx_connect_family_gate. NOT landed: this seat began at NAS 1790371917, after stop-builds 1790364300, so no source edit or build was made. NOT LIVE: imported only by its gate, api_lib family_consent UNWIRED; wire the front-door verb only after the fix.
2026-09-25	REVIEW	measure	R4c nx_connect_realm link log ACTUAL: crl_append opens realm_links.log with CRL_MODE_0644 and writes family uid hex beside CONNECT account id and age band; the uid is nx_ncs_derive_user_id_hash = unkeyed SHA-256 over realm and handle with a public realm name, so a reader can test guessed handles and learn a linked account and minor band; the estate identity store nx_user_account_store appends with 0x180 (0600) and 0600 appears 485 times in runtime; fix = create 0600 and refuse a wider existing log, then key the uid column; acc_save 0644 is the same class in the incumbent; debt 1790372748
2026-09-25	REVIEW	measure	R4d nx_connect_msgstore_gate alias mutant REAL not vacuous: msd_path swaps .cst for .msg so the shipped lib cannot alias, but every gate tooth resolves the file through the same msd_path, so a swap-skip mutant saves to dir/id.cst, reloads it and passes every tooth while clobbering the account world snapshot; tooth = acc_save a world, msg_store_save, assert the .cst bytes unchanged and loadable, plus path ends .msg and differs from acc_path; debt 1790372756
2026-09-25	REVIEW	measure	R4e nx_connect_msgstore save leak ACTUAL (found in this review): msg_store_save maps a buffer of the whole snapshot on every save and never unmaps it, and a full snapshot is written per mutation, so a daemon saving per message grows by the snapshot size per message; msg_store_load keeps its read buffer too; fix = sys_munmap on every exit, tooth = VmSize flat over 64 saves; no builds started by this seat because it began after the wave build cutoff (NAS clock 1790371930 at first read); debt 1790372761
2026-09-25	REVIEW	measure	R5a faithsocial rung rows SPRAWL: 9 of 11 FS rungs re-declare connect contracts with the same symbol (FS1 CN13, FS2 CN5, FS3 CN14, FS4 CN15, FS5 CN18, FS6 CN6, FS7 CN3, FS9 CN4, FS10 CN2); nx_compare_rank jobs 1790372277 and 1790372282 rank cl_mobile_shell twice (connect #1 priority 6300 with 10 sponsors, faithsocial FS10 #2 priority 800 with 4 sponsors), count the same 7 libs done on both boards, and intakes 1790355006 and 1790355007 sponsor only the faithsocial copies (txtscan 0 rows on connect.plan); the verifier STATUS caveats live only on the connect rows. Debt 1790372858 (sev 4) names the consolidation. Side effect declared: the faithsocial ranker run filed 1 of its top 3 into knowledge/status/pm_intake.jrnl as it does on every run
2026-09-25	REVIEW	queue	R5a one owner per rung (for the faithsocial board seat and the ranker owner, board NOT rewritten by this seat): connect owns every rung whose contract it declares; faithsocial keeps only rungs owned nowhere else (FS8 cds_date_checkin, FS11 cgm_mod_queue) and its 9 riding rows go SUPERSEDED then ARCHIVED with successor connect CNn, replaced by a cross-board reference the ranker resolves from the owner board (state, sponsor set, STATUS text) and never ranks a second time; its rungrole and ms rows then name the owner rung. Whether nx_compare_rank already carries a cross-domain reference kind was NOT read by this seat. Debt 1790372858
2026-09-25	REVIEW	measure	R5a youthsafety rung rows NOT-AN-ISSUE: its 7 rung symbols (jur_rules_for, ysf_peer_may_connect, ast_may_discover, fam_guardian_consent, mfr_report_verify, cnt_tracking_census, cmf_device_blur_flag) are on no connect rung (all 22 connect rung symbols read, CB0 to CN18; jur_rules_for occurs only in 2 log rows of connect.plan); one owner per rung holds and the connect-named libs are the by-design one source
2026-09-25	REVIEW	measure	R5b RACI stores ACTUAL+SPRAWL, debt 1790360611 VERIFIED and WIDER: nx_orchestrate_raci imports nx_raci_sov and reads raci_read_all; research resolves PLANNED Accountable=researcher while treecanon-push and connect-release (lane-plane rows) answer deny no-accountable-role. grep over buildroot/runtime (26617 files, corpus_complete=1): raci- read by nx_pm_board, nx_law_warden, nx_pm_cockpit, nx_pm_roi_lib; knowledge/store/raci by nx_orchestrate_raci, nx_pm, nx_pm_plan_report; and a THIRD store knowledge/registry/nishi_raci.tsv still read directly by nx_raci, nx_pm_dashboard, nx_crew_roster_gate. ACTUAL = no append path into the conductor store; SPRAWL = three stores. Superseding-scope debt 1790372867 names survivor knowledge/store/raci, raci- as projection plus lane status, TSV SUPERSEDED then ARCHIVED; 1790360611 left open (its remedy points the right way)
2026-09-25	REVIEW	measure	R5c nx_connect_langcircle NOT-AN-ISSUE (COMPOSES): nx_capsearch language exchange partner match tutor ranks the incumbent nx_connect_match_lib first (the reciprocal language-exchange match engine, mx_recip_score) and the langcircle land row says clc_circle_match composes mx_recip_score, ccl_circle_reach, yw_may_channel and ln_min; no second matcher
2026-09-25	REVIEW	measure	R5c nx_connect_activity NOT-AN-ISSUE (COMPOSES plus one new mechanism): it composes the events incumbent nx_connect_events_lib ev_rsvp (capsearch rank 2 for event rsvp activity plan), ccl_circle_reach and ccl_group_ok, and names nx_connect_lds_room room_admit instead of a second room; its multi-zone waking-window overlap is new beside vizsla_group findtime, which is a single-zone calendar-busy search with one earliest and latest minute pair inside a program with a main (not importable). A shared overlap primitive is a later extraction candidate, not a duplicate today
2026-09-25	REVIEW	measure	R5c nx_connect_family NOT-AN-ISSUE (COMPOSES): its only import is nx_connect_circles (band, guardian link, reach, relationships, channel); familyatlas FA8 fac_circle_offer is a different concern (it OFFERS immediate-family invitations into the CN14 circle from the atlas person card), so no parallel tool. Its own strictest-line fallback is the one overlap, recorded under the juris row
2026-09-25	REVIEW	measure	R5c nx_connect_juris GENUINELY NEW as the per-country data organ (capsearch jurisdiction country minimum age law: nx_supp_jurisdiction is supplement market access, nx_legal_compliance is document regimes; grep COPPA over buildroot/runtime: only nx_connect_juris_gate carries a per-country line) but SPRAWL on one concern: nx_connect_family keeps its own strictest line (every minor needs consent when no or an unsourced row reaches FAM_JR_) while jur_rules_for computes the field-wise strictest over admitted rows (consent below 13 with today's table). Latent divergence for ages 13 to 17 in an undeclared place (neither wired, runtime UNMEASURED). Debt 1790372889 names juris as the one owner
2026-09-25	REVIEW	measure	R5c nx_connect_antistalk SPRAWL on block: three block mechanisms by source read -- nx_connect_serve session slot CS_BLOCKED toggled by the /block route, nx_connect_circles relationship field CCL_F_BLK checked in ccl_channel, and ast_block with ast_block_why in the antistalk lib (nx_connect_graph_lib, nx_connect_social, nx_connect_presence and nx_connect_appd hold 0 block hits; nx_connect_lanes_lib only takes blocked as input). Survivor ast_block; CCL_F_BLK and CS_BLOCKED retire when wired. Debt 1790372875
2026-09-25	REVIEW	measure	R5c nx_connect_youthsafe SPRAWL on contact: it imports the youth and lanes incumbents (composes) but ysf_peer_may_connect and ccl_channel in nx_connect_circles both answer whether two members may open a 1:1; ccl_channel has no adjacent-band clause, so two accepted minors of non-adjacent bands sharing an open ring get a lane there and a refusal from ysf (latent, neither wired for DMs). One entry point ccl_channel delegating its minor-to-minor branch to ysf_peer_may_connect. Debt 1790372882
2026-09-25	REVIEW	measure	R5c UNVERIFIED for the rest of the leg's organs (nx_connect_signup, _realm, _msgstore, _liquidity, _personhood, _study, _service, _franking, nx_opaque_client, nx_opaque_wire_server, nx_connect_api_lib and their gates): this seat began at NAS 1790371947, already past its return-by 1790364900, and did not capsearch them. Deciding observation per organ: nx_capsearch with its intent words plus a read of its import lines. Named leads from the land rows, not classified here: nx_connect_msgstore beside the old per-session nx_connect_msg, and the franking device path using nx_hmac_sha256_wasm as a separate HMAC copy (equivalence to nx_hmac owed by its builder)
2026-09-25	REVIEW	measure	R5d alpha lanes NOT-AN-ISSUE as sprawl, one ACTUAL defect: /alpha/connect-faith (static front door by nx_site_build) and /alpha/connect (the app, supervisor row connect_alpha) are different concerns on their one incumbents; but txtscan of the served sites/nishifamily/alpha/connect-faith/index.html finds 7 call-to-action hrefs, all to production https://nishifamily.com/connect/register or /connect/login and 0 to /alpha/connect, so the alpha front door sends sign-ups past the alpha takeover fix into production (debt 1790359363 sev 8). Exact blueprint fix for the SITE owner in debt 1790372897
2026-09-25	REVIEW	measure	R7 YS1 jurisdiction table thin ACTUAL: the concern is owned by one mechanism, nx_connect_juris over knowledge/connect_jurisdictions.conf (nx_absent 16 CFR 312 over buildroot/runtime nx: 2 matches, both in its own gate, corpus_complete=1; nx_absent jur_rules_for: 16 matches in the lib, its gate and the nx_connect_family interface), and the thinness was in that owner's data, not a symptom of a second mechanism (production 2 admitted of 10 rows, strictest consent below 13, verifier row 1790361300); this seat sourced EU GDPR Art 8 as adopted, GB OSA 2023 s12 and BR Lei 15.211 Art 24 under CAS: gate_run job 1790372818 GREEN 92/92, admitted 5 unsourced 5 refused 0, strictest consent below 17 with verifiable parental consent, no barred band yet; AU, IN, US-UT and EU DSA still owed (youthsafety.plan YS1 queue row 1790372964)
2026-09-25	CN13	measure	W5 wave-7 seat, completion no referee disputes (34 REVIEW rows read at 230617 B: R5a classifies the faithsocial RUNG rows SPRAWL, not its rival columns, and this seat touched no rung): /compare/faithsocial gained the LDSSingles column, coded from the App Store listing and its operator Black Cap Holdings' safety, privacy and terms pages fetched, read and pinned today (journal row BOARD 1790373150 on faithsocial.plan). Against LDS Singles, CONNECT source presence (SOURCE_SYMBOL_DISCOVERY, not runtime; the live /connect app serves only the OPAQUE login, groups, reconnection and sealed messages among these) is ahead on 21 rows -- no stored identity at sign-up, OPAQUE login, age band, the two-deep wall that serves youth, circles, groups, mission reconnection, the ward boundary, faith at equal fidelity, intent lanes, fair exposure, content-blind abuse detection, sealed messages, one account, zero paywall (LDS Singles sells unlimited messaging at USD 49.99 a month), events, games, activities, language, service and sharing; level on 4 (verified person, matching, messaging, installed base by symbol only -- CONNECT has 0 real users against a rival claiming thousands); LDS Singles leads on native apps and trained moderation (both CONNECT watches); neither has a group moderation queue or a date check-in. LDS Singles signs members in through a third-party service (Clerk) with Google Tag Manager in the page head, keeps selfie templates at a verification vendor, and its operator may show a member's profile on its other dating services
2026-09-25	REVIEW	measure	R6 debt 1790357498 (CN3 liquidity gate: the main() local hour read 2433600) is ACTUAL-COMPILER, the library-overrun hypothesis H2 REFUTED: a restored copy of the gate reproduced 39/72 RED (job 1790372368) and its FIRST read of hour (pb, no call between the def and the read) already used 2433600; six probes spanning every lq_* call read 2433600 unchanged (1790372470); a 71-local main with no connect library read 7200 (1790372745); a 3-line function let h = 3600 then v + h + h reads 7200, two such lines 14400, v + 1 + h reads 3601, identical in release and debug (1790372874, 1790373002, 1790373062), while v + h + 1, h + h, subtraction, products, a runtime-initialised h and the named constant read 3600 -- an nx_cc fold stores its folded constant into the node a const-initialised local shares, independent of local count and calls. The gate workaround (the named constant at every use) is sound: promoted gate 72/72 GREEN with diag 3600 (gate_run 1790373197); no library change owed. Superseding debt row 1790373266 sev 7 carries the reproducers and the remedy for the nx_cc owner; 1790357498 eaten (its candidates and its bisect-N repro spec pointed the wrong way). Scratch sources retired reversibly to knowledge/retired; five scratch ELFs buildroot/_build/nx_r6hour_(faithful,probe,min,bisect,bisect2).sov.elf remain because nx_retire_path refuses elf paths; toolchain untouched
2026-09-25	SITE	land	ALPHA FRONT DOOR REPOINTED to the alpha app (work order debt 1790372897): connect_faith_alpha.site 4894 -> 4918 B under CAS h086374a07474a36b, its 4 action URLs (header, hero, hero2, section_cta) now https://nishifamily.com/alpha/connect/register and /alpha/connect/login; plan-site-release-connectfaith- re-run 1790373977976820-28637 COMPLETED 27 of 27; served index 29785 -> 29827 B sha256 09d4ec34466175be876506d2d0cd68bddaba1fa1baf63ef5f8b127b59692fe7a, 6 about pages 28472 -> 28502 B each; nx_txtscan count nishifamily.com/connect = 0 on all 7 served pages (was 7 on index + 5 per about page = 37; positive control 7 on the pre-change control build), nishifamily.com/alpha/connect/ = 7 on index and 5 on each about page; nx_page_verify GREEN a11y-issues=0 broken=0 on all 7 with served bytes equal to file bytes (no ad injection); robots noindex meta and nx-ad-optout marker 1 per page; both targets answered 200 at 1790373513 (register 11246 B, login 11189 B). Production values return only at golive, after the debt 1790359363 fix ships to production.
2026-09-25	SITE	measure	BYTE ATTRIBUTION of that rebuild: exactly two substitutions and nothing else. (1) EMITTER: nx_site_build e6a81423 444448 B (organ_ship SHIPPED GREEN 1790372997, 516 s before this leg) derives --ink-faint light #6E7269 -> #656860 (worst 4.52:1 over ground, ground-sunk and card against the 4.50 pixjudge bar; dark #8A8C84 unchanged), 2 occurrences per page, same length. (2) BLUEPRINT: https://nishifamily.com/connect/ -> https://nishifamily.com/alpha/connect/ at 7 places on index and 5 per about page, +6 B each. Proof by substitution identity: pre-change served bytes + (1) == a /tmp/s1cf_ctl control build of the unchanged blueprint through the promoted emitter (7 of 7 sha256 identical), and that + (2) == the new served bytes (7 of 7 sha256 identical); sitemap.xml, robots.txt, the font and LICENSE published UNCHANGED; nx_ui_audit file 12 of 12 as before.
2026-09-25	SITE	lesson	A single-line minified page defeats every line or run differ (0 newlines in 29785 B, so a printable-run ruler sees one run per file), yet a complete byte-level diff is still one hash away: apply each NAMED substitution to a copy of the old bytes and nx_filehash cmp it with the new bytes, and build the UNCHANGED data through the current emitter first, so an emitter promote that lands between two releases (here 516 s before) is attributed to the emitter and never to the data edit.
2026-09-25	SITE	land	RELEASE GUARD IN THE PATH: plan-site-release-connectfaith- row 28 = nx_absent nishifamily.com/connect sites/nishifamily/alpha/connect-faith html, so a production connect target in the alpha front door now fails the release receipt instead of passing silently. Bite both ways: exit 1 PRESENT matches=7 over the pre-change control build /tmp/s1cf_ctl, exit 0 ABSENT-PROVEN coverage_complete=1 corpus_complete=1 over the served tree; run 1790374636181364-21073 COMPLETED 28 of 28 with all 11 publishes UNCHANGED (the rebuild is deterministic, served index still sha256 09d4ec34). Limit stated: row 28 runs AFTER the publishes (the runner orders by integer row id and 13..26 are taken), so it names a regression the moment it ships rather than preventing it.
2026-09-25	SITE	queue	OWED: (1) move the production-target guard AHEAD of the publishes -- no free integer slot exists between the build (row 12) and the first publish (row 16), so it needs a renumbered plane or a guard phase in the runner; (2) at golive the production blueprint takes the production /connect targets only after the debt 1790359363 register fix is live in production, and this alpha-only guard row must not be copied into the production plane; (3) the front-door copy still calls the target the live app (heronote, step 1, pagecta) while it now opens the alpha app -- copy decision for the SITE owner, not changed here.
2026-09-25	CN14	queue	MINED from faithsocial FS3, retired onto this rung by the wave-9 S3 seat (debt 1790372858): FS3's done-rule made the gate prove two youth peers can befriend each other WITH THEIR GUARDIANS ABLE TO SEE THE FRIENDSHIP; CN14's description carries guardian sight but its done-rule clause does not, and its open list says guardian consent is a flag, not an act. Owed to the CN14 owner: adopt that clause into the done-rule with a gate tooth for it (faithsocial's Discord bar grades guardian visibility against Discord Family Center); the verbatim FS3 row is banked in knowledge/retired/buildroot_knowledge_compare_faithsocial.plan-precons-1790373638
2026-09-25	CN4	queue	MINED from faithsocial FS9, retired onto this rung by the wave-9 S3 seat (debt 1790372858): FS9's accept rule made the held-out labelled set INCLUDE romance-scam patterns (the faithsocial SB-FS-MATCH bar, folk deception cues and detection strategies, arXiv 2606.23241); CN4 says only a held-out labelled set. Owed to the CN4 owner: adopt that clause, so a model that beats the hand-weighted baseline while missing scam patterns stays UNWIRED; the verbatim FS9 row is banked in knowledge/retired/buildroot_knowledge_compare_faithsocial.plan-precons-1790373638
2026-09-25	CN13-DEVICE	measure	W8 TOOLCHAIN SEAT (T0 1790373324): OP_POPCNT64 now lowers through all three wasm links, each measured. SOURCES (sha256 before -> after): buildroot/runtime/nx_wasm.nx 03fc9508 49886 B -> af2674e5 50558 B (one arm beside OP_NEG: push op0, i64.popcnt, store result); buildroot/runtime/_hdl_build/nx_wat_compiler.nx 7f5492fc 49877 B -> 50941 B (atom row i64.popcnt to internal code WC_OP_I64_POPCNT 75 emitting the single byte WC_I64_POPCNT 0x7B, plus wc_say: the unknown-mnemonic refusal passed a hand count of 31 for its 32-byte prefix so every refusal read mnemonic:NAME with no space, found by the new gate); buildroot/runtime/nx_wasm_vm.nx aff002eb 51758 B -> 52782 B (0x7B arm, a masked walk over the 64-bit lane). REFEREE nx_wasm_popcnt_gate (new, buildroot/runtime, 19160 B, spendgate name FREE, no incumbent): RED 28/49 against the old code (live nx_compile_wat c3d93ccb refused opcode 38 exit 3, live nx_wat_compiler 9bb45b5d refused the mnemonic exit 1, and the unchanged VM RETURNED ITS OPERAND -- 0x5555555555555555 in, the same out: the LN13a silent class inside the interpreter, now measured), GREEN 49/49 on the new three (job 1790374918). Two references per case (native popcntq and Kernighan) plus definitional counts; cases zero, all ones, a clock-chosen single bit, the sign bit, both alternating patterns, a clock-derived value; neg-controls: VM answer is not its operand, emitter still refuses the arm-less __ctz32 (opcode 37) by name, assembler still refuses an unknown mnemonic, a popcnt-free control compiles and assembles with no popcnt. NEUTRALITY, both links A/B on one variable: emitter -- a CONTROL nx_compile_wat built from the same closure with nx_wasm.nx reverted (63737850, byte-identical to the 2.5-day _build fossil) and the new one (dc902394) emit BYTE-IDENTICAL WAT for nx_hmac_sha256_wasm (3172d518 402802 B) and nx_dungeon_alpha_wasm (e620de1e 122463 B); assembler -- new 92dedca3 and live 9bb45b5d assemble the same WATs to byte-identical wasm (fcb1bd57 11927 B, e0bfb975 6739 B). LIVE vs NEW compile_wat output DIFFERS (hmac WAT +1457 B, wasm 11927 -> 11949; dungeon wasm same size, different bytes) and the control proves that difference is the 12.9 days of shared-closure drift since live was built, not this arm. Banked in knowledge/bank: nx_wat_compiler.elf-9bb45b5d, nx_compile_wat.elf-c3d93ccb, nx_wasm_vm_verify.elf-193e72f6 (all -20260925, verified byte-for-byte).
2026-09-25	TREAT	land	W8 SEAT FRONT-DOOR (T0 1790373319): three pure-decision verbs WIRED behind the one dispatcher ca_dispatch -- juris_rules (YS1, nx_connect_juris jur_rules_for plus jur_account_decision over knowledge/connect_jurisdictions.conf via jur_conf_load; place self-declared and bounded to ISO alpha-2 plus a subdivision; today yyyymmdd and the age floor come from the caller; refused_no_table ok 0 decided 0 when no admitted row is in force), lang_match (nx_connect_langcircle clc_circle_match) and share_match (nx_connect_service csh_share_match, the CN17 share kind), the two pair verbs over a SYNTHETIC in-memory community built per call from connect_circles.conf (the pair plus the ccl_need adult co-founders who found the shared ring and vouch the pair in; a minor enters only through a guardian link). No member store read, no location input (share takes cells_apart only), every echoed string resolved against its table or bounded by its grammar, stored 0, verb_v 1. Lib nx_connect_api_lib.nx 34674 to 63494 B sha256 973dc857, gate nx_connect_api_gate.nx 20019 to 29649 B sha256 f2e8d9f8, six new teeth T18 to T23 on gv_check (T19 T21 T23 named neg-control; T19 plants an EMPTY table). RED FIRST: a stage-1 build with the three rows still not_yet_wired read 17/23 RED on exactly T18 to T23; flipping the three rows gave 23/23 GREEN. SHIPPED nx_organ_ship nx_connect_api noregister --behavior-args help: live sha256 b0552704 208720 B, contentdiff GREEN lost_from_live=0 ONE-WAY-GAIN (296 runs gained), behaveprobe help IDENTICAL 1441 B, offc twin installed; gate SHIPPED sha256 be145345; NAS /api/gate_run target=nx_connect_api_gate GREEN 23/23 exit 0. Pre-change binary banked knowledge/retired/nx_connect_api.elf-c91eafc2-20260925-wave8bank (nx_filecopy verified, cmp identical to .prev), and nx_behaveprobe prev nx_connect_api returned IDENTICAL for faith_admit, faith_other, match, lane, youth and events_rsvp. LIVE /api/organ_run target=nx_connect: juris_rules US 20260925 12 = how declared, consent_below 13, method_rank 2, allow-with-parental-consent, table 10 rows = 5 admitted + 5 unsourced + 0 refused; lang_match two C2 adults = match weight 50 in lane 0 though a date was asked, reach ring 4; share_match tropical seed one cell apart 0 = paired; live neg-controls: a minor one to one with an unrelated adult is walled (lang -3, share -6) and a malformed date is a range error. WORKFLOW plan-connect-frontdoor- rows 4 to 6 added, nx_plan_run connect-frontdoor COMPLETED 6 of 6 rc 0 (run 1790375215902298-12042). MCP knowledge/tool_schemas.conf nx_connect row re-described additively (562160 to 562408 B); nx_toolreg_reconcile check lists no drift for nx_connect (stale-desc 0; its RED is 47 pre-existing no-schema rows). catalog live: rows 20 = wired 5 + not_yet_wired 15 + not_yet_landed 0. No debt row tracks this wiring (nx_debt find juris_rules matched 0 of 4502); the work item is queue row 1790361145 above
2026-09-25	CN17	measure	W8 SEAT FRONT-DOOR deciding observation for nx_connect_service before wiring share_match (REVIEW row R5c listed it UNVERIFIED and named the observation: nx_capsearch with its intent words plus its import lines): nx_capsearch seed produce share offer request match garden ranks no member-to-member share matcher (nx_offer_ledger is licensing outreach, nx_garden grow-your-own affordability, nx_produce a clean-produce catalog; corpus_complete=0 with 263 dropped, so this is a floor, not an absence proof) and its imports are nx_connect_circles and nx_connect_events_lib, both incumbents -- the share kind COMPOSES the incumbents: NOT-AN-ISSUE as sprawl, so share_match was wired on its one owner. service_match (csh_need_match) stays not_yet_wired
2026-09-25	TREAT	queue	W8 SEAT FRONT-DOOR hand-off to the ALPHA-INTEGRATOR seat and what stays open. ca_dispatch in nx_connect_api_lib.nx sha256 973dc857 now answers juris_rules, lang_match and share_match; a daemon that mounts this dispatcher over HTTP (nx_connect_appd behind /alpha/connect, supervisor row connect_alpha) carries them only after it is rebuilt against this lib -- this seat did not rebuild or restart it, and production /connect was not touched. Open: (1) 15 rows still not_yet_wired: signup_admit, realm_unify, circle_reach, circle_join, circle_channel, circle_guardian_sees, msg_append, liquidity_seed, person_attest, study_post, service_match, youth_peer, antistalk_discover, family_consent, franking_verify; (2) nx_gate_bite over T18 to T23 NOT run -- a mutant build rewrites nx_connect_api_lib.nx in place while the alpha seat may be building against it, so the planted-bad proof so far is the RED on the unwired rows; (3) lang_match takes no mission or area, so the mission-area preference (clc_offer ranking over candidates) is not behind the door; (4) the synthetic community builds only rings admitted by vouch or optin -- a mission or stake shared ring answers ring_not_built with the circles code; (5) juris is now the front-door owner of the legal line, and the divergent strictest line inside nx_connect_family (debt 1790372889) is untouched; (6) a request asks one portion in share_match, the pickup detail is a placeholder the match never releases
2026-09-25	CN6	queue	FIX-CRYPTO-REALM wave-8 seat: nx_connect_msgstore leaks NOT patched here by design (save leak debt 1790372761, alias tooth debt 1790372756) because R4a classified the CN6 per-account snapshot store SPRAWL beside nx_chat_store (comms C1, seg-store, promoted, consumers nx_msg_sync and nx_game_chat; consolidation debt 1790372726). Order: (1) extract nx_chat_store_lib per comms.plan chatstore-lib-extract so the one store is importable; (2) re-seat CONNECT on it (nx_connect_franking mfr_relay and every msg_store_ caller) with replay dedup keyed by (sender, client msg id) -- log_append keys the id alone, so a second sender's message at the same id is answered with the first one's seq and never stored (source read this leg; the franking nonce fix makes the two ciphertexts distinct but cannot make the store keep both); (3) nx_connect_msgstore to SUPERSEDED then ARCHIVED through the lifecycle states with a mining receipt (msd_path alias guard, poison latch, youth-wall channel verdict, receipt states, edit and tombstone rows). The R4d alias tooth (acc_save a world, msg_store_save, assert the .cst bytes unchanged and loadable, the .msg path differs from acc_path) is several lines, not one, so it rides step (2) instead of a gate edit now.
2026-09-25	BOARD	land	faithsocial CONSOLIDATED by the wave-9 S3 seat (debt 1790372858, REVIEW R5a): its nine riding rungs are retired onto their owners on this board (FS1 CN13, FS2 CN5, FS3 CN14, FS4 CN15, FS5 CN18, FS6 CN6, FS7 CN3, FS9 CN4, FS10 CN2, each read here this hour with the same symbol and est u), so connect is the ONE owner board for those contracts; faithsocial keeps FS8 cds_date_checkin and FS11 cgm_mod_queue (still proposed for connect rungs, no rung row on any compare plan declares either), its matrix (untouched, every Nishi cell on its organ and symbol), its bars and its three targets, and FS8 now depends on connect:CN18, the declared cross-board form (sg_parse records it, never an edge, never resolved). One whole-file CAS write (expect hab89e288095b375e, 33686 to 35037 B, sha256 e01a3c14), the pre-change board banked at knowledge/retired/buildroot_knowledge_compare_faithsocial.plan-precons-1790373638 (sha256 10ae43bc). Measured after: faithsocial LADDERED 2 of 2 placed with targets_unclimbed 2 (its frontier targets; their climbers CN18 CN14 CN15 CN4 sit here under T-FRONT-CONNECT), FRESH, ranked by job 1790375207 (TARGET 0.1 FS11 priority 600 unchanged, FS8 333 from 666 because the unresolved reference counts nothing toward momentum), scoped regen job 1790375268 GREEN, nx_page_verify job 1790375309 GREEN a11y-issues=0 (static checks, browser rendering unverified). OPEN: the ranker grammar extension (resolve domain:rung from the owner, a cross-board rungrole, an owner-resolved milestone token, a retired-id declaration nx_board_idref_gate resolves; that gate reads faithsocial danglog 11 to 25) is queued on faithsocial.plan; sponsor rows for intakes 1790355006, 1790355007 and 1790361301 now lift FS8 and FS11 domain-wide and 1790361303 lifts nothing, so their re-route to CN18 CN4 CN14 CN6 CN13 is owed to the PM seat; the two MINED clauses are the CN14 and CN4 queue rows above
2026-09-25	ALPHA	land	W8 ALPHA-INTEGRATOR, the operator's are-you-pushing-to-alpha answered on the served alpha: (1) VERSIONED API mounted at https://nishifamily.com/alpha/connect/api/v1/<verb>, answered in-process by the ONE dispatcher ca_dispatch (nx_connect_api_lib) with its envelope byte for byte; positional arguments are the a= fields of the GET query or the POST form in order, decoded by cs_form_val, the one form-value decoder now factored out of cs_form_get (behaviour unchanged, auth gate 12/12); the status is read from the envelope itself: ok 1 answers 200, not_yet_wired or not_yet_landed 501 (names from ca_state_name, never retyped), wired_without_handler 500, every other refusal 400, any other path under /api 404 with the dispatcher's own error envelope, so the soft 200 (the HTML page for an API path, measured at 1790372002) is gone; mounted only when the stage argv is set, so production routes /api exactly as before. (2) the alpha's RELEASE PAGE https://nishifamily.com/alpha/connect/features, signed-in, labelled ALPHA, every capability row of the same ca_row table with its state, the dated summary and a link to this board, reached from a staged-only nav tab In this alpha. Bank before any change: knowledge/bank/nx_connect_appd.elf-alpha-01c6ce37-20260925 (nx_filehash cmp identical=1, 565485 B). Sources: nx_connect_appd.nx 34980 to 50355 B, nx_connect_serve.nx 125161 to 125800 B (cs_form_val plus the staged-only tab). Builds 85589b13 627416 B (API) then e8ef423a 719957 B (API plus page). Live: daemons.reg row connect_alpha repointed 01c6ce37 to 85589b13 to e8ef423a and re-signed each time (nx_reg_sign SIGNED hmac-sha256); old processes stopped exactly by nx_proc_kill exact through /api/organ_run (pid 8305 exe 01c6ce37, pid 14772 exe 85589b13, stop_confirmed 1 each); the supervisor revived pid 11257 exe e8ef423a (nx_proc_observe digest_match 1, parent 19038). /api/restart refuses connect_alpha (400 unknown service; its allow list is reader to email), so the exact-stop recipe is the alpha's restart.
2026-09-25	ALPHA	measure	W8 PROOF, RED before and GREEN after on the SAME gate bytes: new e2e gate nx_connect_alpha_api_gate (through the sovereign edge, account-free, on nx_gate_verdict with 4 neg-controls) read RED 6/17 on alpha 01c6ce37 (job 1790374277: every status tooth answered 200, the soft-200 defect) and GREEN 17/17 on 85589b13 (job 1790374500); with the release-page teeth it read RED 19/21 on 85589b13 (D2 and D3, job 1790374827) and GREEN 21/21 on e8ef423a (job 1790375205), then SHIPPED by nx_organ_ship sha 395aad5d (prove 21/21, promoted, _offc installed, registered callable). Values on the live alpha: catalog 200 6198 B, GET args 200, POST args 200, missing args 400 usage, unknown verb 400, signup_admit 501 not_yet_wired, /api/v2/catalog 404 not_found. nx_connect_alpha_signup_gate gained S4 (signed in, /features lists every row the api/v1 catalog counts): GREEN 8/8 with features_rows 20 = catalog_rows 20 (job 1790375405, one alpha account created by design), SHIPPED sha a2823024. Serve-core gates on the changed serve: nx_connect_auth_gate 12/12 (job 1790374281), nx_connect_mount_gate 20/20 (job 1790375484). Live language-circle decisions through the door: two adults EN and ES asking lane 3 answer verdict 50 match in lane 0 Language exchange; a minor learner and an unrelated adult one to one answer verdict -3 walled (the two-deep wall). PRODUCTION UNCHANGED: pid 32076 start 479682637 exe 3e46d193 (nx_proc_observe), https://nishifamily.com/connect/ 200 11744 B nx_page_verify GREEN a11y 0 (job 1790375280), production /connect/api/v1/catalog carries no API envelope (gate neg-control); alpha / and /features nx_page_verify GREEN. Visual review of the new page UNMEASURED (no browser capture this leg).
2026-09-25	R1	land	ROOT FIX IN THE OWNER, source landed and gated (seat FIX-ROOT-REGISTER, wave 8). hub/nx_user_account_store.nx eb14e683 11135 B to 18459 B (banked knowledge/bank/nx_user_account_store.nx-eb14e683-20260925) gains nx_uas_create = REGISTER, appends only when the user has NO row, scan and append under ONE exclusive flock on the sibling <store>.lock; a live OR disabled row refuses NX_UAS_EXISTS 1466; a log that exists but cannot be read in full refuses NX_UAS_UNREADABLE 1467; and nx_uas_rotate = supersede a LIVE row only, never creates, never revives a disabled row. nx_uas_lookup now reads through _uas_store_read (fstatat: absent or empty log = NOT_FOUND; not a regular file, unopenable or short read = IO_FAILED, which used to read NOT_FOUND and let a register through), the silent 16 MiB clamp NX_UAS_MAX_STORE_BYTES is removed (no other reference, grep over 26620 files corpus_complete=1) and the whole-log buffer is released per call (sys_free_file; it leaked the log size per login). hub/nx_modern_auth_flow.nx 0e74e6c3 31636 B to 36777 B (banked) writes every credential as a NAMED act: register = CREATE (EXISTS maps to new NX_MAUTH_USER_EXISTS 1412, UNREADABLE to NX_MAUTH_STORE_UNREADABLE 1413), recover = ROTATE (mnemonic-authenticated, the one door supersede), new nx_modern_auth_provision = host-operator create-else-rotate for the arm tools (nx_modauth_arm and nx_modauth_arm_vault migrated, re-arming still rotates the admin); a handle ending in the recovery suffix is refused BAD_INPUT (it names another user's recovery row). The 13 door lines through olg_register need NO change: olg_register is a one-line seam over nx_modern_auth_register.
2026-09-26	CN15	land	RESUME-YOUTH wave 10 finished the wave-8 FIX-YOUTH faith leg (debt 1790372702 faith part, R3c ACTUAL): cfa_discover asks the ONE discovery owner nx_connect_antistalk ast_may_discover on AST_PATH_SEARCH for every candidate over the caller request rows (AST_RQ_SLOTS: shared context, blocks both ways incl the personhood claim, the minor rules) and only then applies the peer band and the faith signal; no antistalk state, no rows or a missing row lists nothing (fail closed); this seat replaced the predecessor per-query sys_mmap why slot (a small arena bump a serving daemon never gets back) with out[cnt] as the owner why out-parameter, so a query allocates nothing, and named the owner in the header. Lib sha256 970ca6ac 24007 B, gate efff6eb3 27759 B. GREEN qualify 67/67 (job 1790437384); RED 65/67 on a planted revert that ignores the owner (job 1790437654: the no-shared-context tooth actual 1 expected 0 and a-block-hides-a-faith-match-inside-a-shared-ring actual 1 expected 0), revert restored byte-identical (970ca6ac re-hashed, window about 2 min); nx_organ_ship SHIPPED nx_connect_faith_gate 675a20f1 prove GREEN, promote live = staged 675a20f1, offc twin installed, registered (job 1790438051); one lost run = the old tooth peer-band-a-minor-query-lists-the-minor-peer that pinned the global search (allow_loss_v1 021e894b), behavior review knowledge/status/harness/review-faith-gate-675a20f1.txt; prior gate banked nx_connect_faith_gate.elf-pre-resumeyouth-20260926 (94472 B). Still owed under 1790372702 (left OPEN): csh_visible and csh_share_visible (nx_connect_service) and ccl_ask (circles) ask ast; NOT LIVE: api_lib wires only faith_admit and faith_other, cfa_discover has no serving caller.
2026-09-26	TREAT	land	W10 SEAT FRONT-DOOR-YOUTH (T0 1790437185) LIB SOURCE LANDED, for the ALPHA seat: buildroot/runtime/_hdl_build/nx_connect_api_lib.nx 63494 B sha256 973dc857 to 88813 B sha256 26d83c5b53e39aca3c930d6cb02aee4aebd280f01f992474a07fd6dd6070f745 (pre-change source banked knowledge/bank/nx_connect_api_lib.nx-973dc857-20260926-wave10, nx_filecopy verified 63494 B). Three more pure decisions WIRED behind ca_dispatch, the three the wave-8 FIX-YOUTH seat journaled GREEN: youth_peer (YS2 ysf_peer_may_connect, or ysf_peer_may_connect_in over a caller-supplied roster of verified bands, one character per member, echoed only as the counts the engine read), antistalk_discover (YS3 ast_may_discover over a synthetic viewer and target with the block rows the caller describes, one-byte claim ids built per call, viewer_told is the one public answer), family_consent (YS4 fam_guardian_consent over a synthetic family of two under knowledge/connect_family.conf and a caller-stated jurisdiction row; self_at builds the take-control history through fam_age_up). New imports nx_connect_youthsafe, nx_connect_antistalk, nx_connect_family. Gate nx_connect_api_gate.nx 29649 B sha256 f2e8d9f8 to 42829 B sha256 3e137424, teeth T24 to T29 on gv_check (T25 T27 T29 named neg-control): RED 23/29 against the unchanged lib 973dc857 (job 1790437553, exactly T24 to T29 failing), GREEN 29/29 on the new lib (job 1790438011); catalog rows 20 = wired 8 + not_yet_wired 12. Ship of nx_connect_api running (job 1790438174). ALPHA: rebuild the alpha daemon against lib sha256 26d83c5b.
2026-09-26	CN18	land	RESUME-YOUTH wave 10 fixed debt 1790359971 (R2a ACTUAL latent, the latent rule fix 1790372549 names as a precondition of any wiring): a vouch attests PERSONHOOD only, so cvh_person_attest issues a youth band only with the guardian's own act -- new cvh_guardian_act composes nx_connect_family (the owner of guardian consent: fam_member_ok, fam_live, the consenting guardian from fam_rrow plus FAM_R_BY since family exports no getter for it) with circles ccl_is_guardian and the guardian's own live ADULT claim (cvh_live_row, cvh_row_band); the family state rides a new request slot CVH_RQ_FAMILY (CVH_RQ_SLOTS 8 to 9, 0 = none, fail closed); the check runs after the declared-band check and BEFORE issue or spend, so the same unspent vouches admit the youth once the guardian acts, and a refusal names CVH_REFUSED_YOUTH_NEEDS_GUARDIAN (0 - 118); the credential path still refuses CVH_DC_VERIFIER_ABSENT; the adult band from vouches is unchanged. Lib sha256 eed5cef4 32586 B (banked pre-change knowledge/bank/nx_connect_personhood.nx-pre-resumeyouth-20260926 30079 B), gate 2772a588 19099 B (banked knowledge/bank/nx_connect_personhood_gate.nx-pre-resumeyouth-20260926). RED 60/65 on the lib without the check (job 1790437656: neg-control-two-colluding-adults-cannot-mint-a-youth-band-from-vouches-alone actual 0 = the youth band minted, expected -118; the no-claim tooth actual 1; the not-consented, no-adult-claim and admitting-act teeth actual -109 because the claim already stood); GREEN 65/65 on the fix (job 1790437860); nx_organ_ship SHIPPED nx_connect_personhood_gate 0115f7c1 prove GREEN, promote live = staged, offc installed, registered (job 1790438273), two lost runs = the old tooth two-vouches-admit-the-youth and the old verdict note (allow_loss_v1 4f31d602, review knowledge/status/harness/review-personhood-gate-0115f7c1.txt); served /api/gate_run GREEN exit 0 for both this gate (job 1790438409) and the faith gate (job 1790438406); prior gate banked nx_connect_personhood_gate.elf-pre-resumeyouth-20260926 (210400 B). RESIDUAL (owned by 1790372549, OPEN): ccl_link_guardian is caller-asserted, so three colluders (one linked as guardian with a consent method the integrator accepted) are not stopped here -- the link must bind the guardian's own act; the per-process revocation note there too. NOT LIVE: personhood is imported only by its gate.
2026-09-26	CN13	queue	W12 SEAT ROLLOUT-CONNECT (T0 1790437669; operator approved rolling the register-takeover fix out to production /connect now, an alpha-stage product, rollback discipline starts at beta): waiting on the wave-10 R1 and ALPHA rows until T0+3600 (1790441269). NEW GATE nx_connect_prod_register_gate (buildroot/runtime/_hdl_build, 22582 B, on nx_gate_verdict, 24 teeth, 6 named neg-control): forks a daemon ELF with ONE argument, the port, which is the production code path (cookie nxc_auth on Path=/, no /api/v1 mount), with its CWD in a fresh /tmp scratch directory so keys and accounts are the run's own; drives home, register and login, registers a fresh handle, registers it AGAIN with another passphrase, signs in with both, asks /connect/api/v1/catalog, kills and reaps the child; it refuses to fork a subject whose bytes lack the port-argument refusal (the served 3e46d193 predates the argument and would bind 8032). KNOWN-BAD PLANT: RED 18/24 on the pre-fix alpha build bfb02bdc (job 1790438720), exactly the six takeover teeth failing -- the second register mints a session and shows a fresh recovery phrase, the holder passphrase stops signing in and the second passphrase signs in. The rollout build will be nx_connect_appd --build-only from the sources current when wave 10 reports (appd, serve, account store and auth flow hashed at build time), copied to knowledge/bank before any use so a concurrent alpha build of the shared _build path cannot swap it.
2026-09-26	CN5	land	RESUME-CRYPTO-REALM wave-10 seat finished the wave-8 FIX-CRYPTO-REALM work on debt 1790372748 (R4c), which had been rebuilt and staged but never proven or journaled: nx_connect_realm.nx (buildroot/runtime/_hdl_build, 30367 B sha256 79eb13b7, banked knowledge/bank/nx_connect_realm.nx-fix-79eb13b7-20260926) creates realm_links.log and realm_links.key 0600, refuses to append to a log wider than 0600 (-CRL_E_STORE, the log is never widened or rewritten), and stores the family uid column as HMAC-SHA-256 under the 0600 CSPRNG link key, so a reader can no longer hash a guessed handle and join it to a CONNECT account or a minor band. RED on the planted pre-change lib (log opened 0644, no mode check, unkeyed column; sha256 6059ab94): qualify job 1790437311 passed 49/56 verdict=RED (T16 log mode 420 vs 384, T16b key absent, T16c key 0 B, T17 raw family uid in the log, T17b keyed uid absent, planted 0644 log accepted rc 0 vs -2207, refused log written 100 B). GREEN on the restored fix: job 1790437543 56/56. SHIPPED by nx_organ_ship job 1790438652: gate sha 95557945 promoted over e47c7ffd, _offc twin installed, already registered; loss approved allow_loss_v1 df99a761 (crl_uidhex is the retired unkeyed column; _ma_register_credential is an auth-closure symbol the gate no longer links, still defined in hub/nx_modern_auth_flow.nx, and the seven-member register and sign-in teeth pass); behaviour reviewed in knowledge/status/harness/review-realm-gate-20260926.review (sha256 ef3dafe8, evidence e7dc6a11). EXISTING ROWS: the lib is imported only by its gate (grep over 26622 files, corpus_complete=1) and no realm_links file exists under connect/ (114 files) or alpha_connect/ (18 files), finds corpus_complete=1, so no production row needs migrating; an unkeyed row still parses but no longer matches a keyed lookup, and a log that holds rows with no key refuses every call rather than silently re-keying. OPEN: nx_connect_accounts acc_save and the msgstore MSD_FILE_MODE still write 0644 (named in 1790372748 as not this lib, carried into a new row); nx_connect_appd still does not call acc_realm_unify, so no served whoami round trip exists.
2026-09-26	R1	measure	VERIFY-ROOT-REGISTER (wave 10) independent verification of row 1790375720. SOURCES match the row: buildroot/runtime/hub/nx_user_account_store.nx 18459 B sha256 c4ec720e (bank knowledge/bank/nx_user_account_store.nx-eb14e683-20260925 re-hashed eb14e683 11135 B) and hub/nx_modern_auth_flow.nx 36777 B sha256 601069f0 (bank re-hashed 0e74e6c3 31636 B); one copy of the store under buildroot (find over 99085 files, corpus_complete=1). CLOSURE census by import grep, corpus_complete=1 at every level: the store (6 importers), the flow (42 lines), then nx_opaque_login (45 lines), nx_site_auth, nx_opaque_wire_server, nx_social_auth_recover, then nx_connect_signup, nx_connect_realm, nx_connect_personhood, nx_opaque_login_routes, nx_lan_signup_routes, nx_torrent_authn, nx_hr_access and the wiki modules = 38 gates plus 4 test programs. RUN by nx_sov_build_run --qualify on the CURRENT sources (the build-cache key covers the whole import closure, so a HIT is valid evidence). GREEN 30: user_account_store 39/39 with all four named teeth (second register of a taken handle -1412 USER_EXISTS; recovery rotates and the old mnemonic dies; a directory log refuses a register -1413; a late row past the retired 16 MiB clamp in a 16777540 B log logs in and is still taken), modauth_e2e 14/14, opaque_login 8/8, connect_signup 66/66, connect_realm 56/56, connect_auth 12/12, opaque_client 42/42, connect_personhood 57/57, realm_isolation 4/4, site_auth 4/4, mgmt_session_mint 8/8, authz_session 6/6, recover 7/7, lan_signup_socket 3/3, hr_access 14/14, signup_origin 5/5, connect_juris 92/92, email_portal 12/12, docportal_admin_daemon 20/20 (in-process invite registration), social_auth_recover 4/4, nojs_session 5/5, mgmt_api 35/35, status_daemon 6/6, docportal_multipart 6/6, torrent_authn 15/15, fin_route 16/16, wiki_login_live 12/12, _wiki_integrate 4/4, _wiki_version 5/5, _wiki_edit 4/4. NOT GREEN 5, none caused by the root fix: nx_siteedit_gate COMPILE-FAIL (calls sed_handle with 7 args, nx_siteedit_daemon.nx defines 8 since mtime 1786297059, 48 days, outside both changed files); nx_studio_daemon_gate 7/8 (only T7 GET /webdev/guided fails, every auth tooth passes); nx_media_e2e_gate 0/6 (live-HTTP probe; the promoted pre-fix binary fails identically via /api/gate_run); nx_office_closed_gate 5/16 under the qualify runner (it spawns ./nx_office_daemon.elf relative to CWD=buildroot, never listens; both new-owner registration teeth PASS; the promoted gate from the serving root reads 16/16); nx_browser_forms_e2e_gate E1-E3 PASS then SIGSEGV in dad_ui_page (nx_addr2line on a debug build): dad_map_get in nx_docportal_admin_daemon.nx unmaps a hard-coded 4294967312 B after sys_read_file, which maps only total+16 since 2026-08-19, so it unmaps the caller buffers above it (pre-existing use-after-unmap, the same code serves docportal :18456). COMPILE PROOF only (need argv): nx_studio_gate (the /studio daemon), nx_torrent_gw_lifetime_gate. UNMEASURED: nx_email_portal_legacy_candidate_gate and 4 test programs. STAGE for the release owner: READY. The takeover stays LIVE in production until these daemons are rebuilt from the current tree and released through their RACI lane: opaque_login :9091 (nx_opaque_login.elf from nx_opaque_login_daemon.nx, the family login), connect :8032 (nx_connect_appd pid 32076 exe 3e46d193, debt 1790359363 sev 8 stays open), connect_alpha :18133, and the census register doors docportal_admin_daemon :18456, email_portal_daemon :18465, gen_gateway_daemon :18794, mesh_gateway :8055, nx_gallery_gw :18190, nx_vault_gw :18200; login-only doors sharing an account log gain the fail-closed lookup and the per-login leak fix on rebuild (hub_gw :18792, the office daemon). No production daemon was rebuilt, deployed or restarted by this seat.
2026-09-26	TREAT	land	W10 SEAT FRONT-DOOR-YOUTH SHIPPED AND PROVEN LIVE: nx_organ_ship nx_connect_api noregister --behavior-args help (job 1790438174) SHIPPED live sha256 2c2b2521bbb61362e2e60a74ba5befa60160c6b867029dd5acca65c89840d11a 273296 B (was b0552704 208720 B, banked knowledge/bank/nx_connect_api.elf-b0552704-20260926-wave10, nx_filehash cmp identical to .prev), contentdiff GREEN lost_from_live=0 ONE-WAY-GAIN (219 runs gained, 4 sources added: nx_connect_youthsafe, nx_connect_antistalk, nx_connect_family, nx_lane_conf), behaveprobe help IDENTICAL 1441 B, offc twin installed; gate nx_organ_ship nx_connect_api_gate (job 1790438262) SHIPPED sha256 9a7070c2 (the same bytes the qualify build ran), behave DIFFERS by design (six new teeth), registered callable; NAS /api/gate_run target=nx_connect_api_gate GREEN 29/29 exit 0 (job 1790438401). UNCHANGED VERBS, live against the banked baseline (nx_behaveprobe prev nx_connect_api): faith_admit 292 B, juris_rules 511 B, lang_match 450 B, share_match 444 B, match 62 B, youth 62 B and the still-pending signup_admit 242 B all IDENTICAL. LIVE through POST /api/organ_run target=nx_connect: youth_peer two same-band minors in the worldwide youth ring = verdict 1 lane Friendship allowed 1 (policy bands 4 span 0 group_floor 3 unsourced 6), neg-control a far-band pair one to one = -307 far_band on row peer_band_span allowed 0; antistalk_discover two adults sharing the searched context = visible 1 shown viewer_told 1, neg-control the target blocked the viewer = visible 0 why 3 blocked viewer_told 0 block_rows 1; family_consent the linked guardian of a twelve-year-old by the sourced rank 2 under the strictest line = verdict 1 consented consent_live 1 holder guardian, neg-control after the youth took control at 16 under a sourced row a guardian claiming 15 = -118 self_held consent_live 0 holder self. catalog live rows 20 = wired 8 + not_yet_wired 12 + not_yet_landed 0. WORKFLOW plan-connect-frontdoor- rows 7 to 9 added (youth_peer, antistalk_discover, family_consent), nx_plan_run connect-frontdoor COMPLETED 9 of 9 (run 1790438525769140-11378). MCP knowledge/tool_schemas.conf nx_connect row re-described additively (564251 to 564585 B under CAS h302bcddb772e612c); nx_toolreg_reconcile check names no drift for nx_connect, stale-desc 0 (its RED is 47 pre-existing no-schema rows and 59 missing rows). Queue row 1790361145 items youth_peer, antistalk_discover and family_consent are CLOSED by this wiring; no debt row tracks the wiring (nx_debt find ca_dispatch and not_yet_wired matched 0 of 4503). ALPHA: rebuild the alpha daemon against lib sha256 26d83c5b; production /connect was not touched.
2026-09-26	TREAT	queue	W10 SEAT FRONT-DOOR-YOUTH what stays open: (1) nx_gate_bite over T24 to T29 NOT run, for the wave-8 reason (a mutant build rewrites nx_connect_api_lib.nx in place while the ALPHA seat rebuilds against it), so the planted-bad proof is the RED 23/29 against the literal pre-change lib 973dc857; (2) the alpha HTTP door (https://nishifamily.com/alpha/connect/api/v1/<verb>) carries youth_peer, antistalk_discover and family_consent only after the ALPHA seat rebuilds nx_connect_appd against lib 26d83c5b and restarts connect_alpha -- this seat did not touch the alpha or production daemons; (3) debt 1790372549 (open) says fam_guardian_consent is reachable from no served door: now stale for the MCP front door (nx_connect family_consent, over a synthetic family only); its remedy, one owner for age, personhood and guardian, is untouched, so the row was NOT eaten; (4) the verbs decide over the conf rows as they stand: youthsafe bands and span are UNSOURCED (span 0, the strictest line; group_min_members 3 is the one sourced row), the antistalk throttles are UNSOURCED and discovery does not read them, family method rank 1 is UNSOURCED; (5) family_consent takes the jurisdiction row from the caller, the divergent family strictest line versus jur_rules_for for ages 13 to 17 stays debt 1790372889; (6) 12 rows still not_yet_wired: signup_admit, realm_unify, circle_reach, circle_join, circle_channel, circle_guardian_sees, msg_append, liquidity_seed, person_attest, study_post, service_match, franking_verify.
2026-09-26	RACI-UNIFY	land	debt 1790360611 ACTUAL part fixed: the one RACI authority is knowledge/store/raci (read by nx_raci_sov raci_read_all for nx_orchestrate_raci, validated by raci_validate_bytes, gated by nx_raci_sov_gate). A reviewed APPEND verb now lives in the owner nx_raci_reconcile_lib (rna_transform, rna_run, rna_report, rna_cli; the apply writer, lock, observation and replay witness are the normalizer's own, generalized so candidate lines beyond the extent land at ordinals extent..extent+n-1) and in the admin entry nx_raci_reconcile (append-dry-run <rows> / append-reconcile <rows> <manifest> <projection> <candidate>). Only activities absent from the authority are accepted; a partly present request, two Accountable roles, no Responsible, bad flags, comments, CR or an unterminated row refuse by named reason. nx_raci_reconcile promoted 790fb470 and registered. Production: dry-run manifest f0a0d7ac projection 094ea22a candidate c95561c1 extent 249 appended 39; apply code 0 durable 1; replay code 1 replay-of-retained-witness. The 39 CONNECT cells of 7 activities (the six wave-4 activities plus connect-frontdoor, byte-identical to the TSV rows, request knowledge/status/raci_append_connect_20260926.rows sha 451bb9a9) are now in the authority: gate_run nx_raci_sov_gate GREEN rows 288 (284 cells, 67 activities, all OK). RED to GREEN on the real subject: nx_orchestrate_raci connect-youth-safety was deny no-accountable-role at 1790437400 and now resolves Accountable=auditor (workstream-organ none bound, the named placeholder); connect-release resolves Accountable=publisher bound to nx_plan_run.
2026-09-26	SITE	measure	W11 SEAT VISUAL-REVIEW (T0 1790437199): the alpha front door captured and graded on the painted page, the first time since the repoint. Oracle CM13 nx_cdp_capture from WSL on the laptop Edge (the MCP surface on the NAS answers CD-BROWSER-ABSENT candidates=2, so the laptop is the only oracle); referee CM6 nx_page_pixjudge with knowledge/pixjudge.conf production bars. Standard doors phone 390x844 dsf 2 (innerWidth 390, ihdr 780x1688) and desktop 1440x900 (innerWidth 1440): all 7 pages (index plus about/sign-up-privately, your-circles, youth, reconnect, safety-and-privacy, independence) verdict OK on both doors -- contrast_fails 0, overlap_pairs 0, text_over_image 0, hierarchy_violations 0, worst 4.91; phone 8 to 10 text boxes measured with 0 unmeasured (7 unpainted = the closed menu sheet); desktop 16 of 25 measured and 9 UNMEASURED on every page = the three fold cards mid-reveal (view()-timeline stagger, swatch fg 858fa5 to c6c7c1 over efefe9, no pixel of their declared ink). Full-height doors from a scratch conf (same oracle and widths, viewport 390x6000 dsf 2 and 1440x3600; the front door carries no vh unit): the six about pages OK with 48 of 48 phone and 54 of 54 desktop boxes measured; the index 60 of 61 and 66 of 67 (the one UNMEASURED box is the dark band's 14 px line mid-reveal); worst 4.52 everywhere = the derived --ink-faint #656860 on ground-sunk, by design just over 4.5. The queue row 1790357760 expectation that the showcase eyebrow fails 4.5 here too is REFUTED on this release: the eyebrow passes on every door. Retained: knowledge/status/visreview_connect_20260926.txt (one row per graded door, partition summing), the PNGs and whole logs in the laptop scratchpad w11vr.
2026-09-26	REVIEW	measure	CCFOLD CENSUS (wave 10 seat CCFOLD-CENSUS, continuing wave 9 seat S2 whose census organ and fixture were on the NAS, built and run, but never journaled). Defect located read-only: buildroot/runtime/nx_opt.nx opt_reassoc (func line 3516) writes the (x op c1) op c2 fold INTO the c2 Value (line 3549 b_val.const_int = folded) for op in ADD MUL AND OR XOR; opt_mem2reg_simple (line 686) and opt_alloca_const (line 805) plus opt_copyprop make every read of a constant-initialised local share that one VAL_CONST. Fixture buildroot/runtime/_hdl_build/nx_ccfold_repro.nx on a fresh --no-cache build (job 1790438874) reads 7200, 3601, 3605 (across statements), 21 (product), 48 (and), 7200 (var), 7200 (60*60 init), 90000 (right local of v+a+d), 205 (pointer em+3+pslen+19) against 3600, 3600, 3600, 7, 240, 3600, 3600, 86400, 202; const-first and both controls read right; the unchanged fixture rebuilt byte-identical to its cached artifact (97b1bf4e) so the compiler has not moved since 2026-09-25. nx_ccfold_census (job 1790437909, coverage_complete=1): 22299 sources, 206101 functions, 13431 constant-initialised locals, 47 candidate sites on 41 locals in 33 files, 34 observable and 7 latent; 5 MUL locals are false positives because opt_strength_reduce turns a power-of-two product into a shift before opt_reassoc runs, so 29 observable = 8 fixture + 6 scratch + 15 in organs. Shipped with a real observable site: nx_procgen_scene_gate (hry reads 12 not 6), nx_zero_claude_ledger_gate (localC reads 4 not 0), nx_vcodec_t8noise_gate (older promoted binary, carries-site unverified) and library nx_worldgen wg_gi_build (e=120 reads GI_CS+120, GI path only) inside promoted nx_worldgen_gate, nx_gen, nx_cloud_volume_gate. No nx_connect or youth-safety source carries a candidate. Per-site table knowledge/gates/ccfold_census_w10_classified_20260926.txt
2026-09-26	SITE	queue	W11 VISUAL-REVIEW findings on the painted front door that the referee has no axis for, each read from the served bytes, for the SITE blueprint seat and the cms emitter owner (not changed here): (1) the colophon paints CONNECT ALPHA -- INDEPENDENT; NOT AFFILIATED ... OR ANY CHURCH UPDATED 2026-09-25 as one run-on line, because nx_nishi_editorial ed_sc_foot appends the CM15 dated signal (a time element, Updated <date>) after the colophon text with only a space and this blueprint's colophon ends without punctuation (production gospelofwest is unarmed and carries no time element, so only armed showcase releases show it) -- ACTUAL, low, queued for the emitter on cms.plan CM15, one fix there covers every armed site; (2) the closing section offers Create an account and Create a private account, different words on two buttons with the SAME href https://nishifamily.com/alpha/connect/register (data-action create-an-account and create-a-private-account), so the second promises a choice that does not exist -- ACTUAL copy; (3) the about pages' closing line says Create your account in the live app while the app it opens says its accounts are kept apart and nothing here reaches the live app -- a wording conflict for the SITE and ALPHA owners; (4) the footer Site column lists Home and Create an account but no Sign in. Copy, not a pixel defect, so no debt row.
2026-09-26	ALPHA	measure	W11 SEAT VISUAL-REVIEW closes the W8 row 1790375545 UNMEASURED: the alpha app captured (CM13, laptop Edge) and graded (CM6, production bars) signed out and signed in, standard and full-height doors, 36 graded doors. Every page reads OK except ONE box: the footer (footer.nx, color var(--faint)) paints #8b94a6 on --bg #f5f7fb at 2.84:1 against 4.5 (12 px phone, 14 px desktop, weight 400, method paper, exact100 284 equal to the declared ratio worked by hand, 2.844), DEFECTS in 24 of the 24 captures where it paints measurably (register, login, circles, features and home signed out, the register result and home, circles and features signed in); every other text box passes, worst 5.33; overlap_pairs 0 and hierarchy_violations 0 on every door. Debt 1790438899 (owner nx_connect_ui.nx line 81, remedy the incumbent nx_ink_derive_lib). text_over_image equals every text box on every app page because the body carries a CSS gradient and the capture maps the body as an img box (the paper method still grades; queued for the cms owner). SIGNED IN: an alpha-only test account, handle w11visrev0926, created by posting the register form's own fields to its own action from a local page (the driver cannot type into a form), on a clean profile of this seat's own; the register result (recovery phrase shown once) OK on the phone and the footer only on desktop; /features renders What this alpha carries with 20 rows = wired 5 + not_yet_wired 15 at capture time (the served alpha still carries the pre-wave-10 dispatcher: the wave-10 lib 26d83c5b with 8 wired is not behind the door yet), OK on both standard doors (24 and 30 boxes measured, worst 5.33); /circles shows the six rings with not joined yet chips, OK; signed-in home OK. Retained: knowledge/status/visreview_connect_20260926.txt.
2026-09-26	REVIEW	land	Fixture extended additively under a CAS size ladder (8155 to 8953 B): SHAPE 8 cfr_s_ptr replicates nx_rsa_pkcs1_sign.nx line 78 (em + 3 + pslen + 19 with pslen a constant local) and reads pslen 205 not 202, so the census's crypto site is real: rsa_pkcs1_v1_5_sha256_em builds an EM with 205 FF bytes, the separator at em[207] and a DigestInfo overwritten by the digest. Backlog: superseding debt 1790438934 sev 7 filed (nonce w10-ccfold-census-20260926, DEBT-ADDED artifact job 1790439087) carrying the mechanism, the fixture values, the census, the shipped list, the promote-blockers and the closure rule; 1790373266 eaten (DEBT-EATEN artifact job 1790439152). Toolchain untouched; nothing promoted or deployed; the census organ and the fixture stay BUILT-UNPROMOTED in _hdl_build as the toolchain owner's instruments.
2026-09-26	CN5	queue	RESUME-CRYPTO-REALM debt outcomes, each read back from its job artifact: 1790372748 (realm link log) DEBT-EATEN job 1790439138; its not-this-lib clause (nx_connect_accounts acc_save and the msgstore MSD_FILE_MODE writing 0644) carried forward as 1790438959. Franking (YS5, journaled on youthsafety.plan 1790439000): 1790372740 and 1790372741 eaten, residual 1790438989, dependency growth 1790439040. Nothing from this leg is served: both libs are imported only by their gates, realm_unify and franking_verify stay not_yet_wired in nx_connect_api_lib, and the alpha (connect_alpha) and production were not touched.
2026-09-26	ALPHA	queue	W11 VISUAL-REVIEW findings for the ALPHA owners (wave-10 lane files, not edited here): (1) /features marks no nav tab current, signed out and signed in; the served HTML carries no aria-current at all while home, register, login and signed-in circles each carry exactly one -- the nav invariant nx_connect_auth_gate holds is broken on the one staged-only tab W8 added, and the gate does not visit /features; debt 1790438906. (2) the signed-out and signed-in navs wrap to three rows on the phone door (9 and 10 links, about 170 of 844 css px before the banner). (3) on the register phone door the two fields sit side by side at about 172 css px each, so the passphrase placeholder is clipped (choose a strong passp) and the two labels wrap to different heights. (4) input placeholders use var(--faint): declared 3.05:1 on the white input surface, UNMEASURED by the referee (a placeholder is not a box in the capture map). (5) the dark theme (the default when the OS prefers dark) is UNMEASURED: the driver does not emulate prefers-color-scheme, and its --faint #6a7488 on #0b0e15 declares 4.11:1. SECURITY OBSERVATIONS for the auth owner, not visual and not changed here, classify before fixing: (a) the register POST from a file:// page (Origin null, cross-site) was ACCEPTED and set the session cookie -- no Origin or token check on the form endpoints, the login-CSRF class, measured by this seat's own account creation; (b) the session Set-Cookie carries HttpOnly, SameSite=Lax and Max-Age but no Secure attribute (source read of cd_setcookie in nx_connect_appd.nx, alpha and production; not wire-verified). The test account w11visrev0926 stays on the alpha (alpha accounts may be reset); its session lives only in the clean capture profile nx_cdp_prof_w11vr under the laptop TEMP.
2026-09-26	REVIEW	queue	OPEN for the toolchain owner (the RESUME-TOOLCHAIN seat this wave): opt_reassoc must fold into ir_const_i64(f, folded), the same fix opt_strength_reduce received on 2026-06-02; land nx_ccfold_repro as a compiler-gate tooth built with --no-cache (a build-cache hit reuses the old artifact without running the compiler), expected exit 0 after the fix. PROMOTE-BLOCKERS until then: nx_rsa_pkcs1_sign and its importers nx_x509_emit, nx_authenticode_sign, nx_efivars_enrol (all BUILT-UNPROMOTED; the lib selftest timed out in keygen at 180 s, job 1790438395, so end-to-end is UNOBSERVED). After the fix: rebuild and re-ship nx_procgen_scene_gate, nx_zero_claude_ledger_gate, nx_vcodec_t8noise_gate, nx_worldgen_gate, nx_gen and nx_cloud_volume_gate, then re-run the census. Not measured by this seat: the operand values of the 6 organ MUL sites (none shipped), inlining, the const_one channel (nx_opt.nx const_one returns any existing VAL_CONST 1, so even the v + h + 1 control writes into a literal 1 that const_one may later share), phis and multi-local chains.
2026-09-26	REVIEW	land	BR-ART24 wave 12 to the wave 11 LAWS seat and every consumer of nx_connect_juris: the BR row of knowledge/connect_jurisdictions.conf now reads consent below 16 (was 17), settled EXCLUSIVE by the official joint ANPD, MJSP and Secom/PR FAQ Perguntas e respostas sobre o ECA Digital of 30 July 2026 (menores de 16 anos; Se o usuario tem menos de 16 anos), knowledge/fetched/rf_1cf8a78e.raw; the file is 11460 B after the CAS edit and only the BR row was touched, so re-read before your next edit; nx_connect_juris_gate 92/92 GREEN with the strictest line now consent below 16 (method rank 2 verifiable_parental_consent, no minimum age, no barred band), which is the line an undeclared or unsourced place gets. Detail and evidence on youthsafety.plan YS1.
2026-09-26	REVIEW	lesson	A census that models the defective pass but not the pass that runs before it overcounts: opt_strength_reduce rewrites a power-of-two product into a shift before opt_reassoc sees it, and 5 of the 11 organ MUL candidates were that (gx_pbr_ggx Q=2^20 and SW, weather_pattern q, water_erosion q=16384, world_quality_grader q=16384). And a predecessor reported as killed before any work had written, built and run both the census organ and the fixture: nx_spendgate refused this seat's own freshly written duplicate census by name, so read knowledge/gates and nx_presubmit before writing an organ.
2026-09-26	CN13-DEVICE	land	W10 RESUME-TOOLCHAIN (T0 1790436669): the scalar bit-op family now lowers through all three wasm links and the three binaries are LIVE. FOUND HALF-DONE: after row 1790375250 the killed W8 seat had added CLZ32 CTZ32 BSWAP64 emitter arms (nx_wasm.nx mtime 1790375646), i32.clz and i32.ctz assembler rows (nx_wat_compiler.nx 1790375686) and VM arms (nx_wasm_vm.nx 1790375659), none journaled or gated, and had already promoted the popcnt-only nx_compile_wat dc902394 (prev c3d93ccb) and nx_wat_compiler 92dedca3 (prev 9bb45b5d) with no row; its gate still asserted __ctz32 was refused, so the promoted gate read RED against its own sources. The next OPAQUE refusal, measured: opcode 27 in nx_bits_rotl64. LANDED: OP_ROTL64 and OP_ROTR64 emitter arms through the incumbent wat_emit_binop (i64.rotl 0x89, i64.rotr 0x8A), assembler rows WC_OP_I64_ROTL 78 and WC_OP_I64_ROTR 79, VM arms (count modulo the lane, the wrapped bits masked because the VM shift is arithmetic). Sources after: nx_wasm.nx 53818 B, _hdl_build/nx_wat_compiler.nx 52191 B sha256 f01caf49, nx_wasm_vm.nx 54926 B sha256 bb48d815. REFEREE nx_wasm_popcnt_gate extended to the whole family (19160 to 38637 B): a fixture per member, two references per case (native lzcntl tzcntl bswapq rolq rorq against bit-length, isolate-lowest-bit, byte-walk and masked-shift definitions), hand-assembled VM modules for the four single-instruction members, rotate counts past the lane and negative, the arm-less control moved from __ctz32 to OP_CALL_INDIRECT 144. RED 139/203 against the served popcnt-only pair (job 1790438578, all five members refused at emit exit 3), GREEN 203/203 on the new pair (job 1790438628). The first RED read 142/203 and convicted my own gate: bswap64, rotl64 and rotr64 of all ones answer -1, the not-run sentinel, so three chain cases passed without running; fixed with a ran flag on both routes, after which RED was exactly the predicted 64. CONTENT RULER (nx_contentdiff via /api/organ_run): compile_wat c3d93ccb to dc902394 (the W8 promote across 12.9 days of closure drift) lost 0, ONE-WAY-GAIN of 668 runs (i64.popcnt, four new parser field-assignment diagnostics, 34 source paths); dc902394 to d9a4389a lost 0, gained exactly i64.rotl i64.rotr i32.clz i32.ctz; wat_compiler 9bb45b5d to 433e9803 lost 0 gained 6; vm_verify 193e72f6 to f9de562d lost 3 SYMBOL NAMES (sys_openat_append, gv_cat, gv_catn: the shared journal writer moved to nx_framed_append.nx, source added, journal-open lock fsync strings gained), behaveprobe IDENTICAL on one input but on an rc-3 input-refusal path (a weak probe, named as such). PROMOTED on the plain lane, /api/build first (src_path verified each time) then /api/promote with expect_sha256: nx_compile_wat d9a4389a 768944 B (serving root and _offc twin byte-identical), nx_wat_compiler 433e9803 82984 B, nx_wasm_vm_verify f9de562d 143384 B, prev banked by each promote. LANE: /api/promote_toolchain admits only nx_cc_sovereign, nxasm_x86_main and nx_sov_build_run (md_toolchain_target_ok in nx_mgmt_data.nx) and none of the three exists under buildroot/_offc, so the canaried lane refuses them by construction; their MCP rows exec the serving root.
2026-09-26	R1	land	ROOT FIX REACHES THE DEVICE PATH (VERIFY-ROOT-REGISTER, wave 10). The closure census found the one register door that bypassed the owner: runtime/_hdl_build/nx_opaque_wire_server.nx osw_register_store appended with nx_uas_append (additive supersede) and nx_opaque_client_gate pinned re-registration of a taken handle as a feature (debt 1790372544). FIX: osw_register_store now returns _ma_store_rc(nx_uas_create(...)) and refuses the recovery-suffix shape through the flow's own _ma_is_rec_handle (a device-registered account has no recovery row, so a free handle plus the recovery suffix would let anyone mint that user's recovery credential); source c6cdce91 9807 B to 10254 B, banked knowledge/bank/nx_opaque_wire_server.nx-c6cdce91-20260926, no direct nx_uas_append remains in it. GATE nx_opaque_client_gate d43fef12 23109 B to 24267 B (banked knowledge/bank/nx_opaque_client_gate.nx-d43fef12-20260926): the feature-pin becomes crypto steps still complete, taken handle refused -1412 USER_EXISTS, first owner row still live, stored record byte-identical to the first registration, and a neg-control that the recovery-suffix shape is refused -1400. RED 44/47 on the unchanged owner (job 1790438695, copied to knowledge/status/harness/evidence-nx_opaque_client_gate-red-on-old-owner-20260926.out sha256 d44c6712; exactly the three new teeth: actual 0 vs -1412, 96 record bytes differ, actual 0 vs -1400), GREEN 47/47 on the fix (job 1790438894). SHIPPED by nx_organ_ship sha 22ecca89 354968 B: 2 lost runs named (the old tooth name, and the _ma_register_credential symbol no longer linked) under allow_loss_v1 c7822c4c; behaviour DIFFERS reviewed in knowledge/status/harness/review-nx_opaque_client_gate-createonly-20260926.txt sha256 2a420066; promoted live==staged, _offc twin installed, registered; /api/gate_run on the served binary exit 0 GREEN 47/47. Debt 1790372544 EATEN (job 1790439449). Also measured since row 1790438980: nx_email_portal_legacy_candidate_gate 12/12 GREEN, so closure gates now read GREEN 31, NOT GREEN 5 (all attributed, none to the root fix), compile proof 2, test programs 4 UNMEASURED. NOT LIVE before or after: no route serves osw_; a device-register route inherits create-only when wired. OPEN for other lanes: hub/nx_modern_auth_flow_verify_t343.nx is a PRE-FIX twin of the flow (line 331 still appends unconditionally) imported by a t343 verification chain (nx_auth_verify_gate_t343, nx_site_auth_verify_t343, nx_host_backlog__t343; none built into a served daemon, no supervisor row), a parallel copy for the lifecycle lane to mine and archive; debts filed 1790439049 (sev 7, docportal dad_map_get unmaps 4 GiB after a total+16 map, crashes nx_browser_forms_e2e_gate at E5, same code serves :18456) and 1790439055 (sev 4, nx_siteedit_gate stale sed_handle arity).
2026-09-26	CN13	measure	W12 ROLLOUT-CONNECT to the ALPHA-REBUILD seat (sole editor of nx_connect_serve.nx) -- THE TREE SERVE IS BEHIND PRODUCTION ON ONE CAPABILITY: /sealed no longer emits the sender verified flag. Served 3e46d193 emits {f, p, vf 0 or 1, s, ct} per message (txtscan of the bank: the literal run {"f":".","p":".","vf":.,"s":.,"ct":"."}); buildroot/runtime/_hdl_build/nx_connect_serve.nx 125800 B emits f, p, s, ct only (shelltool grep for the quoted vf key over buildroot/runtime: 2 matches in 26628 files, coverage_complete=1 corpus_complete=1, both inside nx_connect_pubkey_bind_gate). MEASURED: nx_connect_pubkey_bind_gate built from the current tree reads RED 12/13, T13 /sealed carries the sender TRUE verified flag both ways FAIL (qualify job 1790439385); the COMPLETE content inventory 3e46d193 to alpha e8ef423a (nx_contentdiff_export, complete=1 runs=821 missing=11, knowledge/gates/w12_rollout_cdx_3e46d193_e8ef423a.txt) lists the vf key run as missing, so every alpha-lineage build lacks it. FIX (the /sealed emitter, after the p value and before the s key): emit the vf key with byte 32 of sh_own_at(sh, sp2) as 1 when verified, 0 otherwise or when sp2 is negative, restoring the served contract byte for byte; the other 10 missing runs are the mount-composed URLs and cookie strings, the reworded startup and bind messages and 3 code-byte fossils. The production rollout build waits for this fix until T0+3600 (1790441269); a build without it ships a NAMED capability loss.
2026-09-26	ACTIVITY	land	W11 SEAT GATES-COMPLETION, nx_connect_activity_gate (cav_plan_event, the faithsocial watch Activities planned together; REVIEW R5c NOT-AN-ISSUE, the lib composes ev_rsvp and the circles) BITE-PROVEN, SHARPENED, SHIPPED, REGISTERED, ROSTERED and cited as evidence. (1) nx_gate_bite through /api/organ_run job 1790437447, 2 sites over runtime/_hdl_build/nx_connect_activity.nx: cmp site 0 at off 8364 KILLED, valid_mutants 1 invalid 0 void 0 not_reached 0, restore byte-verified by the harness and re-hashed by nx_filehash b6e826b1 29786 B. (2) first-kill-wins proves the gate CAN fail, never which guards it reaches, so the WHOLE youth-safety invariant was mutated in place (lib banked first at knowledge/bank/nx_connect_activity.nx-b6e826b1-w11-20260926; its gate is its only importer, grep over buildroot/runtime corpus_complete=1): the minor-leader guard deleted in cav_team_found, cav_team_join and cav_judge_add plus the youth-closed, second-team and no-team RSVP guards, and all 59 old teeth stayed GREEN -- an adults-only activity admitted a minor and a minor founded, led and judged a team with nothing RED. (3) gate 26705 to 28564 B: cag_closed_teeth on the adults-only s3 activity with a fixture-reached tooth, six named refusals (CAV_YOUTH_CLOSED, CAV_MINOR_LEADER for join, found and judge, CAV_OTHER_TEAM, CAV_NOT_PARTY) and an adult-cook control; GREEN 67/67 on the pristine lib (job 1790439060), RED 61/67 on the same mutant with exactly the six refusals failing (job 1790439280, actual 1 on the youth-closed tooth means the minor was admitted); lib restored from the bank and re-hashed b6e826b1. (4) nx_organ_ship sha e6ef5113 at 59/59 (job 1790437528: first promote, _offc installed, registered callable), re-shipped sha 9d33e418 at 67/67 (job 1790439431, content GREEN, behave DIFFERS as expected); admitted to knowledge/gateroster.conf mechanically by nx_gate_roster_run trial (GREEN 224 ms, journal knowledge/status/rostertrial_w11_connect_activity.jrnl, job 1790437694) then admit (admitted_new 1, partition reconciles, job 1790437775); cited in knowledge/compare/connect.gates beside the service gate so the page forks it live. OPEN: connect.plan still has no rung row for activities (owed since 1790361810); the Meetup, Iron Chef and church two-deep baselines remain UNVERIFIED; the faithsocial watch flip is read on the next faithsocial regen, a receipt and not the proof.
2026-09-26	CN17	land	W11 SEAT GATES-COMPLETION, nx_connect_service_gate: the 45 SHARE teeth bite-tested for the first time, six blind guards found and closed, gate re-shipped. SAFETY FIRST: nx_connect_service.nx is imported by nx_connect_api_lib (wave 10 owns it and rebuilds the alpha daemons against it), so no mutant ever touched the shared lib: every mutation ran on an ISOLATED COPY (nx_connect_service_w11bite.nx beside a gate copy whose one import named it, byte-identical otherwise); the shared lib read f85153b2 45937 B before, during and after. (1) nx_gate_bite job 1790437779, 2 sites: cmp site 0 at off 8822 KILLED (need board), valid 1 invalid 0 void 0 not_reached 0 killed 1 survived 0, restore byte-verified. (2) first-kill-wins cannot say which SHARE guards are reached, so the whole invariant was mutated on the copy: both live checks, the second-side check, the same-item check and the self check in csh_share_match, the longitude reach check, and the poster-only check in csh_share_close deleted together read 114/114 GREEN (job 1790438239) -- six guards SURVIVED, no tooth reached them. Control: deleting only the consent guard read RED at neg-control-share-no-match-without-consent (job 1790438410), so the method discriminates. (3) gate 39851 to 43891 B: csgs_edges on a fresh share block (the first scenario's counts and transcript untouched) with a fixture-reached tooth and eleven more: a self match answers CSH_SELF, two offers CSH_WRONG_SIDE, another item class CSH_ITEM_MISMATCH, a far longitude CSH_TOO_FAR, a stranger's withdrawal CSH_NOT_PARTY, the poster withdraws OK then ALREADY, a withdrawn offer matched says CSH_NO_SHARE by name (visibility also refuses it as INVISIBLE, so the live guard is DEFENCE IN DEPTH and the tooth pins which refusal answers), invisible to a neighbour, still visible to its poster, and a live second offer control. GREEN 126/126 on the shared lib (job 1790438583), RED 119/126 on the six-guard mutant with seven edge teeth failing and all 114 old teeth passing (job 1790438725). (4) re-shipped by nx_organ_ship sha 9fabf59c (was 6d783160; prove 126/126, content GREEN, behave DIFFERS as expected, promoted, _offc installed, already registered, already rostered) and cited in knowledge/compare/connect.gates. (5) both source copies ARCHIVED by nx_retire_path to knowledge/retired (buildroot_runtime__hdl_build_nx_connect_service_w11bite.nx-1790439163 and the gate copy -1790439145, reversible); mining receipt: scratch fixtures carrying no MCP verb, API route, plan step, RACI row, clock row or ritual. RESIDUE: the copy gate's build fossil buildroot/_build/nx_connect_service_gate_w11bite.sov.elf stays (nx_retire_path refuses any .elf name by design); nothing registers, rosters or forks it. OPEN: CSH_STATE_FULL and out-of-range listing ids in csh_share_match still reach no tooth (robustness, not safety); whether a withdrawal after mutual confirmation should still release the pickup detail is unspecified in csh_share_released; the need board beyond site 0 was not whole-invariant probed this leg.
2026-09-26	ALPHA	measure	W11 VISUAL-REVIEW, the account page and the sign-out interaction (clean profile, the review's alpha test account): a GET of /alpha/connect/logout renders Your account and does NOT sign out (the Sign out of this browser button posts; the session survived, /features stayed signed in), and the form's own POST from a local page signed the profile out (/features back to its signed-out gate; the POST was accepted from Origin null like the register POST, the clearing Set-Cookie applied). The account page paints its Encryption identity sentence across three lines on both doors (published key is bound to @ then the bold handle and so no one can publish a key under your name but you at 16 px under a 14 px note), because nx_connect_serve builds the note with cu_note (which closes its own paragraph) and emits the handle and the clause after it -- ACTUAL, debt filed (job 1790439724). The referee graded the account page desktop DEFECTS at 2.84, but that box is the page wrap div, a text box only because the escaped 54-character clause lands directly in it; the referee searched its glyphs over the whole 1060x676 box (letters 225) and graded the wrap's declared #182031 against the Sign-out button's #2f5fd0 paper (2.85 by hand) -- an instrument false positive queued on cms.plan CM6, not a contrast defect of the page. Account page phone OK 25 of 25.
2026-09-26	ALPHA	queue	W11 VISUAL-REVIEW closing, what is open. Debt rows from this seat, each read back from its job artifact: 1790438899 (sev 5, alpha footer --faint 2.84:1, owner nx_connect_ui.nx line 81, remedy nx_ink_derive_lib), 1790438906 (sev 3, /features marks no nav tab current), 1790439538 (sev 3, the account page note lets the handle and clause escape its paragraph, owner nx_connect_serve cu_note), 1790438914 (sev 5, the shared capture profile holds a saved nishifamily.com credential, cms CM13). STILL UNMEASURED on the painted page: both dark themes (the driver has no colour-scheme door), the front door phone menu sheet opened (the driver cannot click; its 7 links read unpainted closed), placeholder text contrast (not a box in the capture map), and every alpha page after the wave-10 ALPHA rebuild against nx_connect_api_lib 26d83c5b (8 wired): /features and the youth, antistalk and family rows must be re-captured and re-graded before that build counts as delivered. Recipe for the next seat: cdp_capture.conf doors or a scratch conf with the same oracle and a profile of its own, the register form's own POST from a local page for a signed-in session, nx_page_pixjudge per door, and read a DEFECTS box whose letters far exceed its textlen as a question (cms.plan CM6 1790439741). The test account w11visrev0926 remains on the alpha (signed out of the clean profile; alpha accounts may be reset). Production /connect was not touched.
2026-09-26	CN13-DEVICE	measure	W10 RESUME-TOOLCHAIN referee re-shaped and SERVED GREEN. The first promoted cut of the family gate (ac30a6ed, 203 per-case teeth) read GREEN 203/203 when run whole (nx_organ_ship PROVE, job 1790439076) but RED through /api/gate_run (job 1790439412): exit 141 with every visible tooth PASS, capture 16384 of 16384, capture_truncated 1 -- the FAST path captures MA_GR_CAPTURE_CAP 16 KB and the gate died of SIGPIPE writing its 23.5 KB transcript. A verdict must fit the reader that serves it: the family teeth now aggregate per member per route, bound to the case count (reference-native-equals-definition-X-cases-agreeing, vm-direct-X-cases-matching-the-reference, chain-vm-X-cases-matching-the-reference, each actual against expected 7, a case counting only when its call RAN), popcnt keeps its per-case teeth, and the VALUES block prints every reference plus every disagreeing case. Source 39670 B sha256 96f94db8. RED 85/119 against the popcnt-only pair (the banked .prev dc902394 and 92dedca3, job 1790439794: exactly the predicted 34, all five members refused at emit), GREEN 119/119 on the new pair (job 1790439728). PROMOTED 7327a2a0 169360 B (/api/build src_path verified, staged bytes identical to the proven _build artifact, contentdiff lost 1 run = the symbol wp_nmcase, no longer linked; allow_capability_loss with that run named). SERVED: /api/gate_run target=nx_wasm_popcnt_gate FAST exit 0 GREEN 119/119, 12016 B, capture_truncated 0 (job 1790439861), SUBJECT ./nx_compile_wat.elf and ./nx_wat_compiler.elf = the promoted d9a4389a and 433e9803. nx_organ_ship reached PROVE GREEN both times and stopped at needs-intervention: first the 9-run loss set (record knowledge/status/harness/loss-d6ef76f6....record, all 9 = the superseded ctz-refusal control names, its fixture file names and the old head and verdict text), then after allow_loss_v1 the behaviour probe DIFFERS (live gate rc 1 vs staged rc 0, the intended change) and wants a NISHI-SHIP-BEHAVIOR-REVIEW file; the gate was promoted directly on /api/promote with expect_sha256 instead, so the loop's offc-twin and verify stages did not run for it.
2026-09-26	CN13-DEVICE	queue	W10 RESUME-TOOLCHAIN, what is OPEN (the OPAQUE device client is still NOT a wasm module). (1) MEASURED NEXT REFUSAL, on the promoted nx_compile_wat d9a4389a through its own MCP row: IR opcode 142 OP_SHA256_NI_BLOCK in sha256_compress_ni (buildroot/runtime/nx_sha256.nx:212, the SHA-NI block intrinsic __sha256_ni_block), which runs only when c.ni_ok, set at nx_sha256.nx:339 from __cpuid_ebx(7,0) bit 29 -- and OP_CPUID_EBX 133 has no wasm arm either (nx_wasm.nx CPUID count 0). No WAT, so no size, no hash, no VM KAT of ocl_register_blind_det against the C.1.5 vector this leg (the KAT must use the _det entry: ocl_register_blind draws a CSPRNG blind, so it can never equal a pinned request). The choice is the wasm lane owner's and has two honest shapes: (a) OP_CPUID_EBX lowers to i64.const 0 (a wasm target has no x86 feature bits, so every feature-gated fast path is dead at run time) plus OP_SHA256_NI_BLOCK lowered to a real software block ($nx_wasm_sha256_block over the same state, block and K contract, bit-identical to sha256_compress_sw, judged by the NIST KAT through both VM routes); (b) the same cpuid arm plus a trap-only arm for 142 -- cheaper, but it moves an ungated misuse from a compile-time refusal to a runtime trap, which weakens the wat_die_unlowerable guarantee and needs the owner's decision, not a seat's. After 142 and 133 the chain is UNMEASURED; candidates by source read: OP_MUL256_WIDE 143 (fused 4x64 multiply, BMI2 and ADX class) if the P-256 lane reaches it, and nx_cpu_features.nx cpuid gates. (2) HAZARD, not measured: every non-mmap __syscall lowers to a declared result-0 no-op in wasm, so nx_csprng's getrandom path (4 __syscall sites in nx_csprng.nx) returns 0 in the browser -- the non-deterministic ocl_register_blind must not run in wasm until the CSPRNG is an import (crypto.getRandomValues) with its own tooth. (3) VM-ARM BITE NOT RUN: the direct-route teeth for i32.clz, i32.ctz, i64.rotl and i64.rotr were never shown RED on a VM without those arms (the RED runs varied the forked emitter and assembler; the VM is composed in-process and the arms sit inline in wm_call, thousands of numeric sites, so an aimed nx_gate_bite needs an aimlist of wm_call first). (4) nx_organ_ship for the gate needs a NISHI-SHIP-BEHAVIOR-REVIEW file for its intended behaviour change; the gate was promoted on /api/promote instead and has no _offc twin (the MCP row and /api/gate_run use the serving root). (5) the /api/gate_run FAST path captures 16 KB and SIGPIPEs a longer gate into exit 141 RED with every tooth PASS; the capture should drain to EOF and announce truncation instead of killing the subject (mgmt daemon owner; not redeployed by this seat).
2026-09-26	RACI-UNIFY	measure	nx_raci_sov_gate migrated onto nx_gate_verdict (D001, the promote refused the hand-rolled verdict) and SHIPPED f94d3929 (promoted, _offc twin installed, registered): fixture run 47/47 GREEN including 16 reviewed-append teeth (dry-run places rows at extent..extent+n-1 and writes nothing; exact three-hash apply; whole-plane and indexed validators agree; rows below the extent byte-exact; the owned dispatcher still resolves host_operator; replay answers from the retained witness; a fresh dry-run of an applied request is a no-change; neg-controls for an existing activity, a partly present request, two Accountable roles, no Responsible, bad flags, a comment line, an unterminated row, an absent request, an intervening commit and a tampered binding; the real CONNECT request against a clone of the real authority). PLANTED DEFECT: the existing-activity refusal removed from rna_transform turned the gate RED 46/47 on exactly that neg-control; restored, GREEN 47/47; restore proven byte-exact by a BUILD-CACHE HIT reproducing the promoted nx_raci_reconcile sha 790fb470. Ship evidence: 29 enumerated lost runs (26 nx_plan_run_contract strings the gate closure no longer links since the dispatcher moved onto nx_plan_run_core and nx_raci_checked_owner, the superseded usage line, the hand-rolled PASS and FAIL tokens a D001 migration deletes), behaviour review knowledge/status/harness/review-raci-sov-gate-d001-append-20260926.txt.
2026-09-26	RACI-UNIFY	land	ONE STORE decided by readers, gates and authority: knowledge/store/raci is read through nx_raci_sov raci_read_all by the router nx_orchestrate_raci, nx_pm and nx_pm_plan_report, is the only RACI store with a validator (one Accountable, at least one Responsible, no duplicate cells) and a gate, and is the survivor the R5b referee named (debt 1790372867). LIFECYCLE: knowledge/registry/nishi_raci.tsv is SUPERSEDED (header marker written: successor store, the writer verbs, the two readers still on it); MINING RECEIPT: its 67 activities and every cell are in the authority (the design-architecture duplicate pair is the normalized union), its prose charter (role and activity lists, the verify-versus-monitor and train notes, the crew-completeness and CONNECT notes) stays in the file until ARCHIVED with it, its readers are nx_pm_dashboard and nx_crew_roster_gate (re-point owed), and no writer remains legitimate. LANE PLANE knowledge/store/raci- keeps lane status (a separate concern, 110 rows unchanged): the six CONNECT lane rows' stale NOT-yet-in-knowledge/store/raci notes were superseded by setcol col 6 naming the authority generation, and their R A C I columns were checked cell by cell equal to the projection of the authority under the lane convention (R lists the Responsible roles other than the Accountable one, plus-joined), so for CONNECT the lane plane is a derived view in content. PM readers untouched and still read: nx_pm_board over the live planes exit 0 rendering 24 management lanes from raci- (/tmp/pmboard_raciunify_1790440000.out).
2026-09-26	CN17	land	W11 SEAT GATES-COMPLETION, the NEED board half of the same probe, same isolated-copy discipline (shared lib f85153b2 untouched). The gate never called csh_close and asserted neither CSH_NO_NEED nor CSH_NOT_MEMBER (nx_txtscan count 0 each over the gate source). gate 43891 to 46385 B: csg_need_edges on a fresh board (two needs, the board scenario's counts untouched) with a fixture-reached tooth, an id no member holds cannot offer (CSH_NOT_MEMBER), only the poster closes a need (CSH_NOT_PARTY), close OK then ALREADY, a closed need takes no offer and says CSH_NO_NEED by name, a closed need is invisible to a neighbour and still visible to its poster, and an open-need control. On the copy with the need live check, the member check and the poster-only close check deleted together the gate read RED 131/135 with exactly four need-edge teeth failing and all 126 earlier teeth passing (job 1790439989): those three guards had no tooth. Two of them are DEFENCE IN DEPTH for behaviour (visibility still refuses, answering INVISIBLE instead of the named refusal) and the teeth pin the name; the poster-only close guard is not -- without it a stranger closes someone else's need and nothing else stops it. Re-shipped by nx_organ_ship sha 2ea48cf4 (prove 135/135 GREEN on the shared lib, content GREEN, behave DIFFERS as expected, promoted live_sha equals staged_sha, _offc installed, already registered; job 1790440032), connect.gates label now reads 135/135; copies restored to pristine then ARCHIVED again by nx_retire_path (knowledge/retired ...w11bite.nx-1790439958 and ...gate_w11bite.nx-1790439950). Service gate net this leg: 114 to 135 teeth, nine blind guards now each owned by a named refusal.
2026-09-26	CN13-DEVICE	land	W10 RESUME-TOOLCHAIN closing. Debt 1790439972 (sev 5, scope connect-device-wasm-lowering, DEBT-ADDED read from job 1790440059) carries the measured next blocker (IR opcode 142 then OP_CPUID_EBX 133), the unblock recipe and the CSPRNG hazard as a child of arc row 767, which stays open because the OPAQUE client is still not a wasm module; no prior debt row tracked the bit-op lowering (nx_debt find popcnt 3 unrelated rows, opaque_client 1 unrelated eaten row). nx_wasm_popcnt_gate is now on the gate roster (knowledge/gateroster.conf 92551 to 93354 B, its WHY row above it). nx_catalog after: nx_compile_wat, nx_wat_compiler, nx_wasm_vm_verify and nx_wasm_popcnt_gate each BUILT equal to PROMOTED with producer provenance CURRENT_BYTES_BOUND. ROLLBACK SLOTS, stated plainly: the gate was promoted twice this leg, so its .prev holds ac30a6ed and the W8 gate a0aa8f48 (a strict subset of today's teeth apart from the retired __ctz32 refusal control, and RED against the current sources) is no longer on disk; the three tools were promoted once each, so their .prev files hold the W8 generation (dc902394, 92dedca3) and the pre-W8 generation stays banked in knowledge/bank (c3d93ccb, 9bb45b5d, 193e72f6). Production /connect and the alpha daemon were not touched by this seat.
2026-09-26	RACI-UNIFY	queue	OWED, named with measured blockers. (a) Lane-plane PROJECTION MECHANISM: raci- R A C I columns are still authored in the plane; for CONNECT they equal the authority by inspection, but nothing enforces it. Blockers measured this leg: raci- mixes row schemas (vault-suite, Gx-, MH-, TWIN-, CREATOR-, LANG-, ROLLOUT- carry a description in col 1, so nx_pm_board renders a description as R, e.g. vault-suite r=family-suite vault/companion lane); research disagrees (raci- A=pm, authority A=researcher); about 104 lanes exist only in raci- (MH, TWIN and CREATOR rows are work records misfiled as lanes); nx_pm_board renders only 24 of 110 lanes (silent lane cap, the CONNECT lanes are never shown on the board). Remedy: a projector verb on the owner that renders each authority activity to the lane shape plus a drift census partition (agree, drift, lane-only, authority-only) as a tooth in nx_raci_sov_gate, then PM readers derive R A C I through raci_read_all and raci- keeps only status and note; adjudicate research; migrate lane-only rows through append-reconcile. (b) nx_pm_dashboard and nx_crew_roster_gate still read knowledge/registry/nishi_raci.tsv: re-point to raci_read_all, then ARCHIVE the TSV with nx_retire_path. (c) connect-frontdoor (Accountable=architect) has no raci- lane row. (d) nx_raci_reconcile is registered for admin caps only (its header forbids read caps). (e) nx_pm_board_gate reads 1/5 RED on T1 to T4 (executive tallies, debt schema, incidents, ROI), teeth that touch no RACI plane, PM lane owner, cause UNVERIFIED; nx_pm_cockpit_gate 17/17 GREEN including its RACI emitter and JSON RACI teeth.
2026-09-26	RACI-UNIFY	lesson	A store whose only writer was a gate froze the moment the gate correctly became read-only: v2 removed the last path into the authority, so for 2.7 days every owner a seat declared went to the TSV the router cannot read, and the lane plane grew a second answer beside it. An authority with no reviewed writer manufactures its own duplicates. Second lesson, paid inside this leg: a tooth that asserts a one-time transition (appended above zero) goes RED the moment production reaches the state it was written to prove; assert the invariant (the request is whole in a validated clone) instead.
2026-09-26	CN6	queue	CHATSTORE-EXTRACT wave-11 seat: consolidation STEP 1 of the CN6 SPRAWL (debt 1790372726, review R4) is DONE and step 2 is ready. The comms C1 store is now a library: buildroot/runtime/nx_chat_store_lib.nx (every CS_ const and all 29 cs_ verbs and helpers, moved byte-for-byte; release rebuild of nx_chat_store byte-identical before and after, sha 55bd24ba), proven importable STANDALONE by its own in-process gate nx_chat_store_lib_gate 20/20 GREEN (it imports only the lib and the verdict lib, then drives open append fetch and reads the row back from the plane). nx_chat_store (98555eff), nx_msg_sync (fe855c39) and nx_game_chat (01e3d134) all import it and are shipped with their gates GREEN (29/29, 15/15, 13/13). STEP 2 for a later seat, in this order: (a) re-seat CONNECT on the lib -- every msg_store_ caller and nx_connect_franking mfr_relay store through cs_store_forward and read through cs_fetch, one room plane per conversation; (b) REPLAY DEDUP keyed by (sender, client msg id) BEFORE cs_store_forward, because the C1 store has no idempotency key and the msgstore log_append keys the id alone (a second sender's message at the same id is answered with the first one's seq and never stored); (c) the caller contract: every cs_ verb prints its verdict line on fd 1 and returns an exit code, so an in-process CONNECT caller that needs rows in memory needs a NEW lib verb (a buffer-returning fetch), never a silent change to cs_fetch; (d) cs_ and CS_ are owned by the lib in any importer's closure -- check CONNECT's names first; (e) then nx_connect_msgstore goes SUPERSEDED then ARCHIVED through the lifecycle (nx_retire_path with a mining receipt of its verbs, API routes, gate teeth and callers), never deleted. Wave 10 owns franking this week: coordinate before touching it.
2026-09-26	CN13	measure	W12 ROLLOUT-CONNECT follow-up for the ALPHA-REBUILD seat on the /sealed vf regression (row 1790439480): it HAS a live consumer. sites/nishifamily/synth/connect_device.html line 30 (the signed-in device messenger, debt row 1785048275 BADGE-CANNOT-LIE) syncs from production /connect/sealed and stores v:m.vf as each auto-added contact verified badge, so a build without the key renders every verified sender as unverified to that page. Measured on the production candidate 2d9ca777 (built 1790439905 from appd ea54f039, serve 115cf4b3, store c4ec720e, flow 601069f0, api lib 26d83c5b; banked knowledge/bank/nx_connect_appd.elf-2d9ca777-prodcand-20260926): nx_connect_prod_register_gate 29/31, only K3 vf:1 and K4 vf:0 failing (job 1790439946); complete content inventory vs served 3e46d193 missing 11 of 821, 10 adjudicated expected by runtime teeth (code-byte fossils of the unreferenced soft popcount, controls bfb02bdc and the served nx_opaque_login.elf lack them too; mount-composed URLs; composed cookie strings; reworded startup and bind lines) and 1 real loss, the vf key. The serve source the seat is editing (126055 B at 1790440173) still carries no vf key. Restoring it before the alpha rebuild lets the production rollout ship with zero capability loss; the rollout seat rebuilds and re-proves on any serve that carries it.
2026-09-26	CN14	land	W11 SEAT CIRCLES-CONSOLIDATE (T0 1790437058; debt 1790372882, REVIEW R5c): ccl_channel is the ONE entry point and hands its minor-to-minor branch to nx_connect_youthsafe ysf_peer_may_connect -- ccl_youth_channel fills the youthsafe request from the circles rows (both bands, both youth band rows, the guardian pair, the private context, the live reach, both asks, the block) and ccl_from_ysf names each answer in the circles vocabulary (CCL_FAR_BAND -24 beyond the declared span, CCL_YOUTH_BAND -26 for a minor with no youth band row, CCL_YOUTH_POLICY -25 with no loaded policy installed; an unnamed youthsafe refusal passes through as its own code), so the channel and the youth rule can no longer answer differently; circles keeps the membership part (reach first; adult pairs and adult-minor pairs through the wall as before). New state: member slots CCL_M_YB and CCL_M_NAMED (REC 5 to 7), header CCL_H_YSF (a runtime policy slot re-installed after init or reload, carried by ccl_copy_into) and CCL_H_ORQ (a YSF_RQ_SLOTS request scratch after the header, sized by ccl_state_slots), setters ccl_set_youth_policy and ccl_set_youth_band; circles now imports nx_connect_youthsafe (its policy loader makes syscalls, circles itself still makes none). Lib buildroot/runtime/_hdl_build/nx_connect_circles.nx 7ff66d3a 41453 B to ca36872b 50063 B (banked knowledge/bank/nx_connect_circles.nx-7ff66d3a-20260926-wave11). RED 85/95 on a planted phase carrying the new API and the old decisions (job 1790439897: far-band channel actual 1 expected -24, the agreement tooth, no-band 1 vs -26, no-policy 1 vs -25, plus the six guardian-act teeth of the next row); GREEN 95/95 (job 1790440076) with channel_far_band_pair -24, youth_rule_far_band_pair -307, youth_bands 4, span 0 (UNSOURCED, the strictest line); the same-band boy and girl still befriend (lane 1) and cap at community when both ask to date (2). Gate nx_connect_circles_gate c7dba5e3 26157 B to 13217370 31180 B SHIPPED 6c9b9dc3 (was 82aac86a): one lost run = the symbol ccl_link_guardian the migrated fixture no longer calls (allow_loss_v1 2ae41aa2), behaviour reviewed knowledge/status/harness/review-circles-gate-6c9b9dc3-wave11.txt (sha 6e67f50c), promoted, offc twin installed, registered; served /api/gate_run GREEN exit 0 (job 1790440554).
2026-09-26	CN14	land	W11 SEAT CIRCLES-CONSOLIDATE guardian links BY ACTS (debt 1790372549, REVIEW R2c2): a guardianship comes into being only when the YOUTH names the adult (ccl_guardian_name, the actor must be the youth, CCL_NOT_ACTOR -22) and the ADULT takes it by their own act (ccl_guardian_take, the actor must be that adult and the one named, CCL_NOT_NAMED -23), and the consent owner nx_connect_family fam_guardian_consent is the door that takes it: an unlinked adult the youth named becomes the guardian only inside their own verifiable consent, after every check passes (a failed method takes no link), with a FAM_EV_LINK row landing with the consent row (FAM_LINK_ROWS 2, refused FULL together); an unlinked adult never acts on a youth who holds their own consent; a linked guardian consents exactly as before, so the api_lib family_consent verb is unchanged. ccl_link_write is the one slot writer both doors call. Family lib buildroot/runtime/_hdl_build/nx_connect_family.nx 354445e0 29209 B to 6561a358 30381 B (banked knowledge/bank/nx_connect_family.nx-354445e0-20260926-wave11). RED 88/94 on the old family code (job 1790439902: the named coach's strong consent -102 FAM_NOT_GUARDIAN vs 1, weak -102 vs -104, link 0 vs 1, history 10 vs 12, kind -1 vs 6, self-naming 1 vs -22); GREEN 94/94 (job 1790440143). Circles gate guardian teeth RED on the planted phase (a take by someone else 1 vs -22, self-naming 1 vs -22, a never-named take 1 vs -23, a link stood 1 vs 0) and GREEN on the fix. Family gate e4955af5 26100 B to 90f53e03 28668 B (its five fixture links now named and taken; it installs the youthsafe policy and one band row for its three minors so the circles lane it narrows still opens; section 6 on a niece added last) SHIPPED 42474d04, one lost run = the symbol ccl_link_guardian (allow_loss_v1 a3311498), review knowledge/status/harness/review-family-gate-42474d04-wave11.txt (sha ce390116), promoted, offc twin installed, registered; served /api/gate_run GREEN exit 0 (job 1790440637).
2026-09-26	CN3	land	W11 SEAT CIRCLES-CONSOLIDATE liquidity guardian (REVIEW R2c3): a minor's invite is minted only BY THE GUARDIAN IT NAMES -- lq_inv_mint refuses LQC_E_NOT_GUARDIAN_ACT -16 when a member names another adult as the guardian, so the guardian on an invite is the guardian's own act, never an inviter's assertion; redemption still requires the youth to name that same guardian. Lib buildroot/runtime/nx_connect_liquidity.nx 5a0bcf3b 19195 B to c9fe201e 20131 B (banked knowledge/bank/nx_connect_liquidity.nx-5a0bcf3b-20260926-wave11). RED 71/73 on the old lib carrying only the new constant (job 1790439846: the neg-control actual 6 = an invite index minted by a non-guardian, and census-invites-minted 9 vs 8 = that extra invite); GREEN 73/73 (job 1790439978). Gate nx_connect_liquidity_gate 81fcf3a9 19585 B to 4d93525c 19902 B (the positive tooth now mints as the guardian; the old tooth name kept) SHIPPED 2de98b00: content GREEN lost 0, behave DIFFERS by design, promoted, offc twin installed, registered; served /api/gate_run GREEN exit 0 (job 1790440557).
2026-09-26	CN14	land	LIFECYCLE SUPERSEDED (wave 11): nx_connect_circles ccl_link_guardian, the actor-less guardian link (any adult linked to any minor on nobody's act). Successor: ccl_guardian_name (the youth's act) plus ccl_guardian_take (the adult's act), taken through nx_connect_family fam_guardian_consent. Behaviour kept byte-for-byte (a one-line wrapper over ccl_link_write) ONLY because callers remain that this seat does not own, each named with its line: nx_connect_api_lib L751 L752 L755 L756 (the synthetic what-if community behind lang_match, share_match and family_consent, the wave-10 lane), nx_connect_study_gate L196 L300, nx_connect_langcircle_gate L147 L148, nx_connect_service_gate L248, nx_connect_activity_gate L342, nx_connect_personhood_gate L145 (nx_absent ccl_link_guardian over buildroot/runtime matches=21 corpus_complete=1 before this change); migrated by this seat: nx_connect_circles_gate (4 calls) and nx_connect_family_gate (5). MINING RECEIPT: the door carried rules and no act -- minor and adult members only, two links at most, ALREADY idempotent, FULL named -- and every rule lives on in ccl_link_write; it carried no API route, plan step, clock row, RACI row or MCP verb of its own (reachable only through those callers). ARCHIVED when nx_absent ccl_link_guardian( reads only the definition. The ACTUAL latent part of debt 1790372549 stays OPEN until then: the api_lib what-if community still links by fiat (no real account behind it), and no served door creates a link for a real member either way.
2026-09-26	CN3	land	LIFECYCLE SUPERSEDED (wave 11): nx_connect_liquidity LQC_I_GUARD, LQC_M_GUARD and lq_member_guardian as a guardian LINK store (the duplicate REVIEW R2c3 named). Successor: circles ccl_is_guardian, taken by the guardian's verifiable consent in fam_guardian_consent after the youth names them. MINING RECEIPT: the store carried three rules -- a minor's invite needs an adult member guardian (kept in lq_inv_mint), the guardian travels with the handle and must match at redemption (kept in lq_inv_redeem as the youth's naming), and NEW the guardian must be the minter (the guardian's own act, LQC_E_NOT_GUARDIAN_ACT); no API route, plan step, clock row, RACI row or MCP verb (liquidity_seed is not_yet_wired in nx_connect_api_lib). The slots stay as the invite's provenance; readers of lq_member_guardian: nx_connect_liquidity_gate L148 and the scratch nx_zz_lqhour_probe L149 (nx_absent matches=3 corpus_complete=1). ARCHIVED when the integrator hands a redeemed minor to ccl_guardian_name plus fam_guardian_consent and the provenance reader moves.
2026-09-26	RACI-UNIFY	land	LANE PROJECTION CENSUS built in the owner (nx_raci_reconcile_lib rlp_join, rlp_projection, rlp_col, rlp_census, rlp_cli; lane convention as measured on the CONNECT rows: A is the one Accountable role, R lists the Responsible roles other than the Accountable one or the Accountable role alone when it is the only Responsible, C and I list their roles, plus-joined in authority ordinal order; the lane plane is read through the checked loader with q:<ordinal> rows and the q:n count) and served read-only as nx_raci lanes [lane-prefix] (nx_raci SHIPPED a03c8605, behaviour IDENTICAL on its validator default, nx_raci_gate 35/35 GREEN on a fresh build, 27 enumerated closure-only lost runs). LIVE through /api/organ_run: lanes 110 = agree 6 (the six CONNECT lanes) + drift 1 + lane-only 103, authority-only 60, partition sums; the one drift is RACI-LANE-DRIFT lane=research column=A lane_value=pm authority_value=researcher, exactly the disagreement the R5b referee found, and the command exits 1 while any drift stands. It fires on the known disagreement and stays silent on the six known agreements, so it is proven on real ground truth in both directions; nx_raci_sov_gate carries three census teeth over a lane fixture (agree, drift naming both values, lane-only, authority-only, and a neg-control that an agreeing lane is never reported), 50/50 GREEN.
2026-09-26	CN14	measure	W11 closure of the circles and family change, each a qualify build of the CURRENT sources (compile plus run checks, NOT promoted; each rewrote only its own _build fossil, the live binaries stay their owners'): nx_connect_api_gate 29/29 GREEN (job 1790440254, the wave-10 api lib 26d83c5b over the new circles and family: family_consent, youth_peer, lang_match and share_match hold), nx_connect_personhood_gate 65/65 (job 1790440258, cvh_guardian_act over the new consent door), nx_connect_langcircle_gate 47/47 (job 1790440312), nx_connect_service_gate 135/135 (job 1790440316), nx_connect_study_gate 68/68 (job 1790440396), nx_connect_activity_gate 67/67 (job 1790440400). The alpha and production daemons were not built, restarted or deployed by this seat; nx_connect_appd, nx_connect_serve and nx_connect_api_lib (wave-10 lane) were not edited; a later appd build carries circles ca36872b and family 6561a358, whose decisions for every api_lib call are unchanged (no api_lib call reaches ccl_channel, ccl_guardian_name or a named-unlinked consent).
2026-09-26	CN14	queue	W11 OPEN under debt 1790372882 (left OPEN, its consolidation is not complete): two more routes decide whether two minors may pair without the youth rule -- nx_connect_langcircle clc_circle_match and nx_connect_service csh_share_match each call yw_may_channel directly and never ccl_channel (txtscan: one yw_may_channel call in each, zero ccl_channel in langcircle), so two far-band minors can still be matched there, and lang_match and share_match are WIRED on the front door (their verbs take no youth band input, so they cannot express the band); api_lib youth_peer calls ysf_peer_may_connect directly (it agrees with ccl_channel now, but is a second entry point). Recipe: a match proposal between two minors applies the youth rule's band span through a circles helper over ccl_youth_band and the policy span, and the two verbs gain a youth band field. Under debt 1790372549 (left OPEN): migrate the six callers the lifecycle row names off ccl_link_guardian (api_lib L751-756 is the wave-10 lane: name then take, or name then fam_guardian_consent in the family verb), then archive it; the vouch and age-band halves of that row are untouched by this seat.
2026-09-26	ALPHA	measure	W10 SEAT ALPHA-REBUILD (T0 1790439620) INTERIM for the W12 ROLLOUT seat: the alpha runs build e0998c6b (777986 B, sha256 e0998c6bb6068caf968dae0b30752709f60578720bb8dbd962ac7856a8944545, nx_connect_appd --build-only job 1790440409 from appd 50502 B, serve 126055 B, api lib 26d83c5b, hub account store c4ec720e, hub auth flow 601069f0; nothing promoted, the serving-root twin held), pid 3108 digest_match 1 since 1790440660; nx_connect_alpha_api_gate RED 22/32 on e8ef423a then GREEN 32/32 on e0998c6b on the same gate bytes b21e7939; register takeover refused over the edge (signup gate 11/11 twice). ONE MORE appd EDIT follows (the dated release note text on /features only, a staged page) and one more alpha rebuild and restart; serve.nx is final at 126055 B. Final hashes and the full evidence row follow.
2026-09-26	CN14	land	W11 CIRCLES-CONSOLIDATE moved two more callers off the SUPERSEDED ccl_link_guardian onto the acts (the youth names, the guardian takes): nx_connect_langcircle_gate L147 L148 (source 18689 to 18936 B sha256 94f70e02) SHIPPED 4478bca5 and nx_connect_study_gate L196 L300 (24123 to 24203 B sha256 cd02de64) SHIPPED ef642591; each lost only the symbol ccl_link_guardian (allow_loss_v1 a8227bac and ff1a7c8a) and behave read IDENTICAL live against staged (langcircle 5313 B both, first_diff_off -1), prove 47/47 and 68/68 GREEN, promoted, offc twins installed. Pre-edit sources were not banked by copy; each edit is one exact reversible replacement recorded here. Callers LEFT on the SUPERSEDED door: nx_connect_api_lib L751 L752 L755 L756 (wave-10 lane), nx_connect_service_gate L248 and nx_connect_activity_gate L342 (both edited by other seats since the wave-7 rows -- 46385 and 28564 B against 39851 and 26705 then -- so not touched here), nx_connect_personhood_gate L145 (shipped by wave-10 RESUME-YOUTH this morning). Tracked as debt 1790440898.
2026-09-26	RACI-UNIFY	land	SECOND WRITER CLOSED (found by grep for callers, not assumed): nx_raci_sov raci_migrate, the v1 TSV-to-store importer, was still called by nx_conductor_registry cr_seed and nx_markets_member, and any run would re-seed rows 0..287 of the authority from the SUPERSEDED TSV, reverting the four normalized design-architecture cells to the raw duplicates behind every retained witness. It is now bootstrap-only: raci_migrate_at seeds only an ABSENT authority, and a live one answers with its own contiguous row count as total and verified and writes nothing, so the callers that only ensure the store exists keep working. Teeth in nx_raci_sov_gate: an absent authority bootstraps and verifies every row; neg-control, a live authority is never re-seeded (manifest unchanged): RED 51/52 with the guard disabled, GREEN 52/52 with it restored. No served binary calls raci_migrate today (nx_conductor_daemon and nx_markets_member are STAGED-unpromoted, nx_conductor_tick, nx_research_conduct and nx_orchestration_audit are source-only); the two STAGED artifacts predate the guard and must be rebuilt before any promote.
2026-09-26	RACI-UNIFY	queue	CLOSEOUT: debt 1790360611 EATEN at idx 4477 (its ACTUAL part, an authority with no append path, is fixed and proven: reviewed append, 39 CONNECT cells migrated, the router resolves all seven CONNECT activities, connect-frontdoor Accountable=architect bound to nx_plan_run). Production gate_run nx_raci_sov_gate GREEN on the promoted 8c53a45a (52 fixture teeth). Superseding-scope debt 1790372867 stays OPEN for the SPRAWL remainder: (1) a lane-plane projection writer and PM readers that derive R A C I through raci_read_all, measured by nx_raci lanes (110 lanes = 6 agree + 1 drift + 103 lane-only, 60 authority-only); (2) adjudicate research (raci- A=pm against authority A=researcher); (3) move lane-only rows that are real activities into the authority through append-reconcile and reclassify the MH, TWIN and CREATOR work records misfiled as lanes; (4) re-point nx_pm_dashboard and nx_crew_roster_gate to raci_read_all, then ARCHIVE nishi_raci.tsv with nx_retire_path; (5) rebuild the STAGED nx_conductor_daemon and nx_markets_member artifacts before any promote, they predate the bootstrap-only raci_migrate; (6) nx_pm_board renders only 24 of 110 lanes; (7) nx_raci_gate was rebuilt fresh GREEN 35/35 by a ship loop but is not promoted (its own lane); the promoted nx_orchestrate_raci, nx_raci and nx_raci_reconcile predate the raci_migrate edit in their shared closure, a function none of them calls.
2026-09-26	CN13	land	W12 ROLLOUT-CONNECT: THE REGISTER-TAKEOVER FIX IS LIVE ON PRODUCTION /connect (operator decision 2026-09-26: roll it out now, alpha is alpha, rollback discipline starts at beta). SERVED nishihost/nx_connect_appd.elf e0998c6b 777986 B, the bytes the alpha runs (ALPHA-REBUILD interim row 1790440850: appd 50502 B, serve 126055 B, api lib 26d83c5b, account store c4ec720e, auth flow 601069f0), so production carries BOTH takeover layers: csu_handle_taken before register and the create-only nx_uas_create that VERIFY-ROOT-REGISTER row 1790438980 read READY. Promoted by /api/promote with expect_sha256 (PROMOTED prev=1, job 1790441085; the undeclared name took the legacy staged-artifact rule), banked knowledge/bank/nx_connect_appd.elf-e0998c6b-prodcand-20260926; the pre-change 3e46d193 is in nx_connect_appd.elf.prev and knowledge/bank/nx_connect_appd.elf-3e46d193-20260925 (cmp identical). RESTART: pid 32076 start 479682637 exe 3e46d193 stopped exactly by nx_proc_kill through /api/organ_run (SIGTERM, stop_confirmed 1 in 102 ms, job 1790441123); the edge answered /connect/ 503 Retry-After 5 in the gap (job 1790441133); nx_daemon_supervisor revived pid 23283 start 505712546 parent 9271, nx_proc_observe digest_match 1 on e0998c6b, the only nx_connect_appd.elf process, enumeration complete. PROOF BEFORE (production mode on a scratch loopback port with scratch keys and accounts): gate nx_connect_prod_register_gate 29/31 on e0998c6b (job 1790441021) with only K3 vf:1 and K4 vf:0 failing, after RED 18/24 on the pre-fix bfb02bdc (the six takeover teeth) and GREEN on e8ef423a; serve-core nx_connect_auth_gate 12/12 and nx_connect_mount_gate 20/20 from the current sources. PROOF AFTER over the edge: /connect/, /connect/register and /connect/login nx_page_verify GREEN a11y 0 (jobs 1790441176, 1790441179, 1790441185); /connect/api/v1/catalog 200 text/html 11744 B with no API envelope (job 1790441196), identical to the pre-swap baseline; the no-argument gate run on the SERVED file bytes 29/31 with the same two vf teeth (job 1790441222); production connect_auth_store.log still 3460 B = 5 rows, untouched by any test. CONTENT RULER vs 3e46d193, complete inventory 821 runs 11 missing (knowledge/gates/w12_rollout_cdx_3e46d193_e0998c6b.txt): 3 code-byte fossils of the unreferenced soft popcount (controls bfb02bdc and the served nx_opaque_login.elf lack them too); /connect/logout and /connect/addcontact now mount-composed (teeth C1 C2 pass); the two Set-Cookie strings and the nxc_auth= key now composed (A1 A3 C1 K1 pass); the reworded bind-failure and startup lines (P1 reads the new banner); and ONE REAL LOSS, the /sealed vf key the device messenger /synth/connect_device consumes, shipped knowingly under the operator decision and filed as debt 1790441350 with the exact fix. Debt 1790359363 EATEN (job 1790441276). Production still binds 0.0.0.0; /api/v1 and /features stay staged-only.
2026-09-26	CN14	measure	W11 CIRCLES-CONSOLIDATE closing proofs: (1) the SUPERSEDED comment in nx_connect_circles was rephrased as a rule instead of a caller list (a list goes stale at every migration): lib ca36872b 50063 B to 9e4bace7 49987 B, comment-only, and nx_sov_build_run nx_connect_circles_gate --build-only (job 1790441307) rebuilt BYTE-IDENTICAL to the promoted 6c9b9dc3 (nx_filehash cmp identical=1, 139520 B), so no re-ship and BUILT equals PROMOTED; (2) the serve closure: nx_connect_auth_gate imports nx_connect_serve, which imports nx_connect_circles, and it read 12/12 GREEN on the current tree (job 1790441345), so an alpha or production appd build of today's sources compiles circles and its new youthsafe import. DECLARED unpromoted builds (compile plus run checks of other owners' gates, their live binaries untouched): _build fossils of nx_connect_api_gate, nx_connect_personhood_gate, nx_connect_service_gate, nx_connect_activity_gate and nx_connect_auth_gate (BUILT 519808 against PROMOTED 519024) now carry the new circles and family. Final source hashes: circles 9e4bace7 49987 B, family 6561a358 30381 B, liquidity c9fe201e 20131 B, each stable across every build of this seat after its last edit; wave-10 ALPHA land row still absent at 1790441400, so this seat edited after its 40-minute wait bound (first CAS edit 1790439447).
2026-09-26	RACI-UNIFY	measure	TSV ARCHIVE WORKLIST by full census (nx_shelltool grep nishi_raci.tsv over buildroot/runtime, 26630 files, corpus_complete=1, 56 matches, most of them comments and stage or candidate copies): live code that still OPENS the superseded TSV is _hdl_build/nx_pm_dashboard.nx line 841 (the copy the builder compiles, it reads the pm-oversight rows), runtime/nx_crew_roster_gate.nx line 97, runtime/nx_crew_serve.nx (Accountable lookups and the RACI cells it serves, a reader the R5b review did not name), the janitor scrub and sweep gates (they use the TSV as a migrate fixture and assert it survives), and nx_raci_sov RACI_TSV (now bootstrap-only). The stage and candidate twins (nx_raci_sov_path_t320, nx_raci_governance_candidate_t321 v2 v3 v4 t322, nx_raci_sov_path_stage_20260924, nx_raci_candidate_20260923, nx_raci_before_*_t399) are EC71 parallel-tool candidates for their owners. Re-point nx_pm_dashboard, nx_crew_roster_gate and nx_crew_serve to raci_read_all, give the janitor gates their own fixture, then ARCHIVE the TSV with nx_retire_path.
2026-09-26	CN13	measure	W10 SEAT ALPHA-REBUILD to the W12 ROLLOUT seat and the operator: (1) CORRECTION of my interim row 1790440850 -- it said serve.nx was final at 126055 B; I had NOT read rows 1790439480 and 1790440590 (the /sealed vf regression addressed to this seat, appended after my first journal read), so that claim was wrong. (2) The vf key is RESTORED in buildroot/runtime/_hdl_build/nx_connect_serve.nx, now 126565 B: after the p value the /sealed emitter writes the vf key from byte 32 of sh_own_at(sh, sp2), 0 when sp2 is negative, before the s key, the served {f,p,vf,s,ct} shape; pre-edit bytes banked knowledge/bank/nx_connect_serve.nx-126055-prevf-20260926-wave10. nx_connect_pubkey_bind_gate read RED 12/13 on the pre-fix 126055 B serve (job 1790441421, T13 the sender TRUE verified flag FAIL); the GREEN run and the third alpha rebuild are in flight. (3) OBSERVED, NOT DONE BY THIS SEAT: production changed at about 1790441150 -- the serving-root nx_connect_appd.elf is now e0998c6b 777986 B (the first alpha build of this seat, which LACKS the vf key), nx_connect_appd.elf.prev is 3e46d193, and the production process is pid 23283 start_ticks 505712546 parent 9271 exe e0998c6b (nx_proc_observe, digest mismatch against 3e46d193); pid 32076 is gone. This seat never called /api/promote or /api/deploy and never touched the production row or pid (its two exact stops were alpha pids 12100 and 3108); no organ_ship.jrnl row names nx_connect_appd, so the deployer is UNATTRIBUTED here. Consequence while it stands: production /connect/sealed omits vf, so connect_device.html renders every verified sender unverified (row 1790440590). The rollout owner rebuilds from serve 126565 B or later.
2026-09-26	CN13	queue	W12 ROLLOUT-CONNECT: DOORS THAT STILL SERVE THE UNGUARDED REGISTER PATH (the operator approval covered /connect only; each needs a rebuild from the current tree, which now links the create-only nx_uas_create, and a release through its own RACI lane; census = VERIFY-ROOT-REGISTER row 1790438980 plus this seat's grep of the olg_register call over buildroot/runtime, 36 matches, corpus_complete=1, knowledge/gates/w12_rollout_olg_register_census_1790439100.out): opaque_login :9091 (nx_opaque_login_daemon.nx line 484, the family login, deploy row opaquelogin via logindeploy); docportal_admin_daemon :18456 (line 666, row docportal; its invite token is not bound to the handle, so any live invite holder can re-register a taken handle); email_portal_daemon :18465 (line 669, row email, same invite class); nx_gen_gateway :18794 (line 240); nx_mesh_gateway :8055 (line 266); nx_gallery_gateway :18190 (line 357, row galxgw); nx_vault_gateway :18200 (line 386); nx_studio_gate, the /studio daemon (line 148, allow_reg defaults to 1 from argv). Login-only doors sharing an account log gain the fail-closed lookup and the per-login leak fix on rebuild: hub_gw :18792 (row hubgw) and the office daemon :8030 (row office). connect_alpha :18133 already runs e0998c6b with both layers. Per door: rebuild, prove on a scratch instance that a second register of a taken handle is refused (nx_connect_prod_register_gate is the connect model), ship through the row, nx_proc_observe digest_match.
2026-09-26	CN13	queue	W12 ROLLOUT-CONNECT: RELEASE-LANE GAPS for the connect release owner (this rollout used the task fallback, /api/promote under the legacy staged-artifact rule plus an exact stop and the supervisor revive, because nothing better exists yet): (1) knowledge/status/organ_kind.conf carries no nx_connect_appd row, so /api/promote treats the production daemon as a one-shot and probes nothing; declare it daemon; (2) deploy_targets.conf carries no connect row, so the health-checked /api/deploy cannot ship it; add one (gdeploy@connect, port:8032, live path /volume1/homes/elderwesto/nishihost/nx_connect_appd.elf) only after reading how gdeploy name-kills, because the alpha binary nx_connect_appd-<sha>.elf shares the 15-character comm nx_connect_appd with production and a comm-keyed kill would restart the alpha too; (3) plan-connect-release- step 5 (row 1790359470) still names the missing row and a placeholder sha. NEW GATE nx_connect_prod_register_gate: promoted 525b4f16 69449 B (job 1790441456), registered callable (job 1790441474), served /api/gate_run exit 1 RED 29/31 on production e0998c6b (job 1790441490), the two failures being debt 1790441350 (the /sealed vf key); no argument runs the SERVED binary file on a scratch port, a path argument runs a candidate, and it refuses to fork any subject that ignores the port argument. Not rostered by this seat: each run binds a scratch production-mode instance on 0.0.0.0 for a few seconds. Its gate_run result turns GREEN the day the vf restore ships.
2026-09-26	ALPHA	land	W10 SEAT ALPHA-REBUILD (T0 1790439620) FINAL, the alpha shows today's fixes. STAGE RUNNING: build ac638880 (778575 B, sha256 ac638880b25394d733e5f75d9e92e4f444ab0168f1ebc3502356104c60408b87, release, nx_connect_appd --build-only --release job 1790441583; nothing promoted, the serving-root twin held) as pid 11582 start_ticks 505772378 parent 9271, nx_proc_observe digest_match 1 at about 1790441745; copied mode 0755 to alpha_connect/nx_connect_appd-ac638880.elf and banked knowledge/bank/nx_connect_appd.elf-alpha-ac638880-20260926 (cmp identical). Sources at build: appd 50823 B sha256 6a018e1a, serve 126565 B sha256 a16f1d30, api lib 26d83c5b 88813 B, hub account store c4ec720e, hub auth flow 601069f0, circles and family as W11 landed them (row 1790441410). It carries the FRONT-DOOR-YOUTH dispatcher (youth_peer, antistalk_discover, family_consent wired; catalog rows 20 = wired 8 + not_yet_wired 12) and the R1 owner-level register refusal (nx_uas_create, READY per row 1790438980) behind the appd csu_handle_taken check, plus three edits of this seat in the two files it alone owned this wave: (a) debt 1790438906, serve gains CS_P_FEATURES 12 and the staged-only In this alpha tab renders aria-current on that page code, cd_page_features passes it, the now-unused CD_P_NO_TAB removed (production renders no such tab, so its pages are unchanged); (b) the dated release note on /features names the 2026-09-26 build (the three youth-safety decisions deciding over the caller fixture and storing nothing, the store-level refusal of a taken handle, the current tab) above Since 2026-09-25 the versioned API; (c) the /sealed vf key restored (W12 rows 1790439480 and 1790440590, debt 1790441350): content ruler 3e46d193 to ac638880 lost 10 of 821, exactly the 10 runs W12 adjudicated expected, the vf run back (nx_txtscan: the vf key literal once in ac638880, zero in the served e0998c6b). Plus one comment-only correction in appd (olg_register no longer supersedes a taken handle). THE RESTART RECIPE ran three times (e8ef423a to e0998c6b to c86932c0 to ac638880): the signed daemons.reg row connect_alpha repointed under content CAS, re-signed by nx_reg_sign (SIGNED daemons.reg.sig, jobs 1790440630 1790441120 1790441710), exact stops of pid 12100 e8ef423a (job 1790440646), 3108 e0998c6b (1790441140) and 23640 c86932c0 (1790441727), each stop_confirmed 1, the supervisor revived each; every superseded alpha binary ABSENT in a completed scan. BANKS before any change: the running alpha knowledge/bank/nx_connect_appd.elf-alpha-e8ef423a-20260926 (nx_filehash cmp identical=1, 719957 B), daemons.reg knowledge/bank/daemons.reg-pre-alpha-e0998c6b-20260926, sources knowledge/bank/nx_connect_serve.nx-115cf4b3-20260926-wave10, nx_connect_serve.nx-126055-prevf-20260926-wave10, nx_connect_appd.nx-ea54f039-20260926-wave10 and both alpha gate sources -20260926-wave10; intermediate alpha builds e0998c6b and c86932c0 banked beside them.
2026-09-26	ALPHA	measure	W10 ALPHA-REBUILD PROOF over the edge. nx_connect_alpha_api_gate (source 17316 B sha256 a5304b97, artifact b21e7939) gained 11 teeth: E1 the catalog marks youth_peer antistalk_discover family_consent wired; E2 the wired count equals the rows it marks wired; E3 E4 youth_peer for two same-band minors 200 allowed 1 through ysf_peer_may_connect stored 0; neg-control E5 a far-band pair 200 far_band allowed 0; E6 antistalk shown; neg-control E7 a blocked viewer not shown, why blocked; E8 family consented; neg-control E9 an adult who is not the linked guardian refused; D4 D5 /features marks exactly one tab current, its own. RED 22/32 on alpha e8ef423a (job 1790440293, exactly the 10 predicted teeth: the three verbs 501 and features aria-current 0) then GREEN 32/32 on the same gate bytes against e0998c6b (job 1790440678), c86932c0 (1790441192) and ac638880 (1790441771); SHIPPED by nx_organ_ship sha b21e7939 (job 1790441859: content GREEN, behave DIFFERS as expected, promoted live equals staged, offc twin installed, already registered). THE REGISTER REFUSAL for a taken handle: nx_connect_alpha_signup_gate (13531 B sha256 f009bcac) gained S5 a second register with ANOTHER passphrase refused (no cookie, no phrase), S6 the holder passphrase still signs in, neg-control the second passphrase never signs in, and S4b S4c the signed-in /features badges equal the catalog state by state (wired 8 = 8, not_yet_wired 12 = 12); GREEN 13/13 on ac638880 with two fresh clock-derived alpha-only handles (jobs 1790441775 and 1790441834): takeover_cookies 0, holder_login_cookies 1, second_passphrase_login_cookies 0, features_bytes 15305; SHIPPED sha d07a038b (job 1790441966, prove 13/13, content GREEN, behave DIFFERS as expected, promoted, offc twin installed). HONEST LIMIT: the takeover teeth also read GREEN on e8ef423a (job 1790440423) because csu_handle_taken refuses first, so the edge proves the door refuses and cannot say which layer fired; the owner layer is in the build closure and proven by user_account_store 39/39 (row 1790438980). vf: nx_connect_pubkey_bind_gate RED 12/13 on serve 126055 B (job 1790441421, T13) then GREEN 13/13 on 126565 B (job 1790441505); the W12 gate nx_connect_prod_register_gate forked ac638880 in production mode on a scratch port and read GREEN 31/31 including K3 vf 1 and neg-control K4 vf 0 (job 1790442032), where e0998c6b read 29/31 (W12 jobs 1790441021 and 1790441222), so ac638880 is a vf-complete candidate for the rollout owner (its qualify rewrote only that gate's _build fossil, a declared unpromoted check). Serve core on the final serve: nx_connect_auth_gate 12/12 (job 1790441779), nx_connect_mount_gate 20/20 (job 1790441783). Content ruler e8ef423a to e0998c6b GREEN lost 0, ONE-WAY-GAIN 119 (job 1790440513). nx_page_verify GREEN a11y 0 on alpha / (job 1790441842), alpha /features (1790441838) and production /connect/ (1790441848), static checks only. Six alpha-only accounts were created by the signup gate runs and ship prove, by design.
2026-09-26	ALPHA	queue	W10 ALPHA-REBUILD what stays open. (1) PRODUCTION runs the W12 rollout of e0998c6b since about 1790441150 (row 1790441360, operator decision), which lacks the vf key; the rollout owner rebuilds from serve 126565 B or later (ac638880 read 31/31 on the W12 gate) and debt 1790441350 stays open until production carries vf; this seat never touched production (its row, pid or binary) and its correction row 1790441520 called the deployer unattributed before row 1790441360 was read: it is W12. (2) Visual and interaction review of the ac638880 alpha pages is UNMEASURED: no capture this leg (W11 recipe in row 1790439800). (3) The remedy half of debt 1790438906 (eaten, job 1790441925) that asked for a nav-invariant tooth over EVERY staged-only tab is met only for the one staged tab that exists (D4 D5 on /features); a generic enumerator is owed when another staged tab is added. (4) Untouched and open for their owners: the register and logout POSTs accepted from Origin null with no token and the session cookie without Secure (auth owner, classify first, W11 row 1790439133), nav wrap on the phone, clipped register fields, placeholder contrast, dark theme, footer contrast debt 1790438899 (nx_connect_ui.nx), account note paragraph debt 1790439538. (5) csu_handle_taken stays as the first check beside nx_uas_create (consolidation debt 1790372520). (6) nx_gate_bite was not run over E1 to E9 or S5 to S7: their subject is the live alpha daemon and every mutant build of it would be a deploy; the RED 22/32 on the unchanged e8ef423a is the planted-bad proof for the E and D teeth. (7) The superseded alpha binaries alpha_connect/nx_connect_appd-e8ef423a.elf, -e0998c6b.elf and -c86932c0.elf (all banked) are unreferenced by daemons.reg, for the lifecycle lane to archive with nx_retire_path.
2026-09-26	ALPHA	lesson	A seat that declares a source final must first re-read the board for rows addressed to its seat. This seat read connect.plan once at start, then wrote serve.nx is final (row 1790440850) while two W12 rows asking it to restore the /sealed vf key had landed after that read; production then shipped the vf-less build under the operator's rollout decision. The fix took one edit and one rebuild once the rows were read. A board is a mailbox: poll it before every declaration, not only at the start.
2026-09-26	CRYPTO-LEAK	queue	W13 SEAT LEAKS (T0 1790453533) is editing, under content CAS: nx_connect_seal.nx (ADDITIVE: cseal_ws_bytes, cseal_seal_ws, cseal_open_ws over a caller-owned workspace composing the incumbent arena AEAD nx_chacha20_poly1305_pure; cseal_seal and cseal_open unchanged), nx_connect_franking.nx mfr_frank and mfr_receive ONLY (seal and open through that workspace, one mapping per call) and one header note, and nx_connect_franking_gate.nx one NEW leak section after the small-relay tooth plus a ws KAT section (it touches no existing tooth). Seen in flight from another seat: the chat-store consolidation of the same lib and gate (import nx_chat_store_lib, mfr_store_open, the two DEDUP teeth RED 65/71 on qualify job 1790455105). Nothing here edits the store plumbing; a seat that ships the gate carries these teeth and should read this row first.
2026-09-26	CN6	land	CHATSTORE-STEP2 (wave 13, debt 1790372726 consolidation step 2): CONNECT re-seated on nx_chat_store_lib. The lib gained QUIET message verbs (cs_msg_ensure, cs_msg_append, cs_msg_read, cs_msg_count, cs_msg_state, cs_msg_receipt, cs_msg_edit, cs_msg_delete; codes CS_Q_ -51..-59): replay dedup keyed by the (sender, client msg id) PAIR through key cid:<sender>:<cid> committed in ONE CAS segment with the row, receipts rcpt:<seq> forward-only through cm_advance, edits ed:<seq> additive, tombstone del:<seq> (the cs_del key), and the msgstore poison latch carried as a refuse-on-inconsistent-count check; lib 41860 to 57665 B sha256 f27dbc02. nx_connect_franking re-seated: mfr_store_open binds room acct<id> and refuses a non-positive id, mfr_relay judges the tri-state channel verdict first, refuses a record for another recipient and appends through cs_msg_append; the ctx codec is aead_put_u64_le plus mfr_get_u64_le so franking no longer pulls nx_connect_accounts and the serving-daemon closure. RED on the old code: nx_connect_franking_gate with the dedup teeth against the msgstore read 64/66 RED (job 1790454198, two-senders-at-one-client-id and the second record opening under its own sender FAIL). GREEN on the fix: nx_chat_store_lib_gate 50/50 (job 1790454709), a cid-alone mutant of cs_cidkey killed 44/50 RED (job 1790454905) then restored byte-identical f27dbc02; nx_connect_franking_gate 88/88 GREEN (job 1790455935, merged with the wave-13 leak seat's workspace-AEAD teeth, both seats edited the same gate). SHIPPED nx_chat_store_lib_gate 07788347 (job 1790455584) and nx_connect_accounts_gate e6985d82 (its T7 msgstore restart tooth moved to the lib gate T26-T30, 75 lost runs enumerated, reviewed behaviour, job 1790456113).
2026-09-26	CN14	land	W13 SEAT CONSOLIDATE (T0 1790453516; waited for and read the W10 ALPHA-REBUILD FINAL row 1790442100 before touching the alpha closure) debt 1790440898 CLOSED IN SOURCE: the actor-less guardian link has no caller left and is ARCHIVED. Every caller now makes the link by the two acts (the youth names, the adult takes): nx_connect_api_lib gains ca_guardian_link (ccl_guardian_name by the youth, then ccl_guardian_take by the adult, a refused naming returned as is) at its five sites (ca_ring2 four, ca_v_family one); nx_connect_service_gate names then takes (plus neg-control no adult takes a guardianship the youth did not name, CCL_NOT_NAMED); nx_connect_activity_gate names then takes in its youth loop; nx_connect_personhood_gate names, proves the naming alone links nobody (neg-control), then takes under the old tooth name. Qualify GREEN on the migrated sources: api gate 29/29 (job 1790454378, lang 449 share 443 family 451 reply bytes as before), service 136/136 (1790454381), activity 67/67 (1790454388), personhood 67/67 (1790454390). SHIPPED service gate 045a4974 (later 1f18c9ef on the new service lib), activity gate 64cc900a (behave IDENTICAL), personhood gate 28386b84; each lost exactly one run, the symbol name ccl_link_guardian (loss records 01351583 5833a381 70716223; reviews knowledge/status/harness/review-service-gate-045a4974-wave13.txt c15affe8 and review-personhood-gate-wave13.txt 0b191d03). ARCHIVE (lifecycle SUPERSEDED to ARCHIVED): circles 9e4bace7 49987 B banked at knowledge/bank/nx_connect_circles.nx-9e4bace7-20260926-wave13 (copy verified byte for byte), the wrapper and its SUPERSEDED note removed from the lib, its text kept reversibly at knowledge/retired/nx_connect_circles.ccl_link_guardian-20260926-wave13.nx; mining receipt stays row 1790440703 (rules only, all in ccl_link_write; no route, plan step, clock row, RACI row or MCP verb). CENSUS grep ccl_link_guardian over buildroot/runtime: 11 lines before (job 1790453875), ccl_link_guardian( matches=0 after (job 1790456178, 26660 files, coverage_complete=1 corpus_complete=1), so the compile now refuses any caller that comes back. HONEST RED: a behaviour-neutral migration has no behavioural RED; its RED is that census plus the archive compile, and every migrated link is decision-identical by construction (the same minor, adult, ALREADY and FULL rules in ccl_link_write; the naming slot returns to CCL_NONE on success).
2026-09-26	ALPHA	land	W13 SEAT ALPHA-UI-AND-PROD (T0 1790453573), after the W10 ALPHA-REBUILD FINAL row 1790442100. THE ALPHA NOW PAINTS A FAINT INK DERIVED FROM THE REFEREE'S OWN BAR (debt 1790438899) AND THE ACCOUNT NOTE AS ONE PARAGRAPH (debt 1790439538); the W10 vf restore was already in serve (read in source: vf from byte 32 of sh_own_at, 0 when sp2 is negative) and is carried unchanged. STAGE RUNNING: build cb3b5c3d (806805 B, sha256 cb3b5c3df2e69b6629e6a60fa862f0e2ae2954b64bcfd2329c7df8d8de4c24ad, nx_sov_build_run nx_connect_appd --build-only --release job 1790455414, serving-root twin held) as pid 1369 start_ticks 507171421 parent 9271, nx_proc_observe digest_match 1; copied mode 0755 to alpha_connect/nx_connect_appd-cb3b5c3d.elf and banked knowledge/bank/nx_connect_appd.elf-alpha-cb3b5c3d-20260926 (nx_filecopy verified 1 both). RECIPE: daemons.reg banked knowledge/bank/daemons.reg-pre-alpha-cb3b5c3d-20260926, row connect_alpha repointed under content CAS (expect h6d11d2d672ea665f), nx_reg_sign SIGNED daemons.reg.sig (job 1790455688), nx_proc_kill exact 11582 ac638880 signal_sent 1 (job 1790455706: state Z inside the 10 s deadline, stop_confirmed 0 because the supervisor reaps, not the killer), the supervisor revived it on cb3b5c3d. SOURCES: nx_connect_ui.nx 27907 to 31163 B (sha256 5e9fde35 to db5cadd8): palette surfaces and declared faint inks NAMED once (CU_L_* and CU_D_*), arming statics with cu_ink_set cu_ink_off cu_ink_on cu_ink_faint cu_surfaces (the nx_nishi_editorial pattern; unarmed output byte-identical, T14a), and cu_note_open cu_note_close with cu_note composing them; nx_connect_appd.nx 50823 to 55069 B (6a018e1a to 8380c422): cd_ink_arm at startup reads knowledge/pixjudge.conf contrast_min_ratio100 on the circles table's two-rung ladder, derives light and dark over --bg --surface --surface-2 through nx_ink_derive_lib, arms the kit and announces, or refuses by name keeping the declared palette; nx_connect_serve.nx 126565 to 126779 B (a16f1d30 to 061190b6): the account page writes its note between the open and close pair; nx_ink_derive_lib.nx 6821 to 9358 B (aefcd17b) ADDITIVE: inkd_conf_bar with named refusals (cms.plan CM6 row). DERIVED, no hex typed: light 8b94a6 to 686F7C (247 permil steps, worst 450 over the three surfaces, 471 on --bg where the footer paints), dark 6a7488 to 80899A (152 steps, worst 450).
2026-09-26	ALPHA	measure	W13 ALPHA-UI-AND-PROD PROOF. GATES on the final sources: nx_connect_ui_gate migrated onto nx_gate_verdict (per-tooth gv_check, the exit code carries the verdict; the hand-rolled g_tooth counter retired) and grown from 10 to 39 teeth: T11 the declared inks worked BY HAND from the WCAG definition equal the kernel at delta 0 (light on --bg 284, the referee's painted exact100 of wave 11, on --surface-2 271; dark 410 and 337), T12 the derivation (neg-controls: both declared inks fail the bar; accepted; meets the bar on every surface of its theme; one step back misses, so it is the nearest passing colour; direction read from luminance), T13 the bar reader (the referee's row, not its large-text sibling; 700 when given 700; a value ending at CR LF; neg-controls: a longer key and a comment are not the row, a non-number and a number with a tail are refused), T14 the palette (unarmed the exact pre-rung bytes; armed each theme writes its derivation once and neither declared ink; disarmed the old bytes return; the footer and the placeholder are the only two sites painting the token), T15 the note pair (same bytes as cu_note; a composed note keeps the escaped handle and clause inside one paragraph; neg-control: the account page's old call order leaves the handle outside) -- GREEN 39/39 (job 1790455410), SHIPPED by nx_organ_ship sha 1734504731e0aded (job 1790456371: first promote, offc twin installed, registered callable). nx_connect_prod_register_gate forked candidate cb3b5c3d in production mode on a scratch port: GREEN 31/31 incl. K3 vf 1, neg-control K4 vf 0 and M1 to M3 no API in production mode (job 1790455501); nx_connect_pubkey_bind_gate 13/13 incl. T13 (1790455505); nx_connect_auth_gate 12/12 (1790455619); nx_connect_mount_gate 20/20 (1790455621); on the restarted live alpha nx_connect_alpha_api_gate 32/32 (1790455798) and nx_connect_alpha_signup_gate 13/13 (1790455799, alpha-only accounts by design). SERVED BYTES: /alpha/connect/ carries --faint:#80899A and --faint:#686F7C (nx_https_get job 1790455764; the replaced ac638880 served 6a7488 and 8b94a6). PIXEL REFEREE (CM13 nx_cdp_capture on the laptop Edge through WSL with a clean profile and devtools port of this seat's own, CM6 nx_page_pixjudge on the production bars): home, register and features on four doors each (phone 390x844, desktop 1440x900, and full-height 390x2600 and 1440x1700 so the footer paints): contrast_fails 0 in all 12; the footer text box (div in footer.nx, colour 686f7c, 12 and 14 px, weight 400) paints in 10 of them and is each page's worst box at 471, where wave 11 measured 284 in 24 of 24. SIGNED IN as the alpha-only account w13ui0926b (made by the register form's own POST from a local page; the fixture holding its test passphrase was deleted after use): the account page paints the Encryption identity sentence as ONE 14 px paragraph with the handle inside it (box map: b at y 574 inside p 550 to 594, textlen 117, no text node left in the wrap div), contrast_fails 0 on all four doors; the wave-11 DEFECTS grade on the wrap div is gone with the stray node. OPEN ON THE PAINTED PAGE: phone doors grade DEFECTS on hierarchy_step_short (2 on home and account, 4 on the full home): the kit's phone rule sets h1 to --fs-3, the size h2 always has, so on a phone the title and the section heads are one size (debt filed); dark theme and placeholder contrast stay UNMEASURED on the painted page (no colour-scheme door, a placeholder is no box) though both read the derived token (T14g).
2026-09-26	CN6	land	LIFECYCLE nx_connect_msgstore SUPERSEDED then ARCHIVED (CHATSTORE-STEP2, debt 1790372726): header marker written (21094 to 21738 B), then nx_retire_path moved the lib to knowledge/retired/buildroot_runtime__hdl_build_nx_connect_msgstore.nx-1790456647 and its gate source to knowledge/retired/buildroot_runtime__hdl_build_nx_connect_msgstore_gate.nx-1790456670 (reversible, bytes preserved, deleted 0); the gate's row in knowledge/gateroster.conf is commented with its restore line (93697 to 94101 B). ABSENCE PROVEN after the move: nx_shelltool grep nx_connect_msgstore.nx over buildroot/runtime, 26662 files, coverage_complete=1 corpus_complete=1, matches=2, both comments (nx_connect_msg.nx L16, nx_connect_msg_gate.nx L2) -- no importer remains. MINING RECEIPT, each event and where it lives now: SEND with idempotent client id -> cs_msg_append, keyed by the (sender, client msg id) PAIR instead of the id alone (the defect this step fixes); RECEIPT forward-only sent, delivered, read -> cs_msg_receipt and cs_msg_state (lib gate T28-T28d); EDIT, new ciphertext appended, never resurrecting a tombstone -> cs_msg_edit on key ed:<seq> (T29-T29c, T30c); DELETE-FOR-ALL tombstone with bytes retained -> cs_msg_delete on del:<seq>, the cs_del key (T30-T30c); READ with ABSENT, TOMBSTONE and SMALL refusals -> cs_msg_read (T22-T24b, T27b); msd_path ALIAS GUARD -> mfr_store_open refuses an account id below one (franking neg-control-store-refuses-a-non-positive-account) and a room plane <store_root>chat_acct<id>- cannot alias a dir/<id>.cst world snapshot by namespace; POISON LATCH -> cs_q_tail_ok refuses any append while the count declares a row the store cannot produce and writes nothing (T32, T32b), and the whole-file overwrite the latch guarded is gone (append-only segments under CAS); YOUTH-WALL CHANNEL VERDICT tri-state, ABSENT default, only ALLOW stores -> mfr_chan_yw and MFR_CHAN_ in nx_connect_franking, judged before the store (franking teeth youth-wall allow and deny, relay refuses denied and absent); ACCOUNT BINDING -> mfr_store_open binds room acct<id>, mfr_relay refuses a record for another recipient; RESTART -> the plane's segment files (T26, T26b fresh uncached handle; census T25-T25c); ISOLATION -> one plane per room (T27-T27c). NOT CARRIED, named: the FNV-1a snapshot trailer with its TORN, TAMPERED, MAGIC, VERSION and ACCOUNT load refusals (the .msg format is gone; segment integrity is the seg-store's contract, integrity not authenticity as before); the per-send verdict audit field (only ALLOW sends were ever stored); the per-message lang field (the content-blind relay always wrote 0); an edited-flag accessor (no consumer read it). REMAINING for the lifecycle lane: the promoted nx_connect_msgstore_gate.elf, its _offc twin and its MCP registry row (no unregister verb in this seat's caps); nx_connect_api_lib L510 whose UNWIRED msg_append row still names nx_connect_msgstore.msg_store_append (successor owner nx_connect_franking mfr_relay over nx_chat_store_lib cs_msg_append; the api lib is in the alpha lane and was not edited); the two stale comments above.
2026-09-26	CN13	queue	W13 ALPHA-UI-AND-PROD to the connect release owner: PRODUCTION WAS NOT DEPLOYED BY THIS SEAT; the candidate is staged for the release lane. Production still runs e0998c6b (pid 23283 start_ticks 505712546 parent 9271, nx_proc_observe digest_match 1 at about 1790455530), which lacks the vf key (debt 1790441350 stays OPEN), the derived faint ink and the one-paragraph note. The SAME binary the alpha runs, cb3b5c3d (806805 B), is in the deploy slot nx_connect_appd.sov.elf.new (nx_filecopy verified 1, mode 0755), the src the connect row names. Content ruler e0998c6b to cb3b5c3d (nx_contentdiff via organ_run job 1790455909): lost_from_live 4 of 1597 runs (2 permil), all named: the two palette literals (now emitted from named pieces), the run that ended the p value straight into the s key (the restored vf key now sits between), and the 2026-09-25 release-note line W10 superseded; gained 42. WHY NOT SHIPPED: (1) /api/promote target=nx_connect_appd refused DECLARED-DAEMON (the W13 RELEASE-LANE organ_kind row: correct, the W12 fallback swapped a daemon with no probe), so the W12 recipe no longer exists; (2) /api/deploy target=connect refused at the global pre-deploy gate (nx_deploy_ready DEPLOY-BLOCKED: evidence-honesty BLOCK, an independent method reporting failure in some compare domain, plus 8 WARN; nothing promoted, live untouched), and by the RELEASE-LANE comment on that row the SERVED hostctl refuses a row with no field 7 until the exact-kill hostctl ships (nx_catalog nx_hostctl: STAGED 349752 B, PROMOTED 291864 B). This seat passed NO confirm_gate_override and copied nothing into the serving root. TO SHIP, once the exact hostctl is live: POST /api/deploy target=connect&confirm=yes&expect_sha256=cb3b5c3df2e69b6629e6a60fa862f0e2ae2954b64bcfd2329c7df8d8de4c24ad (with an audited confirm_gate_override=yes only if evidence-honesty is still RED and the owner accepts it), then nx_proc_observe nx_connect_appd.elf cb3b5c3d digest_match, nx_page_verify https://nishifamily.com/connect/, nx_connect_prod_register_gate 31/31 with no argument (the served bytes), and /connect/api/v1/catalog not served (M1 to M3 already GREEN on the candidate). The pre-change e0998c6b is banked at knowledge/bank/nx_connect_appd.elf-alpha-e0998c6b-20260926 (nx_filehash cmp identical 1). The superseded alpha binary alpha_connect/nx_connect_appd-ac638880.elf (banked by W10) is unreferenced by daemons.reg, for the lifecycle lane.
2026-09-26	CN13	land	W13 RELEASE-LANE (T0 1790453636). (1) knowledge/status/organ_kind.conf declares nx_connect_appd daemon (78092 to 78166 B, the row sits in the file head): /api/promote now refuses it DECLARED-DAEMON, nx_catalog reads LIVE-DAEMON, nx_builddeploy_lib holds the serving-root twin for a default build of the name. nx_organkind_gate 27/28 (T22 zero conflicting kinds PASS, T18 PASS; T24 lib-reader headroom FAIL is pre-existing, debt 1787938660). CAUGHT AND FIXED IN THE SAME LEG: my first 932 B comment block pushed 8 declared rows (nx_accept, nx_accept_gate, nx_accept_lib, nx_accept_ref_lib, nx_accept_decl, nx_glprobe, nx_glprobe_gate, nx_glprobe_lib) past the 65535-byte window of a capped kind reader, so it was shrunk to 74 B: nx_glprobe_lib now ends at byte 65527, exactly the rows visible before plus this one. (2) deploy_targets.conf gains row connect = 0 nx_connect_appd.sov.elf.new gdeploy@connect port:8032 gdeployrb@connect /volume1/homes/elderwesto/nishihost/nx_connect_appd.elf with NO field 7 on purpose (20153 to 21450 B). READ FIRST: gdeploy restarts with proc_kill_by_name, a SIGKILL of every process whose /proc/<pid>/cmdline CONTAINS the kill-name (the 15-byte comm is not what it reads), so the alpha is spared today only by the spelling of its argv[0] (./nx_connect_appd-<sha>.elf) and any process that merely names the file in an argument dies too. EXACT MODE landed in source: new lib buildroot/runtime/nx_exactkill_lib.nx (10371 B sha256 9b2bc52e) selects by readlink /proc/<pid>/exe equal to the live path or its promote rollback chain (.prev .prev2, optional (deleted)), records start ticks before anything on disk moves and revalidates them before the signal; buildroot/runtime/_hdl_build/nx_hostctl.nx (345827 B 50d59cec to 351248 B f30fc731) uses it when a gdeploy@ or gdeployrb@ row has no field 7 and for gdeploy <live> with no kill-name, refuses a relative path, a /proc walk error or more than 64 matches before destroy, and propagates the rc. The SERVED hostctl 6122278d predates it and REFUSES a row without field 7, so /api/deploy target=connect fails CLOSED until the exact hostctl ships through the hostctl lane.
2026-09-26	CN13	land	2026-09-26 wave 13 SEAT TOOLCHAIN: DEVICE SIGN-IN RUNS INSIDE WASM -- both wave 10 blocks fixed at their owners. nx_wasm.nx lowers OP_CPUID_EBX to 0 (wasm32 exposes no x86 feature leaf, so every gated consumer takes its portable path and nx_sha256 keeps ni_ok 0: its ONE software compression is the SHA-256 wasm runs) and OP_SHA256_NI_BLOCK to unreachable (dead by that construction, a trap if ever reached); getrandom (rv64 278, x86 318) lowers to the declared host import env.nx_getrandom(buf, len, flags), declared only by a module that draws randomness, so a host without it cannot instantiate the module and nothing reads as zeros. nx_wasm_vm is now a host: it binds that import to the machine getrandom and refuses every unbound import by name (wm_host_resolve, where a browser raises LinkError), and it now APPLIES ACTIVE DATA SEGMENTS, which it had silently skipped -- every string literal read as zeros in the estate VM. New gate nx_opaque_wasm_gate 21/21 GREEN (job 1790456699): the unmodified client closure (runtime/_hdl_build/nx_opaque_client_wasm_kat.nx) lowers with no refused opcode, assembles to 175420 B (sha 87406462c551b7c7a9fd3bb9122ea76ff35cd8f10a1e092393bfe9bcc702f3a1, WAT 5112280 B sha a7f7607c), and in the VM: SHA-256 RFC 6234 vectors byte-exact, 32 random bytes non-zero and two draws differ, and ocl_register_blind_det on the RFC 9807 C.1.5 P256-SHA256 inputs gives the registration_request 029e949a...29f8 byte-exact, the value nx_opaque_client_gate pins natively (native run agrees); neg-controls: a host withholding the door refuses the module by name, a module drawing no randomness declares no door. The page is NOT wired (alpha seat lane); the browser host is crypto.getRandomValues bound as env.nx_getrandom
2026-09-26	ALPHA	lesson	A palette derived at runtime needs a refusal that degrades, not one that stops: nx_connect_prod_register_gate forks the daemon in a scratch directory where no conf is in reach, so a fail-fast refusal would have turned a colour into a dead scratch instance and a RED gate; the refusal announces by name and keeps the declared ink, the shape the circles table already had in the same main. And a derived ink sits ON the bar by construction (it is the nearest passing colour: the light one measures 4.5003 on --surface-2 worked to eight places, 450 by the kernel, and a four-place hand pass read it as 4.4998), so the kernel the referee grades with is the authority and the gate prints the hand arithmetic beside it rather than asserting a colour. New finding filed from this seat's capture: debt 1790456813 (phone heading step, sev 3).
2026-09-26	CN13	measure	W13 RELEASE-LANE PROOF of the exact kill on a scratch pair. New gate nx_exactkill_gate (19194 B sha256 646ce1c1) copies its own binary into two scratch directories beside itself, each holding nx_connect_appd.elf (same basename AND same 15-byte comm), and runs each as a sleeping child: 10 pure path-grammar teeth; neg-control the name-keyed cmdline predicate selects BOTH fixture processes (2); exact select finds exactly the prod child and counts the alpha child as spared; neg-control a moved start tick is never signalled; SIGKILL reaches only the prod child and the alpha child lives; the chain teeth follow a process across the promote rename to .prev and after (deleted); two sandbox teeth (the gate only ever signals children it started, because a mutant that over-selects would otherwise reach the REAL production daemon, which carries the same basename); and END TO END the built hostctl (buildroot/_build/nx_hostctl.sov.elf 336682 B sha256 22ccae50, --build-only, NOT promoted) ran gdeploy <scratch live> and printed selected=1 spared_same_comm=3 (the fixture alpha plus the real production and alpha connect processes, both spared), promote ok=1, killed EXACT-BY-PATH procs=1, exit 0, .prev banked, .new consumed. GREEN 34/34 on qualify (job 1790455738). BITE: a planted path-blind selection (the lib prefix check disabled, then restored) went RED 25/30 on exactly the five selection and survival teeth with the E2E withheld (job 1790455983). SHIPPED by nx_organ_ship sha 33683aaf (job 1790456115: prove 36/36, promoted, offc twin, registered callable); served /api/gate_run GREEN 36/36 exit 0 (job 1790456343). Scratch removed (glob xkfix_ over buildroot/_build matches=0 corpus_complete=1; the nishihost-root copy ABSENT). DECLARED unpromoted build: buildroot/_build/nx_hostctl.sov.elf is now this seat's 22ccae50; the older stage nx_hostctl.sov.elf.new 349752 B (not this seat's, predates the exact mode) is untouched and must NOT be deployed as the exact hostctl.
2026-09-26	CN14	land	W13 CONSOLIDATE debt 1790372882: ONE contact predicate for a private pairing nobody has accepted yet. nx_connect_circles gains ccl_pair_propose(st,a,b,lane), which IS ccl_channel with both asks taken as the proposed lane and no relationship row required: reach first, two minors through the ONE youth rule over the SAME fill (ccl_youth_decide, factored out of ccl_youth_channel, which now only reads the row's asks, so ccl_channel decides exactly as before: circles gate 95/95 and family gate 94/94 unchanged, jobs 1790455713 1790455718), the two-deep wall, then a block on the pair's row. nx_connect_langcircle clc_circle_match (one to one) and nx_connect_service csh_pair_lane and csh_pair_ok (the one-to-one need, the share match, the share pickup release) now ask it and never yw_may_channel (census yw_may_channel( over _hdl_build: langcircle 0, service 0, job 1790456184); new named refusals CLC_FAR_BAND -8 CLC_YOUTH_BAND -9 CLC_YOUTH_POLICY -10 CLC_BLOCKED -11 and CSH_FAR_BAND -23 CSH_YOUTH_BAND -24 CSH_YOUTH_POLICY -25 CSH_BLOCKED -26. The front door: nx_connect_api_lib lang_match and share_match take two OPTIONAL youth band rows after the thirteen arguments (a_yb b_yb; echoed only when passed), install the youthsafe policy on the synthetic pair (ca_youth_rows) and name the new refusals. RED then GREEN: langcircle gate 49/50 on the old code (job 1790455170, weight_youth_far_band=50: two youth two band rows apart were paired one to one) then 52/52 (job 1790455707, plus the refusal is CLC_FAR_BAND and the pairing equals ccl_channel for that pair, neg-control the same two still practise in a visible group); api gate YS-T1 YS-T2 RED 29/31 on the old api lib (job 1790455903) then GREEN 31/31 (job 1790456146). Closure GREEN on the final libs: service 136/136 (1790455709), study 68/68 (1790456762), activity 67/67 (1790456770). SHIPPED: langcircle gate 0f1ebe11, circles gate aeaf8e91, service gate 1f18c9ef, api gate c20c5547 (lost runs ccl_link_guardian and csh_pair_ok, symbol names only; review knowledge/status/harness/review-api-gate-wave13.txt 91b5cbc7), nx_connect_api 890edc6e noregister (the producer behind the registered nx_connect row; lost the same two symbol names, loss record 5ef01897). A/B against .prev = 2c2b2521 (the pre-change artifact, hash-verified): lang_match minor with own guardian IDENTICAL 450 B (ship probe), family_consent linked IDENTICAL 464 B, share_match adult pair IDENTICAL 444 B, and lang_match two minors with no band row DIFFERS 450 to 424 B at 258 by design (match became youth_band). WHAT STAYS: the alpha (ac638880) and production (e0998c6b) daemons carry the OLD libs until their owners rebuild; wall-only wrappers remain that read no youth band and pair no circles members on a served path: signup csu_may_channel (signup gate only), faith cfa_may_channel, serve cs_wall_row (a display row), the api_lib v1 youth verb (the raw wall calculator), and api_lib youth_peer is the youth rule's own calculator verb over raw inputs.
2026-09-26	CN13	land	W13 RELEASE-LANE (3) plan-connect-release- step 5 read nx_mgmt POST /api/deploy target=connect&confirm=yes&expect_sha256=FROM_STEP_1_BUILD_RECEIPT: the row did not exist, and the mgmt source's ma_do_deploy never reads expect_sha256 at all (only /api/promote does), so the placeholder was not even a failing guard. Step 5 now reads nx_mgmt POST /api/ship target=nx_connect_appd&deploy_target=connect&confirm=yes (nx_store_put PUT 5 replaced=1 rows=6, job 1790456335; plane re-read shows all six steps): ship rebuilds through the content-addressed cache (same closure, same bytes as step 1), hashes the STAGED bytes itself, deploys through the health-checked /api/deploy row, then re-reads and re-hashes the live file to verify by artifact; the route is served (POST /api/ship with no target answers 400 missing target from its build leg, not 404). (4) NOT RUN: nx_plan_run offers no dry form (prc_dispatch takes only planid, allowlist and prefixes; every live row executes), and a real run would stop before step 1 anyway: connect-release has no managed-owned definition (tool_allowlist.conf holds no connect-release row, so ope_discover_at refuses managed-owned-definition-required). (5) nx_orchestrate_raci connect-release resolves Accountable=publisher, Responsible=publisher,engineer, Consulted=supervisor,referee,security, Informed=operator,pm, workstream-organ nx_plan_run, verdict PLANNED (engagement recorded on the seg-store).
2026-09-26	CRYPTO-LEAK	land	W13 SEAT LEAKS (T0 1790453533). (1) nx_connect_seal.nx 3294 B sha256 8fa0f7e0 to 9300 B 3b0c84ef, ADDITIVE: cseal_ws_bytes, cseal_seal_ws and cseal_open_ws take ONE caller-owned buffer (the nonce, the aad and an NxArena for the incumbent arena AEAD nx_chacha20_poly1305_pure live inside it, re-initialised and wiped every call; a short buffer is refused CSEAL_E_WORKSPACE before any write, an arena overflow is refused with the outputs wiped); cseal_seal, cseal_open and every shared ChaCha20, Poly1305 and HMAC source untouched (nx_hmac.nx 88b16257 and nx_chacha20_poly1305_pure.nx 9ba902f5 identical before and after). nx_connect_seal_gate (a legacy hand-rolled verdict) migrated onto nx_gate_verdict, 15762 B sha256 6a373ba9, SHIPPED de950bbb by nx_organ_ship (job 1790456007: prove 24/24, first promote, offc twin, registered callable). (2) nx_connect_franking.nx mfr_frank and mfr_receive seal and open through that workspace in one mapping per call (the chat-store consolidation of the same lib by another seat landed beside it, 21453 B). (3) nx_connect_realm.nx 30367 B 79eb13b7 to 31287 B 3093b502: crl_famhex, the only CONNECT call site of the allocating hmac_sha256, now calls crl_hmac (hmac_sha256_workspace in one real mapping, unmapped on every exit); nx_connect_realm_gate SHIPPED cd87c623 (job 1790456676: prove 59/59; 3 lost runs approved by allow_loss_v1 abbe8771, all owned by other seats -- the two CSS token runs nx_connect_ui now builds at runtime for the derived footer ink, and the old /sealed key literal replaced by the vf one; behavior review 5e096088 over observation 3a8bc6a2). Debt 1790439040 EATEN (job 1790456862), superseded by 1790456844 (what landed and what stays open) and the daemon census 1790456748.
2026-09-26	CRYPTO-LEAK	measure	W13 SEAT LEAKS proofs. nx_connect_seal_gate 24/24 GREEN (qualify job 1790455770): W1 to W5 the workspace pair gives cseal_seal's ciphertext and tag byte for byte, opens and is opened by the incumbent, and leaves its workspace all zero at 1, 63, 64, 65 and 4128 bytes (mask 31 each); neg-controls another seq gives another ciphertext, a one-bit tag flip is refused, a workspace one byte short is refused and writes nothing; leak loops through ONE reused workspace hold VmSize at 0 KB against the incumbent 1024 KB (128 seals at 4096 B), 56576 KB (52428 seals at 1 B) and 57344 KB (52428 opens at 1 B), each incumbent loop a neg-control that must grow; workspace 1008 B at 1 B and 25256 B at 4096 B. CORRECTION: debt 1790439040's cseal_open 0 KB was a floor of 128 rounds inside one 256 KiB arena chunk; it grows about 1.1 KB a call. nx_connect_franking_gate new absolute teeth RED on the old lib (job 1790455105, 65/71 = these four plus two DEDUP teeth of the store seat: frank 1280 KB over 128 at 4096 B, small franks 58112 KB over 52428, small receives 57344 KB over 52428, mapping count 6 to 7) then GREEN on the new lib with the store migration landed (job 1790456802, 88/88: frank 0 KB, small franks 0 KB, small receives 0 KB, maps 6 to 6, workspace KAT teeth mask 31, the incumbent crypto control still printed at 1280 KB). nx_connect_realm_gate T20 0 KB over 128 keyed derivations against neg-control T20a incumbent hmac_sha256 3328 KB (26 KiB a call), T20b the workspace MAC equals the stored keyed uid (qualify job 1790455995). Census: the allocating hmac_sha256 sits in 21 of 47 supervised daemon closures (nx_closurehash per daemons.reg source, the full roster), 21 are clear, 5 source names unresolved; each named in debt 1790456748. Observed, not this seat's: the franking gate prints stored_relay_vmsize_kb_per_relay=852 on the chat-store path.
2026-09-26	CN13	queue	W13 RELEASE-LANE STATE = WAITING, needs intervention by the hostctl owner (debt 1790456975): production nx_connect_appd has NO working ship path right now, by construction -- /api/promote refuses it (DECLARED-DAEMON; the refusal text suggests target=nx_connect_appd but the deploy row is connect) and /api/deploy target=connect refuses at the served hostctl. Before this leg the only path was the W12 fallback (/api/promote under the legacy rule plus an exact stop), which (1) now closes on purpose. UNBLOCK, in order: /api/build target=nx_hostctl from the current source (351248 B f30fc731 carries the exact mode), prove with nx_exactkill_gate plus the hostctl gates, /api/deploy target=hostctl (selfswap) through the control-plane lane -- NOT done by this seat: it restarts the fleet supervisor and ships every other seat's unpromoted hostctl source (served 291864 B vs source 351248 B); the older stage nx_hostctl.sov.elf.new 349752 B predates the exact mode and must not be the one shipped. THEN the publisher binds connect-release as a managed-owned workflow (nx_pm_owned_define) so nx_plan_run can execute it end to end. Production still lacks the /sealed vf key (debt 1790441350); a vf-complete candidate exists (alpha ac638880 read 31/31), and a newer STAGED nx_connect_appd.sov.elf.new 806805 B from source 55069 B appeared during this leg, owner not identified here. Owed follow-ups: nx_daemon_supervisor ds_exe_sweep onto nx_exactkill_lib (one identity rule), legacy gdeploy rows with a kill-name still substring-kill, nx_exactkill_gate not rostered (its end-to-end leg forks the _build hostctl each run), the DECLARED-DAEMON refusal should name the deploy row.
2026-09-26	CN13	measure	W13 RELEASE-LANE CORRECTION to row 1790456900 by measurement, both probes refusal-only (no confirm, no digest): the SERVED /api/promote reads nx_perf_lib, declared at byte 65864 of organ_kind.conf, as DECLARED-LIB (job 1790457082), so the served mgmt kind reader is UNCAPPED (it carries the 2026-08-28 sys_read_file fix in ok_kind_of_path) and my first 932 B block would not have undeclared those 8 rows for /api/promote; the 74 B shrink still stands for any consumer compiled from the pre-fix lib (unmeasured here). nx_organkind_gate T24 measures OK_CONFBUF, a constant the fixed reader no longer reads for its buffer, so its FAIL (debt 1787938660) no longer describes the served ship path. The same probe style proves (1) live: POST /api/promote target=nx_connect_appd answers 400 refusal DECLARED-DAEMON kind_src knowledge/status/organ_kind.conf (job 1790457036). LESSONS: a comment block inserted near the head of a file read by a capped parser is a silent removal of whatever sat just inside the cap -- measure the reader before sizing the insertion; and a mutation test of a selector whose teeth KILL what it selects must sandbox its signals to its own children before the first plant, because a path-blind mutant here would have selected the real production daemon by its basename.
2026-09-26	CN6	land	CONTRACT REPOINTED so the archived msgstore does not take the capability dark (CHATSTORE-STEP2): connect.matrix row 'Messaging core on the durable store' organ runtime/_hdl_build/nx_connect_msgstore.nx symbol msg_store_append -> organ runtime/nx_chat_store_lib.nx symbol cs_msg_append (25843 to 25827 B), and the CN6 rung contract msg_store_append -> cs_msg_append (edit under content CAS after two refusals from concurrent appends); the watch reads LANDED on the next regen because cs_msg_append is declared in that organ. DEBTS: 1790372726 EATEN (job 1790456883, remainder superseded by 1790456824 -- the nx_chat_demo_api duplicate, blocked by the unpassable demo gate of debt 1790440838, recipe on comms.plan); 1790438989 superseded by 1790457092 with its item 3 (store dedup by sender and client id) closed by this step; new 1790456690 (the quiet verbs' measured VmSize envelope, about 852 kB per stored 4096-B relay, a leak for any daemon composing mfr_relay). SHARED GATE, said out loud for the wave-13 leak seat (debt 1790439040): nx_connect_franking_gate a1a34ec5 was shipped by this seat and CARRIES that seat's workspace-AEAD KAT and sender/recipient absolute leak teeth (88/88 GREEN); nx_connect_franking.nx 21453 B is my re-seat plus that seat's cseal_seal_ws edits.
2026-09-26	ALPHA	measure	W13 ALPHA-UI-AND-PROD painted coverage widened, same profile still signed in as the alpha-only w13ui0926b: features, circles and home on four doors each (CM13 then CM6, production bars): contrast_fails 0 in all 12; worst box 471 on circles and home full-height (the footer), 533 elsewhere; phone home still DEFECTS on hierarchy_step_short 2 and 4 (debt 1790456813). Painted total this seat: 28 door grades (signed out home, register, features; signed in account, features, circles, home), contrast_fails 0 in every one, overlap_pairs 0 in every one. nx_page_verify https://nishifamily.com/alpha/connect/ GREEN a11y 0 (job 1790456906, static checks only). NOT RUN, named: nx_gate_bite over the kit (aimed mode mutates numeric sites and cu_ink_faint has none; a positional sweep lands in cu_slen and cu_puts first; build admission refused two builds this hour at load1 17.15 and 16.90), so the RED-on-old proof rests on the same referee reading the replaced ac638880 footer at 284 (wave 11) and this build at 471, the gate's own neg-controls T12a T12b (the declared inks fail the bar by the kernel) and T15c (the old note call order fails the one-paragraph predicate); production is WAITING on the release lane (row 1790456840).
2026-09-26	CRYPTO-LEAK	queue	W13 SEAT LEAKS what stays open. (1) The franking gate went GREEN 88/88 on qualify (job 1790456802) AFTER debt 1790456844 was filed, so that row's words the GREEN run waits are superseded by this row; the promoted nx_connect_franking_gate (272696 B, BUILT equals PROMOTED at 1790457147) was shipped by the chat-store seat's lane, not this one, and this seat did not adjudicate that migration's content loss. (2) The allocating hmac_sha256 stays in 21 daemon closures through the hub OPAQUE libs and nx_hkdf (plus signed cookie, csrf, drbg, pbkdf2, jwt, otp, TLS finished and PRF): other owners, debt 1790456748 names each daemon and the remedy; the connect daemon's copy comes the same way (hub/nx_opaque_3dh, _envelope, _pake, nx_hkdf), not from CONNECT code, and nx_connect_realm is not yet in the daemon closure. (3) The incumbent nx_chacha20_poly1305_encrypt still maps its MAC buffer and bumps its scratch for its 17 other importers; daemon closures measured for it 6 of 42 with 0 hits, the rest unmeasured. (4) crl_famhex still arena-bumps a 32 B key and a 32 B mac per call (sys_munmap is a no-op at that size, as it is across nx_connect_realm): inside one arena chunk over 128 calls, NAMED not fixed. (5) nx_gate_bite was NOT run over the new teeth (it mutates the shared source in place while another seat was building from it); the incumbent-loop neg-controls, T20a and the W6 KAT neg-control are the planted-bad proofs. (6) nx_connect_seal_gate added to knowledge/gateroster.conf (HAND-ADDED row); served /api/gate_run GREEN 24/24 exit 0 (job 1790457061), realm 59/59 exit 0 (job 1790457062).
2026-09-26	CRYPTO-LEAK	measure	W13 SEAT LEAKS served proof: the PROMOTED nx_connect_franking_gate (272696 B) run by /api/gate_run (job 1790457157, response /tmp/sl13_franking_gate_run_1790457160.txt) reads 88/88 GREEN and carries this seat's teeth: leak_frank_4096_absolute_kb=0, leak_small_franks_kb=0 and leak_small_receives_kb=0 over 52428 rounds, maps 6 before and 6 after, the workspace KAT teeth at mask 31, the incumbent crypto control still 1280 KB. So the franking send and receive paths hold VmSize and the mapping count flat in the served gate; the ship itself was the chat-store seat's.
2026-09-26	CN13	measure	W13 RELEASE-LANE BLAST RADIUS of the hostctl exact mode, for whoever reviews the hostctl ship: deploy_targets.conf carries 30 gdeploy@ rows (nx_txtscan find, whole 21450 B file); 29 name a field-7 kill-name and keep the legacy substring restart byte-for-byte, and only connect takes the new branch (a row without field 7 used to REFUSE and now restarts EXACT-BY-PATH). The direct form gains `gdeploy <live>` (argc 3, rc propagated); `gdeploy <live> <kill-name>` is unchanged. No other hostctl verb was touched. The existing hostctl gates were NOT re-run against the 22ccae50 build (UNVERIFIED); the compile, the in-process lib teeth, the end-to-end scratch deploy through that build and the planted path-blind RED are the evidence.
2026-09-26	CN14	land	W13 CONSOLIDATE debt 1790372702, the REQUEST half: a contact request asks the ONE discovery owner. nx_connect_circles imports nx_connect_antistalk and gains a runtime antistalk slot (CCL_H_AST, installed by ccl_set_antistalk after every init or reload, carried by ccl_copy_into, never persisted, like CCL_H_YSF) and a request scratch after the youthsafe one (CCL_H_ORQA, AST_RQ_SLOTS plus the why slot; header 25 to 27 slots, sized by ccl_state_slots so every caller follows), plus ccl_may_discover(st,path,viewer,target,shared,vouched), which fills ast_may_discover's request from the circles rows (both bands, the guardian pair; no personhood claim presented) and returns its answer, fail closed with no state installed. ccl_ask now asks it on AST_PATH_REQUEST with SHARED = the live reach: a block hides the pair both ways, a non-guardian adult never singles a minor out, a hidden target answers CCL_UNREACHABLE as a stranger's request does. RED 98/101 on a planted phase carrying the new API and the old ccl_ask (job 1790457419: exactly the adult-singles-a-minor tooth, actual 1 expected -1, and the two block teeth) then GREEN 101/101 (job 1790457546), neg-controls the youth may still ask the adult and once unblocked the member may ask again. The only ccl_ask callers (census: circles gate 15 calls, family gate 5, no served caller) install a state: family gate 94/94 (job 1790457551). Closure GREEN on the final libs (circles 8bb532e3 54971 B): api 31/31 (1790457556), service 136/136 (1790457595), langcircle 52/52 (1790457599), personhood 67/67 (1790457603), study 68/68 (1790457675), activity 67/67 (1790457683). SHIPPED on the final layout: circles gate a2437a41, family gate 403e826e, api gate a9337e7b, service gate ad93fb28, langcircle gate da6689d8, personhood gate 0b2416c9, nx_connect_api 2ebc7e32 noregister (behaviour IDENTICAL on the ship probe); activity and study gate re-ships in flight (jobs 1790457860 1790457863). Debt 1790372702 EATEN (job 1790457835), SUPERSEDED by 1790457815 for the listing half.
2026-09-26	CN14	queue	W13 CONSOLIDATE what stays open. (1) debt 1790457815 (supersedes 1790372702): nx_connect_service csh_visible and csh_share_visible still decide listing visibility by reach alone (csh_share_visible is on the served path through share_match) and nx_connect_faith cfa_discover is still a discovery rule; the recipe and the measured knock-ons are in that row (service gate csh_visible teeth, the api_lib synthetic pair must install an antistalk state through the existing CA_AS_ROWS and CA_AS_CLAIM_BYTES, and api gate T23 reads invisible instead of walled in the opt-in worldwide ring -- adjudicate before shipping). Not started this leg: it changes a served verb's answer and could not be finished and shipped inside the time box. (2) debt 1790456699 (supersedes 1790372549) carries the age-band and consent one-owner items, NOT re-measured this leg. (3) The alpha (ac638880) and production (e0998c6b) daemons still carry the OLD circles, service, langcircle and api libs; the alpha rolls out through the alpha lane (operator: alpha is alpha); the appd closure was NOT built by this seat (reasoned safe: antistalk and circles were already both in the appd closure through the api lib, and every importer gate plus the api gate built GREEN on the final libs; UNVERIFIED). (4) The lang_match and share_match catalog rows (CA_LM_ARGS CA_SM_ARGS) do not yet name the optional a_yb b_yb rows: a discoverability gap for agents. (5) nx_connect_api was shipped twice this leg (890edc6e then 2ebc7e32), so .prev holds 890edc6e and the pre-change 2c2b2521 has no rollback slot and was not banked by this seat; alpha-stage, and the A/B probes against it were taken while .prev still hash-verified as 2c2b2521. (6) Wall-only wrappers left for their owners, none on a served pairing path: signup csu_may_channel (signup gate only), faith cfa_may_channel, serve cs_wall_row (a display row), the api_lib v1 youth verb. (7) nx_gate_bite was not run over the new teeth; the RED runs on the old code (langcircle 49/50, api 29/31, circles 98/101) are the planted-bad proof.
2026-09-26	CN14	lesson	A match proposal is not a channel. The brief said route the language match and the share handoff through ccl_channel, but ccl_channel demands an accepted relationship row, so a literal routing would have refused every new language partner and every neighbour seed exchange (NO_ACCEPT) and changed the served verbs for adult pairs too. The single predicate that fixes the far-band hole without that damage is the channel with the proposed lane taken as both asks (ccl_pair_propose), sharing ccl_channel's youth fill (ccl_youth_decide) so the two can never answer two minors differently -- W11's own queue row 1790440706 had already named that recipe. Read the prior seat's recipe before taking a brief's verb literally, and when shipping the same target twice in one leg, bank the pre-change artifact first: the second ship moves .prev off the baseline.
2026-09-26	CN13	lesson	2026-09-26 THE ESTATE VM NEVER LOADED A STRING LITERAL, AND NO GATE COULD SEE IT: nx_wasm_vm's section scan skipped the data section, so every active segment the wat lane emits was left out of linear memory, and eleven VM gates stayed green because every module they run is arithmetic-only. The first module to compare a digest against a vector held in a literal (the OPAQUE client's SHA-256 of abc) read 64 of 64 digest bytes wrong while the randomness door, which needs no literal, passed. A known-answer run over a real closure is the instrument that finds a loader gap; per-opcode fixtures cannot. Bite on the emitter: the same gate against the pre-fix nx_compile_wat reads RED 7/21 (emit refused at IR opcode 142, job 1790456839); control: nx_wasm_popcnt_gate rebuilt on the new VM stays 119/119 (job 1790457914). Owed (debt 1790457250): rebuild and re-run nx_wasm_vm_verify and the other VM gates on the new VM, a VM trap arm for unreachable, and the alpha page wiring of env.nx_getrandom to crypto.getRandomValues
2026-09-26	CN13	retract	2026-09-26 PRECISION ON THE ROW ABOVE: the clause that eleven VM gates stayed green because every module they run is arithmetic-only is an INFERENCE, not a measurement -- eleven is nx_wasm_vm_verify's own 2026-08-14 count of *_wasm_vm_gate organs and none of them was re-read this wave. MEASURED: wmp_scan in nx_wasm_vm.nx has no arm for section 11 and falls to r.pos = send, the OPAQUE harness read 64 of 64 digest bytes wrong until wm_apply_data landed and 0 after, and nx_wasm_popcnt_gate (whose modules carry no data segment) is 119/119 on the new VM. Which of the other VM gates ever loaded a literal is UNMEASURED and is part of debt 1790457250
2026-09-26	CN13	land	W14 PM-RELEASE-PLUMBING (T0 1790458552): connect-release is BOUND as a managed-owned workflow at maturity DRAFT and refuses execution by construction. (1) PRC1 policy plane knowledge/store/connect-release-c-20260926- seeded, 6 rows, one per plan step (exit 0 VERIFIED; step bounds 900000 600000 600000 180000 900000 120000 ms: a step that declares its own deadline gets that plus its build allowance, the rest take the 900000 ms workflow deadline; cwd nishihost). (2) qualification knowledge/gates/connect-release-20260926.qualification.json 2543 B sha256 7046d2ba, schema nishi.pm.owned-qualification-draft.v1, executable false, names step 5 (nx_mgmt POST /api/ship deploy_target=connect) as PRODUCTION_DAEMON_DEPLOY blocked by the operator decision on the hostctl exact-kill deploy. (3) nx_pm_owned_define create wrote knowledge/gates/connect-release-20260926.nxr 976 B sha256 114b1e4462a61bcc (PMI2: workflow and activity connect-release, owner publisher = the current RACI Accountable, raci projection c95561c1, plan_sha 399f8122, policy_sha 3bf4b774, runner nx_plan_run 942c677f, results planrun-connect-release-, dispatch knowledge/status/connect-release-d-20260926-, evaluation and dispatch budget 1); create itself proved every step tool (nx_mgmt, nx_sov_build_run, nx_page_verify) resolves to exactly one GREEN unpinned tool_allowlist.conf row, so no step row was missing; inspect read-back returns all 20 fields (execution NONE). (4) management binding registered through /api/tools/register: nx_pm_owned_4ce61faef131c77d (sha256 of the workflow id) -> nx_pm_owned_run.elf work connect-release <definition> 114b1e44 knowledge/store/connect-release-q-20260926- (row read back in tool_allowlist.conf, 187148 B). (5) PROOF the binding resolves, both runs refused before step 1 with execution NOT_STARTED: nx_plan_run connect-release before the row answered managed-owned-definition-required (job 1790460619); after it, the executor found the row, read the definition by digest, matched workflow allowlist plan results and policy, and refused at the qualification stage owned-policy-schema (job 1790460677). No deploy, enqueue or invoke was run. NEXT (publisher, after the operator decides the hostctl exact-kill deploy): write a nishi.pm.owned-execution-policy.v2 document (effects OWNER_REVIEWED_ACTIONS, one reviewed action per step with executable_sha256 effect commit_contract and write_scopes, plus effect_approval); a v1 handoff policy cannot carry step 5 because v1 admits only READ_ONLY or IMMUTABLE_ARTIFACT_GENERATION. Then re-create the definition at QUALIFIED and repoint this row with /api/tools/register update=yes. UNVERIFIED: whether nx_mgmt_call authenticates when forked by nx_plan_run.
2026-09-26	CN17	land	W14 SEAT LISTING-AND-COUNTRY (debt 1790457815 EATEN, superseded by 1790461582 for its faith half): listing visibility now asks the ONE discovery owner. nx_connect_service csh_may_see fills ccl_may_discover on AST_PATH_CIRCLE (SHARED = the live reach no wider than the ring the poster chose, VOUCHED = ccl_ring_adm of that reach ring is CCL_ADM_VOUCH) and nx_connect_antistalk ast_may_discover decides; csh_visible and csh_share_visible both return it, so need_match, list, render, share_match and share_render inherit it: a block hides a listing both ways and a match across it answers CSH_INVISIBLE (a stranger's answer), a non-guardian adult who shares only an opt-in ring never sees a minor's listing (AST_WHY_MINOR_OPEN_RING) while a linked guardian and a peer minor do, and with no antistalk state installed nothing is listed (fail closed). nx_connect_service_gate 171 teeth: RED 155/171 on the prior lib (job 1790459935, exactly the 16 new discovery teeth), GREEN 171/171 (job 1790460315), SHIPPED 19e5814c. The served front door: nx_connect_api_lib ca_v_share installs an empty antistalk state on its synthetic pair (not in ca_ring2, so lang_match stays byte-identical); api gate T23 adjudicated to INVISIBLE for a minor requester and an unrelated adult offerer on the opt-in worldwide ring (a WALLED answer there would tell the adult a minor posted it) and WALLED for the same pair inside the in-person vouched ward: RED 30/31 (job 1790459960), GREEN 31/31 (job 1790460323), api gate SHIPPED 9afbeeb7 (one lost run, the old T23 label, allow_loss_v1 4791a0ca, behaviour review 81c4c202); nx_connect_api SHIPPED 7980400c noregister (content GREEN, lost 0); nx_behaveprobe live vs staged IDENTICAL on help, catalog, match, juris_rules, lang_match, youth_peer, antistalk_discover, family_consent, share_match adult pair and share_match minor with an adult in the ward, DIFFERS only on share_match minor with an unrelated adult on the worldwide ring (walled to invisible, intended). The alpha daemon nx_connect_appd imports the api lib and carries the old rule until the ALPHA seat rebuilds it; production /connect untouched.
2026-09-26	CN13	land	W14 SEAT LISTING-AND-COUNTRY: a minor's sign-up requires a SELF-DECLARED place and that place's law decides. nx_connect_signup csu_signup_admit calls csu_juris_admit after the key check and before any challenge is looked up: a minor band with no place refuses CSU_REFUSED_COUNTRY_REQUIRED (16), a place outside ISO 3166-1 alpha-2 with an optional ISO 3166-2 subdivision refuses COUNTRY_FORM (17; self-declared, never IP), no table or no admitted in-force row refuses JURIS_TABLE (18, fail closed), and jur_rules_for plus jur_account_decision over the caller's table (jur_conf_load, loaded once) judge the attested band's youngest age (CSU_RQ_AGE_LO; negative reads as the youngest): a barred band refuses JURIS_BARRED (19), an age under the minimum JURIS_UNDER_MIN (20), a consent line PARENTAL_CONSENT (21) unless the caller verified a guardian consent (nx_connect_family) at a method rank of at least one and no weaker than the law names (CSU_RQ_GRANK). An adult may leave the place undeclared; the place decides this one answer and is never stored (the S1 row census stays four fields); a legal refusal spends no challenge and admits nothing. Request slots 7 to 13 added (CSU_RQ_SLOTS 14: PLACE, PLACE_N, AGE_LO, JTAB, JTAB_N, TODAY, GRANK); the lib now imports nx_connect_juris. nx_connect_signup_gate 85 teeth: RED on the constants-only lib (job 1790460544: every legal refusal answered CHALLENGE and the barred band was admitted), GREEN 85/85 (job 1790460800, and the ship's fresh run against the laws seat's grown table), SHIPPED f60018f5 with four named lost runs (the renamed minor tooth; two section-7 takeover teeth another seat had re-pinned to the create-only account log without shipping; the _ma_register_credential symbol from the OPAQUE closure the live binary predated; allow_loss_v1 7d468a20, behaviour review 9f513bbf); the legal door runs on its own account log so the live door's row census and burst arithmetic stay exact. Importer checks on the new lib: nx_connect_juris_gate 99/99 (job 1790460966, since re-shipped 04286dee by the laws seat), nx_connect_personhood_gate 67/67 SHIPPED 233d7f4e (content GREEN, behaviour IDENTICAL). QUEUE for the ALPHA seat: nx_connect_appd must hand the declared place, the table, the day asked and any verified guardian rank through the request before its register path calls csu_signup_admit.
2026-09-26	TOOLCHAIN	land	W14 CRYPTO-PROOF (T0 1790458717): the RSASSA-PKCS1-v1_5 SHA-256 signer lane is observed end to end on the fixed compiler (buildroot/_offc/nx_cc_sovereign.elf sha256 6d71ae5d) in seconds, and by KNOWN ANSWER, not by a round trip. FIXTURE: Wycheproof testvectors_v1/rsa_pkcs1_2048_sig_gen_test.json read and pinned 2026-09-26 by nx_research_fetch (PROVENANCE row 1790458892, HTTP 200) to knowledge/fetched/cmp_connect_wycheproof_rsa2048_siggen.json (105318 B, sha256 587b3d27); test group 3 (RSA-2048, SHA-256, publicExponent 010001, source google-wycheproof 0.8r12), cases tcId 81 (the empty message) and tcId 85, carried by ONE new lib buildroot/runtime/_hdl_build/nx_rsa_kat_wycheproof.nx (15084 B, sha256 e768d048; hex through the incumbent hex.nx); every transcribed value was first confirmed present exactly once in the mirror by nx_txtscan count. nx_rsa_pkcs1_sign: the default selftest loads that key (the ~5 min keygen join kept as selftest-keygen) and adds K0..K7 -- our signer reproduces BOTH published signatures byte for byte, the incumbent verifier accepts them as published, a published signature is refused over the other message, and rkw_provenance re-hashes the mirror against the pin and finds every value in its published place (neg-control: a one-digit mutant is absent). 16/16 from buildroot (mirror rung 1, job 1790460608) and on the PROMOTED binary from the serving root (mirror rung 0, organ_run job 1790461481). BITE: case 85's published signature with its last hex digit changed turned exactly K2 K4 K6 K7 RED (12/16, first_diff_off=255 got=200 want=201, job 1790461149) while all eight round-trip teeth T1..T8 stayed GREEN; the lib was restored to sha256 e768d048 and read 16/16 again (job 1790461245). The census fixture had measured the pre-fix compiler building this signer's EM with 205 FF bytes where RFC 8017 needs 202 (REVIEW 1790439201), so T5 and the KATs could not have passed there; that RED is INFERRED from that measurement, not re-run (it needs the banked pre-fix compiler in a build path). SHIPPED through nx_organ_ship after declaring each kind (oneshot rows in knowledge/status/organ_kind.conf) and each self-gate (rows in knowledge/organ_gate.conf, the fixture lib gated by nx_rsa_pkcs1_sign): nx_rsa_pkcs1_sign 1cc3eb72 (PROVE 16/16, job 1790461352), nx_x509_emit 9cc79c29 (7/7, job 1790461472), nx_authenticode_sign 8dd5b6b9 (9/9 and a bare call now runs the selftest, job 1790461570); all FIRST promotes, _offc twins installed, registered; the x509 and authenticode keys are the same pinned key, so /tmp/nishi_signed.efi and the efivars test varstore still pair.
2026-09-26	TOOLCHAIN	land	W14 CRYPTO-PROOF nx_efivars_enrol, the one organ in the lane that writes FIRMWARE state (UEFI varstore images): rebuilt on the fixed compiler and GATED ONLY -- NEVER promoted, NEVER run against real hardware or efivarfs, deliberately absent from organ_kind.conf and organ_gate.conf. Changes: its platform key for every verb (build, hashdb, selftest) is now the same pinned published key through ONE helper en_platform_key (was ~5 min of kg_keygen), so the enrolled cert still pairs with the image nx_authenticode_sign signs; a NEVER-BRICK output-path guard en_out_path_safe refuses every /sys /dev /proc path and any efivars component BEFORE anything is read or written, in both build and hashdb (declared imprecision: a string test, a symlink planted in an allowed directory is not caught, and it errs toward refusing); the selftest proves the guard both ways first (EN-G1 live efivarfs PK path refused, EN-G2 an MTD device, procfs and relative efivars spellings refused, EN-G3 positive control: its own /tmp image paths allowed) and then EN-K1: the key loads and the signer linked into THIS binary reproduces Wycheproof tcId 85 byte for byte through rsa_pkcs1_kat_case, the lane's one KAT helper (now also what nx_rsa_pkcs1_sign's K1 K2 call, re-shipped 8c6f9723 with behaviour IDENTICAL, job 1790461893). On the NAS the two OVMF varstores do not exist (none under _offc with corpus_complete=1, /usr/share/OVMF absent), so the selftest honours its own contract: EN-SELFTEST 4/4 UNPROVEN, exit 3, with varstore teeth T1..T6 UNOBSERVED (build 101822 B sha256 1ae751c6, job 1790461889); nothing was written.
2026-09-26	TOOLCHAIN	lesson	A ROUND TRIP BETWEEN OUR OWN SIGNER AND OUR OWN VERIFIER CANNOT SEE A WRONG ANSWER. With one published Wycheproof signature corrupted, all eight round-trip teeth (sign, verify, tamper, determinism, EM shape) stayed GREEN and only the known-answer teeth went RED -- the old selftest was a claim that two of our files agree, and a key grown by our own keygen can never carry a published answer, so it bought self-consistency at five minutes a run. A pinned published vector buys correctness in seconds, covers the edge a hand-written SHA-256 is likeliest to get wrong (the empty message, tcId 81), and because each importer statically links its own copy of the signer, the known answer belongs in EVERY binary's selftest (rsa_pkcs1_kat_case, one helper), not only in the library's. And transcribed test values are data to CHECK, not trust: the fixture re-hashes its mirror against the pin and finds each value in its published place, so a slip fails by name.
2026-09-26	TOOLCHAIN	land	W14 CRYPTO-PROOF second leg, the known answer in EVERY binary: rsa_pkcs1_kat_case (one helper in nx_rsa_pkcs1_sign) is now what nx_rsa_pkcs1_sign's K1 K2 call and what each importer's selftest calls, because each binary statically links its own copy of the signer. RE-SHIPPED: nx_rsa_pkcs1_sign 8c6f9723 (ADOPT-GATE content GREEN behave IDENTICAL, job 1790461893; .prev holds the first ship 1cc3eb72), nx_x509_emit 3740b893 (XE-K1, 8/8, behave DIFFERS by exactly the new tooth line, read before promote, job 1790462086; .prev 9cc79c29), nx_authenticode_sign 2319eed4 (AC-K1, 10/10, same, job 1790462183; .prev 8dd5b6b9). Served binaries re-run from the serving root through /api/organ_run: x509 8/8 (job 1790462271), authenticode 10/10 (job 1790462275), rsa 16/16 on its first ship (job 1790461481). nx_catalog: BUILT == PROMOTED for all three (94960, 87080, 111624 B), registered; nx_efivars_enrol BUILT 101822 B, PROMOTED NO. Sources: nx_rsa_kat_wycheproof.nx e768d048 (15084 B), nx_rsa_pkcs1_sign.nx 19e5d330 (18897 B), nx_x509_emit.nx 2842ee16 (19500 B), nx_authenticode_sign.nx 38d318d3 (26393 B), nx_efivars_enrol.nx c581d227 (27665 B). Debt: 1790458186 EATEN (job 1790462335), SUPERSEDED by 1790462294 which carries every other clause verbatim and the one crypto item left (efivars T1..T6).
2026-09-26	TOOLCHAIN	queue	W14 CRYPTO-PROOF what stays open, each with its unblock. (1) nx_efivars_enrol varstore teeth T1..T6 UNOBSERVED: supply OVMF_VARS_4M.fd (empty, setup mode) and OVMF_VARS_4M.ms.fd to a host path and run nx_sov_build_run nx_efivars_enrol --qualify -- selftest EMPTY MS; NEVER promote it, never point build or hashdb at a live machine. Its test varstore now enrols the PUBLISHED Wycheproof key as PK KEK db (before: a keygen key grown from a seed in public source, the same class) -- an emulator image only; carried in debt 1790462294. (2) nx_x509_emit and nx_authenticode_sign prove their DER and PKCS#7 structure by self-consistency (x509_parse and our verifier); EDK2 AuthenticodeVerify acceptance stays the enrol-and-boot rung. (3) RED on the pre-fix compiler is INFERRED from the census fixture (pslen read 205, REVIEW 1790439201), not re-run: that needs the banked pre-fix compiler in a build path, a toolchain action outside this seat. (4) The three shipped organs read REGISTERED-UNAUTHORISED in nx_catalog: no cap names them yet; minting one is the cap owner's step (this seat writes no tokens). (5) nx_gate_bite was not run over the K teeth: the targeted bite ran before the first promote, when no twin existed; on a promoted organ a harness bite builds mutants against live twins, so run it only through the harness's banked-restore path. (6) The mirror's name carries rsa, so nx_fs read is refused by the fs secret deny-list (nx_txtscan and in-organ sys_read_file read it); no .refs row was added on a compare page (the lib header and these rows carry URL, date and pin). (7) One edit job (1790460266) stayed CLAIMED: its expect=11796 guard means it can never apply (the file is now 18897 B) -- a LOST row for the jobclaim reaper. (8) The never-brick guard is a string test; an fd-level check (statfs of the opened path, refuse the efivarfs magic) is its next rung.
2026-09-26	CN13	land	W14 SEAT ALPHA (T0 1790458907) DEVICE SIGN-IN ON THE ALPHA: the passphrase never reaches the server. SERVER HALF (runtime/_hdl_build/nx_opaque_wire_server.nx 10254 to 14285 B): the create-only store (R1, debt 1790372544) was already in place; NEW the store is BOUND to its own respond by a per-session nonce -- OswRegPending, osw_reg_pending_new, osw_register_respond_bound (CreateRegistrationResponse then a CSPRNG nonce bound to the handle's realm user id), osw_bound_refuses (spends the pending state BEFORE comparing, constant-time nonce and user-id compare) and osw_register_store_bound (INVALID_SESSION unless bound, then the create-only rules). CLIENT (runtime/_hdl_build/nx_opaque_client.nx 11926 to 14109 B): the passphrase policy is decided ON THE DEVICE -- OclState gains pw_min pw_max, ocl_policy(st,min,max) refuses bounds that admit nothing, OCL_POLICY -6, registration refuses outside both bounds and a login only above the maximum (an older shorter passphrase still signs in), an empty passphrase is refused everywhere. GATE nx_opaque_client_gate 24267 to 32675 B: sections 1b (B1 another nonce refused, B2 the right nonce after a refused attempt refused, B3 a nonce for erin cannot store fay, B4 own nonce creates and the account logs in, B5 replay refused before USER_EXISTS, B6 a never-opened pending state refused, B7 nonces differ) and 1c (P1 under the minimum refused with nothing leaving the device, P2 over the maximum, P3 P4 boundaries, P5 login over the maximum, neg-control a short login is not a policy refusal, P6 degenerate bounds, P7 empty). RED 61/75 on a planted phase carrying the new API with the checks stubbed (job 1790459732, exactly the 14 new teeth) then GREEN 75/75 (job 1790460017) and SHIPPED sha 126ea0bc (job 1790461920: prove 75/75, content GREEN, behave DIFFERS approved STRONG, promoted, offc twin). WASM: the promoted nx_compile_wat plus nx_wat_compiler rebuilt the device module from nx_opaque_client_wasm_kat.nx with ocl_policy exported, 176424 B sha256 931c3d7b (the wasm gate reads 176424 too: nx_opaque_wasm_gate 21/21 GREEN job 1790460008). DAEMON (nx_connect_appd.nx 55069 to 88187 B, staged instance only): routes POST <mount>/device/params, /device/register/respond, /device/register/store, /device/login/ke1, /device/login/ke3 (session = the stage cookie plus X-Nishi-Session, the base64 of the M5 token as olg_login writes it) and GET /device/opaque.js and /device/opaque.wasm (read once at startup from the instance directory, announced ON or OFF), a bounded pending table keyed by the nonce (constant-time find, spent on use, TTL, oldest evicted and announced). SERVE and UI: CS_DEVICE slot stamped only on a staged instance holding the assets; /register and /login render the DEVICE form (method get to the fallback page, a secret field with NO name attribute, a status line, one deferred same-origin script) and the zero-JS form moved to /register/form and /login/form labelled FORM FALLBACK; production renders byte for byte as before.
2026-09-26	CN13	measure	W14 SEAT ALPHA PROOFS of the device sign-in on the served alpha a25aea85. EDGE GATE (new, runtime/_hdl_build/nx_connect_alpha_device_gate.nx 28061 B; the client role runs natively in nx_opaque_client, the lib the wasm is compiled from, and posts only what the device script posts): 26/26 GREEN on b11dafde (job 1790461554) then 32/32 on a25aea85 (job 1790462395) -- D1 D2 D3 /register and /login carry the device form, 0 fields named pw, the secret field nameless; neg-control /register/form carries exactly 1 field named pw and says FORM FALLBACK; D4 D5 opaque.js binds nx_getrandom to getRandomValues, opaque.wasm is application/wasm with the wasm magic and 176424 B equal to disk; R1 params answer the RFC 9807 sizes; N2 a store with another nonce refused expired_or_unknown; R2 the store with its own nonce creates; R3a KE3 computed on the device; R3 ke3 answers the stage cookie on the mount path; R4 the same token rides X-Nishi-Session (204 base64 chars); N3 the ke3 replay refused; R5 the account page names the handle; T1 /try/lang signed in runs lang_match and shows match, neg-control T1b a minor one to one with an unrelated adult reads walled, T2 /try/share paired, T3 /try/needs says not behind the front door yet with no form, neg-control T4 signed out asks for sign-in and runs nothing, T5 /features lists 6 try rows; N1 a second registration of the taken handle refused handle_taken with 409; N4 a wrong passphrase fails ON THE DEVICE (-4) so no KE3 is sent; V1 V1b no POST body (2041 B over 11 posts) carried the passphrase or its SHA-256 raw or hex, neg-control the detector fires on a body carrying it. SHIPPED sha 1d32bf4d (job 1790462509: first promote, offc twin, REGISTERED callable). REAL BROWSER (laptop CM13 nx_cdp_capture journeys in headless Edge, the wasm client and getRandomValues doing the work): w14devreg registered devjourney1790462600 from /register and landed on /account showing the handle about 2 s after submit (31 steps, verdict OK, /tmp/w14jr/journey.receipt); w14devreg2 from a fresh profile registered the same handle again and the page read That handle is taken without leaving /register (verdict OK); w14devlogin from a third fresh profile signed in on the device and landed on /account (verdict OK); a profile that already held the session read You already have an account (the device session is a real cookie session). GATES on the same build: nx_connect_prod_register_gate 31/31 on a25aea85 in production mode (job 1790462137; b11dafde 31/31 job 1790461112); nx_connect_auth_gate 12/12 (job 1790460831); nx_connect_mount_gate 20/20 (job 1790460834); live alpha nx_connect_alpha_signup_gate 13/13 (job 1790462397, the form fallback POSTs still work) and nx_connect_alpha_api_gate 32/32 (job 1790462400). PIXEL REFEREE (CM13 capture then CM6 nx_page_pixjudge, laptop _build binaries, production bars knowledge/pixjudge.conf): /register /login /features /try/lang signed out at phone 390x844 and desktop 1440x900, 8 grades all verdict OK, contrast_fails 0, overlap_pairs 0, hierarchy_violations 0, hierarchy_step_short 0, worst_ratio100 471 (the footer, as W13) and 533 on the phone login and register; the phone register shot caught the status line at Loading the device sign-in (the phone door shoots first, before the module finished loading) and the desktop shot reads Ready: your passphrase stays on this device. nx_page_verify GREEN on /alpha/connect/register and /login (jobs 1790462727 1790462732, the script asset 200 8974 B).
2026-09-26	ALPHA	land	W14 SEAT ALPHA STAGE RUNNING: the alpha /alpha/connect runs build a25aea85 (865305 B, sha256 a25aea85a26b556e206f796f7b58876c275e526b3e62ddb11d9796cec6c7e247, nx_sov_build_run nx_connect_appd --build-only --release job 1790462039, serving-root twin held, nothing promoted) as pid 30240 start_ticks 507822953 parent 9271, nx_proc_observe digest_match 1; copied mode 0755 to alpha_connect/nx_connect_appd-a25aea85.elf (nx_filecopy verified 1) and banked knowledge/bank/nx_connect_appd.elf-alpha-a25aea85-20260926; device assets beside it in alpha_connect/ (connect_device_opaque.wasm 176424 B sha256 931c3d7b, connect_device_opaque.js 8974 B) banked knowledge/bank/connect_device_opaque.wasm-931c3d7b-20260926 and connect_device_opaque.js-20260926-wave14. RECIPE ran twice (cb3b5c3d to b11dafde to a25aea85): daemons.reg banked knowledge/bank/daemons.reg-pre-alpha-b11dafde-20260926, row connect_alpha repointed under content CAS (hb6405cce45f16faf then hc1495a07c1b56c2c), nx_reg_sign SIGNED daemons.reg.sig (jobs 1790460946 1790462202), exact stops of pid 1369 cb3b5c3d (job 1790461062, stop_confirmed 1) and pid 17106 b11dafde (job 1790462221, signal_sent 1, state Z at the deadline, reaped by the supervisor), the supervisor revived each. SOURCES at build: appd 88187 B sha256 ccf0e148, serve 132671 B e3d59b69, ui 33585 B ddd7c780, opaque client 14109 B, wire server 14285 B, and the W13 libs (circles, service, langcircle, api lib) now in the alpha closure. PART 2, ALPHA PAGES TO TRY (signed in only, labelled ALPHA, nothing listed or stored): <mount>/try/lang runs the front door's lang_match (nx_connect_langcircle clc_circle_match) in-process over the caller's typed inputs and shows the envelope; /try/share runs share_match (nx_connect_service csh_share_match, today's visibility: the LISTING seat's fix of debt 1790457815 had not landed in the api lib at build time, so this page composes the served visibility); /try/needs (service_match, csh_need_match), /try/study (study_post, csc_circle_post) and /try/activities (cav_plan_event, no front-door verb) each say their engine is not behind the door yet, with the state read live from ca_row, and offer no form. /features lists the device sign-in and the five pages with their state (rows class row try, badges on, try it, not behind the door yet, so the signup gate's catalog reconciliation still reads the one table) and its dated note names the wave-14 build.
2026-09-26	ALPHA	retract	W14 SEAT ALPHA CORRECTION to row 1790462902, by measurement: its clause that the LISTING seat's fix of debt 1790457815 had not landed in the api lib at build time is WRONG. That seat's service and api lib edits went GREEN at jobs 1790460315 and 1790460323 and its land row is 1790461700, all before this seat's builds (b11dafde job 1790460767, a25aea85 job 1790462039), so both alpha builds compiled the fixed visibility; the served alpha a25aea85 answers /alpha/connect/api/v1/share_match for an adult offerer and a MINOR requester on the opt-in worldwide ring with verdict_name invisible and paired 0 (nx_https_get job 1790463091), the new rule, where the old one answered walled. So /try/share composes the FIXED visibility. Lesson: read the board for rows addressed to your lane after your first read and before you write a claim about another seat's state (W10's lesson, repeated here).
2026-09-26	ALPHA	measure	W14 SEAT ALPHA PART 2 proofs on the served alpha a25aea85: the device gate teeth T1 to T5 (job 1790462395, row 1790462901) prove the try pages over the edge signed in with a device session. SIGNED-IN VISUAL REVIEW (laptop CM13 nx_cdp_capture on the profile that holds the w14devreg device session, the header reads @devjourney1790462600): /try/lang with a match query (13 labelled fields, the engine's answer section with the lang_match envelope), /try/share with a paired query, /try/needs (the not-behind-the-door note, no form) and /features (the Alpha pages to try table) at phone 390x844 and desktop 1440x900, then CM6 nx_page_pixjudge on the production bars: 8 of 8 grades verdict OK, contrast_fails 0, overlap_pairs 0, hierarchy_violations 0, hierarchy_step_short 0, worst_ratio100 533 or 471. STATIC RED-ON-OLD for the page change: the replaced alpha binary cb3b5c3d carries 0 occurrences of nxc-device where a25aea85 carries 2 (nx_txtscan count), and the pre-change production page /connect/register serves exactly 1 field named pw and no device form (nx_https_get job 1790463192, GET only, nothing written) -- the D teeth read RED on that code; a live RED run of the edge gate against the old alpha was NOT made (its /device routes did not exist, so every R and N tooth would fail by absence rather than discriminate). nx_gate_bite NOT run over the new gates: the edge gate's subject is the live alpha (a mutant build of it is a deploy), and the lib teeth have their planted-phase RED 61/75.
2026-09-26	ALPHA	queue	W14 SEAT ALPHA what stays open. (1) PRODUCTION untouched by this seat: /connect still runs e0998c6b (no vf key, debt 1790441350) with no ship path until the exact-kill hostctl ships (row 1790456903); the device sign-in is staged-only by construction (CS_DEVICE is stamped only on a staged instance holding the assets) and nx_connect_prod_register_gate reads 31/31 on a25aea85 in production mode, so a later production build carries the code dark until the release owner turns the device path on with its assets. (2) debt 1790462863 (new, sev 4) names the device-path open items: no recovery credential for a device-made account (the device must register handle plus the rec suffix with KSF identity), no RFC 9807 6.3.2.2 fake-record KE2 for an unknown handle at ke1, no rate limit on the five routes and an arena bump per sign-in, CD_DEV_SLOTS 64 and CD_DEV_TTL_S 300 typed thresholds owed as conf rows (the measured browser round trip was about 2 s), and the device script plus module living only in the alpha's directory with no source-tree home or release-recipe step yet. (3) READ AND QUEUED from W14 LISTING-AND-COUNTRY row 1790461701: the alpha register path does not call csu_signup_admit at all today (form and device paths run the name rule and the create-only store, the form path also csu_handle_taken); wiring the sign-up door (key check, challenge, work, wall, self-declared place, attested age band, the day asked and a verified guardian rank) into both register paths is a UI and flow rung of its own, not attempted in this time box. (4) debt 1790457250 EATEN (job 1790462830) and superseded by 1790462810 carrying its items (1) to (3) for the toolchain owner; its item (4), the page wiring of env.nx_getrandom, is met here. (5) debt 1790462076 (new, sev 6): nx_proc_kill legacy mode kills by substring on ANY first argument. (6) the superseded alpha binaries alpha_connect/nx_connect_appd-b11dafde.elf and -cb3b5c3d.elf (both banked) are unreferenced by daemons.reg, for the lifecycle lane; eight alpha-only accounts were made by this seat's gate runs and journeys (devprobe and devjourney handles), by design. (7) /try/needs, /try/study and /try/activities open the day their verbs are wired behind the front door (service_match, study_post, and a verb for cav_plan_event).
2026-09-26	ALPHA	lesson	W14 SEAT ALPHA. (1) AN ORGAN WITH A KILL VERB HAS NO HARMLESS ARGUMENT: this seat sent nx_proc_kill the word usage through /api/organ_run to learn its grammar, and the legacy mode took it as a full-cmdline SIGKILL target and killed itself (exit 137, its own report destroyed; debt 1790462076). Read main() before calling any organ that signals, deletes or deploys, even to ask for help. (2) THE IN-BROWSER PROOF WAS REACHABLE WITH THE INCUMBENT DRIVER: nx_cdp_capture journeys have no wait step, but every click step settles and sleeps a poll, so repeated clicks on a no-op target (the page heading) gave the wasm client the two seconds its two KSF runs took, and the final expect step then read the handle on /account; the obvious conclusion (a journey cannot wait, so the browser leg stays UNVERIFIED) was wrong for want of one try. (3) A BROWSER PROFILE IS STATE: the second journey on the first profile read You already have an account because the device session cookie persisted; a refusal test needs its own fresh profile, and the persisted cookie was itself evidence that the device session is a real session. (4) A CLAIM ABOUT ANOTHER SEAT'S STATE MUST BE MEASURED BEFORE IT IS WRITTEN: row 1790462902 said the LISTING fix had not reached the alpha; one GET of share_match on the alpha refuted it (row 1790463100).
2026-09-26	ALPHA	land	W14 SEAT ALPHA FINAL STAGE RUNNING, superseding the build named in row 1790462902: the alpha runs bf1534cd (866481 B, sha256 bf1534cd7deaa93abeff6450b82a2835809248eb74e2b5b6270978e3d4e62ce8, --build-only --release job 1790463856) as pid 14724 start_ticks 508000304 parent 9271, nx_proc_observe digest_match 1; copied to alpha_connect/nx_connect_appd-bf1534cd.elf and banked knowledge/bank/nx_connect_appd.elf-alpha-bf1534cd-20260926 (nx_filecopy verified 1 both); daemons.reg repointed under content CAS hba1838ee1a05cd0c, nx_reg_sign SIGNED (job 1790463980), exact stop of pid 30240 a25aea85 stop_confirmed 1 (job 1790464000), supervisor revived. The one change over a25aea85 closes item (4) of debt 1790462863: the pending table's two THRESHOLDS are DATA -- new knowledge/connect_device.conf (1341 B) rows device_pending_slots 64 and device_pending_ttl_s 300, each with its calibration (the 2026-09-26 journey measured submit to /account in about 2 s for both KSF runs plus five round trips), read once at startup on the circles table's two-rung ladder through inkd_conf_bar; unreadable rows keep the device sign-in OFF, announced, never a typed default (appd source 89245 B sha256 01b3a2f4). PROOFS on bf1534cd: nx_connect_prod_register_gate 31/31 in production mode (job 1790463916); served /api/gate_run nx_connect_alpha_device_gate 35/35 (job 1790464048, the re-shipped 6a7a7c77 adding T3b /try/study and T3c /try/activities not behind the door and the /login/form fallback neg-control), nx_connect_alpha_signup_gate 13/13 (job 1790464049), nx_connect_alpha_api_gate 32/32 (job 1790464051); and in headless Edge from a fresh profile journey w14devreg4 registered devfinal1790464060 on the device and landed on /account (verdict OK, /tmp/w14jr4), which also proves the conf rows were read (the device path is ON only when both are). The superseded a25aea85 and b11dafde are banked and unreferenced, for the lifecycle lane.
2026-09-26	CN13	measure	W14 SEAT ALPHA THE PASSPHRASE POLICY IS DECIDED ON THE DEVICE, observed in a real browser: the device script now keeps the realm's last params answer and names its bounds in a refusal (connect_device_opaque.js 8974 to 9194 B, banked knowledge/bank/connect_device_opaque.js-20260926-wave14b; the alpha re-read it on an exact restart of the same bf1534cd, pid 14724 stop_confirmed 1 job 1790464285, revived as pid 31967 start_ticks 508028459 digest_match 1). Journey w14devpolicy from a fresh profile typed a 5-character passphrase on /register: the wasm client's ocl_policy with the published bounds (pw_min 8, pw_max 256 from /device/params) refused before any blinded request existed, the page read Choose a passphrase of 8 to 256 characters and stayed on /register (verdict OK, /tmp/w14jr5); the native gate proves the same refusal leaves nothing on the wire (nx_opaque_client_gate P1 P1b P1c).
2026-09-28	CN15	measure	W16 SEAT FAITH-RANKING (T0 1790613058, debt 1790461582) START: banked lib nx_connect_faith.nx 970ca6ac 24007 B at knowledge/bank/nx_connect_faith.nx-970ca6ac-20260928-wave16, the wave-15 gate source 549d925d 39659 B at knowledge/bank/nx_connect_faith_gate.nx-549d925d-20260928-wave16 and the promoted gate 675a20f1 105352 B at knowledge/bank/nx_connect_faith_gate.elf-675a20f1-20260928-wave16 (nx_filecopy verified=1 each). RED ON THE OLD LIB: the wave-15 gate source, whose ranking teeth drive cfa_discover through the one adapter cfgt_ranked, qualify job 1790613393 passed 71/90 verdict=RED (build 66cbc8b8 118096 B); every failure is a ranking tooth -- the owner shows 4 and cfa_discover lists 2 (its faith-signal filter), population order instead of score order, the guardian's own minor and every adult hidden from a minor viewer (its peer band), a viewer at importance 0 lists nobody, a withdrawn member vanishes instead of ranking with the no-faith members; the owner teeth (a member ast_may_discover hides stays hidden, a minor never surfaces to an unrelated adult, fail closed without state or rows) already PASS. Census: cfa_discover has exactly one caller, the gate adapter (nx_shelltool grep over buildroot/runtime job 1790613080, 26985 files, coverage_complete=1 corpus_complete=1); nx_connect_api_lib imports the lib for faith_admit and faith_other only, so no front-door verb uses it. Wave 15 left no plan row; its gate header claims a clock-seeded load population the source does not build (CFGT_LOAD_EXTRA declared and unused).
2026-09-28	CN6	land	W16 BOARD-TREATMENT-AND-RANK (T0 1790613009): the CN6 treat row named the ARCHIVED nx_connect_msgstore (prim absent; its gate retired from the roster 2026-09-26) so nx_compare_rank refused the whole board TREATMENT-PARTIAL (job 1790613009, exit 8). Repointed to the successor under content CAS (expect h4fef2e7370ef471c, 434233 to 434225 B as predicted): mcp and agent nx_chat_store_lib_gate (tool_allowlist.conf row GREEN, gateroster.conf row present), api /api/gate_run?target=nx_chat_store_lib_gate, prim nx_chat_store_lib (buildroot/runtime/nx_chat_store_lib.nx 57665 B, the CN6 contract organ since CHATSTORE-STEP2), wf connect-onboard. The successor was proven on the served binary first: /api/gate_run nx_chat_store_lib_gate GREEN 51/51 exit 0 source_newer 0 (job 1790613240), including T26 restart, T27 isolation and T20-T21 dedup by the (sender, client id) pair. The journey workflow itself still ran the archived gate too: plan-connect-onboard- step 7 repointed from nx_connect_msgstore_gate to nx_chat_store_lib_gate (nx_store_put PUT 7 replaced=1 rows=8, job 1790613282). AFTER: nx_treatment connect rows=9 complete=9 partial=0 undeclared=13 verdict=TREATED; nx_compare_rank connect ranks again (job 1790613514, exit 0, connect.rank sha256 6c0d3162).
2026-09-28	TREAT	measure	W16: the wf surface of every connect treat row is MANIFEST-ONLY today. nx_plan_run connect-onboard (job 1790613298) and nx_plan_run youthsafety-audit (job 1790613707) both refused before step 1 with managed-owned-definition-required, execution NOT_STARTED; tool_allowlist.conf holds 16 nx_pm_owned_run.elf rows and none names connect-onboard, connect-frontdoor or youthsafety-audit. nx_treatment reads only knowledge/store/plan-<id>-manifest.txt, so it, the ranker and this page read wf=present for 9 rows whose workflows cannot run. The ruler measures a narrower subject than its field name. Filed debt 1790614098 (sev 5) with both owners named: the EC49 ruler owner decides how the ruler shows the owned binding (labeled first, so no board is refused before the bindings exist), and the PM or publisher lane binds the two workflows through nx_pm_owned_define (recipe row 1790460735); both are gates and read-only verbs, the READ_ONLY class a v1 handoff policy admits, and each needs an Accountable in the RACI cell store first.
2026-09-28	TREAT	measure	W16: zero new treat rows declared, because none of the 13 undeclared rungs has five present surfaces. CB0 recv_bw_svc: nx_connect_room_rx is PROMOTED-UNREGISTERED with no gate, so no MCP row. CB1 so_feed: nx_connect_social is PROMOTED-UNREGISTERED with no gate. CB2 mx_inter_popc: nx_connect_match_lib has no gate. CB3 nx_connect_maturity: MCP row and source present, but no plan plane composes it and nx_execsurface who reads NO-SURFACE (no clock, cron, daemon or roster row runs it). CN1 CN2 CN4 CN7 CN8 CN9 CN10 CN11 CN12 are open rungs whose organs do not exist yet. Any of these declared now would be a partial row, and a declared partial row refuses the whole board with exit 8.
2026-09-28	RANK	measure	W16 MAP the SOTA climb follows (nx_compare_rank connect job 1790613514, connect.rank sha256 6c0d3162): TARGET VERSION 1.0 (M3 Sealed, called, in a pocket); rungs 22, done 12, open 10. FINISH before anything new (LIB-GATE-ONLY, imported only by gates): CN3 lq_cohort_seed, CN5 acc_realm_unify, CN16 csc_circle_post, CN18 cvh_person_attest -- each needs a caller in the served daemon. Critical path: 1 CN2 native mobile shell, priority 6300 (web gate teeth through the shell on a real device, youth wall identical, push_deliver); 2 CN1 codec bound into calls, 5000 (two-peer call round-trips a frame through our encoder, server decodes zero bytes); 3 CN7 AEAD sealing in the live serve, 2200 (tamper rejected live over the edge; UNMAPPED, no matrix row carries cs_sealed_aead); 4 CN8 post-quantum hybrid, 666 (nx_pq_hybrid composed into the browser key agreement, proven by a keyx-vm-class gate on the shipped wasm); then later 5 CN9 real NMT through the LLM serve, 1000 (judge-graded bilingual fixture beats the lexicon on every pair; UNMAPPED; DEP-PULL raises it above CN10); 6 CN4 trained matching and moderation, 750 (must beat the hand-weighted baseline on a held-out labelled set; competitive evidence INCOMPLETE). Ladder LADDERED (2 dated targets, 22 of 22 rungs placed); barfresh FRESH (SB-CONNECT-2609, 2026-09). The gap to T-BIC-CONNECT closes with CN2, CN1, CN7, CN9, the arm CN11 and the FINISH wiring of CN3, CN5 and CN16; the gap to T-FRONT-CONNECT with CN8, CN4, CN12, CN10 and the FINISH wiring of CN18. CB3 reads open only because its symbol is an organ name that no matrix row carries (priority 0, cost UNESTIMATED): a board-data fix for the owner, not new work.
2026-09-28	CN6	queue	W16 open for owners. (1) LIFECYCLE: nx_connect_msgstore_gate is still a PARALLEL-TOOL -- its tool_allowlist.conf row reads GREEN while nx_catalog calls the binary PROMOTED-SOURCELESS (its source was archived 2026-09-26); unregister the row and retire the binary and its _offc twin through the lifecycle (no unregister verb in this seat's caps). (2) debt 1790372756 EATEN (job 1790614081, DEBT-EATEN): its subject, msd_path in the archived msgstore, is ABSENT-PROVEN in buildroot/runtime (nx_absent coverage_complete=1 corpus_complete=1), and the successor guards the alias by namespace (the room plane chat_acct<id>- cannot name a dir/<id>.cst snapshot) and by the nx_connect_franking_gate tooth neg-control-store-refuses-a-non-positive-account. (3) debt 1790614098 for the two unowned workflows (row 1790614121). (4) CB3 symbol mapping (row 1790614123). (5) the STAGED nx_connect_appd.sov.elf.new 806805 B matches the size row 1790456840 gives the W13 candidate cb3b5c3d; identify it by hash before any use.
2026-09-28	CN13	measure	W16 IDENTIFIED BY HASH (settles item 5 of row 1790614124): the STAGED nx_connect_appd.sov.elf.new is sha256 cb3b5c3df2e69b6629e6a60fa862f0e2ae2954b64bcfd2329c7df8d8de4c24ad, 806805 B (nx_filehash) -- byte for byte the W13 ALPHA-UI-AND-PROD candidate cb3b5c3d that rows 1790456660 and 1790456840 placed in the deploy slot on purpose (vf restore, derived faint ink, one-paragraph account note). It is NOT the current alpha: the alpha has since moved to bf1534cd (866481 B, adds device-side sign-in, the five /try pages and the wired front-door verbs). A /connect ship from this slot as it stands would ship the older candidate; the release owner chooses which one, and nothing here was deployed or restaged.
2026-09-28	RELEASE	measure	W16 SEAT HOSTCTL-DEPLOY pre-deploy evidence (operator approved 2026-09-28). Candidate built by /api/build from the current source: nx_hostctl.nx 351248 B sha256 f30fc731 (unchanged since wave 13) over a closure that moved after the wave-13 build (nx_restart_guard.nx and nx_os_introspect.nx at 1790471904, nx_syscalls.nx at 1790543214); staged nx_hostctl.sov.elf.new 382104 B sha256 66ba7f4c (build_debug.flag=1 so the DWARF line table is appended; src_path names nx_hostctl, src_stable=1, closure e0a972e1). The older stage 349752 B 29a45597 is NOT the exact-kill build: mtime 2026-09-09 and zero occurrences of the exact-mode marker; banked, never deployed. Content ruler live 6122278d vs candidate: runs 1828, lost 5 (2 permil), every one named: the gdeploy and gdeployrb banners and the gdeploy usage line reworded for the exact mode, and the two copies of the row-has-no-field-7 REFUSING line, which is the intended behaviour change (a row without field 7 now restarts EXACT-BY-PATH; connect is the only such row). Gained 304 runs, full inventory knowledge/gates/hostctl_w16_gained_inventory.txt (the exact mode, a new install verb over nx_file_install, process-identity and fd-hygiene helpers). Gates all GREEN: nx_exactkill_gate 36/36 with the end-to-end leg driven through the staged candidate itself (selected=1 spared_same_comm=3 killed EXACT-BY-PATH procs=1 exit 0, no xkfix_ scratch left, corpus_complete=1), nx_hostctl_keepbackoff_gate 9/9, nx_hostctl_buildrun_gate 9/9, nx_hostctl_supervise_gate 1/1 (6 KAT, compiled against the current source), nx_restart_guard_gate 28/28, nx_health_probe_gate 1/1 (6 KAT). Banked to knowledge/bank, each re-hashed equal: live 6122278d, _offc twin 6122278d, nx_hostctl.prev ab32babd (selfswap overwrites it), old stage 29a45597, wave-13 build 22ccae50. Baseline: health OK 16 services 0 down 0 degraded supervisors 1; supervisor pid 30209 and reader-keeper 30211 digest_match 6122278d. Next: /api/deploy target=hostctl (selfswap) with expect_sha256 66ba7f4c.
2026-09-28	W16	queue	COORDINATION (orchestrator 2026-09-28 11:54 CDT) -- read before editing any connect daemon source. (1) Wave 16 seats CONNECT-SHIP-2 and SOTA-SEALED-MESSAGING both start after ALPHA-SIGNUP-DOOR journals its FINAL rung ALPHA row, and both need the alpha daemon sources nx_connect_appd.nx, nx_connect_serve.nx and nx_connect_ui.nx. SOTA-SEALED-MESSAGING holds the edit lease on those three files. CONNECT-SHIP-2 makes its production device switch as ONE small content-CAS edit, journals an edit-start row before it and an edit-done row after it, and builds production only from a tree in which every sealed-messaging change is stage-gated and compiles; its land row names the latest SEALED row its build includes. SEALED journals edit-start and edit-done rows around each of its edit batches, and neither seat edits while the other has an edit-start row without its edit-done row. (2) Wave 17 (launched now) owns nx_connect_api_lib.nx and nx_connect_api.nx through its seat FRONTDOOR-FINISH, and otherwise writes only new files (nx_connect_play, nx_webpush, the CN1 call-codec binding, FS8 cds_date_checkin, FS11 cgm_mod_queue). A wave 16 seat that needs a front-door change journals a request row naming FRONTDOOR-FINISH instead of editing the lib (FAITH-RANKING already found that no front-door verb uses cfa_discover, row 1790613500). Wave 17 does not edit the three alpha daemon sources, the OPAQUE libs, nx_connect_signup, nx_connect_franking, nx_connect_seal, nx_chat_store_lib, nx_connect_faith, nx_connect_juris, the jurisdiction table, nx_proc_kill, nx_hostctl or any door source.
2026-09-28	RANK	land	W16 PUBLISHED after the journal rows above: nx_compare_regen_scoped buildroot ../sites/nishifamily/compare/ --domain connect (job 1790614490) verdict=GREEN fork-fresh, index.html 1041793 to 1050548 B (CAPTURE-BEYOND-RESERVE announced, served whole), api.json 111381 B; nx_page_verify https://nishifamily.com/compare/connect/ (job 1790614517) status 200 bytes 1050548 a11y-issues 0 broken 0 VERDICT=GREEN (static checks; browser rendering unverified). The page reads Treatment verdict TREATED and the ranked critical path again; the first regen of this leg (job 1790613715) had moved the page 695177 to 1041793 B because the ranked sections render once the ranker stops refusing. faithsocial (job 1790614419, 251313 B) and youthsafety (job 1790614459, 332353 B) regenerated and verified GREEN in the same leg.
2026-09-28	CN6	measure	W16: CN6 is a FINISH item the ranker cannot see. Its contract organ is now the shared nx_chat_store_lib, which ships inside nx_chat_store, nx_msg_sync and nx_game_chat, so the ranker's adoption test (does any shipping program import the contract organ) passes and CN6 reads done. But the CONNECT caller of cs_msg_append, nx_connect_franking mfr_relay, is imported ONLY by nx_connect_franking_gate (nx_absent import line over buildroot/runtime: 1 match, coverage_complete=1 corpus_complete=1), so no CONNECT serving daemon stores a message durably yet, and the done-rule's second half (the gauge's messaging row moves STUB to PARTIAL) stays open -- the matrix note still reads STUB from the 2026-09-25 gauge run. Next for CN6: a caller of mfr_relay in the served daemon (alpha first, under the SEALED seat's edit lease on the three daemon sources), then a gauge re-run through /api/organ_run. For the ranker owner: judge FINISH against the board's own serving product when a contract organ is shared across boards.
2026-09-28	CN15	land	W16 SEAT FAITH-RANKING (debt 1790461582) SOURCE LANDED, GATE GREEN, NOT YET SHIPPED: nx_connect_faith.nx 970ca6ac 24007 B to 36ea0569 27249 B -- cfa_rank_visible is the faith ranking over the ONE discovery owner: every member nx_connect_antistalk ast_may_discover shows on the search path is listed (never a filter, never a second discovery rule), scored cfa_rank(base, cfa_signal) and ordered highest first with a tie in population order by an in-place heapsort (cfa_rank_order, O(m log m), no allocation, CFA_HEAP_ARITY a named UNIT), the viewer excluded by pointer and by the owner's SELF answer, fail closed without state, rows or a row; cfa_signal gives a missing record no signal. Gate source 549d925d 39659 B to cad62b80 47317 B: the one adapter cfgt_ranked now drives cfa_rank_visible and the order teeth judge the subject's own scores; NEW section D builds the load population the wave-15 header promised and the source never built (every table row a member plus the viewer and a no-faith member, 81, from a printed clock seed: bands, rings, guardian pairs, vouching, blocks both ways, bases in GX_EXCLUDED..full; three anchors make its condition reachable by construction -- a listed faith lift, a hidden member carrying a faith signal, a score tie) with teeth lists-exactly-the-owner-set and oracle-order-and-scores at scale, plus the neg-control the header also claimed and lacked: the agreement check catches a list differing from the oracle only in the tie rule. RED on the old rule twice: 71/90 (job 1790613393, wave-15 teeth) and 74/96 on a planted revert of the adapter to cfa_discover with every new tooth present (job 1790614445: load lists 1 of 23 the owner shows, oracle order 0); GREEN 95/95 with cfa_discover still present (job 1790614293) and 96/96 after it was ARCHIVED (job 1790614679, build 4674e517 129336 B, load seed 1790614679442452: owner shows 17, listed 17, 4 hidden faith bearers, 2 adjacent ties). LIFECYCLE SUPERSEDED then ARCHIVED: cfa_discover removed from the lib (a two-line tombstone names the path), its text kept reversibly at knowledge/retired/nx_connect_faith.cfa_discover-20260928-wave16.nx (4461 B sha256 c1277bd0) with the MINING RECEIPT: owner test on the search path KEPT, viewer exclusion KEPT plus the SELF answer, allocation-free why slot KEPT, peer band RETIRED (its adult-to-minor half is the owner's AST_WHY_MINOR_ADULT; its minor-to-adult half was stricter than the owner and is NOT carried -- a youth-search rule would belong in ast_may_discover), faith-signal filter RETIRED, population order SUPERSEDED by score order; no MCP verb, API route, plan step, clock row, RACI row or ritual. CENSUS cfa_discover( over buildroot/runtime: 1 call before (the adapter, job 1790613080), matches=0 after (job 1790614690, 26993 files, coverage_complete=1 corpus_complete=1), so the compile refuses any caller that comes back. NOT LIVE: the ranking has no serving caller yet; nx_connect_api_lib and nx_connect_appd import the lib for faith_admit and faith_other, so their next rebuild carries the new closure (no verb behaviour changes).
2026-09-28	CN15	land	W16 SEAT FAITH-RANKING SHIPPED (debt 1790461582): nx_organ_ship nx_connect_faith_gate job 1790615017 SHIPPED 4674e517 129336 B (was 675a20f1 105352 B, banked first at knowledge/bank/nx_connect_faith_gate.elf-675a20f1-20260928-wave16): prove GREEN 96/96 on the fresh build; content RED by design with all 13 lost runs enumerated (display_limit=all, omitted 0) and approved by allow_loss_v1 65c79398 (knowledge/status/harness/loss-65c793981a779453ab27462afa18e4e5d8a8032b7c7bc2b4a849e8ba000bf13a.record): ten teeth of the retired discovery rule and its old verdict note, each superseded by a named ranking tooth or retired on purpose (peer-band-a-minor-query-never-lists-an-adult), plus the symbol names cfa_discover and cfgt_listed; behaviour DIFFERS 6692 to 10025 B, reviewed in knowledge/status/harness/review-faith-gate-4674e517-wave16.txt (sha256 35b31eb7, observation 7a81db83); promote live = staged 4674e517, _offc twin installed and hash-identical (nx_filehash cmp identical=1), already registered, already rostered (3 rows in knowledge/gateroster.conf). SERVED: /api/gate_run nx_connect_faith_gate job 1790615054 exit 0 GREEN 96/96 from the nishihost root (table_rung 1; load seed 1790615049452242: owner shows 24, listed 24, 4 hidden faith bearers, 4 ties). IMPORTERS: nx_connect_api_gate qualify job 1790614755 GREEN 31/31 on the new faith lib closure (faith_admit and faith_other unchanged). FOR THE SEATS THAT BUILD nx_connect_appd OR nx_connect (CONNECT-SHIP-2, SEALED, FRONTDOOR-FINISH): every build after 1790614659 compiles faith lib 36ea0569; a content ruler over a debug build may read the symbol-name run cfa_discover as LOST and cfa_rank_visible, cfa_rank_order, cfa_rank_sift, cfa_rank_swap and cfa_rank_before as GAINED -- benign (no string literal of the lib changed and no verb calls either); the receipt is this row plus knowledge/retired/nx_connect_faith.cfa_discover-20260928-wave16.nx. No re-ship of nx_connect: no front-door verb used cfa_discover (the served binary carries it as dead code until its next build).
2026-09-28	CN15	queue	W16 FAITH-RANKING REQUEST for wave 17 FRONTDOOR-FINISH (owner of nx_connect_api_lib and nx_connect_api per row 1790614470; this seat did not edit either): the faith ranking nx_connect_faith cfa_rank_visible, shipped this wave, has no serving caller -- BUILT and UNWIRED. Wire it as a front-door verb faith_rank over a synthetic population the caller describes, the way antistalk_discover already does: the viewer's tradition, church and importance; per candidate its tradition, church, consent, band, shared context, guardian pair, vouching and any block (either direction, account or claim); an optional base per candidate; answer the ordered list with each score, the owner's public answer for the hidden (a stranger's), and nothing stored; engine name nx_connect_faith.cfa_rank_visible, rung CN15. Api gate teeth to carry: a member the owner hides stays hidden whatever their faith, a withdrawn member ranks at the no-faith position, a minor never surfaces to an unrelated adult, the order equals a brute-force oracle, plus a neg-control each. The alpha HTTP door inherits the verb through ca_dispatch on its next build; the faith gate's teeth already pin the engine (96/96 served).
2026-09-28	RELEASE	land	W16 SEAT HOSTCTL-DEPLOY DONE: the exact-kill control-plane supervisor is LIVE, so /api/deploy target=connect now takes the EXACT-BY-PATH branch (the connect row has no field 7). POST /api/deploy target=hostctl&confirm=yes&expect_sha256=66ba7f4c (job 1790614408) answered PROMOTED, pre_deploy_gate DEPLOY-SAFE (hostctl scopes to domain deploy), gate_blockers 0, no override, the staging guard did not refuse. Verified by identity, not by the receipt: nx_proc_observe nx_hostctl 66ba7f4c = pid 11563 (parent 1) and reader-keeper 11564, digest_match 1, start_ticks 523038820; the old 6122278d ABSENT_IN_COMPLETED_SCAN (exactly one supervisor tree); nishihost/nx_hostctl 382104 B 66ba7f4c, nx_hostctl.prev 6122278d, the stage consumed; supervisor.heartbeat and mgmt_snap.json rewritten every 15 s poll by the new process; supervisor.log shows the new startup banner and zero guard restarts in the first 10 min; sentinel log quiet; sites.elf master 17865 untouched (start_ticks 356638539). Health OK 16 services 0 down 0 degraded supervisors 1, identical to the baseline; nx_services 16 UP procs 1 dup 0; the served nx_status row (pinned nx_hostctl status) runs the new binary and lists every daemon UP. /api/build through the NEW buildrun: target=nx_hostctl_buildrun_gate BUILT 52384 B e89c4a3b with src_path naming the gate (DECLARED: that stage nx_hostctl_buildrun_gate.sov.elf.new exists only as this verification and is not for promotion by this seat). Exact mode on a SCRATCH pair through the LIVE binary: nx_exactkill_gate 36/36 with argv nishihost/nx_hostctl, e2e selected=1 spared_same_comm=3 (the fixture alpha plus the real production and alpha connect processes, all spared) killed EXACT-BY-PATH procs=1 exit 0, no scratch left. deploy_status reads DEPLOYED-GREEN listen=UNVERIFIED-may-be-outgoing-process because the hostctl row health is a TCP connect to sites.elf, which selfswap never restarts: that status says nothing about the supervisor (debt 1790615288). The _offc twin refreshed to 66ba7f4c (nx_filehash cmp identical). ROLLBACK if ever needed: superrollback restores nx_hostctl.prev 6122278d, or copy knowledge/bank/nx_hostctl.live-6122278d-prehostctlw16-20260928 to nx_hostctl.sov.elf.new and /api/deploy target=hostctl with expect_sha256 6122278d. FOR THE CONNECT SHIP: knowledge/registry/deploy_domain.conf had NO connect row, so the pre-deploy gate fell back to GLOBAL scope and the 8 unrelated RED domains blocked it; this seat appended connect connect (with its reason) and nx_deploy_ready check with target connect now reads evidence-honesty pass scope domain:connect, blockers 0, DEPLOY-SAFE-WITH-WARNINGS, so no audited override is needed while connect and the shared-fate domains stay clear. Debt 1790456975 (WAITING-ON-HOSTCTL-SHIP) has its blocker cleared and is left for the connect seat to close when /api/deploy target=connect lands; eaten with this evidence: 1784669462 (hostctl pure-API deploy gap: build then deploy now lands) and 1784838617 (magic ratchet refusing hostctl builds: /api/build BUILT today). Other stages left in place and named: nishihost/nx_hostctl.sov.elf.new.prev is the 2026-09-09 stage 29a45597 that /api/build banked itself (also banked durably).
2026-09-28	CN15	measure	W16 SEAT FAITH-RANKING CLOSE (T0 1790613058): (1) debt 1790461582 EATEN (job 1790615183, DEBT-EATEN at_idx 4530, open 2951) -- its last open item was this faith rule, and its alpha clause had already been settled by row 1790463100 (the alpha answers share_match with the new listing rule). (2) EVIDENCE WIRED: knowledge/compare/connect.gates gains nx_connect_faith_gate (the map's own header asks for every built GREEN sibling gate), and nx_swcompare_evidence connect (job 1790615312) forked all 6 gates GREEN, faith 96/96, verdict MEASURED-HONEST. (3) Two header sentences of the lib still said faith discovery; rewritten line for line to name the ranking, lib dd292886 27247 B; the gate rebuilt from it is BYTE-IDENTICAL to the promoted 4674e517 (qualify job 1790615401, cache miss, 96/96), so the served gate is current and the edit is proven comment-neutral (36ea0569 and dd292886 differ in comments only). (4) PUBLISHED: connect regen job 1790615455 GREEN (index.html 1053997 to 1073093 B), youthsafety regen job 1790615500 GREEN (332353 to 335966 B), nx_page_verify GREEN on both (jobs 1790615497 and 1790615543; static checks, browser rendering unverified). (5) OPEN, each named for its owner: the ranking's front-door verb faith_rank (row 1790615101, wave 17 FRONTDOOR-FINISH); whether youth search should list adults at all (youthsafety row 1790615102, the ast_may_discover owner); nx_gate_bite over cfa_rank_order and cfa_rank_before NOT run, because the lib sits in the closure of nx_connect_appd, which CONNECT-SHIP-2 and SEALED build this wave, so an in-place mutant could be compiled into a production or alpha candidate -- the non-vacuity evidence today is the two RED runs and the tie-rule neg-control, and the bite belongs in a quiet window. LESSON: a gate header that promises a fixture its source does not build (here the clock-seeded load population and the swapped-pair neg-control) reads as coverage while measuring nothing; this seat built both rather than deleting the claim.
2026-09-28	FS11	queue	EDIT-START wave 17 seat GROUP-MODERATION (faithsocial FS11 cgm_mod_queue). The FS11 done-rule composes room_admit, abuse_score, sink_fails and ca_should_serve, and all four live in PROGRAMS that carry a main (nx_connect_lds_room, nx_connect_blind_abuse, nx_connect_csae_report, nx_connect_ads) which no lib or gate can import (nx_parse fails closed on two definitions of main; nx_absent-grade scans: no importer of any of the four exists); the csae extraction is already named OWED on this board (row 1790360640, YS5 item 2). This seat moves those symbols VERBATIM and un-renamed into four NEW libs beside them in runtime/_hdl_build (nx_connect_lds_room_lib, nx_connect_blind_abuse_lib, nx_connect_csae_report_lib, nx_connect_ads_lib), edits each program ONLY to delete the moved lines and import its lib, proves each program's own self-test unchanged by before and after qualify runs (baselines this leg: jobs 1790615431 8 of 8 GREEN, 1790615434 GREEN, 1790615439 GREEN, 1790615442 GREEN), and repoints in the same leg the 14 data rows that name those organ paths (buildroot connect.matrix 4, youthsafety.matrix 3, faithsocial.matrix 2; bare-tree connect.matrix 3 and connect.axes 2) so no cell goes dark. None of these files is on the wave 16 or FRONTDOOR-FINISH lists; it is a named deviation from the new-files-only rule, taken because composing them without a second copy is otherwise impossible. An EDIT-DONE row follows.
2026-09-28	CN13	measure	Cross-reference from youthsafety.plan rows 1790615600 to 1790615602 (wave-16 LAWS seat): the juris lib and table that CN13 sign-up (csu_juris_admit) and the juris_rules verb compile changed. (1) nx_connect_juris.nx now carries SOURCED-SILENT (wave 15's grammar, gate bd49f3ce 161/161 GREEN): a statute read and found silent is admitted and counted apart, never taints, never draws; a consumer built from the OLD lib REFUSES such a row (fail closed: the place reads the strictest line and the partition shows refused 4) until it is rebuilt from current source -- nx_connect_api, the signup gate and both connect_appd builds are in that state now, and the next rebuild of each picks the new lib up with no source edit. (2) knowledge/connect_jurisdictions.conf 49715 to 64085 B, rows 34 to 40: MX is DECLARED with consent below 18 by parental_consent (Codigo Civil Federal Art. 646, 23, 424), US-UT is declared (COPPA 13 now, and consent below 18 by VPC from 2027-05-06 under Utah 13-76), and the strictest line every undeclared or tainted place reads moved from consent below 16 to consent below 18 (VPC, barred below 16 unchanged) -- so under the new lib a Mexican minor of 15 is admitted with guardian consent where the old lib bars them, and a 16- or 17-year-old declaring PH, AR, FR, PL or an unlisted place now needs verified guardian consent; sign-up teeth that assert the strictest consent value should be re-read by their owners
2026-09-28	CN8	queue	W16 SOTA-PQ-HYBRID REQUEST to the seat holding the daemon-source edit lease (SOTA-SEALED-MESSAGING per row 1790614470; nx_connect_serve.nx and nx_connect_appd.nx were NOT edited by this seat): make the hybrid LIVE by shipping the additive kx=2 fields exactly as buildroot/runtime/nx_connect_pq.nx (sha256 62b0faad) defines them -- import it and compose its validators, never a second format. (1) POST /connect/pubkey, the cs_route pubkey branch beside cs_sh_pub_put2: read optional kx and q with cs_form_get; when q is present refuse unless kxp_q_ok(kx, q, qn) == 1; store q (kxp_ek_hex() = 2368 hex, one ML-KEM-768 encapsulation key) in the directory row beside the X25519 pub under the SAME owner rule as cs_sh_pub_put2 (a verified handle's q changes only by its owner, never an unowned rebind) and append it as an additive field of the shared.cbl pubkey row so a legacy row replays X25519-only; the plane arena grows by kxp_ek_hex() + 1 bytes per directory row. (2) GET /connect/pubkeys: a row carrying q gains kx 2 and q hex (additive JSON fields). (3) POST /connect/seal: read optional kx, kc (kxp_kc_ok, 2176 hex) and tg (kxp_tg_ok, 32 hex); refuse a partial envelope (kc without tg or the reverse); store both with the message and in the cbl msg row as additive fields; CS_CTHEX does not move. (4) GET /connect/sealed: a message carrying kc gains kc and tg. (5) defense in depth: refuse a seal without kc when BOTH from and to carry q (kxp_accept(1,1,0,0) = KXP_REFUSE_DOWNGRADE), since the page already refuses it. Bodies grow by about 2.4 KB (publish) and 2.2 KB (seal); the appd request buffer is 262144 B so no cap moves. Proof owed with the change: an alpha gate tooth that publishes a q, reads it back from /pubkeys, seals with kc and tg, reads both back from /sealed and refuses the four malformed cases; then the alpha /connect UI links /synth/connect_e2e_pq on stage instances. Until then the page is X25519-only BY RULE (no peer can advertise a field the directory does not carry) and says so on screen.
2026-09-28	CN13	land	W16 SEAT OPAQUE-LIB (T0 1790613031) redid the wave-15 seat killed by the outage, starting from its partial work: wave 15 had written the recovery doors and the fake record into both libs with five W15-RED-DISARM early returns still planted and a gate that called nine helpers it never defined (func g_fake_of count 0), so nothing compiled and nothing was proven. LANDED, debt 1790462863 items 1 and 2: (1) THE RECOVERY CREDENTIAL ON THE DEVICE -- nx_opaque_client ocl_recovery_new (24 BIP39 words drawn on the device through the randomness door by hub/nx_bip39, the in-process encoder, so the words interoperate both ways), ocl_recovery_decode (typed words decoded and checksum-checked on the device, OCL_RECOVERY_MISMATCH -7), ocl_recovery_register_blind and ocl_recovery_register_finalize (the recovery record sealed on a second state initialised from osw_rec_public_cfg: the handle plus the rec suffix with KSF identity, exactly as _ma_issue_recovery_act seals it in process; the entropy is wiped by each finalize), ocl_recovery_login_blind, ocl_recovery_login_finalize, ocl_recovery_forget; server nx_opaque_wire_server osw_rec_public_cfg, osw_register_respond_pair_bound and osw_register_store_pair_bound (one bound nonce for both requests, the recovery row created only after the passphrase row was, so none can be planted beside an existing account), osw_recover_respond and osw_recover_finish (a KE2 against the recovery record plus the two registration responses in one round trip, then nx_uas_rotate of the passphrase row and the recovery row in nx_modern_auth_recover's order); the recovery secret never reaches the server at sign-up or at recovery. (2) RFC 9807 6.3.2.2 THE FAKE RECORD -- osw_fake_record derives client_public_key and masking_key per credential identifier from the realm oprf seed by HKDF-Expand under named labels, envelope Nn plus Nm zero bytes, derived on EVERY lookup (osw_record_or_fake) so a live and a free handle both pay one DeriveKeyPair; osw_login_respond and osw_recover_respond answer a free handle with a KE2 over it and a pending over a fake record never mints (OswPending.fake appended last). WAVE 16 ADDITIONS: (3) THE ROTATION IS BOUND TO THE PROVEN SESSION -- new lib runtime/_hdl_build/nx_opaque_rotbind.nx orb_mac, HMAC-SHA256 under the AKE session key over the label NishiRecoveryRotateV1 then the new passphrase record then the new recovery record, one definition both halves compose: the device ocl_recovery_rotation_mac (armed only by a produced KE3, one use, wipes the session key) and osw_recover_finish(ctx, rp, ke3, record, rec_record, rotation_mac) which recomputes it and compares in constant time, so a TLS-terminating intermediary that passes the genuine KE3 on beside a record of its own rotates nothing. (4) THE DEVICE VALIDATES SERVER ELEMENTS -- ocl_point_ok (the incumbent nx_voprf_deserialize_element) on the evaluated element and server key of a RegistrationResponse and on the evaluated element and server key share of a KE2, refused OCL_BAD_SERVER_MESSAGE -8 before the KSF runs, because the incumbent Finalize discards its deserializer's verdict (debt 1790616294). SOURCES: nx_opaque_client.nx 24721 B sha256 d09956ec780bc796, nx_opaque_wire_server.nx 33152 B sha256 1351c82486c7fbac, nx_opaque_rotbind.nx 2565 B sha256 e3ec68c10b45e367, nx_opaque_client_wasm_kat.nx 7189 B sha256 6b4cd2937fc2d6dc (exports reckat and recrt), nx_opaque_client_gate.nx 67814 B sha256 de88aa85daafd185, nx_opaque_wasm_gate.nx 12567 B sha256 1377795286aa2210.
2026-09-28	CN8	measure	W16 SOTA-PQ-HYBRID FOUND on the LIVE X25519-only E2E page: nx_page_verify https://nishifamily.com/synth/connect_e2e (job 1790616410) serves 38117 B for a 37122 B file -- the edge router appends its ad slot AND an inline view-beacon script (navigator.sendBeacon to /ad/view) to any page lacking the literal nx-ad-optout (nx_host_router hr_has_optout). On a page that keeps X25519 private keys in localStorage that is a script the page did not write running beside the keys, and a view beacon on the messaging surface, against the no-tracking-by-construction directive. Measured the same on the hybrid page before its fix (file 82452 B, served 83447 B with the slot); the hybrid page now carries the comment literal and is served byte-identical (82471 = 82471, job 1790616049), gate tooth T9d pins it. NOT fixed on production by this seat (another lane's surface, rollback discipline): the remedy is the same literal after the head tag in ce_emit_html plus a publish-guarded republish of /synth/connect_e2e with the old page banked; nx_connect_device_client emits the same head and carries the same exposure.
2026-09-28	CN13	measure	W16 OPAQUE-LIB proofs. nx_opaque_client_gate: RED 105/142 on the wave-15 planted old answers (job 1790614783: F1 a free handle answered -1409 USER_NOT_FOUND, F3, R1 to R14 with the recovery doors refused, RN2 to RN6 and the view fixture) then GREEN 143/143 with the plants removed (job 1790615350); a second planted phase for the wave-16 additions read RED 144/151, exactly the predicted seven (job 1790615653: Z1 a finalize against an all-zero RegistrationResponse returned 0 and Z1b sealed 129 bytes, Z2 a zero server key beside a genuine evaluation returned 0, Z3 an all-zero KE2 read -4; and with the MAC compare disarmed RB1 rotated kai to the intermediary's record 0, RB1b the intermediary's passphrase then signed in 0, RB1c the owner was locked out -1410), then GREEN 151/151 (job 1790615939); the planted server was restored byte-identical (sha256 1351c824 before and after). F2 alone does not discriminate (a zero KE2 also fails -4 on the device, measured on the planted run), so F2a pins that a free handle's KE2 is a real message. SHIPPED by nx_organ_ship: nx_opaque_client_gate 3347608e4b71a196 424408 B (job 1790616103: prove 151/151, content GREEN, behave DIFFERS approved, offc twin; prior 126ea0bc banked knowledge/bank/nx_opaque_client_gate.elf-126ea0bc-pre-w16-20260928, nx_filecopy verified 1) and nx_opaque_wasm_gate e9b6176907ad5882 (job 1790616207: prove 25/25; RED 21/25 on the planted state job 1790615085, exactly the four new teeth at -101, GREEN 25/25 job 1790615981; prior cb309327 banked knowledge/bank/nx_opaque_wasm_gate.elf-cb309327-pre-w16-20260928). WASM: the promoted nx_compile_wat then nx_wat_compiler rebuilt the device module from nx_opaque_client_wasm_kat.nx: 210492 B sha256 5af5f9c0a8a7f26019685ad9c20b9a2289f1a96cdbba1372af9e63b30b46617e (was 176424 B 931c3d7b; now carries the BIP39 wordlist, the recovery doors and the element checks), banked knowledge/bank/connect_device_opaque.wasm-5af5f9c0-w16-20260928 (verified 1); inside the VM reckat decodes the pinned 7f vector and recrt round-trips device-drawn words, native and wasm agree; the WAT carries 9 ocl_recovery_ exports. Values: server_view_bytes 3106 with the words and the 256-bit secret absent from it and the neg-control firing on the in-process recover's view, recovery_words_bytes 153 to 159, two free handles' fake records differ in 64 bytes. Served /api/gate_run on 3347608e reads exit 141 RED with capture_truncated 1 while every captured tooth is PASS (job 1790616216): the 16384 B FAST capture closes the pipe on this 19 KB gate, a second measurement of debt 1790615554; the roster runner captures 65536 B and is not affected. The alpha still serves bf1534cd built before all of this: nothing here is live until the ALPHA-SIGNUP seat rebuilds and restarts it.
2026-09-28	CN13	queue	W16 OPAQUE-LIB FOR THE ALPHA-SIGNUP SEAT -- the entry points to wire into nx_connect_appd behind mount/device (the served alpha bf1534cd predates all of it). REGISTER WITH A RECOVERY CREDENTIAL replaces respond and store by the pair: the device inits a passphrase state from /device/params (osw_public_cfg) and a recovery state from a new params field built by osw_rec_public_cfg(ctx, handle, n, out_ccfg, out_context of OSW_CONTEXT_CAP) (client id the handle plus the rec suffix, KSF identity), calls ocl_recovery_new(st, out_words, cap at least NX_B39_MAX_MNEMONIC_LEN 256, out_n) and shows the 24 words to the person (they never leave the device), then ocl_register_blind and ocl_recovery_register_blind and POSTs both 33 B requests; osw_register_respond_pair_bound(ctx, handle, n, req, rec_req, out_resp66, out_rec_resp66, rp from osw_reg_pending_new, out_nonce32) answers two responses and the nonce; the device runs ocl_register_finalize and ocl_recovery_register_finalize (the entropy is wiped) and POSTs both 129 B records with the nonce; osw_register_store_pair_bound(ctx, rp, nonce, handle, n, rec, rec_rec) creates the passphrase row then the recovery row, USER_EXISTS for a taken handle before any recovery row, INVALID_SESSION for any other nonce, handle or a single respond's nonce. RECOVER is two routes: the device runs ocl_recovery_decode(typed words) on a recovery state (a typo answers -7 and nothing is sent), ocl_recovery_new on a second recovery state (the new words), ocl_register_blind for the new passphrase, ocl_recovery_login_blind (KE1 98 B) and ocl_recovery_register_blind, and POSTs KE1 with both requests; osw_recover_respond(ctx, handle, n, ke1, req, rec_req, out_ke2, out_resp, out_rec_resp, rp from osw_rec_pending_new, kept in the pending table like the login pending) answers KE2 259 B and two responses, over a fake record when the account or its recovery row is absent; the device runs ocl_recovery_login_finalize (words that are not the account's, or a fake record, answer -7 and no KE3 is produced), both finalizes, then ocl_recovery_rotation_mac(the decoded state, rec, rec_rec, out_mac32) and POSTs KE3 32 B, both records and the 32 B MAC; osw_recover_finish(ctx, rp, ke3, rec, rec_rec, mac) rotates both rows or answers RECOVERY_MISMATCH or INVALID_SESSION and mints no session (the device then signs in with its new passphrase). LOGIN KE1 needs no route change: rebuilt against the new wire server, /device/login/ke1 answers 200 with a fake KE2 for a free handle and the device fails -4 exactly as for a wrong passphrase (the edge device gate carries no free-handle tooth, 0 hits for sign_in_failed). The device script must name OCL_BAD_SERVER_MESSAGE -8 (a malformed server message, never shown as a wrong passphrase) and OCL_RECOVERY_MISMATCH -7; module 5af5f9c0 exports every ocl_ function. The daemon context comes from olg_ctx_setup_ttl, and the one nx_auth_context_init call in nx_opaque_login passes allow_recovery 1, so the recovery doors are enabled there. STILL OPEN from 1790462863 (superseded by the next debt row): (3) no rate limit on the device routes and an arena bump per sign-in; (5) a source-tree home and a release-recipe step for connect_device_opaque.js and the module; (6) production /connect unchanged by construction.
2026-09-28	CN8	queue	W16 SOTA-PQ-HYBRID REQUEST for wave 17 FRONTDOOR-FINISH (owner of nx_connect_api_lib and nx_connect_api per row 1790614470; neither edited here): two PURE front-door verbs over nx_connect_pq so agents, tests and other doors reuse the rule instead of re-deriving it -- nothing stored, no key material in or out. kx_policy <self_adv> <peer_adv> <pinned> <has_kc> answers kxp_accept (hybrid, x25519-only or refused-downgrade) and kx_policy send <peer_adv> <pinned> answers kxp_send_mode; kx_fields <kx> <q> <kc> <tg> answers kxp_q_ok, kxp_kc_ok and kxp_tg_ok for a directory row or envelope an agent is about to submit. Engine nx_connect_pq, rung CN8. Api gate teeth to carry: both-advertise without kc refused, a pinned peer refused after the directory strips q, a legacy peer x25519-only (positive control), kx 1 refused, a short q refused, a non-hex tag refused. The crypto itself stays in the browser's wasm: a server verb must never touch a private key or a shared secret.
2026-09-28	FS11	land	EDIT-DONE wave 17 seat GROUP-MODERATION (resumed after the 12:39 CDT outage killed the first run; closes EDIT-START row 1790616200). The four libs (nx_connect_lds_room_lib 1917 B, nx_connect_blind_abuse_lib 1341 B, nx_connect_csae_report_lib 1344 B, nx_connect_ads_lib 1588 B) and the four program edits had all landed before the outage; each program now imports its lib and carries no copy of the moved symbols. PROOF the move is behaviour-neutral: after-edit qualify runs reproduce each baseline line for line -- nx_connect_lds_room 8 of 8 GREEN with identical VALUES (job 1790618187 vs baseline 1790615431), nx_connect_blind_abuse recall and precision 1000 permil (1790618190 vs 1790615434), nx_connect_csae_report fail-closed 6 of 6 and 0 duplicates (1790618193 vs 1790615439), nx_connect_ads 7 teeth fails=0 (1790618198 vs 1790615442); all four were BUILD-CACHE hits on post-edit keys, so the predecessor had already built them. DATA ROWS: 14 of 14 now name the libs -- 5 landed by the predecessor (3 room_admit rows in buildroot connect, youthsafety and faithsocial matrices; 2 sink_fails rows in bare-tree connect.matrix and connect.axes) and 9 by this seat under CAS (buildroot connect.matrix sink_fails, abuse_score, ca_should_serve 26361 to 26373 B; youthsafety.matrix abuse_score, sink_fails 13218 to 13226 B; faithsocial.matrix abuse_score 23290 to 23294 B; bare connect.matrix abuse_score, ca_should_serve 6522 to 6530 B; bare connect.axes abuse_score 1946 to 1950 B). Full-corpus greps after the writes: 0 rows in buildroot/knowledge/compare name nx_connect_blind_abuse.nx, nx_connect_csae_report.nx, nx_connect_ads.nx or nx_connect_lds_room.nx followed by a symbol (1164 files, corpus_complete=1), so no watch cell reads DARK on the next beat. NOT PROMOTED, on purpose: the four programs are existing verifiers, not new tools, and this seat promotes only its own new libs gates and tools; their served binaries predate the move and the qualify fossils in _build are behaviour-identical on every tooth they carry.
2026-09-28	CN1	measure	W17 SEAT CALL-CODEC RESUMED (T0 1790618784, after the 12:39 CDT network outage killed the first run mid-work). The predecessor journaled nothing on this board but left three NEW sources, re-read whole: buildroot/runtime/nx_connect_codec.nx (18243 B: cc_ctx_new, cc_call_codec_bind, cc_call_codec_open, cc_ctx_free), nx_connect_codec_relay.nx (8893 B: the ONE clear call-frame header plus the content-blind relay hop over nx_room_relay rr_post and rr_live, importing only nx_room_relay) and nx_connect_codec_gate.nx (34944 B). nx_sov_build_run nx_connect_codec_gate --qualify (job 1790618931, build-cache hit sha256 89fc9f74, 235900 B) reads 54/54 GREEN: the receiver's frame is byte-identical to the sender's encoder reconstruction across bind, seal, relay and open in both directions; key Y-PSNR 4454 cdB and P-frame 3771 cdB against the codec's own 2800 cdB bar at qp 32; the decoder refuses the bytes the relay holds (rc -1) while the same decoder accepts the plaintext stream (rc 0); a flipped ciphertext or tag byte, an edited counter, a relabelled layer and the wrong call key are refused -31 at the AEAD before the decoder runs, a misroute -27, a replay -29; VmSize flat across 16 sealed P-frames. AEAD composed: nx_connect_seal cseal_seal_ws and cseal_open_ws (RFC 8439 ChaCha20-Poly1305, caller workspace) because the room path had no cipher (nx_connect_room_rx rx_decrypt is an additive stand-in). Next: bite, ship, register, roster.
2026-09-28	FRONTDOOR	measure	W17 SEAT FRONTDOOR-FINISH RESUMED (T0 1790618011) after the laptop outage killed the first run. First action: nx_sov_build_run nx_connect_api --build-only (job 1790618011) BUILT the shared tree as it stands, 286008 B sha256 990d09c4 -- nx_connect_api_lib.nx is untouched since 1790460213 (91802 B sha256 a5ec1e10, banked knowledge/bank/nx_connect_api_lib.nx-a5ec1e10-20260928-w17), so no repair was owed. The predecessor journaled nothing and worked in NEW files only: runtime/_hdl_build/nx_connect_frontdoor.nx (the decision cores cfdk_* behind circle_reach, circle_join, circle_channel, circle_guardian_sees CN14, study_post CN16 and liquidity_seed CN3), a scratch copy of the api lib (nx_connect_api_lib_w17scratch.nx with the six handlers, the rows wired, msg_append repointed to nx_chat_store_lib.cs_msg_append and kept unwired, signup_admit, realm_unify and franking_verify kept unwired with their reason in the row), a scratch CLI and a copy of the gate with no new teeth. Its scratch build was a cache hit with the artifact present (332642 B). This seat added: circle_reach now carries the ONE discovery owner's answer on the search path (ccl_may_discover) beside the ring, because reach is not discovery -- an unrelated adult who shares the ward with a minor reaches ring 2 and is told discover_visible 0 minor_adult; and gate teeth T30 to T42 (a positive tooth and a neg-control per verb plus the catalog tooth). First scratch gate run 43 of 44 (job 1790619284): the one RED was my own catalog tooth matching the archived organ name inside msg_append's reason text; it now asserts the engine field. VERB QUEUE carried: faith_rank (row 1790615101), kx_policy and kx_fields (row 1790616600), person_attest decision form (CN18), service_match pair decision (CN17 csh_need_match is a pair decision, not a population).
2026-09-28	CN13	land	W16 SEAT CONNECT-SHIP-1 (resumed after the 12:39 CDT outage, T0 1790618431) SHIPPED PRODUCTION /connect: nx_connect_appd 872a9cc974d23cba 872313 B replaces e0998c6b 777986 B through POST /api/deploy target=connect (job 1790619206: PROMOTED, pre_deploy_gate DEPLOY-SAFE, gate_blockers 0, override none, the exact-kill hostctl 66ba7f4c taking the EXACT-BY-PATH branch). RESUME: the predecessor journaled nothing, banked its build as knowledge/bank/nx_connect_appd.elf-prodcand-872a9cc9-20260928 and the live binary as knowledge/bank/nx_connect_appd.elf-live-e0998c6b-preship-20260928 (both re-hashed equal) and issued no deploy; the job the resume note named as its build (1790616418) is an nx_debt show, not a build. A fresh nx_sov_build_run nx_connect_appd --build-only --release (job 1790618684) answered BUILD-CACHE HIT key 4602f725 = 872a9cc9 -- the key covers the fully expanded source closure, the compiler, the assembler and the flags, so the tree had not moved since the predecessor built it; the daemon sources appd, serve, ui and api_lib are unchanged since 2026-09-26 and no EDIT-START row was open on them. GATES ON THE CANDIDATE BYTES (bank path): nx_connect_prod_register_gate 31/31 (job 1790618843: takeover T1 to T5 closed, M1 to M3 no API envelope and no stage cookie in production mode, K3 vf 1 and neg-control K4 vf 0), nx_connect_auth_gate 12/12 (job 1790618850), nx_connect_mount_gate 20/20 (job 1790618857), nx_connect_pubkey_bind_gate 13/13 fails 0 incl. T13 vf both ways (job 1790618861). CONTENT RULER live e0998c6b vs 872a9cc9 (job 1790618865): lost_from_live 4 of 1597 runs (2 permil), shown 4 omitted 0, complete inventory by nx_contentdiff_export (job 1790618966, complete=1 missing=4) at knowledge/gates/w16_connectship1_cdx_e0998c6b_872a9cc9.txt sha256 c4fb9753. The four, each adjudicated from the candidate bytes: (1) and (2) the dark and light palette literals carrying the DECLARED faint ink (6a7488 dark, 8b94a6 light), now composed from parts with the faint DERIVED at startup by cd_ink_arm against the referee bar in knowledge/pixjudge.conf and refused by name to the declared ink when the conf is unreadable; (3) the /sealed JSON joint quote-comma-s, replaced by the vf key before s (the emitter literal now reads f, p, vf, s, ct -- debt 1790441350); (4) the wave-8 alpha /features note, reworded into the wave-14 note (the /features block is stage-only, production never enters it). Gained 134 distinct runs, led by the stage-only /device routes, SOURCED-SILENT from the juris lib and the ink announcement lines. BANKED before overwriting: the W13 stage cb3b5c3d (never shipped) at knowledge/bank/nx_connect_appd.sov.elf.new-cb3b5c3d-w13staged-20260928 (nx_filecopy verified 1, mode 0755); staged 872a9cc9 by nx_filecopy from the candidate bank (verified 1, mode 0755). VERIFIED BY IDENTITY, not by the receipt (deploy_status reads DEPLOYED-GREEN listen=UNVERIFIED-may-be-outgoing-process, the honest third state): nx_proc_observe nx_connect_appd.elf 872a9cc9 finds exactly one process, pid 9825 start_ticks 523520552 parent 25615 digest_match 1, unchanged on a re-sample about five minutes later; e0998c6b ABSENT_IN_COMPLETED_SCAN; the ALPHA pid 31967 start_ticks 508028459 bf1534cd UNTOUCHED (same pid and ticks before and after). nishihost/nx_connect_appd.elf = 872a9cc9, nx_connect_appd.elf.prev = e0998c6b (the rollback slot; its former 3e46d193 stays banked at knowledge/bank/nx_connect_appd.elf-3e46d193-20260925), the stage consumed. OVER THE EDGE: nx_page_verify /connect/ 200 11744 B a11y 0 GREEN (job 1790619290), /connect/register 200 10706 B a11y 0 GREEN (job 1790619294), /connect/login 200 10649 B a11y 0 GREEN (job 1790619296) -- static checks, browser rendering unverified; /connect/api/v1/catalog answers 200 text/html 11744 B, the home page, with no JSON and no API envelope (job 1790619303: production never enters the api block, the path falls to the core's unknown-path page, as before this ship); /connect/pubkeys byte-identical to its pre-deploy read, 5 keys with equal flags (jobs 1790619172 and 1790619306), and connect/shared.cbl f4e554e8 1225 B unchanged, so the production plane replayed. THE SERVED BYTES: nx_connect_prod_register_gate with its default subject nishihost/nx_connect_appd.elf (job 1790619309) 31/31 GREEN, K3 vf 1 and K4 vf 0. THE DERIVED FOOTER CONTRAST IS LIVE: the served CSS carries faint 80899A dark and 686F7C light; my own WCAG arithmetic (an ad-hoc probe, grade 4) puts both at 4.50 to 1 against surface-2, the worst surface they sit on (the declared inks read 3.38 dark and 2.72 light there), and 5.48 dark and 4.71 light against bg. VISUAL REVIEW NOT DONE: the capture driver's browser rows in knowledge/cdp_capture.conf are the laptop's Edge only, so a NAS-side run refuses CD-BROWSER-ABSENT; the render door is already declared on cms.plan (row 1790608600). DEVICE SIGN-IN stays DARK in production by construction (the device block runs only on a staged instance); CONNECT-SHIP-2 builds its switch from this served base. HEALTH OK 16 services 0 down 0 degraded before and after. DEBTS: 1790441350 EATEN (job 1790619486 DEBT-EATEN at_idx 4517); 1790456975 EATEN (job 1790619481 DEBT-EATEN at_idx 4524) and superseded by 1790619461 (sev 4) carrying its four residuals verbatim -- plan-connect-release- has no managed-owned definition so the RACI plane cannot run this recipe yet (this ship went through /api/deploy on the operator's explicit yes), ds_exe_sweep should compose nx_exactkill_lib, legacy gdeploy rows still substring-kill, the DECLARED-DAEMON refusal names the organ rather than the deploy row. ROLLBACK if ever needed: the .prev slot holds e0998c6b, or copy knowledge/bank/nx_connect_appd.elf-live-e0998c6b-preship-20260928 to nx_connect_appd.sov.elf.new and POST /api/deploy target=connect with expect_sha256 e0998c6b; bank the served binary before any second deploy of connect, which would overwrite .prev.
2026-09-28	CN13	measure	W16 SEAT CONNECT-SHIP-1 POST-SHIP (follows row 1790619720): the release record is PUBLISHED -- nx_compare_regen_scoped buildroot ../sites/nishifamily/compare/ --domain connect (job 1790619781) verdict GREEN fork-fresh, index.html 1073093 to 1145296 B, api.json 111493 to 117060 B, and nx_page_verify https://nishifamily.com/compare/connect/ (job 1790619830) 200 1145296 B a11y 0 GREEN with the ship row on the page (3 matches of the seat name). PRODUCTION STATE UNDISTURBED: connect_auth_keys.bin mtime 1785023286 and connect_auth_store.log mtime 1785047635 unchanged by the restart, the store re-hashed f72f20a0 3460 B equal to its pre-deploy read, so the new daemon loaded the existing realm keys and accounts from the nishihost CWD rather than provisioning fresh ones. THE ALPHA STILL SERVES over the edge: nx_page_verify https://nishifamily.com/alpha/connect/ (job 1790619859) 200 12353 B a11y 0 GREEN, its process pid 31967 unchanged. The W13 stage cb3b5c3d was NOT used (its hash is not the build), banked and replaced; no stage of nx_connect_appd is left armed after the deploy consumed 872a9cc9.
2026-09-28	CN19	land	W17 SEAT GAMES-TOGETHER (resumed after the 12:39 CDT laptop outage; the first run had written buildroot/runtime/_hdl_build/nx_connect_play.nx and nx_connect_play_gate.nx, built the gate GREEN and journaled nothing): lib nx_connect_play (contract cpl_play_move, 26973 B) and gate nx_connect_play_gate (34927 B) GREEN 112/112. This leg: (1) the lib now imports nx_connect_lds_room_lib, the youth room rule's one home since the FS11 move today, instead of the verifying program nx_connect_lds_room, so no consumer of the session inherits that program's main or its short helper names (yw, yn, ad_allowed, may_private_dm); rebuilt with a cache miss, 112/112 GREEN (job 1790618918). (2) nx_gate_bite 4 of 4 compiling mutants KILLED, each restore byte-verified: first-kill at a comparison in the play-table parser on the pre-edit bytes (job 1790618628), then aimed on the final bytes at cpl_join site 9 the room_admit test (job 1790619073), cpl_leave site 8 the room_may_leave test (job 1790619153) and cpl_play_move site 23 the move-legality test (job 1790619289). (3) SHIPPED by nx_organ_ship (job 1790619475) sha256 850c2af1 prove GREEN 112/112 on the fresh build, first promote live equal to staged, _offc twin installed, REGISTERED on the MCP surface (callable 1); served /api/gate_run (job 1790619582) exit 0 GREEN 112/112 on the FAST path, capture untruncated. (4) rostered in knowledge/gateroster.conf and cited in knowledge/compare/connect.gates. (5) board: rung CN19 Games together, one to one or in groups (1.5 u, deps CN14) added to M2 with the milestone cumulatives restated (M2 16.5, M3 25, M4 32.5, M5 36.5) and the answer row, rungrole CN19 contender T-FRONT-CONNECT, matrix watch row _ABSENT_:cpl_play_move on runtime/_hdl_build/nx_connect_play.nx with Discord Best and Meetup Part grounded by two new pinned refs (discord-activities sha256 0c17a9bf fetched this leg and read, meetup-home-2609 sha256 bcff6060); intake 1790361302 (games together, plus2) routed to connect:CN19 (nx_intake_route FILED); nx_ladder connect LADDERED 23 of 23 placed; nx_compare_rank connect (job 1790619825) reads rungs 23 done 15 open 8 with CN19 in FINISH as LIB-UNCENSUSED until the next eco-graph build and importcensus. HONEST STATE: LIB-GATE-ONLY like CN3 CN5 CN16 CN18 -- imported only by its gate, no served caller, nothing member-facing; shipped, gate 112/112, awaiting acceptance.
2026-09-28	CN19	land	W17 GAMES-TOGETHER: nx_connect_lds_room (the youth game and hangout room verifier, on nx_gate_verdict since 2026-09-25, already rostered) was PROMOTED-UNREGISTERED; REGISTERED on the MCP surface (/api/tools/register job 1790619650, callable 1) against the served binary sha256 dbe94f48 48217 B, and run through /api/organ_run (job 1790619743) exit 0 GREEN 8/8 (a lone adult denied a youth room, two-deep admits, a leave cannot strand youth, live game and chat rosters 2 and 2 with the denied adult absent). /api/gate_run refuses the name by design (verifiers must end in gate, test or kat), so organ_run is its served witness. The BUILT 56912 B fossil is the GROUP-MODERATION seat's post-extraction build of the same program (the rule moved verbatim into nx_connect_lds_room_lib today); the served binary predates that move and this row changed no binary.
2026-09-28	CN19	queue	VERB REQUEST FOR FRONTDOOR-FINISH: the games-together verbs, rung CN19, engine nx_connect_play (import runtime/_hdl_build/nx_connect_play.nx; it composes nx_connect_circles, nx_connect_lds_room_lib, nx_folkgame_lib, nx_determinism and nx_room_relay; measured over buildroot/runtime with corpus_complete=1: the cpl_ prefix is defined only in nx_connect_play, room_admit and TWO_DEEP only in nx_connect_lds_room_lib, and BAND_MINOR also only in the program nx_connect_idage, which nothing imports). OWN-ACCOUNT OPERATIONS -- the actor is always the session's account mapped to its circles member, never a request field; room hashes are minted by the server; now is the server clock; a room block is the only state: play_open = cpl_open(ps: i64, st: i64, conf: i64, owner: i64, kind: i64, base: i64, room: i64, now: i64) -> i64 with kind 1 private (one to one) or 2 group, base = cpl_game(slug: u8) -> i64 (tictactoe today, 0 refuses), conf = cpl_conf_new() then cpl_conf_read(knowledge/connect_play.conf, conf) -> 0 or -2 (no table, no room opens), ps sized cpl_state_slots(conf) i64 words; play_invite = cpl_invite(ps: i64, st: i64, from: i64, to: i64, now: i64) -> i64 (private rooms, only where ccl_channel admits the pair); play_join = cpl_join(ps: i64, st: i64, who: i64, now: i64) -> i64 (reach or invitation, the cap, room_admit on join, ast_may_discover both ways); play_sit = cpl_sit(ps: i64, who: i64, now: i64) -> i64 (group rooms, the second side starts the game); play_move = cpl_play_move(ps: i64, who: i64, mv: i64, now: i64) -> i64 with mv = cpl_place(cell: i64) -> i64, or cpl_play_move_relay(ps, g_st, g_ar, who, mv, now) to also carry the validated move and its digest on the room's game channel; play_state = cpl_state_for(ps: i64, who: i64, now: i64, out: i64) -> i64 with out sized cpl_state_words(ps) (state, side to move, plies, digest, result, abandoned, the caller's own seat, then one word per cell), answering ONLY an occupant of the room (-14 otherwise); play_leave = cpl_leave(ps: *i64, who: i64, now: i64) -> i64 (room_may_leave on leave). Return spelling: 0 ok, 1 already, 2 unrelayed (the move stands), -1 bad_input, -2 no_table, -3 no_game, -4 not_member, -5 closed, -6 expired, -7 two_deep, -8 two_deep_leave, -9 not_invited, -10 channel (cpl_why carries the ccl code), -11 hidden (cpl_why carries the AST_WHY, and the reply maps it through ast_public_answer so a block reads as a stranger, never the word blocked), -12 unreachable, -13 full, -14 not_occupant, -15 not_player, -16 not_your_turn, -17 illegal, -18 not_playing, -19 finished, -20 wrong_kind, -21 seats_taken. The one-shot stateless dispatcher cannot hold a room between calls, so these rows land UNWIRED (engines nx_connect_play.cpl_open, cpl_join, cpl_play_move and cpl_state_for) until the alpha daemon holds the room table (integration spec row below). PURE DECISION the door can wire today: play_check over a synthetic pair the caller describes, built by the door's own ca_ring2 (its adult co-founders serve as hosts) and ca_youth_rows, acceptance through ccl_ask, a block through ast_block -- args game kind a_band b_band guardian accepted blocked hosts moves [a_yb b_yb] (bands 0 minor 1 adult; guardian and accepted 0 or 1; blocked 0 none 1 a blocks b 2 b blocks a; hosts 0 to 2 co-founders seated first in a group room; moves a comma list of cells alternating from the opener) -- returning the open, invite and join verdict names, every move's verdict name, plies, the result name, the final digest and viewer_told, nothing stored. Api gate teeth: a youth-youth one-to-one with acceptance plays while an adult-minor one-to-one refuses walled both ways; a group room with one host refuses a minor two_deep and with two hosts admits; a blocked pair answers viewer_told stranger with no blocked word in the reply; an out-of-turn and an illegal move are named and leave the digest unchanged; the door's final digest equals a direct cpl_ replay of the same moves in-process; a neg-control each. The engine is pinned by nx_connect_play_gate, 112/112 served.
2026-09-28	FRONTDOOR	land	W17 SEAT FRONTDOOR-FINISH LANDED the front door's wave-17 verbs in the shared lib in ONE content-CAS write (expect h19c28ae978421efc): runtime/_hdl_build/nx_connect_api_lib.nx 91802 B sha256 a5ec1e10 to 116201 B, importing the new decision-core lib runtime/_hdl_build/nx_connect_frontdoor.nx 35739 B (one import line). CATALOG PARTITION before rows 20 = wired 8 + not_yet_wired 12 + not_yet_landed 0; after rows 20 = wired 14 + not_yet_wired 6 + not_yet_landed 0. WIRED, each a PURE decision over a synthetic situation built per call and dropped with it, no member data, nothing stored, no verb lists anyone: circle_reach (CN14 ccl_circle_reach, one pair's innermost ring plus the ONE discovery owner's search-path answer), circle_join (ccl_join), circle_channel (ccl_channel, THE ONE contact rule), circle_guardian_sees (ccl_guardian_sees), study_post (CN16 csc_circle_post, the corpus text resolved, the reflection never echoed), liquidity_seed (CN3 lq_cohort_seed and the invite arrival it seeds). STILL not_yet_wired with the reason in the row: signup_admit (wave-16 ALPHA-SIGNUP-DOOR is changing csu), realm_unify (own-account: ca_dispatch carries no caller identity on either surface -- measured: the alpha cd_api_handle passes only the verb and its a= fields), msg_append (engine repointed from the archived nx_connect_msgstore to nx_chat_store_lib.cs_msg_append; wave-16 SEALED owns messaging), franking_verify (SEALED owns franking), person_attest and service_match (owed this leg). PROOFS: gate teeth T30 to T42 read RED 31 of 44 on the OLD lib (job 1790619920, exactly the 13 new teeth, every prior tooth PASS) and GREEN 44 of 44 on the landed lib (job 1790619992, the scratch twin 44 of 44 job 1790619445); nx_gate_bite over nx_connect_frontdoor.nx (job 1790619740) killed 1 of 1 compiling mutant, restore verified byte-identical; the ALPHA COMPILES against the new lib: a byte copy of nx_connect_appd.nx importing the wave-17 lib (runtime/_hdl_build/nx_connect_appd_w17check.nx, never run) built 957528 B sha256 05ba29f5 with no duplicate definition (job 1790619608); nx_sov_build_run nx_connect_api --build-only BUILT 381464 B sha256 9d83712e (job 1790619998). The alpha and production serve the new verbs only at their next rebuild by wave 16; this seat restarts nothing. Gate source nx_connect_api_gate.nx 46272 to 70918 B (old banked knowledge/bank/nx_connect_api_gate.nx-cbf3a89b-20260928-w17). NEXT: ship the gate and nx_connect_api (noregister), then kx_policy, kx_fields, person_attest, service_match and faith_rank.
2026-09-28	CN19	queue	W17 GAMES-TOGETHER INTEGRATION SPEC for the alpha /connect daemon owner (wave 16 holds nx_connect_appd, nx_connect_serve and nx_connect_ui; this seat edited none, and FRONTDOOR-FINISH measured that ca_dispatch carries no caller identity on either surface, row 1790620060, so the own-account play verbs live in the daemon): (1) startup loads the play table with cpl_conf_read and fails closed -- without it the play routes answer a named refusal and no room opens; (2) a room table keyed by the server-minted room hash, each entry one cpl session block of cpl_state_slots(conf) i64 words beside one nx_room_relay game channel (rr_init with slot bytes cpl_frame_bytes()), over the circles state the daemon already holds; (3) zero-JS routes in the app's own style: POST open (game, kind), POST invite (a handle the caller can already see), POST join, POST sit, POST move (room, cell) through cpl_play_move_relay, GET room (only the caller's own room, through cpl_state_for: the board as HTML with every empty cell a form button and the digest printed so a second device can compare), POST leave; (4) the actor is the session's account mapped to its circles member, never a form field, and a hidden pair renders the one public answer; (5) idle expiry by cpl_sweep on every touch of a room, which closes it and releases every seat at once, so no adult is ever left alone with youth by a timeout; (6) nothing tracked: no IP, user agent, device id or location stored or logged, no analytics, and the play pages carry no ad slot at all. Daemon acceptance: the play gate's teeth driven over the served routes (a lone adult refused on join and on leave, an adult-minor one-to-one refused, a blocked pair answered as a stranger, an out-of-turn move refused) plus a visual review of a board on a phone at nishifamily.com/alpha/connect -- until then the capability is UNVERIFIED on any served surface.
2026-09-28	CN19	measure	W17 GAMES-TOGETHER /games read live (nx_https_get job 1790618639, 18304 B, emitted by nx_games_page at epoch 1787677284): tic-tac-toe against an unbeatable minimax and Connect Four against a 5-ply alpha-beta are PLAYABLE there, both as inline page JavaScript rather than through nx_folkgame_lib, beside sovereign wasm Sudoku, and a Play together section links one replayed store match. The same page carries the estate ad slot (Nishi Video) and an IntersectionObserver view beacon that calls navigator.sendBeacon on /ad/view/... So the alpha connect note (play against the computer now, with friends when rooms go live) is WITHHELD, not published: one click from the ad-free, beacon-free connect door would land a youth on a page that serves an ad and fires a view beacon, breaching the no-ads-to-minors and no-tracking stance by construction. Owed first, for the /games owner (the nx_games_page emitter and its site lane): the ads optout blueprint row on /games (the router then injects neither the slot nor the beacon) and the two align games driven by the one generator; then the note is one line on the connect front door through its own publish lane.
2026-09-28	CN1	land	W17 SEAT CALL-CODEC: CN1 SHIPPED, gate 60/60, awaiting acceptance. nx_connect_codec_gate shipped by nx_organ_ship (job 1790620070) sha256 6e2212bf: prove GREEN 60/60 on the fresh build, first promote live equal to staged, _offc twin installed, REGISTERED callable 1; served /api/gate_run (job 1790620130) exit 0 GREEN 60/60 on the FAST path, capture 8417 B untruncated, source_newer 0, sources resolved from the nishihost root through buildroot/runtime. Libs: buildroot/runtime/nx_connect_codec.nx sha256 7e92ca5e 18243 B declares cc_call_codec_bind (the contract symbol the matrix watch names, in the organ path the row names) with cc_call_codec_open, cc_ctx_new and cc_ctx_free; nx_connect_codec_relay.nx sha256 0f0d5a57 8893 B. This seat added the real-frame leg on the estate's REAL-frame fixture knowledge/staging/media/bframe_test_decoded.yuv (YUV420 576x1024, the frames nx_vcodec_t8noise_gate and nx_vcodec_bgop_bench read): frame 0 as a key frame 94930 codec bytes sealed to 94970 at 4488 cdB, frame 1 as a P-frame 1779 codec bytes sealed to 1819 at 3958 cdB, closed loop both times (gate source 34944 to 36925 B). Bite-proven: nx_gate_bite 3 of 3 compiling mutants KILLED, each restore byte-verified -- the lib comparison site at off 10012, the geometry guard in cc_ctx_new (job 1790619821); aimed numeric site 30 at off 16255, the receiver replay window ctr + 1 in cc_call_codec_open (job 1790619956); the relay comparison site at off 6574, the magic check in ccr_hdr_parse (job 1790620023). Rostered in knowledge/gateroster.conf, cited in knowledge/compare/connect.gates, declared for both libs in knowledge/organ_gate.conf. RESOURCE ENVELOPE, named: one call context holds an AEAD workspace of cseal_ws_bytes of its plaintext bound, 2765824 B at 320x240 (the incumbent arena AEAD spends a block state per 64 plaintext bytes, about 6x the 460818 B bound), allocated once in cc_ctx_new and returned by cc_ctx_free (VmSize falls 3396 kB on free); nothing is allocated per frame (VmSize delta 0 over 16 sealed frames). The watch flip on the next connect publish is the receipt, not the proof.
2026-09-28	CB0	measure	W17 SEAT CALL-CODEC gave CB0 its MCP row: nx_connect_room_rx (PROMOTED 44471 B, a self-gating organ whose main runs 9 teeth on the base class and returns gv_verdict) REGISTERED through /api/tools/register (job 1790620383, callable 1) and run through /api/organ_run (job 1790620422): exit 0, 9/9 GREEN, capture complete. /api/gate_run REFUSES it by name (job 1790620406: verifiers only, the name must end in gate, test or kat), so the roster and the gate route cannot run it until a thin nx_connect_room_rx_gate exists -- queued, not built. HONEST SCOPE: its T3 content-blind tooth is a modelled constant (server_decoded_blind returns 0 by definition and rx_decrypt is an additive stand-in); the MEASURED content-blind proof for the call path now lives in nx_connect_codec_gate T4 (the decoder refuses what the relay holds, accepts the plaintext) and T5 (the relay closure and CB0 import no decoder and no AEAD).
2026-09-28	CN1	queue	CN1 INTEGRATION SPEC for the call UI owner (the alpha daemon sources are wave 16 locked, and no /connect source carries a call path today: nx_txtscan count of video is 0 in nx_connect_appd 89245 B, nx_connect_serve 132671 B and nx_connect_ui 33585 B). SERVER, alpha first then production: one call route pair composes nx_connect_codec_relay ONLY and never nx_connect_codec -- POST a sealed frame through ccr_relay_post(st, arena, room, now, frame, n, info) over relay state from ccr_state_cells(nslots) with rr_init slot bytes cc_frame_cap(W, H) of the call's top rung (a frame over a slot is REFUSED CCR_E_SLOT, never truncated); GET the newest frame of one sender and layer through ccr_relay_fetch(st, arena, room, kid, layer, now, ttl, out, cap). Admission stays with its owners: nx_connect_lds_room room_admit on join AND on leave (two-deep youth wall), nx_connect_circles ccl_channel for a one-to-one pair, nx_connect_antistalk ast_may_discover for who may be called. CLIENT: compile nx_connect_codec through nx_compile_wat into the call worker (the door nx_opaque_wasm_gate proved for the OPAQUE client); per own stream cc_ctx_new(W, H, qp, kid, layer, call_key) once, each camera tile vv_rgba_to_yuv420 then cc_call_codec_bind(ctx, yuv, key_req, out, cc_frame_cap(W, H)) then POST; per remote sender one receiver context, each fetched frame cc_call_codec_open(ctx, frame, n) then render cc_ctx_frame(ctx); cc_ctx_free at hang-up. The family video app already writes the same 6-byte inner header before its vv_enc stream (nx_video_appv2_emit encodes at RT + 0xB0000 + 6), so swapping NX.vv_enc and vv_dec for cc_call_codec_bind and cc_call_codec_open there is wire-compatible; four literal probes of that emitter (crypt, seal, subtle, chacha) count 0 each over its 74595 B, so its frames cross nx_vroom without a cipher today (ephemeral by nx_room_privacy_gate, not content-blind by construction). CALL KEY: until CN7 and CN8 land a server-free key agreement, the call key comes from the sealed-messaging key path (wave 16 SEALED), never from the server. Teeth the integration owes: extend the T5 import census over the serving daemon (no decoder, no AEAD in its closure), a live two-peer call over the served route round-trips a frame while the relay holds ciphertext, and a lone adult is refused on join and on leave of a youth call room.
2026-09-28	CN2	queue	W17 SEAT PUSH-DELIVERY resumed (predecessor died in the 12:39 CDT network outage with no journal row): found its two sources, buildroot/runtime/nx_webpush.nx (estate-wide RFC 8291 encryption + RFC 8292 VAPID + RFC 8030 header lines, composing nx_p256_ecdh, nx_hkdf, nx_aes128_gcm, nx_jose_es256, nx_ecdsa_p256_sign, nx_ecdsa_p256, nx_base64, nx_jwt, nx_csprng) and buildroot/runtime/nx_connect_push.nx (push_deliver, closed vocabulary, SSRF host fence, four-field subscription record, owner tombstone, VAPID key file), plus the three RFC mirrors (knowledge/fetched/cmp_connect_rfc8291.txt d7130962, rfc8292 2165418a, rfc8030 bc8b9646, re-hashed equal). No gate, no conf, no build existed. This leg: bounded every caller-sized scratch request before allocation (a p256dh, auth or signature segment larger than the arena block would have killed the process, exit 231), made the rs check strict (RFC 8291 section 4 says rs GREATER than record plus tag) and added the RFC 8030 7.2 body cap WPUSH_BODY_MAX, and wrote buildroot/runtime/nx_connect_push_gate.nx (54618 B, sections A RFC 8291 worked example byte exact, B refusals, C RFC 8292, D policy end to end to the POST). First build next.
2026-09-28	CN8	land	W16 SOTA-PQ-HYBRID RESUMED (T0 1790618739; the predecessor was killed by the 12:40 outage after shipping the gate and before journaling a land row). CN8 is LANDED ON THE PAGE and proven on the shipped wasm, and is NOT live for members until the directory half ships. WHAT: runtime/nx_connect_pq.nx (22167 B sha256 62b0faad) holds kx_pq_hybrid (okm = SHAKE256 over LABEL, ss_mlkem, ss_x25519, ct_mlkem, sender and recipient identity keys, 64 bytes: the ChaCha20 key then the tag key), the SHA3-256 message tag kxp_mac, the downgrade rule kxp_accept and kxp_send_mode, the additive kx=2 wire validators kxp_q_ok kxp_kc_ok kxp_tg_ok and the memory layout the page JavaScript is emitted from; nx_connect_e2e_client pq writes /synth/connect_e2e_pq (82471 B sha256 028082ba, banked knowledge/bank/connect_e2e_pq.html-028082ba-v2-cn8-20260928, the ML-KEM-768 module banked nx_ml_kem_768.wasm-0abd65a8-cn8-20260928), the X25519-only page untouched. PROOF on the promoted referee nx_connect_pqkx_vm_gate 2441a3c8 (241968 B, shipped by nx_organ_ship at 1790616675, _offc twin identical): GREEN 53/53 on the shipped page (nx_job_run pid 3478, /tmp/cn8_w16r_green.out, vm_elapsed_ms 173872): FIPS 203 NIST ACVP ML-KEM-768 keygen tcId 26 plus the first encapsulation case, its decapsulation and the modified-ciphertext implicit-rejection case byte-exact on the shipped module from the sha256-pinned mirror a556952c, RFC 7748 section 6.1 on the shipped X25519, both ends derive the same okm equal to the native kx_pq_hybrid, a tampered ML-KEM ciphertext and a wrong X25519 half each make the tag refuse, either half alone derives a different key, and X25519-only is refused once both peers advertise or the peer is pinned. RED 26/53 on the X25519-only page (nx_job_run pid 3984, /tmp/cn8_w16r_red_oldpage.out): exactly the 27 KEM, hybrid, tamper and page-wiring teeth fail while the pure rule teeth T8 and the classical-module teeth pass, which is the discrimination. BITE: nx_gate_bite nx_connect_pqkx_vm_gate nx_connect_pq.nx 2 aim kxp_accept 5 (job 1790620413): the has_kc == 1 site mutant compiled and the gate went RED, valid_mutants=1 killed=1, restore byte-identical 22167 B, both twins RESTORED and re-hashed 2441a3c8. WIRED THIS LEG: knowledge/organ_gate.conf rows nx_connect_pq and nx_connect_e2e_client to nx_connect_pqkx_vm_gate (the close ruler had resolved nx_connect_gate by one-segment strip); heavy-roster admission by nx_gate_roster_run trial then admit (GREEN 53/53 in 171261 ms at nice 10, 38 percent of the 450000 ms heavy share, admitted_new=1, partition reconciles); knowledge/bite_deadline.conf row 450000 for this gate; a knowledge/compare/connect.gates evidence row; treat row CN8 (nx_treatment COMPLETE, board TREATED 10 of 10). HONEST SCOPE: static identity keys, so no ratchet and no forward secrecy (Signal SPQR and iMessage PQ3 are ratchets), no safety numbers, and every conversation is X25519-only BY RULE until the directory carries kx=2 (queue row 1790616560). Shipped, referee GREEN, awaiting operator acceptance.
2026-09-28	CN8	measure	W16 SOTA-PQ-HYBRID, WHAT THE CLOSE RULER READS AND WHY ONE LINK IS FALSE. nx_rungclose check connect CN8 now reads stage LIVE: journal, built (kx_pq_hybrid declared in runtime/nx_connect_pq.nx), live (treat row, mcp present), wired (treat COMPLETE) and page HOLD; tested FAILS no-green-since-land with the gate resolved by the organ_gate.conf declaration and rostered in knowledge/gateroster_heavy.conf. Its operated link reads HOLDS run=1790619791 read_from=clock-ran-the-agent-by-its-job-name, and that witness is NOT a run: knowledge/status/actlog.jrnl line 1979538 is a CLOCK-DISPATCH-V2 row for job=gaterosterheavy with exit=0 but pid=0 execution=NONE state=WAITING_AUTHORITY late=431131, which rgc_ax_index credits because it never reads execution= (debt 1790620981, sev 6, close-ruler owner). So CN8 operated is UNVERIFIED, and tested cannot hold until a roster beat runs: every clock row read (the three roster beats and all 51 complete rows of the nx_clockjob live prefix) is WAITING_AUTHORITY with executable_binding=UNBOUND and execution_proven=0, and knowledge/status/gateroster.jrnl and gateroster.stamp end at ts=1790178517 -- no gate roster pass for 5.1 days (debt 1790620957, sev 8, clock-plane owner; recipe nx_clockjob bind). THE TREAT ROW, CAVEATED: wf=connect-pqkx names knowledge/store/plan-connect-pqkx- (row 1 nx_filehash of the shipped page, row 2 nx_job_run of the referee into /tmp/planrun_connect_pqkx.out), which nx_plan_run REFUSES before step 1 with managed-owned-definition-required (job 1790620103), the same manifest-only state as every connect workflow (row 1790614121, debt 1790614098) -- the binding is the PM or publisher lane through nx_pm_owned_define (recipe row 1790460735); agent=gaterosterheavy is the beat the gate is admitted under and runs nothing while its clock row waits for authority; api=/api/organ_run with deadline_ms=300000 because /api/gate_run's FAST path cannot hold a 174 s gate.
2026-09-28	FS8	queue	VERB REQUEST FOR FRONTDOOR-FINISH: the date-safety verbs, faithsocial rung FS8 (contract cds_date_checkin), engine nx_connect_datesafety (import runtime/_hdl_build/nx_connect_datesafety.nx; it composes nx_connect_circles ccl_band, ccl_channel and ccl_block, nx_connect_antistalk ast_block through the circles closure, nx_connect_franking mfr_relay, mfr_report_verify and mfr_report_route, nx_connect_seal, nx_x25519 and nx_hkdf; the cds_ prefix is defined only in nx_connect_datesafety). OWN-ACCOUNT OPERATIONS -- the actor is always the session's account mapped to its circles member, never a request field; now is the server clock; the state is ONE caller-sized i64 block ds = cds_new(cap: i64, acap: i64) -> i64 loaded by cds_load_default(ds) from knowledge/connect_datesafety.conf (policy flag 1 live, anything else refuses every share -202): date_share = cds_date_share(ds: i64, cst: i64, rq: i64) -> i64 with rq sized CDS_SQ_SLOTS i64 words (sharer account and circles member from the session, contact account and member, deadline epoch seconds, now, pointer and length of the device-sealed plan from cds_plan_seal, pointer and length of the device-franked escalation from mfr_frank with sender = the sharer and seq = its client msg id, that client msg id), answering the share id above zero (the SAME id for a byte-identical replay, -218 for the same key carrying other bytes) or a refusal; date_checkin = cds_date_checkin(ds: i64, id: i64, actor: i64, now: i64) -> i64 (idempotent: 1 already, 2 ok_late after the escalation was delivered); date_block_report = cds_block_report(ds: i64, cst: i64, sx: i64, bq: i64, out: i64) -> i64 with bq sized CDS_BQ_SLOTS (share id, actor account and member, match account and member, the match's live personhood claim id or 0, the server franking key, optionally the reported plaintext with its opening, commitment, server tag and ctx taken from the stored record via mfr_rec_tf, mfr_rec_rf and mfr_rec_ctx, and an MFR_CAT_ category) and out sized CDS_BR_SLOTS (ast_block answer, ccl_block answer, report route or refusal, verified true sender) -- ONE step: discovery hidden both ways, the lane severed, the report routed. Companion own-account verbs on the same block: date_extend = cds_date_extend(ds, id, actor, deadline, now), date_cancel = cds_date_cancel(ds, id, actor, now), date_update = cds_date_update(ds, id, actor, plan, pn), date_plan = cds_plan_fetch(ds, id, requester, out, cap) (the sharer or the contact only). SERVER BEAT, not a user verb: a sweep walks cds_due(ds, id, now) and calls cds_escalate(ds, id, st, kf, chan, now) with st = mfr_store_open(conf, contact account) and chan = cds_channel_verdict(cst, sharer member, contact member) at delivery time. Return spelling: share id above 0, 0 ok, 1 already, 2 ok_late, -201 refused_input, -202 refused_policy, -203 refused_minor, -204 refused_minor_contact, -205 refused_no_channel, -206 refused_deadline_past, -207 refused_deadline_far, -208 refused_full, -209 refused_no_such, -210 refused_not_owner (the reply maps it through cds_public_answer so another person's share reads exactly as no share), -211 refused_closed, -212 refused_not_due, -213 undeliverable, -214 refused_self, -215 refused_weak_dh, -216 refused_open, -217 refused_report_sender, -218 refused_conflict, -219 refused_band, -220 refused_earlier; cds_code_name gives the wire word so the door and the gate never disagree. The one-shot stateless dispatcher cannot hold the block between calls, so these rows land UNWIRED until the alpha daemon holds the date-safety block beside its room table. PURE DECISION the door can wire today: date_admit = cds_admit(policy: i64, sharer_band: i64, contact_band: i64, contact_lane: i64, deadline: i64, now: i64, lead_max: i64) -> i64 over the conf the door loads (bands YW_BAND_MINOR and YW_BAND_ADULT, the youth wall's own). GATE TEETH that prove each verb: nx_connect_datesafety_gate 122/122 GREEN promoted sha f1feb09f (share, an idempotent check-in that changes no server byte, a missed check-in delivered into the contact's room and opened there, a minor sharer and a minor contact refused by name with nothing written, block and report in one step with discovery hidden both ways, a sealed plan that does not open under a third party's key, a census of the state image and the contact's segment files carrying no word of the plan); the door's own tooth should assert date_share by a minor answers refused_minor and date_checkin by another account answers refused_no_such.
2026-09-28	CN19	queue	W17 GAMES-TOGETHER RITUAL plane seeded for its owner: knowledge/store/plan-connect-play-verify- holds 4 READ_ONLY steps (1 nx_connect_play_gate, 2 nx_connect_lds_room, 3 nx_ladder connect, 4 nx_barfresh connect), every step tool registered on the MCP surface; nx_plan_run connect-play-verify (job 1790620457) refused before step 1 with managed-owned-definition-required, execution NOT_STARTED, the same state the connect-onboard and youthsafety-audit planes are in (debt 1790614098). The binding belongs to the PM or publisher lane through nx_pm_owned_define (recipe row 1790460735) once the RACI cell store names an Accountable for a connect-play activity; every step is a gate or a read-only verb, the READ_ONLY class a v1 handoff policy admits. No plan manifest file was written, so nx_treatment reads no workflow surface for CN19, and no treat row is declared: of the five surfaces only the primitive lib is present (the front-door verb, the alpha API mount, the owned workflow and an agent row are absent).
2026-09-28	FS11	queue	VERB REQUEST FOR FRONTDOOR-FINISH: three front-door verbs over runtime/_hdl_build/nx_connect_groupmod.nx (seat GROUP-MODERATION, faithsocial FS11 cgm_mod_queue; gate nx_connect_groupmod_gate GREEN, shipped, registered, rostered). The lib is a pure core with caller-owned rows: the front door owns durability, persists every report and action row as i64 fields (read through cgm_queue_row and cgm_log_row) and replays them on start with cgm_load_report(q i64, row i64) -> i64 then cgm_load_action(q i64, row i64) -> i64 (every report first, then every action, each in order; out-of-order history refuses -61). Context: cgm_init(q, evctx), cgm_bind_groups(q, gmeta, gmem, gcap), cgm_bind_rows(q, rpt, rpcap, act, accap) and cgm_group_add(q, meta, mem) -> gid over the SAME nx_connect_group_lib group arrays and nx_connect_events_lib ctx the live app binds (group ids equal to the events ctx group ids). (1) mod_report, an OWN-ACCOUNT operation (reporter = the authenticated account, never a request field): cgm_report(q i64, gid i64, reporter i64, target i64, reason i64, at i64) -> i64 returns the report id or -61 bad argument, -63 not a member, -67 full, -68 self; for a message, cgm_report_message(q i64, gid i64, reporter i64, reason i64, at i64, fr i64) -> i64 with fr slots GMF_KF the server franking key (the front door's secret, never client input), GMF_M and GMF_MLEN the reported message, GMF_NF the opening, GMF_TF the commitment, GMF_RF the server tag and GMF_CTX the stamp from the recipient's received record; the sender is proven by mfr_report_verify, a franking refusal passes through (-43 opening, -42 not the recipient) and only the message id is stored; reason is the franking category 1 CSE, 2 sexual, 3 bullying, 4 harassment, 5 stalking, 6 spam; at is the server clock in seconds. (2) mod_queue_mine, a PURE READ for the authenticated account: cgm_mod_queue(q i64, gid i64, viewer i64, out i64, cap i64) -> i64 returns the count of open report ids in priority order (CSAE first, then abuse score, then filing time) or 0 for anyone who is not the group owner or an admin, -67 when cap is too small (never a silent prefix); each row through cgm_queue_row(q i64, viewer i64, rid i64, out i64) -> i64, 12 fields in order gid, reporter (0 for a content-blind signal), target, reason, at, route (1 safety, 2 CSAE), csae_tries, csae_ok, frank_mid, frank_ok, score, src (1 member, 2 signal), or -62 not an admin, -68 the viewer is the target (anti-retaliation) with out untouched. (3) mod_act, an OWN-ACCOUNT operation (actor = the authenticated account): cgm_act(q i64, gid i64, actor i64, rid i64, kind i64, at i64, until i64) -> i64 with kind 1 warn, 2 mute until the epoch in until (0 until reversed), 3 remove (a ban until reversed), 4 dismiss; returns the action id or -62 not an admin, -63 target no longer a member, -64 the two-deep youth wall refuses, -65 a CSAE report its sink has not accepted, -66 already resolved, -67 full, -68 self, -69 rank; with cgm_reverse(q i64, gid i64, actor i64, aid i64, at i64) -> i64 for undo (-70 not reversible) and cgm_csae_retry(q i64, rid i64) -> i64 for a retry beat. Posting, RSVP, join and the ad slot of a moderated group should route through cgm_can_post, cgm_rsvp, cgm_join (-75 banned) and cgm_ad_serve so a muted, removed or banned member and a minor-holding group are refused by construction. Teeth that prove it, all in nx_connect_groupmod_gate: the DONE-RULE teeth (an admin sees and resolves a planted franked report; no plaintext in any byte of the queue, with the census control finding the canary in an incumbent row; a youth group left with one adult refuses; a CSAE report whose sink fails refuses every action until retried; a group holding a minor serves no ad), the member and outsider empty-queue neg-controls, anti-retaliation, removed-cannot-post, reversal-restores with both rows kept, ban until reversed, and replay equivalence (a fresh context loaded from the stored rows answers every queue and posting read identically).
2026-09-28	CN19	land	W17 GAMES-TOGETHER SECOND METHOD CLASS for the chained digest: nx_connect_play_gate grew four teeth (source banked first, knowledge/bank/nx_connect_play_gate.nx-3db13fde-20260928-w17, and the promoted elf, knowledge/bank/nx_connect_play_gate.elf-850c2af1-20260928-w17, both copies verified byte for byte): a bitwise CRC-32C written from the standard (no table, sharing no code with nx_crc32c) reads the catalogued check value 0xE3069283 on the nine ASCII digits; the opening digest and every ply's digest are recomputed from the folk-game generator driven directly (never the session), over the words the session chains -- previous digest, move, the generator's own snapshot -- serialised little-endian by shifts rather than a memory cast, and all five plies agree (second_method_opening_digest 3598535430, second_method_plies_agreeing 5); a neg-control feeds the same words high byte first and must disagree. PLANTED: the IEEE polynomial 0xEDB88320 in place of the Castagnoli one read RED 113/116 (job 1790621034) with exactly the three second-method teeth failing (the KAT read 3421780262, the IEEE check value 0xCBF43926); restored, the build HIT the GREEN build's cache key f4cef98e byte for byte (job 1790621090) at 116/116. SHIPPED: /api/build (job 1790621115) staged 236896 B sha256 6b796697 with src_path naming the gate and src_stable 1; nx_contentdiff live vs staged GREEN, lost_from_live 0, four runs gained (job 1790621155); /api/promote with expect_sha256 PROMOTED 6b796697 (job 1790621177, prev kept); nx_offc_install installed the _offc twin from the promoted root binary; served /api/gate_run (job 1790621212) exit 0 GREEN 116/116, capture untruncated; the roster comment and the connect.gates label restated to 116/116. The digest is therefore a spec any client in any language can reproduce, which is the crossplay-by-determinism property the rung promises; a cross-architecture replay (wasm, rv64) stays UNMEASURED.
2026-09-28	CN19	lesson	A lib that imports a verifying PROGRAM for one rule inherits every short helper name that program defines (here yw, yn, yinlist, ad_allowed, may_private_dm and its stripped main): it builds today only because the import preprocessor strips the main, and the first consumer that also defines a yw or yn would refuse on two definitions. The moment the rule has a lib home (nx_connect_lds_room_lib since the FS11 move this morning), import the lib -- the play gate rebuilt 112/112 on the switch and every aimed mutant still died. Second: a digest proven only by replaying the same code twice is ONE method class; an independent recompute (a bitwise CRC anchored to its published check value, over shift-serialised words, from the rules engine driven directly) is what makes it a spec a client in another language can reproduce, and the planted wrong polynomial reading RED on exactly those teeth is what proves the recompute is not trivially agreeing. Third: a research fetch that follows a redirect lands the mirror under a different canonical, and the refs gate counts it MOVED against a ratchet; re-fetch the canonical URL directly (hops 0) and cite that, which took connect's row off both the open-redirect and moved lists.
2026-09-28	R1	measure	W16 DOORS-LOGIN-CRITICAL door 1 of 3 (family login opaque_login :9091, deploy row opaquelogin via hostctl logindeploy, organ_kind none, deploy_domain authz) PRE-DEPLOY: served nishihost/nx_opaque_login.elf e070b5fa 335882 B pid 31543 start_ticks 169365106 parent 1 cwd nishihost stdout /tmp/login.log (hostctl HC_LOGIN_CMD spawn); production registration_open reads 0 and nishi_hr.log is ABSENT so POST /register refuses everyone today; opaque_store.log 29064 B. REBUILT from the current tree nx_sov_build_run nx_opaque_login_daemon --build-only --release (job 1790620536, cache MISS) = fabec913bd7af5dce762307ab40694cbf5bdb7029ad26e0d4ca51c999d133279 376177 B. BANKED: knowledge/bank/nx_opaque_login.elf-live-e070b5fa-predoors-20260928 (verified=1), knowledge/bank/nx_opaque_login.elf.prev-9c84dd66-predoors-20260928 (447621 B, the slot logindeploy overwrites), knowledge/bank/nx_opaque_login_daemon.sov.elf-cand-fabec913-doors-20260928. GATES on the current tree: nx_opaque_login_gate 8/8 (job 1790620683), nx_user_account_store_gate 39/39 incl second register -1412 and late row past 16 MiB (job 1790620805). NEW scratch-instance door gate buildroot/runtime/_hdl_build/nx_opaque_login_door_gate.nx (24570 B): forks the binary under test against /tmp fixture keys+log, control row early, owner row past the retired 16 MiB clamp; GREEN 28/28 on fabec913 (job 1790621324), RED 20/28 on the served e070b5fa for the right reason (daemon up, page 200, early control logs in 200, late owner 401, recovery 400; job 1790621364). CONTENT RULER served vs candidate (job 1790620605): lost 2 of 319 runs (6 permil, shown 2 of 2): the seg-store message SS-COMMIT REFUSED ... (seq1730) Fix the caller -- superseded by the deeper SS-WRITE-SEG REFUSED guard in nx_seg_store.nx ss_write_seg (same seq1730 refusal, moved to the point compactors also reach); gained 111. Honest limit: with registration closed the door refusal cannot name its layer; the owner layer is proven in-process. Side effect named: door-gate logins append fixture rows (handles doorgate*) to production op_receipts.tsv and nishi_uid_handle.tsv. NEXT: stage fabec913 as nx_opaque_login.elf.new and POST /api/deploy target=opaquelogin.
2026-09-28	CN13	land	W16 SEAT OPAQUE-LIB RESUMED (T0 1790618779, after the 12:39 CDT outage). Mined first: its own wave-16 rows 1790616600 to 1790616602 were intact, debt 1790462863 EATEN and superseded by 1790616843 (open), the three sources byte-identical to that land row (client d09956ec, server 1351c824, rotbind e3ec68c1), and a rebuild of the gate from the current tree hit the build cache at 3347608e and ran GREEN 151/151 (job 1790619281), so nothing was redone. NEW THIS RUN (debt 1790616843 items 3 and 8): the lib half of item 3 is FIXED and both items are now MEASURED. nx_opaque_wire_server.nx 1351c824 33152 B to 66e3a398e0336969 35531 B: osw_register_respond, osw_fake_record and osw_ke2 are thin wrappers that restore the OPAQUE engine's u256 scratch cursor (nx_scratch_save then nx_scratch_restore) around private bodies _osw_register_respond, _osw_fake_record and _osw_ke2, because the engine allocates its u256 and point temporaries from the chained scratch arena with no frame of its own and every device request left them behind; each body also wipes the server AKE private key copy it derives once the response is made. Every public name and signature is unchanged; the client lib and the device module 5af5f9c0 are unchanged, so the wasm module was not rebuilt. Banked first: knowledge/bank/nx_opaque_wire_server.nx-1351c824-pre-w16frame-20260928 (verified 1). Gate nx_opaque_client_gate.nx de88aa85 67814 B to 5d25878b 94335 B gains section 9 (below); SHIPPED by nx_organ_ship as 4c0e6f28e6705dd2 (job 1790621669: prove 171/171, content GREEN, behave DIFFERS approved, offc twin), prior 3347608e banked at knowledge/bank/nx_opaque_client_gate.elf-3347608e-pre-w16env-20260928 (sha verified), source bank knowledge/bank/nx_opaque_client_gate.nx-de88aa85-pre-w16env-20260928. Consumers of the changed server: nx_connect_appd.nx and nx_connect_appd_w17check.nx only (grep, corpus_complete 1); production 872a9cc9 (CONNECT-SHIP-1) was built before this edit and the device block stays dark there, so its next build carries the framed server with no production behaviour change.
2026-09-28	FRONTDOOR	land	W17 SEAT FRONTDOOR-FINISH SHIPPED the front door twice this leg. (1) nx_connect_api 9d83712e (381464 B) by nx_organ_ship job 1790620754 noregister: prove GREEN 44 of 44 on a fresh gate build, content ruler lost 1 run exactly -- the archived engine name nx_connect_msgstore.msg_store_append that msg_append's row now spells nx_chat_store_lib.cs_msg_append -- approved by allow_loss_v1 f6965dc5 (evidence knowledge/status/harness/loss-f6965dc5a92125b191f70eecd86b6a4f96ac63f39b82778d2ffe9a6840d857e7.record), behaviour on help IDENTICAL, offc twin installed. nx_behaveprobe live e0-era 284400 B vs that stage: help, match, faith_admit, lang_match, share_match, youth_peer, antistalk_discover and family_consent IDENTICAL; catalog DIFFERS as intended (8072 to 12203 B); juris_rules DIFFERS only in the table partition (live admitted 23 refused 4 pending 3, candidate admitted 27 refused 0 pending 4, decision fields identical) -- the wave-16 LAWS seat's SOURCED-SILENT juris lib reaching this binary on its first rebuild, as row 1790616270 predicted, not this seat's change. (2) SECOND BATCH landed under content CAS (expect hdfac512d7cb5b39f, lib 116201 to 127392 B) and SHIPPED nx_connect_api 21e0f212 (500024 B, job 1790621607, content GREEN with 0 lost runs, behaviour help IDENTICAL; circle_reach, study_post, liquidity_seed and family_consent IDENTICAL against the first ship): person_attest (CN18 cvh_person_attest over a synthetic circle, family and a THROWAWAY issuer key; the claim is wiped inside the core and never returned; a youth attests only through the linked guardian's own family consent, a youth claim never vouches, the credential path refuses dc_verifier_absent by name), kx_policy and kx_fields (CN8, the SOTA-PQ-HYBRID request row 1790616600: kxp_accept and kxp_send_mode, and the daemon's own field validators, lengths echoed never the fields). New lib runtime/_hdl_build/nx_connect_frontdoor2.nx 13814 B. CATALOG PARTITION after: rows 22 = wired 17 + not_yet_wired 5 + not_yet_landed 0. PROOFS: gate teeth T43 to T47 RED 44 of 49 on the first-batch lib (job 1790621190, exactly the five new teeth) and GREEN 49 of 49 landed (job 1790621372); nx_gate_bite over nx_connect_frontdoor2.nx killed 1 of 1 (job 1790621217, restore verified); the alpha still compiles against the lib with personhood and pq in its closure (nx_connect_appd_w17check 997477 B, job 1790621099). A design point measured, not assumed: the first person_attest cut let the conflicting voucher be an extra adult who joined the ring, and the circles vouch table (sized need times parties by cfdk_community) refused that vouch full, so the verb now bounds vouchers plus conflict to the table's own need.
2026-09-28	CN13	measure	W16 OPAQUE-LIB section 9 of nx_opaque_client_gate: the server halves' resource envelope and KE2 timing, MEASURED and printed as values, never judged against a typed bar (arena bytes by a one-byte probe before and after ONE call, kept mapped kB by VmSize before and after, u256 scratch by nx_scratch_save before and after, monotonic microseconds). RED 168/171 on the unframed server (job 1790621009: S1 the device KE2 left 273920 scratch bytes over 32 samples, about 8.5 KB per request; S3 a registration respond 2784; S4 a fake record 880); GREEN 171/171 on the framed server (job 1790621519), neg-control a bare u256_alloc reads 64. VALUES (job 1790621519): a KE2 bumps exactly 33536 arena bytes for a live handle AND a free one (tooth P9: min equals max, 16 and 12 clean samples) and keeps 368 kB mapped per call; ONE hmac_sha256 keeps 24 kB mapped and bumps 1088 arena bytes, a fake record keeps 48 kB, a bare server AKE key derivation 24 kB, a registration respond 48 kB, the account-log lookup 0 (57 us) -- the kept mappings are the allocating hmac_sha256 of open debt 1790456748, about 15 calls per KE2; ServerFinish bumps 179376 to 182816 arena bytes (the ed25519 mint) and keeps nothing; the in-process login the family login and production run (both roles) leaves 19744 scratch bytes, 243920 arena bytes and 744 kB of mappings per sign-in; the device blind leaves 5520 scratch bytes and the device finalize 8736 plus 420 kB mapped. ITEM 8, TIMING PARITY: 16 interleaved live and free KE2 pairs, median live 53897 us, free 53851 us, paired free minus live median -757 us with quartiles -1387 and +973 -- the interquartile range spans zero, so no live-versus-free difference is measurable at about 1 ms resolution on a 54 ms response (by construction both paths derive the fake and scan the whole log; the lookup is 57 us). NEW, VARIABLE TIME: the engine's p256_scalar_mul, which hub/nx_voprf (blind, evaluate), hub/nx_voprf_finalize (unblind) and hub/nx_opaque_core (DeriveKeyPair, DH) call with SECRET scalars, is binary double-and-add whose own header scopes variable time to public ECDSA-verify scalars: a one-bit scalar takes a median 21 us, an all-bits scalar 9307 us, 443 times (the leading-zero doublings of an infinity point are nearly free and every set bit adds) -- RFC 9807 section 9.1 asks constant time, independent of the bits of any secret. THE DAEMON RECIPE, proven on the lib (tooth A1): pendings and context allocated before ONE sys_arena_mark on a fresh chunk, sys_arena_reset after every request, and 3 of 3 whole device logins minted and validated across resets; neg-control: a pending allocated after the mark sits at the next request's pending address after the reset and its KE3 is refused -1410.
2026-09-28	CN13	queue	W16 OPAQUE-LIB FOR THE ALPHA-SIGNUP SEAT AND CONNECT-SHIP-2 (addendum to row 1790616602; no entry point, argument or answer changed): the next nx_connect_appd build compiles the framed server 66e3a398, so a device request leaves no engine scratch behind; the gate proves every device answer unchanged (171/171 including the RFC 9807 vectors, the fake record, recovery and the rotation MAC). WHAT A DEVICE REQUEST STILL COSTS THE DAEMON, measured above: about 34 KB of arena per KE2 and about 180 KB per ServerFinish -- both returned by ONE sys_arena_reset after each request IF the pending tables (OswPending, OswRegPending with its pair flag, OswRecPending) and the auth context are allocated BEFORE a single sys_arena_mark at startup, after one warm request of each class so every lazily allocated static exists before the mark (the nx_opaque_login_daemon note on nx_seg_store ss_hget) -- the recipe tooth A1 proves on the lib and its neg-control shows the failure a pending allocated after the mark produces. NOT returned by any reset: 368 kB of mappings per KE2 and 744 kB per in-process login, all kept by the allocating hmac_sha256 (24 kB each) until nx_hmac stops allocating or the engine composes the caller-owned workspace HMAC the franking lane uses -- open debt 1790456748 (estate/hmac-sha256-daemon-leak, 21 supervised daemons), whose owner and remedy this does not change. Item 3's rate limit on the five device routes and item 7's TTL, slot bound and wipe for the two new pending kinds stay with the daemon. For the release owner: /api/gate_run's FAST capture reads this gate RED by truncation (its output is now about 26 KB; debt 1790615554); the roster runner and nx_organ_ship read it whole.
2026-09-28	CN2	land	W17 SEAT PUSH-DELIVERY: push_deliver SHIPPED, gate 127/127, awaiting acceptance (the rung CN2 itself stays OPEN: cl_mobile_shell and its real-device witness are not built). SOURCES (buildroot/runtime): nx_webpush.nx 33130 B (estate-wide: RFC 8291 aes128gcm encryption with every intermediate exposed, RFC 8292 ES256 VAPID with RFC 6979 nonces, RFC 8030 header lines; composes nx_p256_ecdh, nx_hkdf, nx_aes128_gcm, nx_jose_es256, nx_ecdsa_p256_sign, nx_ecdsa_p256 verify, nx_base64, nx_jwt, nx_csprng); nx_connect_push.nx 36067 B (push_deliver, push_deliver_account which lists ONE account's directory <root>/<account>/ until getdents64 returns 0, cpush_subscribe and cpush_unsubscribe own-account operations, cpush_vapid_key and cpush_vapid_public, the closed vocabulary, the SSRF host fence); nx_connect_push_gate.nx 64340 B. POLICY DATA: knowledge/connect_push.conf 2888 B (three content-free payload rows -- New message, New invitation, Something new in your circles -- padded to one length; host rows fcm.googleapis.com and updates.push.services.mozilla.com, hostsuffix rows .push.apple.com and .notify.windows.com, UNPINNED until the vendor documents are mirrored; vapid_sub https://nishifamily.com/connect; vapid_exp 43200, ttl 86400, urgency normal, topic nxconnect, each THRESHOLD row carrying its reason). GATE nx_connect_push_gate 127/127 GREEN in the build lane and through /api/gate_run on the promoted binary (path FAST, exit 0, production conf resolved_by=knowledge/connect_push.conf): A RFC 8291 section 5 and Appendix A byte for byte at every intermediate (keys derived from private keys, ECDH from both parties, PRK_key, key_info, IKM, PRK, cek_info, CEK, nonce_info, NONCE, 86-octet header, whole body) plus the reference receiver; B refusals by name (wrong auth secret, tampered ciphertext and tag, delimiter 0x01 and none, off-curve and not-below-p and compressed keys, rs equal to record plus tag, body past 4096); C RFC 8292 section 2.4 token verifies under its own k with the estate verifier, our claims reproduce its signing input, k equals the JWK x and y, our token deterministic and refused past 24 h, aud and sub rules; D policy end to end to the POST with no trust store; E the production conf builds every kind at one length. SHIPPED: /api/build (src_path names the gate, src_sha256 c035a8c5, closure 75bb12c6) then /api/promote expect_sha256 e8b95223a70eeec17c977ec3f9a8ceb5e532174fa6d4469a4cfc016d1ff9de73 (623656 B, PROMOTED), /api/tools/register callable 1 (schema 0), knowledge/gateroster.conf row, knowledge/compare/connect.gates row. BITE: nx_gate_bite killed a compiling comparison mutant in each lib (restores byte-verified 33130 and 30184 B); a hand-planted revert of the RFC 8291 section 4 greater-than rule turned the gate RED 126/127 on exactly B12 (actual 144 expected -4), restored and GREEN again from the same build-cache key as the first green. No daemon touched, nothing deployed.
2026-09-28	CN2	queue	VERB REQUEST FOR FRONTDOOR-FINISH: the push verbs, rung CN2 (contract push_deliver), engine nx_connect_push (import runtime/nx_connect_push.nx; it composes runtime/nx_webpush.nx, nx_https_fetch_lib and nx_https_post_lib; the cpush_ and wpush_ prefixes and push_deliver are defined only there; gate nx_connect_push_gate 127/127 GREEN, promoted e8b95223, registered, rostered). THREE VERBS. (1) push_vapid_key -- a PURE READ, no caller identity needed: cpush_vapid_public(path: u8, out: u8) -> i64 with path knowledge/keys/connect_vapid.key (a 32-octet P-256 scalar, mode 0600, created on first use with O_EXCL so two racers cannot both mint one; the lane owner may pick another path but must keep it off every served root) and out sized wpush_b64u_cap(65) = 89 octets; returns 87 (the base64url applicationServerKey length) or a named refusal (CPUSH_ERR_IO -25, WPUSH_ERR_RNG -14); answer 200 with the 87 characters as the body. (2) push_subscribe -- OWN-ACCOUNT: cpush_subscribe(conf: u8, clen: i64, root: u8, account: u8, device: u8, js: u8, jn: i64, now: i64) -> i64 where conf and clen are knowledge/connect_push.conf read with sys_read_file, root is the subscription store (proposed knowledge/store/connect_push_subs, created 0700; the lib creates <root>/<account>/ on first use), account is the session's AUTHENTICATED account id and NEVER a request field, device is the request field device= (16 random bytes as base64url the client keeps in localStorage; only [A-Za-z0-9_-] passes), js and jn are the request field a= holding PushSubscription.toJSON(), now is the server clock; returns the endpoint length (> 0) or a named refusal CPUSH_ERR_SUBJSON -22, CPUSH_ERR_HOST -23 (the SSRF fence: https on a named push host only), CPUSH_ERR_ID -24, CPUSH_ERR_IO -25, WPUSH_ERR_POINT -1, WPUSH_ERR_AUTH -3, WPUSH_ERR_ENDPOINT -15; answer 200 ok when > 0, else 400 naming the rule. (3) push_unsubscribe -- OWN-ACCOUNT: cpush_unsubscribe(root: u8, account: u8, device: u8, now: i64) -> i64, returns WPUSH_OK 1, CPUSH_ERR_NOSUB -26 or CPUSH_ERR_ID -24; the record becomes a tombstone keeping only created and removal time. The client speaking exactly this contract is buildroot/sites/connect_assets/push/connect_push_client.js (POST form fields device= and a= to <mount>api/v1/<verb>, mount /alpha/connect/ or /connect/). GATE TEETH to add to nx_connect_api_gate: push_vapid_key returns 87 characters decoding to a 65-octet point that passes wpush_point_ok; push_subscribe with an allowed-host fixture subscription writes a record of exactly four fields under the SESSION account; neg-control, an account= field in the request is ignored and the record lands only under the session account; an unauthenticated call is refused before the lib runs; a subscription on an unnamed host answers CPUSH_ERR_HOST by name; push_unsubscribe leaves a tombstone with no endpoint and no key; a device id holding a slash is refused CPUSH_ERR_ID. BLOCKER already measured on this board (row about realm_unify): ca_dispatch carries no caller identity on either surface, so (2) and (3) wait on the front door passing the authenticated account into the dispatcher; (1) can land today.
2026-09-28	CN2	queue	INTEGRATION SPEC for the /connect daemon owner (the alpha and production daemon sources nx_connect_appd, nx_connect_serve and nx_connect_ui are wave-16 locked; nothing in this row edits them). The web shell assets have a source home now: buildroot/sites/connect_assets/push/ (this seat's subdirectory; a sibling subdirectory under connect_assets/ is free for the device sign-in assets ALPHA-SIGNUP-DOOR is housing). (a) Serve connect_sw.js (2852 B) at <mount>sw.js with Content-Type text/javascript and Cache-Control no-cache, so its default scope is the mount (/connect/ or /alpha/connect/); the worker reads its own scope, shows only the decrypted vocabulary sentence under one notification tag, fetches nothing, and a tap opens or focuses the mount. (b) Serve connect.webmanifest (308 B) at <mount>manifest.webmanifest as application/manifest+json and link it from the page head; start_url, scope and id are relative, so one file serves both mounts. Icons are EMPTY and OWED: Chromium installability wants 192 and 512 px icons, and iOS web push only works after the member adds the app to the Home Screen (display standalone). (c) Render a Notify-me-on-this-device control that calls connectPushOptIn() from connect_push_client.js (3643 B) on a tap and never on load, plus an off switch calling connectPushOptOut(). (d) In the message path, after a message is stored for a recipient ACCOUNT, call push_deliver_account(store_i, knowledge/connect_push.conf, <subscription root>, recipient_account, 1, now, vapid_priv, box) from a FORKED worker, never on the request path: each delivery maps small buffers the incumbent HKDF, GCM and SHA-256 never unmap, so a worker per batch returns them; store_i from hf_store_load once per worker, vapid_priv from cpush_vapid_key; kind 2 for an invitation and 3 for a circle event. (e) The content stays out of the notice by construction: push_deliver takes a kind, never text, and the words come only from knowledge/connect_push.conf, so a minor's lock screen never shows a sender, a circle or a message. CSP: all three assets are same-origin.
2026-09-28	CN2	lesson	THREE LAWS FROM THE PUSH LEG. (1) A WORKED EXAMPLE CAN DISAGREE WITH ITSELF: RFC 8291 section 5 prints Content-Length 145 over a base64url body that decodes to 144 octets (86-octet header, 42-octet record, 16-octet tag, and Appendix A's header plus ciphertext concatenate to exactly that body); the bytes are the oracle and the prose number is not, so the gate asserts the bytes and prints both numbers instead of trusting either one silently. (2) A SCRATCH REQUEST SIZED BY A CALLER IS A KILL SWITCH: nx_scratch exits 231 on any single request above its 1 MiB block, and the inherited libs sized three scratch requests from caller input (a p256dh, an auth secret, a token's signature segment) and one from the conf size -- a 2 MiB subscription would have killed the serving process, not refused the request. Every caller-sized request is bounded before it is made now, and D19 proves it discriminates: a 2 MiB p256dh answers WPUSH_ERR_POINT where the unbounded code dies. (3) READ THE COMPARISON IN THE RFC, NOT THE ONE THAT FEELS RIGHT: RFC 8291 section 4 requires rs GREATER than plaintext plus delimiter plus padding plus tag; the inherited check allowed equality, and a planted revert turns B12 RED 126/127 with actual 144 against expected -4, so the rule is now a tooth rather than a reading.
2026-09-28	R1	land	W16 DOORS-LOGIN-CRITICAL door 1 of 3 SHIPPED AND VERIFIED: the family login opaque_login :9091 now runs nx_opaque_login.elf fabec913bd7af5dce762307ab40694cbf5bdb7029ad26e0d4ca51c999d133279 (376177 B, rebuilt from the current tree: create-only owner, fail-closed lookup, 16 MiB clamp retired). POST /api/deploy target=opaquelogin confirm=yes expect_sha256=fabec913 (job 1790621542) = PROMOTED, pre_deploy_gate DEPLOY-SAFE, gate_blockers 0, override none; deploy_status reads DEPLOYED-GREEN listen=UNVERIFIED-may-be-outgoing-process, so identity was taken from the process: nx_proc_observe nx_opaque_login.elf fabec913 = ONE process pid 25221 start_ticks 523752277 parent 1 digest_match 1 (complete scan, 0 digest mismatches, the e070b5fa pid 31543 gone), cwd nishihost, stdout /tmp/login.log (the hostctl HC_LOGIN_CMD spawn), unchanged at a resample about 525 s later. Files: nx_opaque_login.elf = fabec913; nx_opaque_login.elf.prev = e070b5fa (the rollback slot; the 9c84dd66 it held is banked). SERVED over the edge (static checks, no browser): https://nishifamily.com/login 200 5582 B, the same size as before the ship (jobs 1790621395 and 1790621582), nx_page_verify GREEN with a11y 4 (missing lang, two h1, heading skips, no main -- page constants untouched by this rebuild; job 1790621615); /whoami without a session answers 401 session rejected from the new daemon (job 1790621620). Health OK before and after: 16 services, 0 down, 0 degraded. GATE: final door-gate bytes GREEN 28/28 on fabec913 (job 1790621791) and RED 20/28 on e070b5fa for the right reason (job 1790621829); nx_organ_ship nx_opaque_login_door_gate (job 1790621946) SHIPPED 8c55bd17 with PROVE GREEN 28/28 against the fabec913 bytes, promoted, offc twin installed, REGISTERED callable (a first attempt with --behavior-args stopped at adopt-gate needs-intervention -202 existing-live-artifact-required, job 1790621868, before any promote). ROLLBACK RECIPE: copy knowledge/bank/nx_opaque_login.elf-live-e070b5fa-predoors-20260928 to nx_opaque_login.elf.new (nx_filecopy keeps mode 0755) and POST /api/deploy target=opaquelogin (hostctl logindeploy renames live to .prev, then .new to live, then restarts :9091); do NOT use /api/rollback, which restores only the edge sites.elf. NOTE for every later logindeploy: it reads ONLY nx_opaque_login.elf.new and renames live to .prev FIRST, so a stage under the .sov.elf.new name alone would leave :9091 with no binary -- stage the exact name. Census row 1790441500: the opaque_login door is CLOSED.
2026-09-28	R1	measure	W16 DOORS-LOGIN-CRITICAL doors 2 and 3 CLASSIFIED NOT-APPLICABLE, NOT DEPLOYED. Census row 1790441500 called hub_gw :18792 (row hubgw) and the office daemon :8030 (row office, one binary that also serves the firm instance office_aw :18467) login-only doors that gain the fail-closed lookup and the per-login leak fix on rebuild; measured from source that is wrong for both. nx_hub_gw.nx and nx_office_daemon.nx call only olg_ctx_setup and olg_whoami; olg_whoami is nx_modern_auth_validate_session, which is stateless (Ed25519 signature, expiry, realm) and never reads the account log; nx_office_serve.nx carries 0 olg_ 0 modern_auth 0 nx_uas_ references (txtscan counts over 237163 B); the account-log lookup has exactly four runtime callers -- the flow's _ma_verify_credential (login and recover), the owner's create and rotate, nx_connect_signup and nx_opaque_wire_server (grep nx_uas_lookup over buildroot/runtime 17 matches corpus_complete=1, knowledge/gates/w16_doors_login_grep_uas_lookup_1790622000.out). Neither door registers, logs in or recovers, so neither carries the takeover path or gains from the fix, and the operator's approved list (family login, docportal admin, email portal, gen, mesh, gallery, vault, studio) does not name them; a redeploy would restart three live surfaces (hub, nishifamily office, the firm's closed office) for tree drift alone. EVIDENCE KEPT: hub_gw rebuilt from the current tree (job 1790621816) = d6a97d8b 235358 B, banked knowledge/bank/nx_hub_gw.sov.elf-cand-d6a97d8b-notdeployed-20260928; served /volume1/ai/hub/nx_hub_gw.elf ff93fefe 467009 B, pid 3953 parent 1 digest_match 1, byte-identical to the stale nishihost stage nx_hub_gw.sov.elf.new; content ruler served vs rebuild (job 1790621850) lost 5 of 282 runs: two software-popcount code-byte fossils (UUUUUUUUH! and 33333333H! twice) and the superseded seg-store SS-COMMIT message, gained 116; the 50 percent size drop is UNADJUDICATED (no matched-vintage control run), one more reason not to ship it for nothing. The office daemon was not rebuilt; its served nx_office_daemon.elf is 2a31fedd 480857 B. LANE FINDING (read from nx_hostctl.nx, not exercised): hc_deploy_one looks for the stage BESIDE the live path and never reads the row src, while /api/deploy validates the row src in nishihost; for hubgw the beside-live names /volume1/ai/hub/nx_hub_gw.sov.elf.new and .elf.new are both ABSENT, and the field-7 branch of gdeploy@ discards the refusal rc (cmd_gdeploy then sys_exit 0), so a hubgw /api/deploy today would report PROMOTED and DEPLOYED-GREEN listen=UNVERIFIED while promoting nothing; same shape for wikigw, genorch and mediaauth (debt filed). Because a real deploy reports that same status, only process identity separates a ship from a no-op.
2026-09-28	CN20	land	W16 SOTA-PQ-HYBRID DECLARED THE NEXT RUNG UP THE PQ LADDER, because the board contradicted itself: T-BIC-CONNECT names a post-quantum ratchet [signal-spqr] and the Signal bar row said PQ and the ratchet are CN8, while CN8's done-rule is only the hybrid key agreement and its own scope says no ratchet and no forward secrecy. Apple's PQ3 page was fetched and READ this leg (nx_research_fetch job 1790621590, status 200, 106073 B, sha256 d3c9d379, knowledge/fetched/cmp_connect_apple_pq3.html; February 21, 2024): Level 2 is post-quantum initial key establishment (Signal PQXDH), Level 3 adds post-quantum rekeying -- a Kyber-768 ratchet about every 50 messages and at least every 7 days beside an ECDH step on every response -- so a point-in-time key compromise heals; by that scale the CN8 page is below Level 2 (static keys, no ratchet). LANDED AS DATA: rung CN20 kx_pq_ratchet (cost 3, deps CN8) with a done-rule a ratchet-vm-class gate must prove on the shipped wasm (forward secrecy, post-compromise healing planted both ways, a bounded skip window with replay refused, a downgrade that strips the epoch refused); rungrole contender for T-BIC-CONNECT; ms M3 now CN7,CN8,CN20,CN1,CN2 with the cumulative budgets 28, 35.5 and 39.5; a matrix watch row runtime/nx_connect_pqratchet.nx _ABSENT_:kx_pq_ratchet (Signal Best, the rest 0 as a presence reading); ref apple-pq3 pinned hd3c9d379 and cited inline; the Signal bar row now says CN8 is proven on the shipped page and the ratchet is CN20. RULERS: nx_ladder connect LADDERED (24 of 24 placed), nx_barfresh FRESH, nx_compare_rank connect (job 1790621977) ranks CN20 #3 on the version 1.0 critical path at priority 733 behind CN2 and CN7 and files it to pm_intake; nx_compare_refs_gate (job 1790622014) passes every schema, pin, mark and cited-inline tooth for the new row and reads RED 43/45 only on two fleet ratchets raised by other lanes' rows (open-redirect: pmdash monday_ai_2026_09_23, automation osworld26, search marginalia-api, datavis plot; moved: the monday row), which their owners should read.
2026-09-28	CN13	queue	Cross-reference from youthsafety.plan rows 1790621400 to 1790622300 (wave-16 LAWS-CONTINUED second run; gate nx_connect_juris_gate b76135e5 171/171): knowledge/connect_jurisdictions.conf now DECLARES PH and GT (consent below 18 by parental_consent), adds a VE civil row and a DO silent row beside UNSOURCED rows (both still strictest), and admits Honduras's Codigo de Familia Art. 16 (majority at twenty-one) beside an UNSOURCED row, so the strictest consent-below every undeclared or tainted place reads rose from 18 to 21 (method rank 2 verifiable_parental_consent and barred below 16 unchanged). FOR THE CN13 OWNER: csu_juris_admit judges only the MINOR band (a non-MINOR band returns CSU_OK), so the 21 changes no adult sign-up; it also means an 18- to 20-year-old Honduran, a minor under patria potestad by Art. 16, signs up in the ADULT band unjudged, because the band model cannot carry a majority above eighteen -- an owner decision not taken here: judge an ADULT band against the declared place's consent line (jur_rules_for already answers it, the juris_rules verb now answers consent for ages 18 to 20 in an undeclared place), or record why not. No lib change is needed for the new rows; consumers compiled on the pre-SOURCED-SILENT lib still refuse the silent rows until rebuilt on their owners' lanes
2026-09-28	CN19	land	W17 GAMES-TOGETHER EVERY ALIGN GAME through the session: nx_connect_play_gate 127/127 served (/api/gate_run job 1790622146, exit 0, capture 14173 of 16384 untruncated) on the promoted f9b26ac4 (/api/build job 1790622074 src_path the gate, src_stable 1; nx_contentdiff GREEN lost_from_live 0, 11 gained; /api/promote with expect_sha256 job 1790622122; _offc twin byte-identical by nx_filehash cmp). The gate reads the align spec with the generator's own reader and plays EVERY game it names (8 today, tic-tac-toe, three mens morris, achi, nine mens morris, morabaraba and the rest) one to one through the session twice -- a deterministic pass (the spec's first line as a forced line, then the generator's first listed move) and a pass seeded by the run's own clock scrambled by the second method's CRC -- with the mover taken from the DIRECT generator's side, never from the session, and the full generator snapshot compared after every ply: 792 plies agreed on the served run (775 on the qualify run; the seeded pass differs by design), 0 refused, 24 removals and 24 same-side repeats (the capture phase gives one player two moves running), 175 slides (the movement phase), the result identical in all 16 playouts, and a removal offered at the opening refused ILLEGAL in all 8 games. PLANTED on an ISOLATED COPY (the lib now has a consumer, FRONTDOOR-FINISH's nx_connect_frontdoor3.nx, so no mutant may touch it in place): naive turn alternation in cpl_to_move read RED 124/127 (job 1790621957) with exactly the snapshot-agreement, refused-none and movement-phase teeth failing while the tic-tac-toe tree, the walls, the blocks and the digest teeth all passed -- tic-tac-toe alone could never have caught it; both copies ARCHIVED by nx_retire_path to knowledge/retired (…nx_connect_play_w17plant.nx-1790622005 and …w17plant_gate.nx-1790622037); its _build fossil nx_connect_play_w17plant_gate.sov.elf 212548 B stays, refused by the retire organ's protected .elf token, named here for the next _build sweep. The lib is unchanged since the import switch (26973 B sha256 7721ab81), so frontdoor3 builds against the same bytes the bites measured; the gate source is 47120 B sha256 8ff89845 (bank of the pre-change source knowledge/bank/nx_connect_play_gate.nx-3db13fde-20260928-w17). WATCH: the served capture is 14173 of the 16384 FAST-path cap; one more section of this size would truncate it. Shipped, gate 127/127, awaiting acceptance.
2026-09-28	CN8	land	W16 SOTA-PQ-HYBRID CLOSED THE TRACKING EXPOSURE ON THE LIVE X25519-ONLY E2E PAGE and pinned it with a tooth (the predecessor measured it in row 1790616580 and left it). BEFORE: nx_page_verify https://nishifamily.com/synth/connect_e2e (job 1790621093) served 38117 B for a 37122 B file with the router's injected ad slot (asset adnet_ha_video.png 728x90) and its inline view-beacon script beside the page's localStorage private keys. FIX, rollback-banked first: the page banked knowledge/bank/connect_e2e.html-cf51038e-pre-optout-cn8-20260928 (nx_filecopy verified=1, 37122 B sha256 cf51038e); ce_emit_html in runtime/nx_connect_e2e_client.nx emits the 19-byte opt-out literal after the head tag exactly as the hybrid emitter already does (source 27114 to 27133 B, sha256 61b5440698db6b2f; compile proof nx_sov_build_run --build-only job 1790621224, 54186 B sha256 9200feeb, not promoted, the emitter is run by hand); the served page carries the same literal at the same place (37141 B sha256 b57bcf64; not re-emitted, because the X25519-only mode needs the two raw wasm files the page embeds base64). AFTER: nx_page_verify (job 1790621289) serves 37141 B == the file, img=0, a11y-issues=0, VERDICT GREEN. PINNED: nx_connect_pqkx_vm_gate gains T10d (the X25519-only page carries the opt-out too): GREEN 54/54 on the current pages (qualify job 1790621415, vm_elapsed 167976 ms) and RED 53/54 with exactly T10d failing against the banked pre-opt-out page (job 1790621641), T10a and T10b still passing because the modules did not move. SHIPPED by nx_organ_ship (job 1790621863): prove 54/54, content GREEN, behave DIFFERS (expected, the new tooth line), promoted 130fe90a (242160 B, debug flavour as the incumbent), _offc twin identical; prior 2441a3c8 banked knowledge/bank/nx_connect_pqkx_vm_gate.elf-2441a3c8-pre-t10d-20260928 and its source knowledge/bank/nx_connect_pqkx_vm_gate.nx-a785fc02-pre-t10d-20260928 (both verified=1); gate source now 41100 B sha256 4883e9aa; connect.gates label 54/54. ROLLBACK: nx_filecopy the two banks back over the page and the gate.
2026-09-28	FS11	queue	VERB REQUEST FOR FRONTDOOR-FINISH, addendum to row 1790621140 (seat GROUP-MODERATION): the gate re-shipped as sha b5386d1e, 145 of 145 GREEN, served GREEN through /api/gate_run. Reporting is now idempotent under a client retry: cgm_report, cgm_report_message and cgm_signal return the OPEN row that a retry duplicates (same group, reporter, target, reason and franking reference) instead of filing a second row or making a second CSAE sink attempt, so mod_report can pass a client retry straight through with no request-key store of its own; a report after a decision files a new row. One new refusal code joined the list: cgm_join returns -75 for a member whose removal stands (a removal is a ban until cgm_reverse supersedes it). No signature changed.
2026-09-28	CN13	queue	W16 SOTA-PQ-HYBRID FOR THE ALPHA-SIGNUP or FRONTDOOR owner of runtime/nx_connect_device_client.nx (not edited by this seat): cd_emit_html emits the same head as the X25519-only E2E page did, without the router opt-out literal, so the edge router injects its ad slot and inline view-beacon script into the device sign-in page beside the OPAQUE device keys (predecessor finding, row 1790616580). The remedy is the one this seat applied to ce_emit_html today (row 1790622330): the 19-byte <!--nx-ad-optout--> literal immediately after the head tag, a tooth in that page's gate (the pqkx gate's T9d and T10d are the pattern: pk_has on the served page), RED on the banked pre-fix page, GREEN after, and a publish-guarded republish of the served page with the old one banked. Measured cost of the exposure on /synth/connect_e2e before the fix: 995 foreign bytes per load (38117 served for a 37122 B file).
2026-09-28	R1	queue	W16 DOORS-LOGIN-CRITICAL HAND-OFF for the remaining operator-approved sign-up doors (not in this seat's brief; none touched). Measured from the DECLARED argv in daemons.reg and the nx_hostctl HC__CMD strings, not from live process argv: register is LIVE by design on docportal_admin_daemon :18456 (row docportal, gdeploy with a field-7 name-kill nx_docportal_admin_daemon.elf, rb docportalrollback; its invite token is not bound to the handle) and email_portal_daemon :18465 (row email, gdeploy field 7, the same invite class), and on the /studio daemon (allow_reg defaults to 1 from argv; no deploy row) -- ship these first. Register is CLOSED by argv allow_register=0 on nx_gen_gateway_daemon :18794 (argv 6, no deploy row), nx_mesh_gateway :8055 (argv 6, own store meshgw_, no deploy row), nx_gallery_gateway :18190 (argv 6, own store galx_gw_*, row galxgw via the bespoke galxdeploy) and nx_vault_gateway :18200 (argv 5, galx store, no deploy row): latent, and all four still LOG IN through _ma_verify_credential, so a rebuild gives them the fail-closed lookup and the retired clamp. Four of the seven have NO deploy_targets row (gen gateway, mesh gateway, vault, studio): each needs a row and an organ_kind daemon declaration before a health-checked ship. Docportal starts 10-15 s before it listens (inside the 30 s watchdog) and VERIFY-ROOT-REGISTER row 1790438980 recorded a pre-existing use-after-unmap in dad_map_get on that code path. Per door: rebuild from the tree, a scratch door proof in the shape of nx_opaque_login_door_gate (argv subject, fixture keys and log, in-process owner rows, a planted late row past the retired clamp, a banked old binary as the RED control), content ruler, bank, deploy, nx_proc_observe digest_match (the deploy receipt cannot tell a ship from a no-op, debt 1790622301). FOLLOW-UPS on this door: nx_opaque_login_smoke (REGISTERED-DARK) can never go GREEN while production registration_open reads 0 (its register tooth depends on that fixed production path); nx_opaque_login_door_gate supersedes its teeth 1-4, and its one unique tooth (VmSize growth over 100 requests) is owed to the door gate before the smoke is retired through the lifecycle; knowledge/organ_gate.conf now declares nx_opaque_login_daemon to nx_opaque_login_door_gate; the door gate leaves its 16 MiB fixture log in /tmp/nx_olgd_door_gate until the next run or the tmp reaper; its RED control subject is knowledge/bank/w16door-olgd-old-e070b5fa-scratchsubject (a name that cannot match the logindeploy name-kill or the hc_guard_login alive check).
2026-09-28	CN7	queue	FOR THE SEALING OWNER (wave 16), from the wave-17 DATE-SAFETY seat: the estate now carries ONE RFC 9180 HPKE, runtime/_hdl_build/nx_hpke_lib.nx (base mode; DHKEM(X25519, HKDF-SHA256), HKDF-SHA256, ChaCha20Poly1305; hpk_derive_keypair, hpk_encap, hpk_decap, hpk_key_schedule, hpk_seal and hpk_open at a caller-passed sequence number, hpk_export, and the single-shot hpk_seal_base and hpk_open_base), proven byte for byte against the RFC's own Appendix A.2.1 vectors by nx_hpke_lib_gate 47/47 GREEN (promoted sha 839be23c, bite-proven twice). faithsocial FS8 seals date plans through it. If a sealing rung seals anything to a recipient's public key, compose it rather than build a second box; this seat touched no wave-16 file. Declared limits: base mode and one suite only; Encap's ikm must come from the caller's CSPRNG.
2026-09-28	R1	lesson	W16 DOORS-LOGIN-CRITICAL, three laws from this leg. (1) A census line saying a door GAINS a fix on rebuild is a hypothesis until the door's request path is read: hub_gw and the office daemon validate sessions statelessly (Ed25519 signature, expiry, realm) and never read the account log, so the fix cannot reach them and shipping them would have been risk for nothing. (2) The deploy receipt cannot tell a ship from a no-op: connect and opaquelogin both read DEPLOYED-GREEN listen=UNVERIFIED-may-be-outgoing-process, and that is exactly what a gdeploy row with a field 7 reports when hostctl refused for want of a stage (debt 1790622301); only nx_proc_observe digest_match on the new sha, with the old sha absent, proves the door changed. (3) A RED from an old binary counts only when that binary demonstrably ran: the door gate's RED on e070b5fa kept readiness, the page and an early-row control login GREEN, so the 401 on the late row names the retired clamp and not a startup or fixture-format failure. PROMOTED-ONLY CHECK: /api/gate_run target=nx_opaque_login_door_gate from the serving root resolved its default subject by the serving-root ladder and read GREEN 28/28 exit 0 (job 1790622560).
2026-09-28	CN2	measure	LIVE PUSH DOOR MEASURED with nx_connect_push_probe (built for measurement from buildroot/runtime/nx_connect_push_probe.nx and deliberately NOT promoted or rostered: its answer depends on a third party's network, so it is a measurement taken on purpose, never a beat). One RFC 8030 POST [rfc8030] through push_deliver with the estate trust store, a fixture subscription on a token nobody was issued, the RFC 8291 section 5 keys [rfc8291] and a VAPID key drawn in memory [rfc8292]: Mozilla autopush (updates.push.services.mozilla.com, the endpoint family of the autopush documentation [autopush-http]) answered 404 in 784 ms after full certificate-chain validation, and FCM (fcm.googleapis.com) answered 410 in 301 ms; both times the lib's gone rule left the record a tombstone (record_after_rc -26). PROVEN: TLS to a real push service, the request framing, the status read-back and the gone handling. NOT PROVEN: that either service accepted our VAPID token as valid (a lookup of an unknown token may answer before the token is checked) or that a device shows the notice -- that needs a real subscription from a real browser on a served origin. The SSRF fence rows in knowledge/connect_push.conf now carry their evidence: .push.apple.com from Apple's instruction to allow https://*.push.apple.com [apple-webpush], .notify.windows.com from the WNS rule that a channel must use that domain [wns-channel], push.services.mozilla.com added from the autopush documentation, fcm.googleapis.com and updates.push.services.mozilla.com from the live probe (no Google document mirrored: the FCM migrate page answered a definitive 404 and the web.dev push article names no host). The three RFC mirrors re-fetched from the RFC Editor hash identical to the ones the gate reads.
2026-09-28	FS11	measure	For FRONTDOOR-FINISH (VERB REQUEST rows 1790621140 and 1790622340): the moderation lib composes with the front door's dispatcher. A build-only probe, runtime/_hdl_build/nx_connect_groupmod_compose_probe.nx, imports nx_connect_api_lib.nx and nx_connect_groupmod.nx together (the full closure: franking, seal, chat store, the four moved libs, group and events libs and everything the api lib already imports) and qualify job 1790622787 compiled it clean (67715 B, sha256 c9d4e7ce) and ran it, printing composed=1 both-answered=1 (cgm_ctx_bytes and ca_slen each answered as their sources say) with exit 0; nx_parse refuses any duplicate top-level definition, so adding import nx_connect_groupmod.nx to nx_connect_api_lib.nx collides with nothing as of this build. NOT PROMOTED and NOT REGISTERED, deliberately: the probe is a one-off compile witness, and its _build fossil is the only artifact it leaves.
2026-09-28	CN13	land	W16 OPAQUE-LIB BUILT THE REMEDY FOR THE VARIABLE-TIME FINDING, as a NEW file so no build in flight moves: buildroot/runtime/nx_p256_scalar_mul_ct.nx ef4efb672f257af5 3825 B, p256_scalar_mul_ct(out, k, P) -- the SEC-CT-002 shape that fixed Ed25519 (always add, then a masked select) over the incumbent Jacobian formulas: k recoded to k + n or k + 2n by u256_cmov, never a branch, so it always carries bit 256, then 256 steps of one doubling and one addition each with the sum taken by u256_cmov where the bit is set; the recoded scalar is wiped. PROVEN by nx_opaque_client_gate section 10: C1 byte-identical to the incumbent p256_scalar_mul for 1, 2, n-1, n-2, every bit set and 16 fresh random scalars, on the generator and on a random base (42 of 42), RED with the recoding select planted inverted (174/175, 0 of 42, job 1790622592) and restored byte-identical (sha ef4efb67 re-read); C2 it leaves no engine scratch; neg-control the byte compare fires on 1 G against 2 G. TIMING (job 1790622514): one-bit median 9528 us, all-bits 9517 us, where the incumbent reads 21 and 9429 (449 times) -- flat within noise, at about the incumbent's worst-case cost. BITE for P9: with the free handle planted in the recovery-suffix shape the free class takes another path and P9 reads RED (job 1790622805), restored byte-identical (gate source 58840aec). Gate SHIPPED 6e4110c06c0d1867 (job 1790622690: prove 175/175, content GREEN, promoted, offc twin; prior 4c0e6f28 banked at knowledge/bank/nx_opaque_client_gate.elf-4c0e6f28-pre-w16ct-20260928). HONEST LIMIT: the field layer under it is the incumbent's and not audited for data-dependent branches. NOT WIRED: the hub closure is frozen by the takeover rollout; adoption is one call name at each site, listed in debt 1790622839 (which supersedes 1790621963, eaten).
2026-09-28	CN1	land	W17 SEAT CALL-CODEC RE-SHIPPED CN1 with two call-path fixes, gate 80/80, awaiting acceptance. (1) LOSS: cc_call_codec_open now decodes a P-frame only against the reference it was predicted from; a counter gap or a P-frame before any key frame is refused CC_E_NEEDKEY once it authenticates, undecoded, reference untouched, and cc_ctx_need_key asks the app for a key frame (key_req on the sender's next bind, the picture-loss-indication pattern of RFC 4585). Before this, a frame the relay's newest-frame slot overwrote (nx_room_relay keeps one frame per sender and layer) made the receiver decode every later P-frame against the wrong reference. (2) GEOMETRY: nx_vcodec codes whole 16x16 macroblocks only, so at 320x240 the 160x120 chroma planes (7.5 macroblocks tall) keep their last 8 rows uncoded and a key frame cannot resync a receiver with another buffer history -- measured by the new T12: the same raw key frame decoded into a dirty buffer differs by 2845 bytes, all chroma, luma identical. The binding now codes a padded frame (each dimension rounded up to a multiple of 32 by cc_coded, last row and column replicated, cropped back for display, the frame-cropping practice of H.264) and accepts any even geometry; padded, the same key frame decodes identically whatever the receiving buffer held (0 bytes). Found because the first T11 run read 71/73 RED: the recovery key frame opened (rc 0) but its picture differed from the sender's. Evidence: qualify job 1790622413 80/80; bites on the shipped lib bytes (sha256 aa596da8, 26134 B): aimed site 27 the reference-held check in cc_call_codec_open KILLED (job 1790622471), aimed site 2 the padded-view branch of cc_publish KILLED (job 1790622522), both restores byte-verified and both live twins restored. SHIPPED by nx_organ_ship (job 1790622782) sha256 a845a98b: loss set exactly the two relabelled teeth (the bad-geometry neg-control now names the odd-width rule it tests; the plaintext neg-control now compares after the crop), approved by allow_loss_v1 11740e02; behaviour change reviewed (review file knowledge/status/harness/review-nx_connect_codec_gate-a845a98b-20260928.txt sha256 a69ef16b over observation b1b6ba3a and evidence 2e3d7c03); promote live equal to staged, _offc twin installed. Served /api/gate_run (job 1790622801) exit 0 GREEN 80/80 FAST, capture 10946 B untruncated, source_newer 0. Values: sealed key frame 6397 B at 320x240 coded 320x256, AEAD workspace 2950144 B per context, key Y-PSNR 4455 cdB. Roster, connect.gates and the matrix note updated to the new counts.
2026-09-28	CN1	retract	W17 SEAT CALL-CODEC corrects its own queue row 1790620520 in two places. (1) It said swapping the family video app's NX.vv_enc and vv_dec for cc_call_codec_bind and cc_call_codec_open is wire-compatible: only the 6-byte inner header LAYOUT matches. A bound frame is sealed and, since the padding fix, coded at the padded geometry, so a raw vv_dec peer can neither open it nor decode it -- both ends of a call swap together, never one. (2) It told the client to call cc_ctx_new(W, H, ...) as if any macroblock multiple worked; any EVEN geometry now works (320x240 codes as 320x256 and crops back), and the client must also honour cc_ctx_need_key -- when a receiver context raises it, send the sender a key-frame request and the sender binds its next frame with key_req 1; until that key frame lands the tile freezes rather than showing a picture predicted from a lost reference.
2026-09-28	CN1	lesson	A KEY FRAME IS A RESYNC POINT ONLY IF IT OVERWRITES EVERY BYTE OF THE RECEIVER'S FRAME. The codec gate and this gate's first 60 teeth proved the closed loop byte-exact because sender and receiver always started from identical zeroed buffers, and every quality number was luma-only -- so 8 never-coded chroma rows at 320x240 (the live family video app's geometry) were invisible to every instrument that already existed. A tooth that gives the receiver a DIFFERENT history (a frame dropped by the relay, a late joiner, a dirty buffer) is the only instrument that can see a codec defect whose symptom is identical output under identical history; T11 found it by reading RED, T12 pins it on the raw codec. The family video app still calls vv_enc at 320x240: filed as debt 1790622664 (sev 5, videocodec) with the measurement and the padding remedy, for the vcodec and family video owners.
2026-09-28	CN13	measure	W16 OPAQUE-LIB REPRODUCIBILITY FOR THE ALPHA-SIGNUP SEAT: the device module rebuilt now from the current tree by the promoted nx_compile_wat then nx_wat_compiler (runtime/_hdl_build/nx_opaque_client_wasm_kat.nx to /tmp/w16ol_repro_kat.wat 5751667 B, WATC GREEN to /tmp/w16ol_repro_kat.wasm) is byte-identical to the banked knowledge/bank/connect_device_opaque.wasm-5af5f9c0-w16-20260928 (nx_filehash cmp identical 1, 210492 B, sha256 5af5f9c0a8a7f260) -- the client lib is unchanged this run (d09956ec) and nothing in the module's closure moved, so the banked module IS the current source and the only side this run changed is the daemon's (the framed server 66e3a398). Device-side measurements for the same seat (section 9): a device blind leaves 5584 bytes of engine scratch and a finalize 8608 plus 420 kB of hmac mappings per attempt inside the page; framing the ocl_ entry points would bound the scratch but changes the module hash, so it is left for a quiet window rather than moved under an asset the alpha is housing.
2026-09-28	CN2	land	W17 PUSH-DELIVERY second ship: the message path's one call exists and is gated. buildroot/runtime/nx_connect_push.nx 40640 B adds push_deliver_account_async(store_i, conf_path, root, account, kind, now, vapid_priv, receipt) -- it forks a worker that forks once more and exits at once, the caller reaps that middle child immediately (no zombie, no SIGCHLD handler), and the grandchild closes every inherited descriptor above stderr (a worker holding the daemon's listening socket would keep a restarted port hostage), runs push_deliver_account and exits, so the TLS session, the P-256 work and the incumbents' never-unmapped HKDF, GCM and SHA-256 buffers die with a short-lived process instead of accumulating in the serving daemon; a second-fork failure comes back as CPUSH_ERR_FORK -28 through the middle child's exit status, never silently. The subscription store is one directory per account (<root>/<account>/<device>.sub, created 0700 on first subscribe), and push_deliver_account lists ONE account's directory with getdents64 until the kernel returns 0. Gate nx_connect_push_gate 132/132 GREEN: D57-D65 (two live devices, a tombstone, a temp file and a stray name in one account, another account's device never seen) and D66-D70 (the async call returns the reaped middle child; the detached worker's receipt lands in 100 ms against a budget of fifty times the 78 ms synchronous call and equals the synchronous tally exactly; a bad account id forks nothing and leaves no receipt after the observed worker latency). Planted defect: the worker writing the wrong tally box turned it RED 131/132 on exactly D68, restored. SHIPPED /api/build (src_path names the gate, closure 5597dbf3) then /api/promote expect_sha256 87d8bd9f5598af052ec91f8867c7d95ba9089397709f8355a6ec3781c0763e43 (633032 B, PROMOTED, prev slot holds e8b95223); /api/gate_run on the promoted binary GREEN 132/132 exit 0, 13514 B captured of 16384 (not truncated). The INTEGRATION SPEC step (d) is now one call: push_deliver_account_async(store_i, knowledge/connect_push.conf, <root>, recipient_account, kind, now, vapid_priv, 0). connect.gates row updated to 132/132.
2026-09-28	CN2	queue	CN2 STAYS OPEN, named precisely. BUILT this wave: the push half (push_deliver, push_deliver_account, push_deliver_account_async, subscription store, VAPID key, policy conf, gate 132/132 promoted, live push services reached) and the web-shell sources (buildroot/sites/connect_assets/push/: connect_sw.js, connect.webmanifest, connect_push_client.js). NOT BUILT: cl_mobile_shell in runtime/nx_connect_client.nx (no source was written under that name on purpose -- a stub carrying the contract name would flip the watch cell with nothing behind it). REAL-BROWSER PROOF UNVERIFIED, reason: no served secure origin hosts the worker yet (the /connect routes are wave-16 locked), and a service worker cannot register from a file or from an origin that does not serve it, so the CM13 capture driver has nothing to open; a push reaching a browser also needs a real subscription the page creates. OWED IN ORDER: (1) FRONTDOOR-FINISH lands push_vapid_key now and push_subscribe and push_unsubscribe once ca_dispatch carries the session account (row 1790622060); (2) the /connect daemon owner serves sw.js and manifest.webmanifest under the mount, renders the opt-in control, and calls push_deliver_account_async after a message is stored (row 1790622100); (3) then the WHAT THE OPERATOR MUST DO ON A REAL PHONE, which is the done-rule's witness: on an iPhone with iOS 16.4 or later open https://nishifamily.com/connect/ in Safari, Share, Add to Home Screen, open Connect from the Home Screen icon (web push only works in the installed app on iOS), sign in, tap Notify me on this device and Allow; on an Android phone open the same page in Chrome, sign in, tap Notify me on this device and Allow. Close the app on both. From a second member's account send each phone a message: each phone must show the notice New message and nothing else (no sender, no circle, no text), a tap must open Connect, and signing a minor's device in must show the identical words. Record device, OS version, time and a lock-screen photo, then run the web gate's teeth inside the installed app and grant camera and mic in a call; with those an operator ACCEPT row in the accept plane is the third signature. Icons for the manifest (192 and 512 px) are owed for Chromium installability.
2026-09-28	CN2	measure	PUBLISHED after the second ship: nx_compare_regen_scoped buildroot ../sites/nishifamily/compare/ --domain connect (job 1790623722) verdict=GREEN fork-fresh, index.html 1325899 B, api.json 126017 B; nx_page_verify https://nishifamily.com/compare/connect/ (job 1790623772) status 200, a11y-issues 0, broken 0, VERDICT=GREEN (static checks; browser rendering unverified). The push watch cell now reads Measured: push_deliver exists in runtime/nx_connect_push.nx (data-s me, flagged lib-uncensused until nx_importcensus next runs). Ranker (job 1790623741): CN2 still #1, priority 6900 (was 6300), TREATMENT-UNDECLARED because only the primitive lib of the five surfaces exists -- no treat row declared, by rule. REFS: six rows added to connect.refs (rfc8291, rfc8292, rfc8030, apple-webpush, wns-channel, autopush-http), each cited inline [rfc8291] [rfc8292] [rfc8030] [apple-webpush] [wns-channel] [autopush-http] in rows 1790622700 and this one; nx_compare_refs_gate named two defects in my own first rows (the Apple row cited the page URL while the fetch journal held the JSON URL I fetched; the WNS fetch had followed a redirect to a MOVED page) and both are fixed (cite the fetched URL; re-fetch the WNS page from its canonical URL, bytes identical), so provenance mismatch is 0 and the WNS row left the open-redirect list. The gate still reads 43/45 on two ratchets I did not move: provenance-open-redirect-ratchet-does-not-rise (17 against baseline 14: pmdash monday_ai_2026_09_23, automation osworld26, search marginalia-api, datavis plot) and moved-ratchet-does-not-rise (pmdash monday_ai_2026_09_23 MOVED) -- named for those boards' owners, not touched.
2026-09-28	R1	measure	W16 DOORS-REST (T0 1790622710) pre-change state, all seven approved doors LIVE, one process each, identity by nx_proc_observe digest_match 1: docportal_admin :18456 pid 32420 e20601bc 1717472 B (debug build) + .prev 335f08ac 1703056 B; email_portal :18465 pid 4084 8cf6ae68 457456 B (debug) + .prev 8ad92e04 490815 B; gen_gateway :18794 pid 18001 abd5a081 540694 B at /volume1/ai/gen (no .prev); mesh_gateway :8055 pid 18942 36dd9289 296025 B + .prev 4a80cd47 420056 B; gallery_gateway :18190 pid 24992 51dc3b18 300923 B at /volume1/ai/galx + .prev 69b610cf 298069 B; vault_gateway :18200 pid 30282 82b7c766 481335 B + .prev 813ed534 396096 B; studio :18099 pid 8685 c0acb66d 297579 B at nishihost/studio (no .prev; publicly routed nishifamily.com /studio, registration argv 1). BANKED (nx_filecopy verified byte-for-byte, mode 0755) all 12 as knowledge/bank/<name>-live-<sha8>-predoors-20260928 and <name>.prev-<sha8>-predoors-20260928. CANDIDATES rebuilt from the current tree in the incumbent flavour: studio bf84eb55 272544 B, gen 3d1973f3 401667 B, mesh cd5932e0 282858 B, gallery 2ee44bd1 287567 B, vault a437c5d5 305226 B (release, as served), email a7fc6374 480136 B (debug, flavour src=incumbent). CONTENT RULER served vs candidate: the four gateways and studio lose only the three software-popcount code-byte fossils (plus for vault the superseded SS-COMMIT message and the reworded STS-LOCK open-failed diagnostic, both successors present in the candidate by txtscan count 1); email debug loses 5 of 1059 runs: the SS-COMMIT halves, ss_max_segid, ss_commit_body and _ma_register_credential -- the pre-fix register function the create-only owner replaced. A release build of the debug-served docportal and email lost every symbol name, so those two are rebuilt in the incumbent debug flavour before any comparison is trusted.
2026-09-28	CN8	land	W16 SOTA-PQ-HYBRID SHIPPED T11, THE PAGE'S OWN DOWNGRADE RULE EXECUTED, NOT GREPPED. nx_connect_pqkx_vm_gate now imports nx_js_eval and runs kxAccept and kxSendMode, cut by brace count from the shipped connect_e2e_pq page, in the estate JavaScript evaluator over all 16 accept inputs and all 4 send-mode inputs, comparing every answer with the native kxp_accept and kxp_send_mode rule (T11b to T11e); a copy with its refusal flipped (return -1 made return 1) must disagree on exactly the 3 refusing inputs (neg-control-T11g), so an evaluator that answered everything identically cannot pass. Qualify job 1790622990 GREEN 61/61; the X25519-only page reads RED 29/61 (job 1790623193). Shipped by nx_organ_ship job 1790623243: promoted sha 791f8335, 1664264 B, _offc twin identical; banks knowledge/bank/nx_connect_pqkx_vm_gate.elf-130fe90a-pre-t11-20260928 and .nx-4883e9aa-pre-t11-20260928. T10d pins the router ad-slot opt-out on the X25519-only page as well. The wave 17 connect front door answers kx_policy (organ_run jobs 1790623321 and 1790623323), so the treat row now names mcp=nx_connect with api=/api/organ_run?target=nx_connect&args=kx_policy; the matrix note and the connect.gates label read 61/61. Shipped, referee GREEN, awaiting operator acceptance.
2026-09-28	CN1	land	W17 SEAT CALL-CODEC: the relay can now size its slots with NO codec in its closure, gate 83/83, awaiting acceptance. The integration spec (row 1790620520) told the serving daemon to size rr_init slots with cc_frame_cap, which lives in nx_connect_codec -- importing it would have put the decoder in the server's closure and broken the content-blind construction T5 proves. The frame sizing now has ONE home in nx_connect_codec_relay (ccr_yuv_bytes, ccr_coded, ccr_frame_cap with CCR_MB, CCR_CHROMA_DIV, CCR_INNER, CCR_VV_PREFIX, CCR_STREAM_BYTES_PER_SAMPLE, CCR_TAG; the relay still imports only nx_room_relay), nx_connect_codec derives cc_frame_cap, cc_plain_cap and cc_coded from it, and cc_ctx_new refuses to build a context if its inner-header, plane-prefix or AEAD tag width ever disagrees with the relay's. New T13 checks the relay-side bound against hand derivations: 491572 B for 320x240 (coded 320x256) and 5652532 B for 720p (coded 1280x736). Qualify job 1790623990 83/83; SHIPPED by nx_organ_ship (job 1790624051) sha256 39f98d3d, content GREEN with no lost run, behaviour DIFFERS as expected (three teeth added), promote live equal to staged, _offc twin installed; served /api/gate_run (job 1790624098) exit 0 GREEN 83/83 FAST, capture 11372 B untruncated. Sources: nx_connect_codec.nx sha256 843ac93b 25876 B, nx_connect_codec_relay.nx f9583bf9 11229 B, gate d907b9d4 46987 B. Not bitten this round: the sizing functions carry no numeric or comparison site the harness mutates, and T13 asserts exact hand-derived values.
2026-09-28	CN1	queue	CN1 INTEGRATION SPEC, CORRECTED (supersedes the SERVER sizing line of row 1790620520): the serving daemon sizes each relay slot with ccr_frame_cap(W, H) from nx_connect_codec_relay for the call's top rung, and composes nx_connect_codec_relay ONLY -- never nx_connect_codec, whose closure holds the decoder and the AEAD. Extend nx_connect_codec_gate's T5 import census over the daemon source when the route lands (the census reads quoted import names, so the check is one call per source). Everything else in rows 1790620520 and 1790623080 stands: ccr_relay_post and ccr_relay_fetch for the route pair, room_admit on join and leave, ccl_channel and ast_may_discover for who may call whom, the client compiling nx_connect_codec through nx_compile_wat, any even geometry, and cc_ctx_need_key honoured by a key-frame request that the sender answers with key_req 1.
2026-09-28	CN2	land	W17 PUSH-DELIVERY third ship: the front door's answer is one table in the lib. cpush_refusal_name(rc) -> *u8 gives each of the 25 refusal codes of nx_webpush (-1..-16) and nx_connect_push (-20..-28) a distinct machine-readable rule name (unknown codes read unknown-refusal), and cpush_http_status(rc) -> i64 maps a positive value to 200, a refused request (bad key, bad auth, not https, incomplete subscription, unnamed push host, bad id, kind with no words) to 400, a removed device to 404, an unreachable push service to 502 and the service's own failures to 500 -- so the push verbs answer 200 with the value or that status with the rule name as the body, and no caller re-derives the mapping (rule 6). ADDENDUM TO THE VERB REQUEST (row 1790622060): FRONTDOOR-FINISH composes these two functions for every push verb's reply. Gate nx_connect_push_gate 141/141 GREEN (F1-F9: every code named, no duplicate name, gap and past-end codes unknown, the five status classes); planted duplicate name turned it RED 140/141 on exactly F2 (actual 1 expected 0), restored. SHIPPED /api/build (src_path names the gate, closure 8be208c6) then /api/promote expect_sha256 7c19c3ca1fce7992c6ce3e15db4163a979263c266e6520b3619f81e898b6e28e (637504 B, PROMOTED); /api/gate_run on the promoted binary GREEN 141/141 exit 0, 14358 B captured of 16384 -- the gate is within 2 KB of the FAST-path capture cap, so further teeth should move to a sibling gate or print less rather than risk a truncated verdict. nx_connect_push.nx 43936 B, nx_webpush.nx 33130 B, gate 71038 B.
2026-09-28	CN19	land	W17 FRONTDOOR-FINISH, THIRD BATCH: play_check WIRED behind the ONE door (answers VERB REQUEST row 1790620030). A PURE decision over a synthetic room built per call: runtime/_hdl_build/nx_connect_frontdoor3.nx cfd3_play drives nx_connect_play (cpl_open, cpl_invite or the group joins, cpl_sit, every cpl_play_move and the chained digest) over the pair the caller describes; the circle table's adult co-founders are the only possible hosts and each opens reach one ring at a time first (cfd3_host_open, because ccl_circle_reach asks BOTH sides); a hidden pair is told what a stranger is told (ast_public_answer), lists_members 0, stored 0, no clock read. play_open, play_join, play_move and play_state are catalog rows not_yet_wired with their reason (own-account: a room lives between calls and ca_dispatch carries no caller identity). DEFECT FOUND BY QUALIFY: the first scratch run read T48 hosts_joined 0 and join two_deep because the co-founder hosts had never opened reach; fixed in frontdoor3 (scratch job 1790622539 GREEN 53/53). PROOF: RED-on-old -- the new gate compiled against the phase-2 lib reads 49/53 with exactly T48-T51 failing (job 1790622867); GREEN 53/53 on the landed lib (job 1790622999); nx_gate_bite over frontdoor3 killed a compiling comparison mutant at off 4865, restore byte-verified 11149 B (job 1790622632); the alpha source (scratch copy importing the new closure, never run) compiles 1064741 B (job 1790622871). LANDED: nx_connect_api_lib.nx 127392 to 134478 B under CAS h1ba6774627c39a75 (job 1790622972). SHIPPED nx_connect_api by nx_organ_ship noregister (job 1790623241): prove 53/53, content ONE-WAY-GAIN lost 0 of 1787 runs, behave help IDENTICAL, promoted dde5865b (577520 B), _offc twin installed; live-vs-staged behaveprobe on pre-existing verbs circle_channel (433 B) and person_attest (443 B) IDENTICAL, play_check DIFFERS as expected (live 120 B unknown_verb, staged 466 B). GATE SHIPPED by nx_organ_ship (job 1790624465): prove 53/53, the one lost run named and approved (nx_connect_msgstore.msg_store_append, the intended msg_append engine repoint; evidence knowledge/status/harness/loss-e04fea16...record), behaviour change reviewed (knowledge/status/harness/review-frontdoor-finish-nx_connect_api_gate-c8f80c86.txt, sha 35c542cf), promoted c8f80c86 (749664 B, was 9afbeeb7), _offc twin installed. LIVE from the nishihost root: /api/organ_run nx_connect play_check tictactoe group ward 1 0 0 0 0 1 0,4 answers hosts_joined 1, join ok, both sits ok, moves [ok,ok], plies 2, digest 2019662868, result ongoing, viewer_told 1, lists_members 0, stored 0 (the folkgame spec resolves through ep_artifact_path). WATCH: an unknown game makes nx_folkgame_lib print a FOLKGAME-REFUSED line on stderr; the JSON on stdout stays clean. RECIPE: /api/organ_run args_encoding=percent-v1 separates argv with a plus sign (a percent-encoded space stays inside one argument). Shipped, gate 53/53, awaiting acceptance.
2026-09-28	CN19	land	W17 GAMES-TOGETHER, ONE DIGEST SPEC: the chained digest moved out of nx_connect_play into nx_connect_play_digest (cpd_chain and cpd_words, 1596 B -- CRC-32C through det_state_checksum over little-endian words prev, move, then the generator's full fg_save snapshot), so the play session and the crossplay probe run the same code and a second spelling of the rule cannot exist; cpl_chain now delegates. Proven neutral before shipping: qualify 127/127 with the same digests (opening 3598535430, first move 2330911069, fifth 455173136). nx_connect_play_gate rebuilt through /api/build (src_path names the gate, src_sha256 4087fbf0, closure 10d8bbea), content GREEN lost_from_live 0 with one source added (the digest lib), promoted expect_sha256 6a491bd27108a1670d47e11014bce5423676851f43c14b717ba5867436ccf81e (246696 B, before it d806920b), _offc twin installed; served /api/gate_run 127/127 GREEN exit 0, 14215 of 16384 B captured, untruncated.
2026-09-28	CN19	measure	CROSSPLAY BY DETERMINISM, two architectures of one host: the probe runtime/_hdl_build/nx_connect_play_replay.nx (3828 B; the tic-tac-toe rules embedded because the wasm door reads no file; the forced line read off the generator's own first line, never typed) prints CPD ply=0..5 digest 3598535430 2330911069 3170970567 4123116413 359321511 455173136 run native (nx_sov_build_run, x86-64) and on the estate wasm VM (nx_compile_wat --host-write, nx_wat_compiler, nx_wasm_run: WASM-RUN export=main rc=0 module_bytes=64120) -- byte-identical lines, and the native values equal the play session's own. Not measured: a phone browser, the Nishi browser, NishiOS native (gameengine GE27 and GE47 name those doors).
2026-09-28	CN19	land	nx_connect_play_crossplay_gate 12/12 GREEN, awaiting acceptance: the native chain computed in-process by cpd_chain over the generator parsed from the spec FILE is compared line by line with what the VM prints for the probe, so the embedded rules cannot drift from knowledge/compare/folkgames.align without a RED; the final line agrees; the WASM-RUN receipt is last with rc 0; a neg-control shows the same position reached by another move order (the first three moves reversed) carries another digest, 2298537200, that the VM never printed. BITE: a drifted forced line planted in the probe (the second player's two answers swapped) read RED 10/12 with exactly the two agreement teeth failing (vm_lines_agreeing 2 of 6, the unchanged plies 0 and 1) while every pipeline tooth stayed green, so the RED was for the right reason; restored and hash-verified (h5d228de7b90bd4b6, 3828 B), then GREEN 12/12. SHIPPED /api/build (src_path names the gate, src_sha256 5250c3b3, closure 5bcfaf85), /api/promote expect_sha256 0ff0ac932a533a9ddf19244ae8d7c6d7956769f59632d7245c03bee1dd1cef99 (137464 B), /api/tools/register callable 1, _offc twin installed; served /api/gate_run from the serving root GREEN 12/12 exit 0 (probe resolved to buildroot/runtime/_hdl_build, toolchain to the promoted nx_compile_wat, nx_wat_compiler and nx_wasm_run), 1586 B captured. Rostered in knowledge/gateroster.conf and knowledge/compare/connect.gates, and row 5 of the ritual plane plan-connect-play-verify-. SCOPE, stated: an agreement gate cannot see a change to the digest spec that both sides share by construction; the pinned values in nx_connect_play_gate hold that class.
2026-09-28	CN19	queue	W17 GAMES-TOGETHER CLOSE-OUT, open and owned: (1) FRONTDOOR-FINISH owns the four verbs play_open, play_join, play_move, play_state (VERB REQUEST row 1790620030; play_state returns only the caller's own room) -- until they land CN19 has no served caller and stays LIB-GATE-ONLY; (2) nx_connect_play_gate, nx_connect_play_crossplay_gate and nx_connect_lds_room are registered and callable but in no seat cap -- the cap owner mints, this seat writes no tokens; (3) the ritual plane plan-connect-play-verify- (5 rows) is refused by nx_plan_run managed-owned-definition-required until the PM owner defines it (row 1790621120); (4) the room rule carries no guardian clause, so a guardian's own youth is refused a private room on join (recorded tooth) -- an operator decision, never a seat's; (5) nx_connect_play_gate prints 14215 of the 16384 B FAST capture, so further play teeth go to a sibling gate (the crossplay gate is the first) or print less; (6) crossplay beyond x86-64 and the estate wasm VM is unmeasured; (7) the ranker reads CN19 LIB-UNCENSUSED until the eco graph and importcensus refresh; (8) no /games alpha note was published -- the site lane was not taken, this journal is the record.
2026-09-28	CN1	land	W17 SEAT CALL-CODEC: simulcast through the binding, gate 90/90, awaiting acceptance. New T14: one sender binds a base layer (320x240, 6357 codec bytes on its key frame) and a top layer (640x480 from the same camera frame, 17104 bytes) under one call key; they take two relay slots (the relay keys a slot on sender and layer); the thumbnail receiver and the speaker receiver each open only their own layer, byte-identical to the sender's reconstruction of that layer; a base-layer receiver refuses the top layer's frame by its layer (-28) before the AEAD runs. This is CB0's layout-aware selection carried by real sealed codec streams rather than modelled byte counts; each layer keeps its own counter and the layer is bound into the nonce, so the relay can choose which layer to forward but cannot relabel one. Qualify job 1790624676 90/90; SHIPPED by nx_organ_ship (job 1790624720) sha256 44d86106, content GREEN, behaviour DIFFERS as expected, promote live equal to staged, _offc twin installed; served /api/gate_run (job 1790624737) exit 0 GREEN 90/90 FAST, capture 12108 B untruncated. Gate source sha256 b9ad8a6f 51297 B; the two libs unchanged since row 1790624280. Roster and connect.gates updated to 90/90.
2026-09-28	CN1	queue	W17 SEAT CALL-CODEC RETURNS -- CN1 is shipped as lib plus gate, 90/90 on the served binary, and is a FINISH item, not done: the published page reads nishi 1 with adoption LIB-GATE-ONLY importers=1 (connect regen job 1790624898, page_verify job 1790624925 GREEN static only, browser rendering unverified). The PSNR the gate emits recomputes by hand from its own values: key Y SSE 174827 over 76800 pixels gives 44.56 dB against the ruler's 4455 cdB. OPEN, each for its owner: (1) the served call route in the alpha daemon per rows 1790620520, 1790623080 and 1790624310 (alpha daemon sources are wave 16 locked; no /connect source carries a call path today); (2) the call key without the server is CN7 and CN8, and per-sender secrets are what would stop a member forging another member's kid; (3) nx_connect_room_rx is registered but /api/gate_run and the roster refuse its name, so a thin nx_connect_room_rx_gate is owed, and its T3 content-blind tooth stays a modelled constant; (4) nx_connect_codec_gate and nx_connect_room_rx read REGISTERED-UNAUTHORISED until the cap owner mints a cap naming them; (5) debt 1790622664 (sev 5, videocodec): the live family video app codes 320x240 raw and so leaves 8 chroma rows uncoded; (6) not bound yet: the range-coded and t8 codec variants and rate control (the binding codes at a fixed qp); (7) no treat row declared -- media frames do not ride the MCP front door, and the plane and agent surfaces were not built; (8) acceptance is three-party: referee panel, operator ACCEPT row, seat attestation -- shipped, gate 90/90, awaiting acceptance.
2026-09-28	CN8	measure	W16 SOTA-PQ-HYBRID REFRESHED THE IMPORT CENSUS THE CLOCK COULD NOT. CN8 read FINISH state=LIB-UNCENSUSED because knowledge/status/importers.tsv predated every importer of nx_connect_pq, and the census refresh rides the clock plane, which has executed nothing since about 2026-09-23 (debt 1790620957). nx_eco_graph_build (job 1790624758, heavy-I/O slot 2 of 4, ADMIT) rebuilt knowledge/store/ecograph_full over buildroot/runtime: nodes=22684 edges=65104 files_scanned=22709 complete=1; nx_importcensus then rewrote importers.tsv: rows=22684 = has_nonval 4623 + val_only 2772 + orphan 15289 (sums), edges=65104, asof=1790624646. nx_connect_pq.nx now reads 5 importers, 3 of them non-validation, first nx_connect_e2e_client.nx. nx_compare_rank connect (job 1790624896): finish (done but partially adopted) 7 to 2. CN8, CN3, CN16, CN18 and CN19 left the list; rows read for CN18 (nx_connect_personhood, imported by nx_connect_frontdoor2) and CN19 (nx_connect_play, imported by nx_connect_frontdoor3), CN3 and CN16 not read individually. CN1 moved from LIB-UNCENSUSED to LIB-GATE-ONLY and CN5 stays LIB-GATE-ONLY, both named for their owners. Scoped regen job 1790624940 published the page at 1360837 B with no live LIB-UNCENSUSED state left (the 14 remaining mentions are journal prose). Every board that reads importers.tsv picks the refresh up on its next publish; the census stays stale again from here until the clock plane is bound.
2026-09-28	CN19	land	Gate resolution declared, not left to naming: knowledge/organ_gate.conf now pairs nx_connect_play_digest with nx_connect_play_gate (the pinned values and the second-method recompute of the digest spec live there, which the name convention would never reach) and the crossplay probe nx_connect_play_replay with nx_connect_play_crossplay_gate, so a ship of either resolves its PROVE stage by declaration; nx_connect_play keeps the convention. The connect page republished through nx_compare_regen_scoped (GREEN, index.html 1358003 B) and nx_page_verify reads it GREEN, status 200.
2026-09-28	CN13	queue	Cross-reference from youthsafety.plan row 1790624760 (W16 LAWS-CONTINUED): Colombia is now a DECLARED place in knowledge/connect_jurisdictions.conf (consent below 18 by parental_consent from Ley 1581 de 2012 Art. 7 as read by Sentencia C-748 de 2011 with Decreto 1377 de 2013 Art. 12), so the sign-up lane's next read of the table admits a Colombian minor of 13 to 15 with the representante legal's authorization where the strictest line barred them; the decree's two parameters (the processing responds to the minor's interes superior and respects their fundamental rights) and the minor's right to be heard before the representative authorizes are content duties the table does not carry and are owed to the csu_signup_admit guardian-consent step (record that the minor was heard). No consumer rebuild is needed because the table is read at run time; gate nx_connect_juris_gate 92c73640 174/174 GREEN carries the three CO teeth. Bolivia gained a SOURCED civil row (Codigo Civil Art. 4 as reformed by Ley 2089: majority at 18) beside its UNSOURCED data-protection row, so a Bolivian declarant still reads the strictest line.
2026-09-28	R1	land	W16 DOORS-REST door 1 (email portal :18465) SHIPPED AND VERIFIED. nx_email_portal_daemon.elf now a7fc6374aa8a4a18f764ff515aec28d0c681806779e76fc407d033349fc2b3f6 480136 B (rebuilt from the current tree, debug flavour to match the served twin's DWARF; carries create-only nx_uas_create, fail-closed nx_uas_lookup, retired 16 MiB clamp). POST /api/deploy target=email confirm=yes expect_sha256=a7fc6374 = PROMOTED, pre_deploy_gate DEPLOY-SAFE gate_blockers 0 gate_override none gate_exit 0 (email deploy_domain is comms, NOT in RED_DOMAINS, so it scoped clean with NO override). VERIFIED by process identity not the receipt: nx_proc_observe = ONE process pid 18444 start_ticks 524075388 parent 11563 (the exact-kill hostctl) digest_match 1 sha a7fc6374, complete scan 0 mismatches, the old 8cf6ae68 pid 4084 gone. Files: nx_email_portal_daemon.elf=a7fc6374, .elf.prev=8cf6ae68 (rollback slot; roll back with gdeployrb@email). SERVED over the edge: https://mail.andelinwest.com/ 200 text/html 5422 B. Health OK 16 services 0 down 0 degraded before and after. BANKED (byte-verified, mode 0755): knowledge/bank/nx_email_portal_daemon.elf-live-8cf6ae68-predoors-20260928 and .elf.prev-8ad92e04-predoors-20260928. Content ruler served vs candidate: 5 of 1059 runs lost (4 permil) -- the two SS-COMMIT halves (successor SS-WRITE-SEG REFUSED present, txtscan count 1), ss_max_segid, ss_commit_body (the nx_fio.nx seg-store refactor, SOURCE-ADDED runtime/nx_fio.nx) and _ma_register_credential (the pre-fix register the create-only owner replaced) -- all benign, 105 gained. NOTE: the email invite token is not bound to the handle; that binding was NOT changed here (out of scope; this ship carries only the account-log create-only + fail-closed fix). No email-specific door gate exists; the fix is proven in the shared owner (nx_user_account_store_gate 39/39) and end-to-end through the identical docportal door (nx_docportal_admin_daemon_gate 20/20 GREEN this run, R1/R2/R3 invite-register conjuncts).
2026-09-28	FS8	land	W17 FRONTDOOR-FINISH, FOURTH BATCH: date_admit WIRED behind the ONE door (answers the PURE DECISION named in VERB REQUEST row 1790621000). runtime/_hdl_build/nx_connect_frontdoor4.nx cfd4_admit composes nx_connect_datesafety cds_admit over the conf the engine loads through its own root ladder (cds_load_default: policy 1, lead_max_s 2592000 from knowledge/connect_datesafety.conf; an unreadable conf leaves the policy refused), the youth wall's bands, and THE ONE contact rule's lane to the contact (ccl_channel over the synthetic community cfdk_channel builds); the deadline is the caller's lead_s past a synthetic now, so no clock is read; no plan, place or member data is carried; stored 0. Grammar: date_admit a_age b_age guardian shared a_ask b_ask blocked lead_s. UNWIRED WITH THEIR REASON (catalog rows, each answering not_yet_wired by name): FS8 date_share, date_checkin, date_block_report, date_extend, date_cancel, date_update, date_plan (own-account on one date-safety block between calls); FS11 mod_report, mod_queue_mine, mod_act (own-account on durable report and action rows; the addendum row 1790622340 -- idempotent reporting, cgm_join -75 -- is noted for the day they are wired); CN2 push_subscribe, push_unsubscribe (own-account on the push store) and push_vapid_key (key custody: the engine mints a relative server key file on first use, so the door must not be the minter). PROOF: RED-on-old -- the new gate against the phase-3 lib reads 53/56 with exactly T52, T53 and T54 failing (job 1790624617); GREEN 56/56 on the landed lib (job 1790624705); nx_gate_bite over frontdoor4 killed a compiling comparison mutant at off 4985, restore byte-verified 6325 B (job 1790624229); the alpha source (scratch copy on the new closure, never run) compiles 1089948 B (job 1790624090). LANDED: nx_connect_api_lib.nx 134478 to 141017 B under CAS h35ae88aca0cabde8 (job 1790624687). SHIPPED nx_connect_api by nx_organ_ship noregister (job 1790624817): prove GREEN, content ONE-WAY-GAIN lost 0 of 2002 runs, behave help IDENTICAL, promoted bcbd3511 (608544 B), _offc twin installed; behaveprobe live-vs-staged play_check (483 B) and circle_channel adult-with-own-minor (433 B) IDENTICAL, date_admit DIFFERS as expected (live 120 B unknown_verb, staged 372 B). GATE SHIPPED (job 1790624877): prove 56/56, content GREEN, behaviour change approved, promoted 55b1f7de (791168 B), _offc twin installed; registered and rostered (knowledge/gateroster.conf); nx_catalog reads REGISTERED-UNAUTHORISED (no cap names the gate). LIVE from the nishihost root: date_admit 1 1 0 ward 1 1 0 7200 answers verdict ok, admitted 1, contact_lane 1, policy 1, lead_max_s 2592000, stored 0; date_admit 0 1 1 ward 1 1 0 7200 answers refused_minor (-203) although the minor holds a lane with their own guardian. WATCH: the catalog reply is now 28879 B inside the 65536 B output buffer nx_connect_api.nx declares as K_MAGIC_65536 with no bound check (41 rows); the gate prints catalog_reply_bytes every run. Shipped, gate 56/56, awaiting acceptance.
2026-09-28	CN17	queue	W17 FRONTDOOR-FINISH HAND-OFF -- what this seat did not reach, each with its recipe. (1) CN17 service_match stays not_yet_wired: a pure decision needs a synthetic service state (the csh conf cell and reach from knowledge/connect_service.conf, one need posted by csh_post with req slots ring, kind, cap, plen/poff, youth, lat, lon, when), then csh_need_match(st, cst, e, helper, consent, hloc), whose admission order is live, member, not self, consent, visibility through the poster's circles, the coarse locality band, the two-deep wall for a one-to-one need and ev_rsvp capacity last; the circles side is cfdk_community exactly as the other wave-17 verbs build it; one door build cycle. (2) CN15 faith_rank (request row 1790615101) stays queued: cfa_rank_visible over a synthetic population the caller describes; teeth: hidden stays hidden whatever the faith, a withdrawn member ranks at the no-faith position, a minor never surfaces to an unrelated adult, the order equals a brute-force oracle, a neg-control each. (3) FOR THE ALPHA OWNERS (wave 16; this seat edited no alpha source and restarted nothing): the alpha inherits play_check, date_admit and room_check through ca_dispatch on its next build (nx_connect_alpha_api_gate tooth E2 compares the wired count dynamically, and C5/C6 still exercise signup_admit, which stays unwired); study_post has been behind the door since phase 1, so the device gate tooth T3b that asserts /try/study is not behind the door will read differently after that rebuild; 22 catalog rows are own-account and wait for ONE identity-carrying entry point -- ca_dispatch carries no caller identity on either surface, and the remedy is a sibling dispatcher that takes the session's circles member from the daemon, never from a request field. (4) LIFECYCLE: runtime/_hdl_build/nx_connect_api_lib_w17scratch.nx, nx_connect_api_gate_w17scratch.nx, nx_connect_appd_w17check.nx (a never-run copy of the alpha source importing the scratch lib, kept only as a compile check) and nx_connect_api_w17scratch.nx, with their _build artifacts, are SUPERSEDED by the landed lib and gate; none is registered, rostered or on a clock row; archive with nx_retire_path (not in this seat's caps) before anyone mistakes them for a parallel door. (5) Activity rows were not reached: no request row names the activity engine's verbs; its owner should file one.
2026-09-28	CN2	land	VAPID refresh window shipped: the token exp is now - (now mod vapid_refresh) + vapid_exp, so every delivery inside one conf-declared window signs byte-identical bytes (RFC 6979) and a push service sees one token per window; knowledge/connect_push.conf gained vapid_refresh 3600 with its evidence (Apple asks senders not to refresh the VAPID JWT more than once per hour, mirrored knowledge/fetched/cmp_connect_apple_webpush.json); cpush_build refuses a refresh that is not positive or not below vapid_exp (CPUSH_ERR_CONF), which keeps exp - now inside the RFC 8292 24 hours by construction and guards the modulo. Gate nx_connect_push_gate 146/146 GREEN: D39 checks the windowed exp, D71 a window mints one token (its first and last second compared, the fixture derives a window of at least two seconds), neg-control D72 the next window mints a different token that still verifies, neg-control D73 a conf file with refresh equal to vapid_exp is refused through push_deliver, neg-control D74 a zero refresh is refused, E8 the production refresh is at least an hour and below vapid_exp. Two defects planted at once (a mint that ignores the window, a refresh bound off by one): RED 143/146 failing exactly D39 D71 D73 (D73 read -27, the bad conf reached the POST); restored; /api/build sha 78c7782e is byte-identical to the pre-plant qualify build; /api/promote PROMOTED 78c7782e with expect_sha256; /api/gate_run on the live binary GREEN 146/146 exit 0; nx_offc_install installed=1.
2026-09-28	CN2	measure	nx_connect_push_gate live run at 1790625412: refresh chosen by the run 26864 s, vapid_exp 39142 s, windowed exp 1790659062 = 1790625412 - 5492 + 39142 recomputed by hand; production vapid_refresh 3600 below vapid_exp 43200; gate output 15007 B against the /api/gate_run FAST capture cap 16384 B (capture_truncated=0, 1377 B headroom).
2026-09-28	CN2	lesson	A same-window tooth over a one-second window compares an instant with itself and cannot fail, so the fixture derives its refresh from a named two-instant floor (CPG_WINDOW_INSTANTS) and asserts the last second is after the first before comparing tokens. A gate whose FAST capture sits at 15007 of 16384 B has room for about eight more tooth lines: the next push teeth belong in a sibling gate, or the verdict line falls off the capture.
2026-09-28	CN2	queue	Open after wave 17 PUSH-DELIVERY: cl_mobile_shell stays OPEN (real-device witness, no stub written); FRONTDOOR-FINISH owns push_vapid_key (a pure read, ready now) and push_subscribe and push_unsubscribe (blocked until ca_dispatch carries the session account); the connect daemon owner owns serving connect_sw.js and connect.webmanifest, the opt-in control, and calling push_deliver_account_async from the message path; the manifest icons are owed; the real-browser push proof is UNVERIFIED (no served secure origin for the connect assets, and the capture driver cannot grant notification permission or receive a push); CN2 needs the operator ACCEPT row before it reads complete.
2026-09-28	R1	land	W16 DOORS-REST door 2 (studio /studio :18099) SHIPPED AND VERIFIED -- the one remaining door with OPEN, un-invite-gated registration (argv allow_register default 1, publicly routed nishifamily.com /studio buffered), i.e. the live account-takeover surface among the untouched seven. nx_studio_gate.elf now bf84eb551b800072ebbe97b887e745d67654130bf6015819f0aa8e8be3801d75 272544 B (rebuilt from the current tree, release flavour matching the served twin; the shared create-only nx_uas_create + fail-closed lookup reach it through olg_register/olg_login). NEW deploy_targets row added (studio, EXACT-BY-PATH like connect: no field-7 kill-name, so the exact-kill hostctl restarts only the pid whose /proc/exe is the absolute live path and nx_daemon_supervisor revives). organ_kind already declares nx_studio_gate a daemon. POST /api/deploy target=studio confirm=yes confirm_gate_override=yes expect_sha256=bf84eb55 = PROMOTED, pre_deploy_gate DEPLOY-BLOCKED-OVERRIDDEN gate_blockers 1 gate_override AUDITED gate_exit 3. THE OVERRIDE IS HONEST NOT GAMING: studio has no compare domain so it fell to GLOBAL scope, and the 8 RED_DOMAINS (search webscraping finance videocodec softbody pmdash autodev ecosystem) are all unrelated to studio -- the sanctioned audited escape for a proven fix held by unrelated evidence debt, with health-check + auto-rollback + banked .prev. VERIFIED by process identity: nx_proc_observe = ONE process pid 12503 digest_match 1 sha bf84eb55 parent 25615 (nx_daemon_supervisor), old c0acb66d pid 8685 gone. Files: studio/nx_studio_gate.elf=bf84eb55, .elf.prev=c0acb66d (first-deploy rollback slot created; roll back with gdeployrb@studio). SERVED: https://nishifamily.com/studio 200 text/html 2336 B (the OPAQUE login shell) Cache-Control no-store. Health OK 16/0/0. BANKED: knowledge/bank/nx_studio_gate.elf-live-c0acb66d-predoors-20260928. Content ruler served vs candidate: 3 of 169 lost (17 permil) -- only the software-popcount code-byte fossils (UUUUUUUUH!, 33333333H! x2); 26 gained (arena diagnostics). No studio-specific door gate exists; the fix is proven in the shared owner (nx_user_account_store_gate 39/39) and end-to-end through the identical docportal door (20/20).
2026-09-28	R1	queue	W16 DOORS-REST door docportal_admin :18456 is BLOCKED AT THE PRE-DEPLOY GATE ON ITS OWN DOMAIN -- NOT SHIPPED, deliberately NOT overridden. Candidate PROVEN and STAGED: nx_docportal_admin_daemon.sov.elf 2dd4f896b79b931fca9cf68ebe467caa56ec006e8f47e3003164d5c1ae574995 1744544 B (debug flavour matching the served twin; carries create-only nx_uas_create, fail-closed lookup, retired clamp), staged as nx_docportal_admin_daemon.sov.elf.new. nx_docportal_admin_daemon_gate GREEN 20/20 this run against the current source (T1-T6 gating, R1/R2/R3 invite-register create-only, S1-S8c public search/doc/API). Content ruler: 6 of 2161 lost (2 permil) -- the seg-store SS-COMMIT/STS-LOCK refactor halves (successors SS-WRITE-SEG REFUSED + STS-LOCK present by txtscan, nx_uas_create present) + ss_commit_body/sts_mm/_ma_register_credential; SOURCE-ADDED runtime/nx_fio.nx. BANKED: knowledge/bank/nx_docportal_admin_daemon.elf-live-e20601bc-predoors-20260928 + .elf.prev-335f08ac-predoors-20260928. WHY BLOCKED: POST /api/deploy target=docportal returned PRE-DEPLOY GATE BLOCKED, gate_blockers 1 (evidence-honesty). docportal deploy_domain is search, and evidence_honesty.log RED_DOMAINS carries search -- so the block is ON docportal's OWN domain, not unrelated debt. docportal serves a CLIENT property (admin.andelinwest.com, the law firm) + nishifamily /search /doc. I will NOT override a client property on an on-subject domain RED. UNBLOCK = clear the search-domain evidence honesty (another lane: nx_sota_status names the search gate/attestation in dissent, nx_swcompare_evidence search re-measures); then /api/deploy target=docportal scopes to search=GREEN and ships with no override. The staged candidate + banks are ready for that moment.
2026-09-28	FRONTDOOR	land	W17 FRONTDOOR-FINISH FIFTH BATCH CLOSED by the resumed seat (T0 1790630519): room_check WIRED behind the ONE door -- the youth room rule nx_connect_lds_room_lib room_admit on JOIN and room_may_leave on LEAVE as a PURE decision over the counts the caller describes (runtime/_hdl_build/nx_connect_frontdoor5.nx cfd5_check behind ca_v_room, one import line in the lib; no room, member or clock is read; stored 0). The predecessor landed it (nx_connect_api_lib.nx 141017 to 143713 B) and shipped nx_connect_api f627cd16 615416 B at 1790625488 (organ_ship.jrnl BUILD to SHIPPED GREEN) after its hand-off row, then died before shipping the gate or journaling. CATALOG PARTITION before rows 41 = wired 19 + not_yet_wired 22 + not_yet_landed 0; after rows 42 = wired 20 + not_yet_wired 22 + not_yet_landed 0. THIS LEG: build-check of the shared tree (job 1790630519) BUILT f627cd16, byte-identical to the promoted binary (nx_filehash cmp identical 1), so the lib compiles and no repair was owed; gate qualify (job 1790630777) GREEN 60/60 reproducing the staged 4534300d byte for byte (T55 allowed joins and leaves with the counts after, neg-control T56 two_deep, two_deep_leave, an uncounted leaver and malformed input refused by name, T57 a 64-case oracle over zero to three youth and adults, both ages, both moves, room_oracle_agree 64 of 64, T58 the catalog row). GATE SHIPPED by nx_organ_ship (job 1790630886): prove 60/60, content GREEN, behave DIFFERS as expected for new teeth, promoted 4534300d 809080 B, _offc twin installed, already registered. LIVE from the nishihost root through /api/organ_run nx_connect: room_check 2 1 1 answers ok, allowed 1, youth_after 2, adults_after 2 (job 1790631137); room_check 2 2 1 leave answers two_deep_leave, allowed 0 (job 1790631140). NOT RUN, named: nx_gate_bite over frontdoor5 (the file is now in the alpha closure through the lib, so an in-place mutant could reach a wave-16 alpha build; the 64-case oracle tooth is the independent second method) and a RED-on-old run (no bank of the 141017 B lib exists). Shipped, gate 60/60, awaiting acceptance.
2026-09-28	R1	measure	W16 DOORS-REST (resumed after the outage, T0 1790630526) door gallery_gateway :18190 FOUND DEPLOYED BY THE PREDECESSOR SEAT AND UNJOURNALED -- verified now, not inherited. /volume1/ai/galx/nx_gallery_gateway.elf is 2ee44bd1b07ac611a52515759c589f2c5b4ddf6c38590670f27c8d126164390b 287567 B (the predecessor's candidate: rebuilt from the tree, release flavour, carries create-only nx_uas_create, the fail-closed lookup and the retired 16 MiB clamp); .elf.prev is 51dc3b18 300923 B, the pre-change live, also banked as knowledge/bank/nx_gallery_gateway.elf-live-51dc3b18-predoors-20260928 (byte-identical by nx_filehash). nx_proc_observe: ONE process pid 29168 start_ticks 524159513 parent 11563 (the exact-kill hostctl, respawned by hc_guard_galx_gw) digest_match 1 and name_matches 1, so the old 51dc3b18 pid 24992 is gone; the start ticks place the restart at about epoch 1790625614, after the docportal row 1790625470 and before the predecessor stopped. Served over the edge: https://nishifamily.com/gallery 200 text/html 2867 B no-store; /gallery/auth/whoami with no session 401 login required. Health OK 16 services 0 down. The deploy RECEIPT was NOT recovered (the _jobs dir is past the shelltool glob budget), and galxgw has no deploy_domain row, so whether the pre-deploy gate was scoped, blocked or overridden is UNKNOWN -- this verification rests on the served bytes and the process, never on a receipt. Rollback recipe: re-stage the bank as nishihost nx_gallery_gateway.sov.elf.new and POST /api/deploy target=galxgw (galxdeploy banks the current live as .prev first).
2026-09-28	R1	land	W16 DOORS-REST door mesh_gateway :8055 SHIPPED AND VERIFIED. NEW deploy_targets row meshgw (EXACT-BY-PATH, no field 7; live /volume1/homes/elderwesto/nishihost/nx_mesh_gateway.elf; rb gdeployrb@meshgw), deploy_domain row meshgw workermesh (the /mesh console is the GPU worker mesh job console, nx_hostctl HC_MESH_GW_CMD beside HC_MESH_SERVE), and organ_kind rows declaring nx_mesh_gateway, nx_gen_gateway_daemon and nx_vault_gateway daemons (none had a kind row). Candidate: nx_sov_build_run nx_mesh_gateway --build-only --release (job 1790631247) BUILD-CACHE HIT cd5932e02bd2b12f4e933cfce871e398e8c9d7d60daeafcfd0224ebb3df5ae02 282858 B, the predecessor's candidate, artifact re-hashed present. Shared owner gate on the CURRENT tree: nx_user_account_store_gate --qualify (job 1790631354, cache MISS so compiled fresh) GREEN 39/39 (second register of a taken handle -1412, an unreadable log refuses -1413 and -1467, a late row past the retired 16 MiB clamp logs in and stays taken). Content ruler served 36dd9289 vs candidate (job 1790631323): 3 of 191 runs lost (15 permil), all three the software-popcount code-byte fossils (UUUUUUUUH! and 33333333H! twice), 26 gained (arena diagnostics). BANKS byte-identical: knowledge/bank/nx_mesh_gateway.elf-live-36dd9289-predoors-20260928 and nx_mesh_gateway.elf.prev-4a80cd47-predoors-20260928. Staged nx_mesh_gateway.sov.elf.new by nx_filecopy (verified, mode 0755, re-hashed). POST /api/deploy target=meshgw confirm=yes expect_sha256=cd5932e0 (job 1790631504) = PROMOTED, pre_deploy_gate DEPLOY-SAFE, gate_blockers 0, gate_override none (scoped to workermesh). deploy_status DEPLOYED-GREEN listen=VERIFIED. VERIFIED by process identity: ONE process pid 7594 start_ticks 524749835 parent 11563 (hc_guard_mesh_gw respawn) digest_match 1, name_matches 1, the old 36dd9289 pid 18942 gone. Files: nx_mesh_gateway.elf = cd5932e0, .elf.prev = 36dd9289. Served: https://nishifamily.com/mesh 200 text/html 2716 B, the same size as before the ship, no-store; /mesh/auth/whoami with no session 401 login required. Health OK 16 services 0 down before and after. Registration stays CLOSED by argv (allow_register 0), so the value is the fail-closed lookup and the retired clamp on login. No mesh door gate exists (the proof is the owner gate plus the served behaviour). Rollback recipe: re-stage the bank as nx_mesh_gateway.sov.elf.new and POST /api/deploy target=meshgw (hc_promote_to banks the current live as .prev first).
2026-09-28	ALPHA	measure	W16 SEAT ALPHA-SIGNUP-DOOR RESUMED (T0 1790630638, third run of this seat; the second run died after 1790625628 with no journal row). EDIT-START on nx_connect_appd.nx, nx_connect_serve.nx, nx_connect_ui.nx, nx_connect_signup.nx and connect_device_opaque.js (this seat is their only editor until its FINAL row). Predecessor state measured against its banks knowledge/bank/nx_connect_appd.nx-01b3a2f4-pre-signupdoor-20260928, nx_connect_serve.nx-pre-signupdoor-20260928 (e3d59b69), nx_connect_signup.nx-pre-signupdoor-20260928 (5d71ad39) and connect_device_opaque.js-pre-signupdoor-20260928 (4d03efba, identical to the served alpha asset): LANDED in source and compiling (nx_sov_build_run nx_connect_appd --build-only --release job 1790631092, 1106414 B sha256 153792c7, not run, not installed) -- the lib's web door (csu_door_tail, csu_signup_check_web with the SELF-DECLARED age screen CSU_ATT_SELF, csu_signup_commit, csu_code_slug and csu_code_text, csu_purpose_name, csu_record_num, csu_today_ymd; signup 32870 to 46340 B), the serve pages (the CS_SIGNUP ctx block, the device register form with the age screen and place, the form fallback that the device script solves the work for, the refusal banner with its slug, the account page's sign-up record; serve 132671 to 141624 B), and in appd the helpers (CdDoor, cd_su_req, cd_s1_write and cd_s1_read, cd_su_rows, the route rate limiter cd_dev_rate over conf rows; appd 89245 to 101230 B). NOT LANDED: none of the appd helpers is called (cd_dev_handle and main are byte-identical in logic to the bank: no challenge route, no door at respond or at POST /register, no rate check, no S1 write, the door never armed), no rate rows in knowledge/connect_device.conf, the device script unchanged, no gate touched. This run wires them, then gates, rebuilds and restarts only the alpha.
2026-09-28	R1	land	W16 DOORS-REST door vault_gateway :18200 SHIPPED AND VERIFIED. NEW deploy_targets row vaultgw (EXACT-BY-PATH, no field 7; live /volume1/homes/elderwesto/nishihost/nx_vault_gateway.elf; rb gdeployrb@vaultgw; respawner nx_daemon_supervisor via daemons.reg nx_vault_gw revive) and deploy_domain row vaultgw mediaingest (the vault gateway browses the mvault records the mediaingest board owns and that board names it a surface). Candidate: nx_sov_build_run nx_vault_gateway --build-only --release (job 1790631656) BUILD-CACHE MISS, compiled fresh, a437c5d5d954af6471e8f00aeb573966421a2bb78258544fd007239d93884169 305226 B -- byte-identical to the predecessor's candidate, so the closure did not move. Served 82b7c766 481335 B was built 2026-08-01 (file mtime 1785561912; the source moved 2026-08-08); the size drop is the toolchain generation, and every lost string is named: the COMPLETE inventory (nx_contentdiff_export, knowledge/gates/w16doorsrest_vault_contentdiff_export.txt, complete=1 runs=317 missing=6) is the three software-popcount code-byte fossils, the two SS-COMMIT REFUSED halves (successor SS-WRITE-SEG REFUSED present, count 1) and STS-LOCK open-failed (not flock) path= (reworded, STS-LOCK open-failed present); the 134 gained (inverse export knowledge/gates/w16doorsrest_vault_gained_export.txt) are all shared-runtime lines -- arena diagnostics, seg-store and STS load honesty, the file-install lifecycle states, the bounds-violation refusal and the crash guard -- and no vault route or surface string. BANKS byte-identical: knowledge/bank/nx_vault_gateway.elf-live-82b7c766-predoors-20260928 and nx_vault_gateway.elf.prev-813ed534-predoors-20260928. Staged by nx_filecopy (verified, mode 0755, re-hashed). POST /api/deploy target=vaultgw confirm=yes expect_sha256=a437c5d5 (job 1790631807) = PROMOTED, pre_deploy_gate DEPLOY-SAFE, gate_blockers 0, gate_override none (scoped to mediaingest). The first process scan straight after the receipt read ABSENT (the old pid was killed, the supervisor had not yet revived) -- then deploy_status DEPLOYED-GREEN listen=VERIFIED and a COMPLETE scan: ONE process pid 23756 start_ticks 524780814 parent 25615 (nx_daemon_supervisor) digest_match 1, the old 82b7c766 pid 30282 gone. Files: nx_vault_gateway.elf = a437c5d5, .elf.prev = 82b7c766. Served: https://nishifamily.com/vault 200 text/html 1612 B, the same size as before, no-store; /vault/auth/whoami with no session 401 login required. The mgmt service rollup does not list the four gateways, so its OK is no evidence about them; the process and the edge are. Registration stays CLOSED by argv. Rollback recipe: re-stage the bank as nx_vault_gateway.sov.elf.new and POST /api/deploy target=vaultgw.
2026-09-28	R1	land	W16 DOORS-REST door gen_gateway :18794 SHIPPED AND VERIFIED -- the gateway that reads the PRODUCTION family login keys and account log (register closed by argv). NEW deploy_targets row gengw with src ABSOLUTE and BESIDE LIVE (/volume1/ai/gen/nx_gen_gateway_daemon.sov.elf.new) because hc_deploy_one looks only beside field 6 while /api/deploy validates field 2 (the debt 1790622301 hazard, avoided by making both name one file); live /volume1/ai/gen/nx_gen_gateway_daemon.elf; EXACT-BY-PATH, no field 7; rb gdeployrb@gengw; respawner nx_hostctl hc_guard_gen_gw. deploy_domain row gengw gen (the /gen surface board; genorch already maps there). Candidate: nx_sov_build_run nx_gen_gateway_daemon --build-only --release (job 1790631901) BUILD-CACHE MISS, compiled fresh, 3d1973f379dccea05e545b41222ab65308a1fffb4e22eea16328a169b54f891c 401667 B, byte-identical to the predecessor's candidate. Served abd5a081 540694 B had run since boot (pid 18001, start_ticks 11106, parent 1) with NO .prev. COMPLETE lost inventory (knowledge/gates/w16doorsrest_gen_contentdiff_export.txt, complete=1 runs=247 missing=3): only the three software-popcount code-byte fossils; the 132 gained (inverse export w16doorsrest_gen_gained_export.txt) are shared-runtime lines only (arena, seg-store honesty incl. SS-WRITE-SEG REFUSED, file-install lifecycle, bounds refusal, crash guard, a diacritic fold table) and no gen route string. BANK byte-identical: knowledge/bank/nx_gen_gateway_daemon.elf-live-abd5a081-predoors-20260928. No stale stage existed beside live (.new, .sov.elf.new and .prev all ABSENT before). Staged by nx_filecopy beside live (verified, mode 0755, re-hashed). POST /api/deploy target=gengw confirm=yes expect_sha256=3d1973f3 (job 1790632023) = PROMOTED, staged_artifact /volume1/ai/gen/nx_gen_gateway_daemon.sov.elf.new, pre_deploy_gate DEPLOY-SAFE, gate_blockers 0, gate_override none (scoped to gen). deploy_status DEPLOYED-GREEN listen=VERIFIED. VERIFIED by process identity: ONE process pid 1680 start_ticks 524800910 parent 11563 (hc_guard_gen_gw respawn) digest_match 1, complete scan, the boot-era pid 18001 gone. Files: live = 3d1973f3, .elf.prev = abd5a081 (its FIRST rollback slot). Served: https://nishifamily.com/gen 200 text/html 2676 B, the same size as before, no-store; /gen/auth/whoami with no session 401 login required. Rollback recipe: re-stage the bank as /volume1/ai/gen/nx_gen_gateway_daemon.sov.elf.new and POST /api/deploy target=gengw.
2026-09-28	CN2	land	W17 PUSH-DELIVERY fifth leg (resumed T0 1790630704; the fourth ship's gate re-built byte-identical 78c7782e and read 146/146 before any edit, so no half-applied batch was left): buildroot/runtime/nx_connect_push_ua_probe.nx 31708 B, NEW, the far end of the wire -- a push user agent that receives and opens what push_deliver sends. It composes, never copies: hf_open for TLS 1.3 (CSPRNG ephemerals, chrome then plain hello, chain validated by the trust store), nx_ws_client_build_request plus the push-notification subprotocol line, wscs_send and wscs_recv_headers for records, ws_build_header, ws_apply_mask and ws_parse_frame, the estate JSON DOM nx_value_parse_json for every server message, and cpush_subscribe, push_deliver, cpush_unsubscribe and wpush_decrypt from the push libs. Its own code is only what no incumbent had: a stream reader that keeps the bytes after a frame and answers pings (pua_ws_recv), UUIDv4 channel ids from the CSPRNG, and the message builders. The protocol is read from the service's own source [autopush-protocol] [autopush-notification] [autopush-endpoint] and its design page [mozpush-design], never recalled. Privacy by construction: keys and auth secrets live in memory only, the uaid and endpoints print as lengths only (they are capabilities), both channels unregister and both subscription records are removed by the owner verb before exit. Not rostered: its answer depends on a third party's network.
2026-09-28	CN2	measure	PUSH DELIVERED END TO END THROUGH A REAL PUSH SERVICE, measured twice with the same binary (b73e0879, the second run a build-cache hit; clocks 1790632099 and 1790632189): the probe opens Mozilla autopush's user-agent WebSocket, says hello, registers two channels restricted to one VAPID key (the service answers v2 endpoints bound to that key's sha256 [autopush-endpoint]), subscribes both through cpush_subscribe with user-agent keys and auth secrets it drew itself, and delivers through push_deliver [rfc8030]. BOTH RUNS IDENTICAL: a POST to channel B signed by a DIFFERENT VAPID key answered 401 and nothing ever arrived for B (VAPID-CHECKED); the POST to channel A signed by its registered key answered 201 (VAPID-ACCEPTED) [rfc8292]; the notification for A was already waiting on the socket when push_deliver returned (inside the 199 and 223 ms POST round trips), named aes128gcm, and its 176-character data decoded to a 132-octet body -- exactly the length push_deliver builds for the production conf, record size 4096; the reference receiver recovered exactly the 11 octets of the kind-1 words (DECRYPTED) [rfc8291] and refused the same body under another auth secret (WPUSH_ERR_TAG); both channels unregistered with status 200. Verdict 18/18 GREEN, the accept rule declared in the probe source before the first run. This PROVES the two claims row 1790622700 left open: a real push service validates and accepts our VAPID token, and our aes128gcm bytes cross it intact and open. STILL NOT PROVEN: that a browser's own decryptor opens them (our receiver is anchored to the RFC 8291 section 5 bytes by the gate, not to a browser) and that a phone shows the notice, which is the done-rule's device witness.
2026-09-28	R1	queue	W16 DOORS-REST door docportal_admin :18456 STILL BLOCKED ON ITS OWN DOMAIN -- NOT SHIPPED, NOT OVERRIDDEN, re-measured this run. knowledge/status/evidence_honesty.log still reads RED_DOMAINS= search webscraping finance videocodec softbody pmdash autodev ecosystem, and docportal's deploy_domain is search. The search stamp knowledge/status/evstamp_search.verdict (epoch 1790624822) reads ok=0 grounded=68/69 (ONE ungrounded matrix claim) gates=5/7 skipped=2 declared=7 hashed=6 (one declared gate binary was not hashed, so dig=ABSENT and the suite digest is undefined); all seven declared search gate elfs ARE promoted at the serving root by nx_catalog, so the unhashed one is a resolver question inside the evidence organ, not a missing file. redseen=1 is the bite-witness count (ev_bite_seen), not a red gate. The unblock belongs to the search lane: name the ungrounded row and the unhashed gate (nx_swcompare_evidence search prints both), fix, re-stamp, let nx_sota_status rewrite the log; then POST /api/deploy target=docportal confirm=yes expect_sha256=2dd4f896b79b931fca9cf68ebe467caa56ec006e8f47e3003164d5c1ae574995 scopes to search and ships with no override. READY FOR THAT MOMENT, verified now: the staged nx_docportal_admin_daemon.sov.elf.new is still 2dd4f896 1744544 B (debug flavour, create-only register, fail-closed lookup, retired clamp), the live is still e20601bc 1717472 B, both banks are in knowledge/bank (predoors). WHY NOT OVERRIDE: the RED is on the one domain whose surface this binary serves (/search and /doc beside admin.andelinwest.com, a client property), so an override would ship a search-serving binary while the search evidence cannot vouch for itself. RISK WHILE BLOCKED, stated plainly: the served docportal keeps the pre-fix register path, so a holder of a live invite can still re-register a taken handle there; the operator can authorise an audited override (confirm_gate_override=yes) for this one target if that exposure outweighs the evidence debt. INVITE BINDING (email and docportal): NOT a small change -- the invite store rows (nx_invite_token.nx: INV issued hash realm level expiry) carry no handle, so binding needs a row-format addition, the mint CLI, inv_check and both daemons plus their gates; left out of this rollout. With the create-only owner live on email, an invite can no longer take an EXISTING handle, only claim a free one. LATENT, named: nx_invite_token.nx keeps its own NX_INV_MAX_STORE_BYTES 16 MiB scan cap, the same class the account owner retired; a consumed row past the cap would be unseen (fail-OPEN for single-use), unmeasured risk today because the invite logs are small.
2026-09-28	CN2	measure	SAME-LENGTH ON THE LIVE WIRE, added before its first run and declared in the probe header: after kind 1, the probe delivers kind 2 to the same channel through push_deliver (201 in 161 ms); the notification arrives, its body is 132 octets -- exactly kind 1's, though the words are 14 octets against 11 -- and it opens to exactly the kind-2 words; neither forwarded body holds a plaintext word sequence. So Mozilla autopush, the party that sees every notice, sees two notices of one length and only ciphertext [rfc8291] [autopush-notification]. Probe 22/22 GREEN (qualify build a3601ec2, clock 1790632746). Discrimination of these two live teeth lives in the gate, not here: D31 and E4 prove the padding makes every kind one length in-process, and a live POST cannot plant an unpadded body without editing the policy lib.
2026-09-28	CN2	queue	REAL-BROWSER PROOF STILL UNVERIFIED, the reason re-measured this leg rather than inherited: nx_cdp_capture (82749 B) holds zero occurrences of grantPermissions and zero of ServiceWorker, so the CM13 driver can neither grant notification permission nor read a service worker's notifications; and no served secure origin hosts connect_sw.js yet (the /connect routes are wave-16 locked). The push-service half no longer waits on a browser: nx_connect_push_ua_probe proves it sovereignly (rows 1790632320 and 1790632780). OWED FOR THE BROWSER LEG, each for its owner: (1) the /connect daemon owner serves sw.js and manifest.webmanifest under the mount (row 1790622100); (2) the capture-driver owner (cms) adds one door that calls Browser.grantPermissions for notifications on the page origin and reads registration.getNotifications() through Runtime.evaluate after a delivery; (3) then the browser proof is: open the served mount in the headless oracle, subscribe from the page, deliver kind 1 through push_deliver, read the notice back. Firefox is the quickest browser referee because its push service is the one this probe measured.
2026-09-28	CN2	queue	DEFECT FILED FOR ANOTHER LANE, found reading an incumbent before composing it: debt 1790632360 sev 6 on runtime/_hdl_build/nx_ws_client_session.nx -- wscs_connect fills the TLS 1.3 client random and the key-share seed with consecutive bytes of a caller integer (256 possible private keys, an observer can enumerate them), and wscs_ws_recv keeps only binary frames and drops the bytes after the first frame of a record. Its importers are three never-built video probes, so no live exposure was measured; the remedy is one edit (draw both from nx_csprng_fill as hf_open does, or delegate to hf_open), and pua_ws_recv is the candidate reader to fold in. Not edited here: another lane's file.
2026-09-28	CN2	lesson	TWO LAWS FROM THE USER-AGENT PROBE. (1) A 2xx FROM A RECEIVER IS EVIDENCE ONLY BESIDE A REFUSAL THE SAME RECEIVER MUST ISSUE: without the wrong-key POST a 201 could come from a service that validates nothing; two channels bound to one key, one POST per key, made the 201 proof and the 401 its control in the same session, three runs out of three. (2) READ A SHARED HELPER'S KEY SOURCE BEFORE COMPOSING IT: the estate's WSS helper looked like the obvious client and derives its TLS key share from a caller integer, while the fetch lib's opener hf_open already drew both secrets from the CSPRNG; composing hf_open gave the WebSocket a sound session for free and the defect went to its owner as a debt row instead of into a second client.
2026-09-28	CN8	land	W16 SOTA-PQ-HYBRID third run (T0 1790630683; the second run was cut off after building T12 and before journaling it) SHIPPED T12, THE PAGE'S OWN TAG COMPARISON EXECUTED. The predecessor had written T12a to T12g into runtime/nx_connect_pqkx_vm_gate.nx and built it (banks knowledge/bank/nx_connect_pqkx_vm_gate.nx-cbdcf725-pre-t12-20260928 and .elf-791f8335-pre-t12-20260928, the elf bank verified identical to the served 791f8335 by nx_filehash cmp); this run corrected the header (it credited T12 with the helper-block check, which is T9a, and never described kxSame) and proved it. kxSame, cut from the shipped connect_e2e_pq page by brace count, runs in nx_js_eval over one designed case set counted natively first (equal; first, second and last byte differing; one byte short; either side absent; two bytes transposed so their XORs cancel) and agrees with native byte equality on all 8, while two mutants of the page's own function disagree exactly where each is wrong (d===0 widened to d>=0 on the 4 same-length differing pairs, d
2026-09-28	R1	land	W16 DOORS-REST THE GATEWAY DOOR PROOF THE HAND-OFF ASKED FOR NOW EXISTS, and it shows the takeover on the old binaries over the wire. NEW buildroot/runtime/_hdl_build/nx_opaque_gateway_door_gate.nx (29074 B): ONE gate over a profile table read from each gateway's own main (mesh and gallery: realm nishi_gallery, Nishi Gallery, backend argv; vault: nishi_gallery, Nishi Vault, no backend argv; gen: nishi_site_admin, Nishi Family), shaped on nx_opaque_login_door_gate. Per profile it writes a control row in-process, pads the fixture log past the retired 16 MiB clamp with genuine owner rows (16777540 B before the owner, 16778232 B after), writes the LATE owner, then forks the gateway under test on a free port with allow_register=1 (production runs 0, so the create-only OWNER answers the takeover over the wire) and drives login page, control login, late-owner login, token, whoami, a forged token (neg-control), a takeover register of the owner's handle, the owner still logging in, the takeover passphrase (neg-control), a FREE handle registering and logging in (the positive control that proves the register route is alive), and an unknown handle (neg-control); 24 teeth per door plus gv_kv values. GREEN 96/96 on all four build artifacts (qualify job 1790632854), and each artifact is BYTE-IDENTICAL to the served binary (nx_filehash cmp: mesh cd5932e0, gallery 2ee44bd1, vault a437c5d5, gen 3d1973f3). RED 18/25 on EACH banked pre-change binary run as a scratch copy named so it cannot read as the served daemon (jobs 1790632912 mesh 36dd9289, 1790632936 vault 82b7c766, 1790632958 gen abd5a081, 1790632979 gallery 51dc3b18), and red for the right reason every time: the early control logs in (200), the late owner answers 401, and THE TAKEOVER REGISTER OF A TAKEN HANDLE ANSWERS 200 -- the old binary handed the owner's handle to a second registrant -- while a freshly registered handle cannot log in (its row lands past the clamp). SHIPPED by nx_organ_ship (job 1790633030): prove GREEN 96/96, promoted d26d9ca3ca330ead40a87d24cc9623325df9d000a1f46964cf3fe23561738ce2, _offc twin installed, registered callable. SERVED /api/gate_run target=nx_opaque_gateway_door_gate (job 1790633086) from the serving root: GREEN 96/96 exit 0 FAST, capture untruncated. knowledge/organ_gate.conf now maps nx_mesh_gateway, nx_gallery_gateway, nx_vault_gateway and nx_gen_gateway_daemon to it. Scratch RED subjects: knowledge/bank/w16doorgw-<profile>-old-<sha8>-scratchsubject (copies of the predoors banks, mode 0755). Side effects named in the gate header: each scratch instance binds 0.0.0.0 on a port from 18300 for seconds; the gen profile's main read the production entitlement store and printed OWNER-BOOTSTRAP already has the /gen entitlement (no write); fixture files are unlinked per profile. Census status: debt 1790372837 named seven doors with no existence predicate -- six now carry the owner fix and are proven at the door (studio, mesh, gen, vault, gallery by this gate or the owner gate; email by the owner gate); docportal is the seventh and is blocked (row 1790632480). Debts 1790372520 and 1790372837 stay OPEN until docportal ships.
2026-09-28	FRONTDOOR	land	W17 FRONTDOOR-FINISH SIXTH BATCH LANDED in the shared tree: service_match (CN17) and faith_rank (CN15) WIRED behind the ONE door, each a PURE decision over a situation built for the call and dropped with it, neither listing a population. New decision-core lib runtime/_hdl_build/nx_connect_frontdoor6.nx 16070 B: cfd6_service posts ONE need on a board built from knowledge/connect_service.conf (the need in cell 0, a one-byte placeholder place, no coordinate input) and judges ONE described helper through csh_need_match in the board's own order (live, member, not self, consent, visibility through the poster's ring and the ONE discovery owner, the coarse cell band, the two-deep wall for a one-to-one need, then ev_rsvp with the youth rule and capacity last); the adults already on the need are the circle table's co-founders offering first through the same contract symbol. cfd6_faith is cfa_rank_visible in its DECISION form: which of TWO described candidates the viewer is shown first and whether each is shown (who is shown is ast_may_discover on the search path, faith only orders, a hidden candidate is told what a stranger is told). Grammar: service_match kind p_age p_ring cap youth h_age cells_apart consent guardian shared adults_on [p_yb h_yb]; faith_rank v_minor v_trad v_sub v_imp then trad sub state minor shared vouched guardian blocked for a and for b then [a_base b_base]. The faith_rank request (row 1790615101) asked for the ordered list; per the door rule a ranking is answered in its pairwise decision form, and the request's four teeth are all carried. LANDED: nx_connect_api_lib.nx 143713 to 154984 B in ONE write-file under CAS h2459e97295d46b1e (job 1790633029), from a scratch twin proven first; gate nx_connect_api_gate.nx 108275 to 130099 B under CAS h684208da14620b44 (job 1790633048). ca_faith_name gained withdrawn and ca_csh_name gained the service board's own refusals (two_deep, youth_closed, minor_organizer, no_need, not_offered, table_bad), additive. CATALOG PARTITION before rows 42 = wired 20 + not_yet_wired 22 + not_yet_landed 0; after rows 43 = wired 22 + not_yet_wired 21 + not_yet_landed 0. PROOFS: RED-on-old -- the new gate against the pre-batch lib reads 60/66 RED with exactly T59-T64 failing and faith_oracle_agree 0 of 432 (job 1790632829); GREEN 66/66 on the landed tree (job 1790633072, debug build 870936 B sha 07f3ca9d); T64 is a 432-case oracle (a's faith, history and block by b's faith, history, minority and base) recomputing shown, score and first through ast_may_discover, cfa_signal and cfa_rank with the first decided by brute force, 432 of 432 agree; nx_gate_bite over frontdoor6 through the scratch gate BEFORE the lib imported it (job 1790632911) killed a compiling comparison mutant at off 11492, restore verified byte-identical 16070 B; nx_sov_build_run nx_connect_api --build-only BUILT 650152 B sha 499966aa (job 1790633053). WATCH: the gate's own output is about 13.9 KB against the 16384 B FAST capture of /api/gate_run, so the next batch's teeth go in a sibling gate. NEXT: ship nx_connect_api (noregister) and the gate, live-check both verbs from the nishihost root.
2026-09-28	FRONTDOOR	land	W17 FRONTDOOR-FINISH SIXTH BATCH SHIPPED (service_match CN17, faith_rank CN15). nx_connect_api by nx_organ_ship noregister (job 1790633200): prove 66/66 on a gate rebuilt because its closure bank drifted, content GREEN with no lost run, behave help IDENTICAL, promoted 499966aa 650152 B (was f627cd16), _offc twin installed. PRE-EXISTING VERBS PROVEN UNCHANGED against the pinned rollback slot (nx_connect_api.elf.prev verified f627cd16 615416 B by nx_filehash before the probe): nx_behaveprobe prev IDENTICAL STRONG on faith_admit (292 B), play_check (483 B), date_admit (372 B), circle_channel adult with own minor (433 B), room_check (460 B), match (62 B), antistalk_discover (368 B), juris_rules (492 B) -- jobs 1790633297 to 1790633337. GATE SHIPPED by nx_organ_ship (job 1790633284): prove 66/66, content GREEN, behave DIFFERS as expected for new teeth, promoted 07f3ca9d 870936 B, _offc twin installed, already registered; SERVED /api/gate_run FAST GREEN exit 0, 13276 of 16384 B, capture_truncated 0 (job 1790633470). THE ALPHA COMPILES on the landed lib: a byte copy of the current nx_connect_appd.nx as runtime/_hdl_build/nx_connect_appd_w17check.nx (never run) built 1176335 B sha 05f0a5d6 (job 1790633138). LIVE from the nishihost root through /api/organ_run nx_connect: service_match need 1 ward 1 0 1 0 1 0 ward 0 answers matched, filled 1, capacity 1, board_reach_cells 1 (job 1790633410); service_match need 0 ward ... (a minor's need, an unrelated adult helper in the vouched ward) answers walled -6 (job 1790633417); faith_rank with a shared church against no faith answers listed 2, first a, a_score 100, b_score 0 (job 1790633413); faith_rank with the same-church candidate a minor and the viewer an unrelated adult answers a_shown 0, a_told 0, first b (job 1790633419). The alpha serves both verbs at its next rebuild by wave 16 (nx_connect_alpha_api_gate E2 and nx_connect_alpha_signup_gate S4c compare counts dynamically; no gate asserts a fixed partition). Shipped, gate 66/66, awaiting acceptance.
2026-09-28	CN2	measure	FRONTDOOR-FINISH ON push_vapid_key (the PUSH-DELIVERY row 1790625463 calls it a pure read, ready now): it is NOT a pure read. runtime/nx_connect_push.nx cpush_vapid_public(path, out) calls cpush_vapid_key, which reads the 32-byte server key at path and, when it is absent, MINTS a new P-256 key pair and writes it with O_EXCL mode 0600 (lines 536-567). The door runs with the nishihost root as its CWD on the MCP surface and with the alpha's own CWD on the mount, so a relative key path read through the door either mints a second server key in the wrong directory or reads a private key the door has no custody of -- the row stays not_yet_wired with its key-custody reason. RECIPE for the push owner (the door wires it the same hour it lands): a read-only sibling cpush_vapid_public_ro(path, out) that returns a named refusal (no key) instead of minting, with the key path declared as a row of knowledge/connect_push.conf resolved on the root ladder the other push rows use; gate teeth: an existing key reads its base64url public point, an absent key is refused by name and NO file is created (stat before and after), and the door's reply carries the public point only.
2026-09-28	R1	land	W16 DOORS-REST the /studio door joined the gateway door gate as a fifth profile (realm nishi_studio, page /studio, verbs /studio/login /studio/register /studio/whoami, argv port keys store budget m t p allow_register, context armed with olg_ctx_setup exactly as its main does) -- studio is the door whose production registration is OPEN, so it needed the over-the-wire proof most. GREEN 120/120 over all five build artifacts (qualify job 1790633428; studio artifact bf84eb55 byte-identical to the served studio/nx_studio_gate.elf by nx_filehash cmp). RED 18/25 on the banked pre-change studio c0acb66d (job 1790633517), for the same reason as the four gateways: late owner 401, takeover register of the taken handle 200. RE-SHIPPED by nx_organ_ship (job 1790633926): content ruler lost exactly one run, the old unknown-profile message, superseded by the one naming studio (loss record knowledge/status/harness/loss-5e91c65c0fe7510cf1054a61b4bd213a0ac8b6192d9cb334526d6b46745ab860.record, allow_loss_v1 bound to both hashes); behaviour DIFFERS as intended and was approved by a review file bound to the retained observation 80f5f626 (knowledge/status/harness/w16doorsrest-gwgate-studio-behavior-review.txt, sha 6f32d205, evidence w16doorsrest-gwgate-studio-review-evidence.txt sha de857346); promoted e1005628713466138650dde0a361e625d6d2ae84235323355d24eb3efb10b3d4, _offc twin installed. SERVED /api/gate_run (job 1790634002) GREEN 120/120 exit 0 FAST, capture untruncated. organ_gate.conf maps nx_studio_gate to it as well (five rows). Scratch RED subject knowledge/bank/w16doorgw-studio-old-c0acb66d-scratchsubject.
2026-09-28	CN20	queue	W16 SOTA-PQ-HYBRID REQUEST to the daemon-source lease holder (nx_connect_serve.nx and nx_connect_appd.nx were NOT edited by this seat): the additive kx=3 ratchet fields, composing runtime/nx_connect_pqratchet.nx (29430 B sha256 491feda6) and never a second format. (1) POST /connect/pubkey: kx=3 advertises the ratchet, accepted only when kxr_q_ok(kx, q, qn) == 1 (one ML-KEM-768 key at version 3, the first turn's encapsulation key) under the same owner rule as cs_sh_pub_put2; GET /connect/pubkeys returns kx 3 additively. (2) POST /connect/seal: optional kx=3 with e and n and pn (decimal counters, e at least 1), dh (kxr_dh_ok, one X25519 key in hex), kc (kxp_kc_ok, one ML-KEM-768 ciphertext in hex), q (the sender's fresh encapsulation key, the length kxr_q_ok checks) and tg (kxp_tg_ok); refuse a partial ratchet header; store all of them with the message and return them additively on GET /connect/sealed. (3) Defense in depth: refuse a seal without the ratchet header when BOTH from and to advertise kx=3 (kxr_accept(1,1,0,0) == KXP_REFUSE_DOWNGRADE), as the page will. Bodies grow by about 4.7 KB per message (kc 2176 and q 2368 hex, dh 64, tg 32, three counters); the appd request buffer is 262144 B, so no cap moves. Proof owed with the change: an alpha gate tooth that publishes kx=3, seals with a full ratchet header, reads every field back from /sealed and refuses each malformed field and the stripped header between two ratchet-advertising members.
2026-09-28	CN20	queue	W16 SOTA-PQ-HYBRID, THE PAGE LEG OF CN20 for the next seat on this rung (nothing below is built yet; the lib is the source of truth). (1) nx_connect_pqratchet grows a second emitter, the ratchet state machine as JavaScript (krInitAlice, krInitBob, krTurnSend, krRatchet for kx_pq_ratchet, krSend, krRecv, krOpen with the commit-on-verified-tag copy), a state object with the kxr_st_* fields kept per peer in localStorage as hex, fresh randomness from crypto.getRandomValues in the kxr_rnd_* layout, over the helpers kxr_emit_js already emits. (2) nx_connect_e2e_client gains a pqr verb writing /synth/connect_e2e_pqr from ce_emit_html_pq plus both ratchet blocks, with the router opt-out, saying on screen that the ratchet is not live until the directory carries kx=3. (3) nx_connect_pqratchet_vm_gate gains page teeth: the page carries both emitted blocks byte for byte (the CN8 gate's T9a pattern), the page's own krAccept, krSendMode and krSkipOk run in nx_js_eval lifted from the page instead of the emitter, and a REAL-BROWSER self-test because nx_js_eval cannot call wasm: the page opened with ?selftest=1 plays this gate's scripted conversation (init, four turns, out of order, late previous-turn delivery, replay, tamper, epoch rewrite, window edge) on its own modules and writes one line per step into a pre element that nx_cdp_capture reads, and the gate compares those lines with its own native run, so the page's state machine is executed, not merely present. CN20's done-rule is met on the shipped MODULES today; the page leg is what makes the proof cover the page's own code.
2026-09-28	CN20	queue	W16 SOTA-PQ-HYBRID REQUEST for the FRONTDOOR owner (nx_connect_api_lib and nx_connect_api, not edited here): one PURE verb kr_policy over nx_connect_pqratchet -- kr_policy <self_adv> <peer_adv> <pinned> <has_hdr> answers kxr_accept, kr_policy send <peer_adv> <pinned> answers kxr_send_mode, kr_policy window <nr> <held> <n> answers kxr_skip_ok; nothing stored, no key material in or out. Teeth to carry: both-advertise without the header refused, a pinned peer refused after the directory strips kx=3, a legacy peer falls to the kx=2 rule (positive control), the window edge admitted and one past it refused. With it a CN20 treat row can name mcp=nx_connect and api=/api/organ_run?target=nx_connect&args=kr_policy; until then CN20 declares no treat row, by rule.
2026-09-28	CN20	queue	KXR_MAX_SKIP 32 is a THRESHOLD compiled into nx_connect_pqratchet (the skip window and the capacity of the held-key table): its conf row, knowledge/connect_ratchet.conf with the Signal Double Ratchet section 3.5 guidance and a measured localStorage budget per conversation as its calibration, is owed before the page leg ships, since the page's window must be the lib's.
2026-09-28	R1	land	W16 DOORS-REST THE INVITE STORE'S OWN 16 MiB SCAN CLAMP IS RETIRED AND THE EMAIL DOOR CARRIES IT -- the latent defect named in row 1790632480, fixed rather than filed. MEASURED: nx_invite_token.nx inv_check read the whole file (sys_read_file) and then scanned only its first 16 MiB (NX_INV_MAX_STORE_BYTES), latest row wins, so a CONSUMED row past the clamp was unseen and a single-use invite answered as live (fail-OPEN); the constant and its one use were the only references in buildroot/runtime (nx_shelltool grep, coverage_complete=1 corpus_complete=1). GATE FIRST: nx_invite_token_gate migrated onto nx_gate_verdict (per-tooth gv_check_eq, values, exit carries the verdict; it hand-rolled a pass counter and had never been promoted) and gained T7 -- issued row at the head (113 B), store padded past the clamp with genuine issued rows (16777223 B before the consume), then the consume (row lands at 16777318 B), fixture teeth assert the placement first, positive control that the head token is live before its consume. RED 19/20 on the clamped lib (qualify job 1790634172: T7 after-consume level 2, expected 0), then the lib fix (the use first, the constant retired to a dated comment second, so no intermediate state failed to compile), GREEN 20/20 (job 1790634266: after-consume level 0). BANKS: knowledge/bank/nx_invite_token.nx-pre-w16invitecap-20260928 (15008 B) and nx_invite_token_gate.nx-h9ccfbbe3-pre-w16invitecap-20260928 (5642 B). SHIPPED nx_invite_token_gate by nx_organ_ship (job 1790634285): prove GREEN 20/20, first promote baee866334ebe6c5d2949e1910db10a79b1fa6cb62e0d45250a449c6e328f587, _offc twin, registered. EMAIL DOOR REDEPLOYED with it (its second deploy today, so the pre-change live a7fc6374 was banked FIRST as knowledge/bank/nx_email_portal_daemon.elf-live-a7fc6374-preinvitecap-20260928, byte-identical): candidate bcd08b8a470a46f453cda4f6fe2fd3a9fdd377c01b3269aebb591628d16ab878 480072 B (debug flavour, job 1790634295), content ruler vs a7fc6374 IDENTICAL-CONTENT 1165 of 1165 runs, 0 lost 0 gained (the 64-byte delta is the removed clamp); POST /api/deploy target=email expect_sha256=bcd08b8a (job 1790634448) = PROMOTED, DEPLOY-SAFE, 0 blockers, no override (scoped to comms); deploy_status DEPLOYED-GREEN listen=VERIFIED; ONE process pid 21135 start_ticks 525044270 parent 11563 digest_match 1 (complete scan), old pid 18444 gone; files live bcd08b8a, .prev a7fc6374 (8cf6ae68 left the rollback slot and stays banked as nx_email_portal_daemon.elf-live-8cf6ae68-predoors-20260928); https://mail.andelinwest.com/ 200 text/html 5422 B before and after; health OK 16 services 0 down. The docportal candidate is being rebuilt with the same fix (it is still blocked on search evidence).
2026-09-28	CN2	land	VAPID KEY CUSTODY SHIPPED, the precondition the front door's push_vapid_key row waits on (nx_connect_frontdoor4 CFD4_VAPID_PENDING: a stateless door must never be the minter of a server secret). runtime/nx_connect_push.nx 44913 to 49274 B adds cpush_vapid_read and cpush_vapid_public_read (READ-ONLY: an absent key is CPUSH_ERR_NOKEY -29, rule vapid-key-absent-or-unreadable, status 503, and nothing is created) and cpush_vapid_mint (the one mint for the push lane owner: a CSPRNG scalar written 0600 with O_EXCL into a directory it creates 0700; any key already in place is CPUSH_ERR_EXISTS -30, rule vapid-key-already-minted, status 409, left byte-identical, because every live subscription is bound to the applicationServerKey its browser was given); CPUSH_ERR_LAST now bounds the refusal table, and nx_connect_push_gate enumerates to it with zero added output lines (146/146, refusal codes 27 distinct, promoted f76431c8, capture 15008 of 16384 B). NEW runtime/nx_connect_push_key_gate.nx 9969 B: 21/21 GREEN in the build lane and through /api/gate_run on the promoted binary a462583f, registered, rostered, connect.gates row; planted defect (a read that mints) RED 18/21 on exactly K1 K2 K3b, restored, and the push gate rebuilt to the identical f76431c8, which proves the restore byte-exact. NEW runtime/nx_connect_push_vapid.nx 3646 B (mint and public verbs, promoted b6943e53, registered, offc twin installed). PRODUCTION KEY MINTED through /api/organ_run by the push lane owner: public before the mint answered REFUSED vapid-key-absent-or-unreadable status 503 and left knowledge/keys absent; mint answered MINTED (32 octets, 0600, directory 0700, the scalar never printed) with applicationServerKey BMt-9p9mkoxSnHBoQdjz8EOTaTg6LMmVidSbaJcWqrz4itl2lN8X_D37vygEKCHIJTB6qysKOfmpc4tfgHisv9M (public by design); a second mint answered REFUSED vapid-key-already-minted status 409; the key gate then read production_key_present 1, mode 384 (0600), 32 octets. No subscription existed yet, so no rotation was possible.
2026-09-28	CN2	queue	VERB REQUEST FOR FRONTDOOR-FINISH (addendum to rows 1790622060 and 1790624350; it answers nx_connect_frontdoor4 CFD4_VAPID_PENDING): push_vapid_key is UNBLOCKED and is a pure read with no caller identity, so it can be wired today. Engine: cpush_vapid_public_read(path: u8, out: u8) -> i64 in runtime/nx_connect_push.nx, READ-ONLY (it never creates a key; do NOT call cpush_vapid_public, which mints on first use). path knowledge/keys/connect_vapid.key (now minted, 0600, off every served root); out sized wpush_b64u_cap(65) = 89 octets. Returns 87 (the applicationServerKey length) or CPUSH_ERR_NOKEY -29 or CPUSH_ERR_IO -25; answer 200 with the 87 characters, else cpush_http_status(rc) with cpush_refusal_name(rc) as the body (503 vapid-key-absent-or-unreadable, 500 subscription-store-io). The row's pending reason can then be retired. Gate teeth for nx_connect_api_gate: push_vapid_key answers 87 characters decoding to a 65-octet point that passes wpush_point_ok and equals the production key's public point; neg-control, pointed at an absent key file the verb answers 503 vapid-key-absent-or-unreadable and creates no file. push_subscribe and push_unsubscribe still wait on ca_dispatch carrying the session account (row 1790622060).
2026-09-28	CN2	queue	INTEGRATION SPEC AMENDED for the /connect daemon owner (row 1790622100 step d): the message-path worker reads the signing key with cpush_vapid_read(knowledge/keys/connect_vapid.key, priv_out, pub_out), READ-ONLY, never cpush_vapid_key, which would mint a second key if the file were ever missing and silently orphan every subscription bound to the first. On CPUSH_ERR_NOKEY the worker delivers nothing and logs the rule; the push lane owner, never a request path, mints (nx_connect_push_vapid mint, which refuses when a key exists).
2026-09-28	CN2	lesson	A PLANTED DEFECT GRADES THE TEETH, NOT JUST THE CODE. The first plant (a read that mints) turned the custody gate RED on K1 and K2 by return code, but K3, the no-mint tooth, still PASSED: the mint-on-read failed only because the fixture key's directory did not exist, so no file could be written, and the tooth was right for the wrong reason. K3a and K3b now read inside a directory that EXISTS with no key, the one place a minting read could write, and the second plant fails there (RED 18/21, K3b included). A GREEN earned under a condition the defect cannot exploit proves nothing about that defect.
2026-09-28	R1	queue	W16 DOORS-REST docportal_admin :18456 STILL BLOCKED (RED_DOMAINS still carries search at 1790634690), but its STAGED CANDIDATE NOW CARRIES BOTH FIXES and supersedes row 1790632480's hash: nx_docportal_admin_daemon.sov.elf.new = f8be3c96e1025ee24c3362b98bcf4203a32ca335dc8ba5a4f3531c7cc5424dbc 1744488 B (debug flavour, job 1790634524): create-only owner, fail-closed lookup, retired account clamp AND the retired invite-store clamp. Content ruler vs the previous stage 2dd4f896: IDENTICAL-CONTENT 2274 of 2274 runs (job 1790634556), the 56-byte delta is the removed invite clamp. nx_docportal_admin_daemon_gate --qualify on the current tree (job 1790634561) GREEN 20/20, incl. R1 invite register, R2 garbage invite 403, R3 single-use replay 403. The previous stage is banked as knowledge/bank/nx_docportal_admin_daemon.sov.elf.new-2dd4f896-staged-w16-20260928; the live e20601bc and its .prev 335f08ac stay banked (predoors); no stale nx_docportal_admin_daemon.elf.new exists (so /api/deploy validates the same file hostctl promotes). WHEN search clears: POST /api/deploy target=docportal confirm=yes expect_sha256=f8be3c96e1025ee24c3362b98bcf4203a32ca335dc8ba5a4f3531c7cc5424dbc, then nx_proc_observe nx_docportal_admin_daemon.elf digest_match and the edge (admin.andelinwest.com, nishifamily.com /search). NOT a gateway-gate profile: docportal's register is invite-gated through dad_handle, and its own gate already drives that path in-process.
2026-09-28	CN2	measure	THE PRODUCTION KEY WORKS AT A REAL PUSH SERVICE: nx_connect_push_ua_probe gained an optional key-file argument (channel A registered with that key's public point, push_deliver signing with its scalar read through the READ-ONLY cpush_vapid_read, never minted, never printed; channel B still signed by a key drawn in memory). Shipped /api/build 051ac8cc (src_path names the probe, closure 4b25bd3c) then /api/promote expect_sha256 PROMOTED 639536 B, offc twin installed. LIVE through /api/organ_run target=nx_connect_push_ua_probe args knowledge/connect_push.conf - knowledge/keys/connect_vapid.key (clock 1790634659): exit 0, 22/22 GREEN, vapid_key_from_custody_file 1, Mozilla autopush answered 201 to the POST signed by the production key and 401 to the wrong-key control, kind 1 and kind 2 both arrived at 132 octets and opened to their own words, both channels unregistered. The same verdict came from the qualify build (clock 1790634538). So the key the front door will serve as applicationServerKey is proven end to end against a push service before any member subscribes with it. Five live runs this leg (1790632099, 1790632189, 1790632473, 1790632746 and 1790632883 with in-memory keys, then 1790634538 and 1790634659 with the production key), every one GREEN with identical statuses.
2026-09-28	CN2	retract	Correction to row 1790634680, which says Five live runs and then lists seven: the leg made SEVEN live runs of nx_connect_push_ua_probe against Mozilla autopush, five with VAPID keys drawn in memory (clocks 1790632099, 1790632189, 1790632473, 1790632746, 1790632883) and two with the production key (1790634538, 1790634659), every one GREEN with the same 401 and 201 statuses. Every other figure in that row stands.
2026-09-28	R1	lesson	W16 DOORS-REST, four laws from this leg. (1) A PREDECESSOR'S UNJOURNALED DEPLOY IS VERIFIED FROM THE SERVED BYTES AND THE PROCESS, NEVER INHERITED: the gallery gateway was live on the candidate with no row naming it, and only nx_filehash of the live path plus nx_proc_observe (one pid, digest_match, parent the exact-kill hostctl) turned 'someone probably deployed it' into a fact; its receipt is still unknown and is reported as unknown. (2) FOR AN OFF-ROOT DAEMON THE DEPLOY ROW'S src MUST BE THE ABSOLUTE PATH BESIDE LIVE: hc_deploy_one looks only for <live>.new and <live-base>.sov.elf.new next to field 6 while /api/deploy validates field 2, so gengw names /volume1/ai/gen/nx_gen_gateway_daemon.sov.elf.new and both halves read one file (debt 1790622301 remains for the rows that do not). (3) A DEPLOY_DOMAIN ROW IS WRITTEN FROM THE BOARD THAT OWNS THE SURFACE, AND WITH ONE THE GATE SCOPES INSTEAD OF INVITING AN OVERRIDE: meshgw workermesh, vaultgw and galxgw mediaingest, gengw gen each shipped DEPLOY-SAFE with no override, while studio (no owning board) still falls to GLOBAL scope. (4) AN IN-PROCESS OWNER GATE PROVES THE OWNER; ONLY A WIRE GATE ON THE SERVED BINARY PROVES THE DOOR -- and the wire gate showed the takeover live on all five pre-change binaries (a second register of a taken handle answered 200). Honest limit of that RED: its fixture pads past 16 MiB, so it shows the missing existence check and the clamp together; the small-store production exposure (P2 logs in, P1 fails) is the one debt 1790372520 already documents, and the GREEN side is the owner gate plus these wire teeth. Also: the invite store carried the same clamp class as the account owner, found by reading the reader the doors call, not by a census.
2026-09-28	ALPHA	land	W16 SEAT ALPHA-SIGNUP-DOOR (T0 1790630638): THE PRIVATE SIGN-UP DOOR IS LIVE ON THE ALPHA, on both register paths. STAGE RUNNING: https://nishifamily.com/alpha/connect/ runs build bdeb97bc (1176861 B, sha256 bdeb97bc3d7bfc9820e6ee078b757920e74e0532ad894b76c3a9b182154590a8, nx_sov_build_run nx_connect_appd --build-only --release job 1790634013; nothing promoted, the serving-root twin held) as pid 20441 start_ticks 525039228 parent 25615 (nx_daemon_supervisor), nx_proc_observe digest_match 1; copied mode 0755 to alpha_connect/nx_connect_appd-bdeb97bc.elf and banked knowledge/bank/nx_connect_appd.elf-alpha-bdeb97bc-20260928 (nx_filecopy verified 1); daemons.reg row connect_alpha repointed under content CAS (ha98b435320160e76, then hc8bdd168ecfce2f9), nx_reg_sign SIGNED (jobs 1790633668 and 1790634372); exact stops of pid 31967 exe bf1534cd (job 1790633686) and pid 24818 exe 05f0a5d6 (job 1790634394), stop_confirmed 1 each. The intermediate build 05f0a5d6 (1176335 B) is banked knowledge/bank/nx_connect_appd.elf-alpha-05f0a5d6-20260928; the replaced bf1534cd was already banked (cmp identical 1); daemons.reg banked knowledge/bank/daemons.reg-pre-alpha-05f0a5d6-20260928. WHAT THE DOOR DOES (nx_connect_appd.nx 101230 to 116620 B, wiring the predecessor's helpers): a staged instance arms the door at start (csu_policy_default over knowledge/connect_signup.conf, csu_state_new, jur_conf_load), announced ARMED or REFUSED by name, and an unarmed door refuses every sign-up signup_policy_unreadable; POST <mount>/device/signup/challenge issues a single-use CSPRNG challenge (the nonce as decimal text, the lib's own work tag, bits, ttl); /device/register/respond runs csu_signup_check_web BEFORE the OPRF answers, so osw_register_store_bound can never create an account the door did not admit, and keeps the band with the pending step; /device/register/store commits (csu_signup_commit) and writes the S1 record under the realm-scoped user-id hash the session later names; POST /register (the form fallback) runs the same decision through cd_su_form_refused before olg_register and commits after it; production (staged 0) never enters any of it. Every device route counts against a door-wide budget per window before any work: knowledge/connect_device.conf 1341 to 3186 B gained device_rate_window_s 3600 and six route rows, each DERIVED from the pending table (768 per window, params 1536), 429 rate_limited with retry_after_s, and any missing row keeps the device path and the door OFF. The account page renders the S1 record (csu_record_census, then csu_record_num for band and consent) with every purpose OFF from the lib's one list. /try/study and /try/needs now carry study_post's seven and service_match's eleven arguments (FRONTDOOR wired both, so the old rows would have rendered a placeholder field). DEVICE ASSETS: source home buildroot/sites/connect_assets/device/ (connect_device_opaque.js 15409 B sha256 dfa0d09d, connect_device_opaque.wasm 210492 B sha256 5af5f9c0 the OPAQUE-LIB module, MANIFEST carrying the release step); the script solves the door's hashcash with the platform SHA-256 on both forms, carries the age screen and place, shows the door's own sentence on a refusal and names OCL_BAD_SERVER_MESSAGE -8; both copied into alpha_connect/ (verified 1; the replaced module 931c3d7b banked knowledge/bank/connect_device_opaque.wasm-alpha-931c3d7b-pre-w16door-20260928).
2026-09-28	CN2	queue	VERB REQUEST FOR FRONTDOOR-FINISH, the reply shape of push_vapid_key (read before wiring it): ca_dispatch answers every verb in its versioned JSON envelope (ca_open2: v, tool, verb, verb_v, then the verb's fields), so the push client now reads the key from the envelope field application_server_key (87 base64url characters, exactly what cpush_vapid_public_read writes) when ok is 1, and still accepts a bare 87-character body; push_subscribe and push_unsubscribe count as success only when the HTTP status is 200 AND the envelope's ok is 1, so a refusal should carry ok 0 and rule = cpush_refusal_name(rc) with the status from cpush_http_status. Please ship exactly that field name, or say so on this board and the one constant NX_PUSH_KEY_FIELD changes. The client was fixed this leg (buildroot/sites/connect_assets/push/connect_push_client.js 3643 to 4669 B): the earlier version base64url-decoded the whole reply body, so the first envelope it met would have thrown inside atob and every opt-in would have failed on a real phone with no visible reason; it now also checks the key against the 87-character base64url shape before handing it to pushManager.subscribe.
2026-09-28	CN2	land	WORKFLOW PLANE SEEDED for the push lane: knowledge/store/plan-connect-push- (3 rows through nx_store_put, PUT 1-3 replaced=0) runs nx_connect_push_gate, nx_connect_push_key_gate and nx_connect_push_vapid public knowledge/keys/connect_vapid.key -- all read-only, none contacting a third party (the live autopush probe is kept out of any ritual so no future clock row can make it one). nx_plan_run connect-push (job 1790635030) refused managed-owned-definition-required, execution NOT_STARTED, the same state W16 measured for connect-onboard and youthsafety-audit (row 1790614121). Binding it needs an Accountable for a connect-push activity in the RACI cell store and then nx_pm_owned_define (recipe row 1790460735), which belongs to the PM and RACI owners. Treatment state of CN2 after this leg: primitive nx_connect_push present, workflow plane manifest present, agent present (gateroster rows nx_connect_push_gate and nx_connect_push_key_gate), api follows the mcp verb; the one missing surface is the front-door verb push_vapid_key, so no treat row is declared, by rule.
2026-09-28	CN13	queue	VERB REQUEST FOR FRONTDOOR-FINISH (wave 17 owns nx_connect_api_lib; this seat edited none of it): nx_connect_signup is STABLE after W16 ALPHA-SIGNUP-DOOR (46340 B; its web door csu_signup_check_web, csu_door_tail, csu_signup_commit, the verdict vocabulary csu_code_slug and csu_code_text, csu_purpose_name, csu_record_num, csu_today_ymd are live on the alpha bdeb97bc), so the catalog row signup_admit can leave not_yet_wired. The PURE part is the legal door: csu_juris_admit over a request whose band, youngest age of the band, self-declared place (ISO 3166-1 alpha-2, optionally -subdivision), day asked (csu_today_ymd of the caller's clock) and verified guardian method rank the caller states, over knowledge/connect_jurisdictions.conf loaded with jur_conf_load -- nothing stored, no challenge spent, the answer is csu_code_slug and csu_code_text plus the rule the table drew. Suggested grammar: signup_legal <band> <age_lo> <place or -> <guardian_rank or -1>. Teeth to carry: an AU declarant of 13 answers jurisdiction_barred, a US declarant under 13 without a guardian rank answers parental_consent_required, a minor with no place answers country_required, neg-control an AU declarant of 16 is allowed, neg-control an adult with no place is allowed and never judged. The door's stateful half (challenge, work, window) stays with the daemon that owns the door; consent changes (csu_consent_set) are own-account and wait for the identity-carrying entry point the FRONTDOOR hand-off row 1790625380 names.
2026-09-28	CN2	land	KEY CUSTODY MOVED INTO THE DELIVERY WORKER: runtime/nx_connect_push.nx 49274 to 51137 B. The detached double fork now has ONE home, cpush_spawn, and two thin entry points: push_deliver_account_async (unchanged contract, caller-held key; the push gate's D66-D70 still pass on it) and the new push_notify_account(store_i, conf_path, root, account, kind, now, key_path, receipt), whose grandchild reads the VAPID key itself through the READ-ONLY cpush_vapid_read, so the serving daemon never holds the private scalar and a missing key yields a receipt naming CPUSH_ERR_NOKEY -- never a mint. nx_connect_push_key_gate 26/26 GREEN (K19-K23: a fixture device subscribed under the production conf; the worker's receipt equals the synchronous tally byte for byte, tried 1 and transport 1 with no trust store so nothing leaves the box; with the key path absent inside an existing directory the worker delivers to nobody, its receipt equals the NOKEY receipt byte for byte, and no key appears); planted defect (the worker minting through cpush_vapid_key) RED 24/26 on exactly K22 and K23, restored, and the re-qualify was a build-cache HIT on the green key 9dbc44e1, which proves the restore byte-exact. SHIPPED: nx_connect_push_key_gate 431c1092 (586000 B) and nx_connect_push_gate 78c2aff1 (146/146, capture 15007 of 16384 B) through /api/build with src_path checked, /api/promote expect_sha256, /api/gate_run GREEN on both promoted binaries, offc twins installed; nx_connect_push_vapid rebuilt 9ee65c70 and promoted; the probe rebuilt byte-identical to the live 051ac8cc, so nothing to promote.
2026-09-28	CN2	queue	INTEGRATION SPEC SIMPLIFIED for the /connect daemon owner (supersedes step d of rows 1790622100 and 1790634542): after a message is stored for a recipient account, the message path makes ONE call and returns to its request at once -- push_notify_account(store_i, knowledge/connect_push.conf, <subscription root>, recipient_account, kind, now, knowledge/keys/connect_vapid.key, 0) with kind 1 for a message, 2 for an invitation and 3 for a circle event, and store_i from hf_store_load once per daemon. The worker reads the key read-only, lists the recipient's live devices and delivers the content-free notice; the daemon holds no key material, never mints, and the TLS sessions and the incumbents' never-unmapped buffers die with the worker. A NOKEY receipt means the push lane owner has not minted (nx_connect_push_vapid mint); nothing else can create the key.
2026-09-28	ALPHA	measure	W16 ALPHA-SIGNUP-DOOR, THE PROOF ON BUILD bdeb97bc (sha256 bdeb97bc3d7bfc9820e6ee078b757920e74e0532ad894b76c3a9b182154590a8, 1176861 B, live as pid 20441 under nx_daemon_supervisor, nx_proc_observe digest_match 1). RED BEFORE GREEN on every new tooth: the extended nx_connect_alpha_signup_gate read 13/19 RED on the pre-door alpha bf1534cd (job 1790632680) failing exactly D1 to D6, then 19/19 on 05f0a5d6 (job 1790633722) and on bdeb97bc (job 1790634449); the extended nx_connect_alpha_device_gate read 34/39 RED on bf1534cd (job 1790633109) failing exactly DD1 DD2 DD3 N1b T3b, 38/39 RED on the intermediate 05f0a5d6 (job 1790634009) failing exactly T3, the /try/needs placeholder form its rewritten tooth exists to catch once FRONTDOOR wired service_match, then 39/39 on bdeb97bc (job 1790634444). FINAL on bdeb97bc: sign-up gate 23/23 (qualify job 1790635681) and device gate 42/42 (qualify job 1790635685); both PROMOTED through /api/promote with expect_sha256 (sign-up 695236aa 662584 B job 1790635845, device 3b346c56 771224 B job 1790635847), their lost runs enumerated first (sign-up 3: the old header and the two pw form literals the new fixtures spell differently; device: the old T3 and T3b tooth names and one fixture-reached wording), offc twins installed (jobs 1790635974 and 1790635977), and the PROMOTED binaries run through nx_job_run read 23/23 and 42/42 again. The sign-up gate carries D1 a minor with no country refused country_required, D2 a scripted sign-up with no challenge refused challenge_unknown, D3 a short counter refused work_insufficient, D4 a replayed challenge refused challenge_spent before the handle is asked about, D5 a takeover refused handle_taken by the door, D6 every consent purpose OFF after sign-up (9 off, 0 on), D7 AU 13 to 15 refused jurisdiction_barred, D8 US under 13 refused parental_consent_required, neg-control D9 AU 16 clears, D10 the minor's account shows the under-18 lanes of the two-deep wall; the device gate carries DD1 no challenge refused 403 at respond with no OPRF answer, DD2 the store step's sign-up record with every purpose OFF, DD3 a minor with no country refused 403 at respond, N1b the taken handle refused AT RESPOND, N5 and N5b the fake-record KE2 for a free handle, V1 and V1b no POST body carried the passphrase or its SHA-256. Also on bdeb97bc: nx_connect_alpha_api_gate 32/32 (job 1790634462) and nx_connect_prod_register_gate 31/31 in production mode on a scratch instance (job 1790636508, SUBJECT the same bdeb97bc bytes; 31/31 on 05f0a5d6 at job 1790633389); nx_connect_auth_gate 12/12 (job 1790633391), nx_connect_mount_gate 20/20 (job 1790633396), nx_opaque_client_gate 175/175. OVER THE EDGE IN A REAL BROWSER (the laptop's Edge through the cdp capture organ, a fresh profile per journey): CM13 w16signup_adult (device path, age 18) reached /alpha/connect/account reading Your sign-up record with the purpose rows, OK; w16signup_minor (age 13, no country) stayed on /register reading Under 18, sign-up needs the country or region you live in, OK; w16signup_form (the form fallback, the device script solving the work into the two hidden fields) landed on Welcome to Connect with Save your recovery phrase now, OK. CM6 nx_page_pixjudge on /register and /register/form at phone 390x844 dsf 2 and desktop 1440x900: four verdicts OK, contrast_fails 0, overlap_pairs 0, hierarchy_violations 0, worst ratio 5.33 on phone and 4.71 on desktop, one unmeasured h1 on each capture. nx_page_verify GREEN on both pages (a11y-issues 0, opaque.js 200 15409 B). Hashcash cost: about 4 to 5 s at 17 bits on the laptop's headless Edge; the promoted gates read 19 bits after the window's admissions.
2026-09-28	ALPHA	lesson	W16 ALPHA-SIGNUP-DOOR, three laws. (1) A TOOTH THAT ASSERTS A PAGE SAYS NOT BEHIND THE DOOR YET GOES RED THE DAY A SIBLING WIRES THE VERB, AND THAT RED IS THE INSTRUMENT WORKING: FRONTDOOR wired study_post and service_match mid-leg, the alpha's /try rows still carried the unwired verb's placeholder field, and T3 caught it on the intermediate build 05f0a5d6; the remedy was data (each row now names the verb's real argument labels, 7 and 11) plus a tooth demanding one labelled field per argument and no placeholder, so the next wiring moves the tooth to GREEN instead of RED. (2) THE DOOR DECIDES BEFORE THE OPRF ANSWERS: csu_signup_check_web runs at /device/register/respond, not at store, so a refused request never receives an OPRF evaluation, a pending slot or a server message (DD1, DD3 and N1b each assert the absence), which is what makes osw_register_store_bound unable to create an account the door did not admit; a check at store would have handed a refused caller the server's OPRF output first. (3) A BEHAVIOUR PROBE THAT REQUIRES LIVE AND STAGED TO BOTH EXIT CLEAN CANNOT SHIP A GATE WHOSE OLD VERSION IS CORRECTLY RED AGAINST THE NEW SUBJECT: nx_organ_ship refused both extended gates for that reason, and the lane was the enumerated lost runs, /api/promote with expect_sha256, then the PROMOTED binary run again through nx_job_run (23/23 and 42/42), never a waiver.
2026-09-28	ALPHA	queue	W16 ALPHA-SIGNUP-DOOR, WHAT IS OPEN (debt 1790636396 supersedes 1790621989, eaten with DEBT-EATEN read from job 1790636413). (a) The form fallback is no longer zero-JS for sign-up: the door needs the page's script to solve the work into the two hidden fields, and the page says so in a noscript sentence (With scripts off this form cannot finish ... Sign-in works with scripts off); a no-script sign-up path (an invite or guardian code, or a server-timed puzzle) is owed and is a product decision for the connect owner. (b) Guardian consent at sign-up is not wired: fam_guardian_consent in nx_connect_family needs an existing linked member, so PARENTAL_CONSENT refuses by name (parental_consent_required) instead of holding a pending account for a guardian to approve. (c) The age band is self-declared (CSU_ATT_SELF); nx_connect_idage is a stand-in demonstrator, so no attested claim source exists yet. (d) OPAQUE-LIB device recovery is not composed into the daemon (two pending kinds, each needing TTL, slot bound and wipe), and the daemon has not adopted the arena recipe (about 34 KB of arena per KE2, 180 KB per ServerFinish; hmac mappings debt 1790456748). (e) The 429 branch of the device-route budgets is proven by construction only; owed a scratch-instance gate with a small budget that reads 429 rate_limited with retry_after_s (running it against the live alpha would lock a route for the window). (f) Hashcash on phones is unmeasured (laptop headless Edge about 4 to 5 s at 17 bits; 19 bits after the window's admissions). (g) UNDER_MIN is not exercised live. (h) Production /connect keeps the door and the device block dark by construction (staged 0 never enters them): CONNECT-SHIP-2 carries it through the release lane; this seat shipped nothing to production and did not touch the staged cb3b5c3d. (i) The signup_legal verb request for FRONTDOOR-FINISH is row 1790635700.
2026-09-28	CN20	lesson	A PASSIVE-THIEF GATE CANNOT SEE AN ACTIVE HEADER ATTACK. The first cut's message tag covered epoch, n and dh only, so pn, the ML-KEM ciphertext kc and the next-turn ML-KEM key q rode outside it, and every healing tooth stayed GREEN because every thief in the gate only read state. Planted back into the lib (tag over epoch and n only), a new-turn header whose q was swapped for another valid key was ACCEPTED (T7g actual 0, want E_TAG -6), a rewritten pn was accepted (T7h), and the receiver committed both, changing 12160 state bytes (T7i): an active attacker would have been handed the receiver's next KEM secret, the one thing the ML-KEM half exists to deny. Fixed before any page carried it: tag = SHA3-256(label, k_tag, the WHOLE 2328-byte header, body)[0..16) in the lib (kxr_in_mac, kxr_mac, kxr_open), in the gate's copy on the shipped modules (rg_mac), and in the emitted krTag, which now also refuses a header of the wrong length (KRL.hb). Restore verified by hash (lib 1f45b31e, 29584 B, byte-identical to the pre-plant copy). For every header field, write the active-rewrite tooth beside the passive-theft tooth.
2026-09-28	CN20	measure	nx_connect_pqratchet_vm_gate after the whole-header tag: 70/70 GREEN on the three modules the shipped CN8 page embeds (on_shipped_modules=1, agree_steps=18, agree_differing_bytes=0, agree_verdict_mismatches=0) with vm_elapsed_ms=430713 at load1 3.73, against 356790 for the 66-tooth first cut (its load was not recorded); the whole-header tag makes the interpreting VM hash about 16 more SHA3-256 blocks per tag, the likely share of that rise, UNMEASURED. Native mode 69/70 (T1e only, by design). RED 67/70 on the X25519-only page, which embeds no ML-KEM module (T1c T1d T1e). Planted first-cut tag RED 65/70 (T1e T7g T7h T7i T7j). tag_body_max_bytes=1776, was 4056: the tag now reads 16+32+2328 bytes of the 4152-byte tag region the kx=2 page lays out, so one ratchet frame carries at most 1776 bytes of body, refused past that and never truncated. header_bytes=2328 state_bytes=7656 emitted_js_bytes=1427 (was 1459).
2026-09-28	R1	land	W16 DOORS-REST THE GATEWAY DOOR GATE v3 IS SHIPPED AND RE-RUN ON THE NAS, AND ITS NEW SMALL-STORE PHASE SHOWS THE OLD REGISTER WAS NEVER CREATE-ONLY ON ANY STORE. Each of the five profiles (mesh gallery vault gen studio) now opens with a phase on a store INSIDE the retired 16 MiB clamp: a control and an early owner written in-process, the gateway under test started on that store, then owner login 200, a second register of the taken handle 400 with no mnemonic, the owner still logs in 200, and the takeover passphrase refused 401; the padded-store phase of row 1790633120 follows unchanged. Against the five banked pre-change binaries (knowledge/bank/w16doorgw-DOOR-old-SHA-scratchsubject) every profile read passed 23/34 verdict=RED (studio job 1790635484, mesh 1790635543, gen 1790635571, vault 1790635600, gallery 1790635628): the four small-store teeth fail beside the seven padded-store teeth, so the production takeover needed no large log at all -- the old register accepted a second register of a taken handle, issued it a mnemonic, locked the owner out and let the takeover passphrase in on a store of two rows. nx_organ_ship job 1790636043 SHIPPED c8391d5c (318488 B; loss approval 681ba34b names the one lost run, the old port= diagnostic line; behavior review 7d6ee686 over the retained observation, evidence 66a3ff1f in knowledge/status/harness), offc twin installed, already registered; the served gate before it was e1005628 (120/120). /api/gate_run (job 1790636275, promoted to the job lane by its deadline) read passed 165/165 verdict=GREEN against the default build artifacts, which this run measured byte-identical to the served gateways. Shipped, gate GREEN, awaiting acceptance.
2026-09-28	CN20	queue	THE PER-TURN DIGEST, to win back the frame body bound and the gate's VM time without giving back whole-header authentication: tag over (label, k_tag, epoch, n, pn, dh, D, body) where D = SHA3-256(kc, q) is computed once per turn by the sender and once on the new-turn receive and kept in the ratchet state beside the kept kc and q, and a same-turn header is refused unless its kc and q equal the kept ones byte for byte. Per-message tag work drops from about 18 SHA3 blocks to about 2 and the body bound returns to about 4040 bytes. Recipe: state layout + kxr_turn_send + kxr_recv + kxr_mac in the lib, the same in the gate's copy (rg_*), krTag in the emitted JS, then T7g T7h T7i re-run plus a same-turn kc or q rewrite tooth (must refuse) and the planted first-cut tag (must go RED). Until it lands the gate runs about 431 s at load 3.7, over the 420000 ms compare-referee bound (the referee abstains DEADLINE-UNMEASURED on this row) and at 96 percent of the heavy roster's 450000 ms share.
2026-09-28	R1	queue	W16 DOORS-REST docportal_admin :18456 STILL NOT SHIPPED AND NOT OVERRIDDEN -- THE BLOCKER MOVED FROM search TO loadgov. search left RED_DOMAINS after the one-row path correction on search.matrix (search.plan row 1790635560): knowledge/status/evidence_honesty.log, rewritten by nx_sota_status this run, reads RED_DOMAINS= webscraping finance videocodec softbody synthroom autodev ecosystem pmdash loadgov. The rewrite also showed the log had been STALE: the clock plane that runs evidencebeat executes nothing since about 2026-09-23 (debt 1790620957 sev 8), so loadgov's RED had been invisible to the pre-deploy gate. loadgov is shared fate (knowledge/registry/deploy_sharedfate.conf: deploy loadgov toolchain supervisor), so its RED refuses EVERY health-checked deploy, docportal included. nx_swcompare_evidence loadgov (job 1790636104) verdict=RED failing_conjunct=quorum, 6 of 7 gates GREEN; /api/gate_run nx_clock_reregister_gate (job 1790636322) passed 30/35 -- T13 T13b T13c T13d T14, every tooth that forks the public clock writer, fail at the seal check before any child runs, because the gate pins the reviewed writer digest 400ab16e while the served nx_clockjob.elf is aa68b408 (311000 B, equal to its build artifact; .prev is f570e1f4 106149 B), so the pin names no artifact on disk; the same gate's argecho pin 7c49db77 matches its served file and those teeth pass. Filed for the clock lane as debt 1790636764 sev 7 (re-review the current writer and re-pin, or restore the reviewed one; never widen the seal). The staged candidate nx_docportal_admin_daemon.sov.elf.new f8be3c96 (1744488 B, create-only register plus fail-closed lookup plus the invite-store scan fix) re-hashed unchanged this run; the moment loadgov leaves RED_DOMAINS the release is POST /api/deploy target=docportal confirm=yes expect_sha256=f8be3c96e1025ee24c3362b98bcf4203a32ca335dc8ba5a4f3531c7cc5424dbc, then nx_proc_observe digest_match and the door's own gate. Debts 1790372520 and 1790372837 stay OPEN until docportal ships.
2026-09-28	ALPHA	land	FINAL W16 ALPHA-SIGNUP-DOOR (seat T0 1790630638): the alpha https://nishifamily.com/alpha/connect/ runs build bdeb97bc (sha256 bdeb97bc3d7bfc9820e6ee078b757920e74e0532ad894b76c3a9b182154590a8, 1176861 B, nx_sov_build_run nx_connect_appd --build-only --release job 1790634013, serving-root twin held, nothing promoted), re-observed at this row as pid 20441 start_ticks 525039228 parent 25615 (nx_daemon_supervisor), digest_match 1, from the signed daemons.reg row connect_alpha (./nx_connect_appd-bdeb97bc.elf 18133 /alpha/connect alpha). SOURCES AT THIS ROW: runtime/_hdl_build/nx_connect_appd.nx 116620 B sha256 57edfb7623294e51ece7637dc83d538c2698c4e3fbbff693a06070f4b4f71e0d (the door wiring, the device-route budgets and the /try rows are this seat's edits), nx_connect_serve.nx 141624 B sha256 54aed8ae2452bed2c394fad7e1a4e7ead1862680bc3cca896dc5d844181a970b and nx_connect_ui.nx 33585 B sha256 ddd7c780f758bcf67fe890845c8fa60ed590b92530072c63228d21803b3c2c39 (not edited by this seat), nx_connect_signup.nx 46340 B sha256 851984f946d9ff04bb192c6ab4f3604dd512229e1c03ddaf49a2161944aa2166 (the predecessor's door lib, not edited); knowledge/connect_device.conf 3186 B; device assets in buildroot/sites/connect_assets/device/. GATES ON bdeb97bc: nx_connect_alpha_signup_gate 23/23 (promoted 695236aa), nx_connect_alpha_device_gate 42/42 (promoted 3b346c56), nx_connect_alpha_api_gate 32/32, nx_connect_prod_register_gate 31/31 (production mode unchanged), nx_connect_auth_gate 12/12, nx_connect_mount_gate 20/20, nx_opaque_client_gate 175/175; real-browser CM13 journeys OK x3 and CM6 pixel referee OK x4 (row 1790636600). Banks: knowledge/bank/nx_connect_appd.elf-alpha-bdeb97bc-20260928, nx_connect_appd.elf-alpha-05f0a5d6-20260928, daemons.reg-pre-alpha-05f0a5d6-20260928, connect_device_opaque.wasm-alpha-931c3d7b-pre-w16door-20260928 and the two gate sources pre-w16door. Open items: row 1790636702 and debt 1790636396. STAGE STATE: alpha RUNNING on bdeb97bc; production /connect untouched. THE EDIT LEASE on nx_connect_appd.nx, nx_connect_serve.nx and nx_connect_ui.nx passes to SOTA-SEALED-MESSAGING at this row, and CONNECT-SHIP-2 may start.
2026-09-28	R1	lesson	W16 DOORS-REST, three laws from the close of this leg. (1) A PRE-DEPLOY GATE IS ONLY AS CURRENT AS THE BEAT THAT FEEDS IT: evidence_honesty.log moves only when the evidence beat runs, the clock plane runs nothing (debt 1790620957), so loadgov was RED and blocked nothing until this seat re-ran nx_sota_status to clear its own domain and unmasked a shared-fate RED that now blocks every seat. Read the age of the producer before reading unblocked, and expect a refresh to surface REDs that were there all along. (2) THE REFUSAL NAMED THE WRONG DOMAIN: nx_deploy_ready check for docportal prints scope domain:search beside DEPLOY-BLOCKED while search is green and loadgov fired, because dr_sharedfate_red returns only a bit -- filed for the deploy lane as debt 1790637059 with an additive remedy. (3) A GATE THAT PINS A REVIEWED DIGEST TURNS EVERY UNREVIEWED REBUILD OF ITS SUBJECT RED BY DESIGN, and one hash separates a broken seal from a stale pin: the same gate's second pin (argecho 7c49db77) still matched its file and its teeth passed, so only the writer pin was stale. The remedy is a review, never a re-pin made to turn the gate green, and a seat whose own deploy waits on that gate is the wrong seat to re-pin it. Also carried from the gate v3 row: test the smallest store as well as the largest -- the takeover the padded store was built to expose happened on a store of two rows.
2026-09-28	CN20	queue	THE ACTIVE-REWRITE AUDIT the CN20 lesson owes the rest of the board, UNAUDITED by this seat and so not a claim that anything is missing: for every header or envelope field each E2E protocol gate authenticates (nx_connect_seal_gate, nx_connect_franking_gate, nx_sealed_sender_gate, nx_mls_group_gate, nx_msg_sync_gate, nx_connect_pqkx_vm_gate), name the tooth that rewrites that one field in transit and asserts a refusal with no state change, and plant the tag or signature that skips the field to prove the tooth can fail. A gate whose adversaries only read state proves forward secrecy and healing and says nothing about what an active attacker can substitute; CN20's first cut passed 66 of 66 teeth with q, pn and kc outside its tag.
2026-09-28	CN2	land	FIRST-USE STORE ROOT FIXED (found by reviewing the path the daemon owner will run, not by a user): cpush_subscribe now creates the subscription store root 0700 before the account directory, one sys_mkdir whose EEXIST is the common case, so the first opt-in on a fresh production store no longer answers a 500 because nobody hand-made that directory. The key gate grew K24 (the fresh root is absent before the subscribe, the condition reached first), K25 (the record FILE is read back, the state and not the return code) and K26 (root mode 0700): qualify 29/29 GREEN, RED 27/29 on a planted removal of that one mkdir failing exactly K25 and K26, restore proven byte-exact by a build-cache HIT on the pristine key 1e0914f8 (sha 6fed4bc1). Shipped by /api/build + /api/promote with expect_sha256, src_path checked on each: nx_connect_push_key_gate 6fed4bc1, nx_connect_push_gate 80510874 (146/146 on the new lib, qualified before its promote), nx_connect_push_vapid 0036a2a5, nx_connect_push_ua_probe 2888f875 (the banked prior stage was the live 051ac8cc, no sibling work); nx_offc_install on all four; /api/gate_run on the promoted binaries: key gate 29/29 GREEN (3479 of 16384 B), push gate 146/146 GREEN (15100 of 16384 B, capture_truncated 0). gateroster.conf and connect.gates rows restated with the new counts and shas.
2026-09-28	CN2	measure	FRONTDOOR-FINISH HAS CONSUMED THE PUSH CONTRACT in its _hdl_build sources (nx_absent over buildroot/runtime, corpus_complete=1: 9 files import nx_connect_push.nx, 4 of them theirs): push_vapid_key is WIRED in _hdl_build/nx_connect_api_lib.nx and emits application_server_key, the exact field connect_push_client.js reads, and their gate drives cpush_vapid_public_read, the refusal table and one mint in-process (T72); push_subscribe and push_unsubscribe stay not_yet_wired under CFD4_PUSH_PENDING (the subscriber is the signed-in account and ca_dispatch carries no caller identity, so both wait for the alpha daemon, which matches this lane's integration spec). Their next build picks up today's store-root fix through the same import; no file of theirs was edited.
2026-09-28	CN2	queue	DECLARED, NOT FORGOTTEN: nx_connect_push_probe (the first live POST probe) stays BUILT-UNPROMOTED on purpose -- a hand measurement against a third party's network, never rostered, whose live gone-to-tombstone leg the UA probe does not repeat; its _build fossil predates today's lib edit, so run it with --qualify when the measurement is wanted. The four CN2 organs read REGISTERED-UNAUTHORISED (S4) in nx_catalog because no cap names them yet: minting one is the push lane owner's call, not a seat's.
2026-09-28	CN2	lesson	A STORE'S FIRST USE IS ITS OWN CODE PATH. Every tooth ran against a fixture tree its setup made, so the one directory production would lack was the one directory no tooth ever lacked, and 146 plus 26 green teeth said nothing about it. Walking the integration as its owner will run it (fresh root, first opt-in) found it in minutes; K24 asserts the root is absent BEFORE the subscribe so the tooth cannot pass on a leftover, and K25 reads the record back instead of trusting the return code.
2026-09-28	FRONTDOOR	land	W17 FRONTDOOR-FINISH SEVENTH AND EIGHTH BATCH SHIPPED: activity_plan over nx_connect_activity cav_plan_event (row tag ACTIVITY) and push_vapid_key (CN2) over nx_connect_push cpush_vapid_public_read, the READ-ONLY reader of row 1790634541. activity_plan is a pure decision over participants the caller describes as zone:band, no member data read. push_vapid_key takes no argument, reads only the fixed path knowledge/keys/connect_vapid.key relative to the door's working directory and never mints; it answers ok 1, status 200 and application_server_key (87 base64url characters), or ok 0 with error = cpush_refusal_name, status = cpush_http_status and detail. A mount runs in its instance directory, which holds no key, so the alpha answers 503 vapid-key-absent-or-unreadable and never reads production's secret. LANDED under CAS: nx_connect_api_lib.nx 154984 to 162354 B (hb6e96d691c08d621, job 1790636274), nx_connect_api_gate.nx 130099 to 146869 B (h6a83bfb6a7ec31b4, job 1790636292), nx_connect_api.nx 972 to 1858 B (the CLI reply buffer is now derived from its inputs, the fixed 64 KiB reply plus twice each argument plus the echo separators, where it was an unchecked 64 KiB). NEW runtime/_hdl_build/nx_connect_frontdoor7.nx 10102 B. CATALOG PARTITION before rows 43 = wired 22 + not_yet_wired 21 + not_yet_landed 0; after rows 44 = wired 24 + not_yet_wired 20 + not_yet_landed 0. PROOFS: RED on the pre-batch lib 66/70 with T65-T68 failing (job 1790634685); nx_gate_bite over frontdoor7 through the scratch gate before the lib imported it killed a compiling comparison mutant, restore byte-identical 10102 B (job 1790634858); T67 is a 98-case oracle over seven declared zones (half and quarter hours included) and both bands recounting the fitting starts from the published rule, 98 of 98 agree; the push teeth bite: a planted refusal swallow (ok 1 and status 200 on the refusal branch) read 72/74 with exactly T70 and T71 failing (job 1790636112), restore byte-exact a493d2f8; T16 learned zero-arity verbs (a wired row that takes no argument must reach its engine and never answer usage). SHIPPED nx_connect_api by nx_organ_ship noregister (job 1790636492): prove 74/74, content GREEN with no lost run, behave help IDENTICAL, promoted 6655290c 718992 B (was 499966aa 650152 B; the growth is the push lane's closure), _offc twin installed; .prev verified 499966aa by nx_filehash, then nx_behaveprobe prev IDENTICAL STRONG on faith_rank (669 B), service_match (431 B), match (62 B), room_check (460 B) and juris_rules (492 B), jobs 1790636619 to 1790636803. GATE by nx_organ_ship (job 1790637189) with allow_loss_v1 d296bb14 (the two lost runs are the T54 needle and label that named push_vapid_key not_yet_wired, superseded because the row is wired) and a behaviour review bound to observation 9d40bac1 (knowledge/status/harness/w17frontdoor-apigate-b78-behavior-review.txt sha a25b1549, evidence w17frontdoor-apigate-b78-review-evidence.txt sha bcff3239): promoted 08abcb1d, _offc twin, registered. SERVED /api/gate_run FAST GREEN 74/74 exit 0, 14718 of 16384 B, capture_truncated 0, vapid_key_readable_here 1, so under the served root T71 compared the door with the production key (job 1790637562). THE ALPHA COMPILES on the landed lib: nx_connect_appd_w17check, a byte copy of the current 116620 B nx_connect_appd.nx that is never run, built 1206537 B (job 1790636369). LIVE through /api/organ_run nx_connect from the nishihost root: push_vapid_key answered ok 1 status 200 application_server_key BMt-9p9mkoxSnHBoQdjz8EOTaTg6LMmVidSbaJcWqrz4itl2lN8X_D37vygEKCHIJTB6qysKOfmpc4tfgHisv9M, the production key row 1790634540 published (job 1790636740); activity_plan 1 5 worldwide with an SLC adult and SLC, London and Johannesburg youth answered planned, round_utc_min 840 900 960 1020 1080, overlap_starts 17 (job 1790636745). REPLY SHAPE for the push client (row 1790635230): the key field is application_server_key exactly as asked, so NX_PUSH_KEY_FIELD stands; the refusal's rule name travels in the door's structured-error field error, beside status and detail, not in a field named rule. WATCH: the gate prints 14718 of the 16384 B FAST capture. Shipped, gate 74/74, awaiting acceptance.
2026-09-28	CN20	measure	Heavy-roster trial of the promoted nx_connect_pqratchet_vm_gate (sha a25c9259): TIMEOUT exit=137 at ms=450018 against the 450000 ms per-gate share at nice 10 (journal /tmp/cn20_pqr_heavy_trial.jrnl), killed after T2e, about three quarters of the way through; NOT admitted, so no beat runs this gate yet (it runs at ship, on gate_run and on demand). The same bytes ran 70/70 in 430713 ms at nice 0 an hour earlier, and the 66-tooth first cut ran 356790 ms, so even the first cut fit the kill bound only at nice 0.
2026-09-28	CN20	queue	SPLIT THE VM WORK SO A BEAT CAN RUN IT: the gate's VM path can take over from a native-produced state at any turn, because both paths hold byte-identical states wherever agreement holds. Two roster gates, one with the VM on from init through turn 2 and one native to turn 2 then VM on for turns 3 and 4 and the healing, each carry about half the VM ML-KEM operations and X25519 multiplications; each needs a tooth that the handover state equals the native state and an agree_steps that counts only VM-executed steps. With the per-turn digest (1790636662) each half should land near 200 s, inside the 420000 ms referee bound and the 450000 ms heavy share at nice 10 -- an ESTIMATE from the CN8 gate's rate (7 ML-KEM operations and 5 scalar multiplications in about 171 s), UNMEASURED. Then trial and admit both through nx_gate_roster_run.
2026-09-28	CN20	land	nx_connect_pqratchet_vm_gate SHIPPED by nx_organ_ship: built through /api/build (sha a25c9259fcda16fd, 1707816 B), PROVE 70/70 GREEN on this run's fresh build, promoted with live sha equal to staged sha, the _offc twin installed and hashed equal to live, REGISTERED callable=1, harness token h6ae6485635fc0ae4. The lib buildroot/runtime/nx_connect_pqratchet.nx (sha256 1f45b31e, 29584 B) declares kx_pq_ratchet, so the scoped regen published /compare/connect with the cell measured present (lib-gate-only, importers=1): index.html 1509004 B, nx_page_verify GREEN 200 with 0 a11y issues. connect.gates carries the CN20 row and the matrix CN20 note carries the header-auth fix and the 1776-byte body bound. NOT LIVE: no page carries the ratchet (queue 1790634201), the directory does not carry the kx=3 fields (1790634200, nx_connect_serve.nx belongs to ALPHA-SIGNUP), and there is no kr_policy verb (1790634202). Heavy roster NOT admitted (TIMEOUT, 1790637700). Shipped, referee GREEN, awaiting operator acceptance.
2026-09-28	CN2	land	NEG-CONTROL FOR THE STORE-ROOT FIX: the key gate's K27 subscribes into a root whose PARENT is absent and asserts CPUSH_ERR_IO with nothing created, so the fix stays one level (a mistyped root never grows a tree) and a failed write can never read as a landed record: qualify 30/30 GREEN, RED 29/30 on a planted swallowed write failure that returned the endpoint length (61) for a record that never landed, failing exactly K27; restore proven byte-exact by a build-cache HIT on the pristine key 1dcdc77d (sha 6dc92311). /api/build + /api/promote expect_sha256 6dc92311, nx_offc_install, /api/gate_run on the promoted binary 30/30 GREEN (3721 of 16384 B, capture_truncated 0). The lib bytes are the ones the push gate 80510874, vapid 0036a2a5 and ua probe 2888f875 were promoted from (51276 B, restored twice by self-adjudicating replaces). gateroster.conf and connect.gates restated (a sibling edit of connect.gates landed between my reads and the content CAS carried the retry).
2026-09-28	CN2	queue	DAEMON WIRING ADDENDUM for the nx_connect_appd edit-lease holder (SOTA-SEALED-MESSAGING since row 1790636840; this seat edits no wave-16 file): the store root no longer needs a hand-made directory -- pick one whose parent exists (for example knowledge/connect_push_subs) and the first subscribe creates it 0700. Owed on the daemon, all of it through functions that already exist and are gate-proven: serve <mount>sw.js from buildroot/sites/connect_assets/push/connect_sw.js as text/javascript (its scope is the mount, so no Service-Worker-Allowed header), serve connect.webmanifest as application/manifest+json and link it from the page head, serve connect_push_client.js; render a Notify-me-on-this-device control that calls connectPushOptIn() only on tap and an opt-out that calls connectPushOptOut(); answer POST <mount>api/v1/push_subscribe (fields device and a) with cpush_subscribe(conf, clen, root, the SESSION account, device, a, alen, now) and push_unsubscribe (field device) with cpush_unsubscribe(root, account, device, now), refusals as cpush_http_status and cpush_refusal_name; on each new message or event call push_notify_account(0, knowledge/connect_push.conf, root, recipient account, kind, now, knowledge/keys/connect_vapid.key, receipt) and never wait on it -- the daemon never holds the VAPID scalar. push_vapid_key is already wired by FRONTDOOR-FINISH (row 1790637411).
2026-09-28	CN2	queue	OPEN AT THIS SEAT'S CLOSE (shipped, gates 146/146 and 30/30 GREEN on the promoted binaries, awaiting acceptance; CN2 stays OPEN): (1) cl_mobile_shell in runtime/nx_connect_client.nx is not built and its real-device witness is owed -- once the daemon addendum above is served on the alpha mount, the operator on a real iPhone (iOS 16.4 or later) opens https://nishifamily.com/alpha/connect/ in Safari, Share then Add to Home Screen, opens Connect FROM THE HOME SCREEN ICON, signs in, taps Notify me on this device and allows notifications; closes the app, has a second account send a message, and confirms a notification arrives reading one vocabulary sentence and naming no sender or circle; taps it and lands in Connect; then opts out and confirms nothing further arrives; the same on an Android phone in Chrome without the Home Screen step; (2) the daemon wiring above (lease holder); (3) push_subscribe and push_unsubscribe front-door rows stay not_yet_wired under CFD4_PUSH_PENDING until the daemon carries the caller identity; (4) manifest icons (192 and 512 px PNG plus an apple-touch-icon) are a design-lane item and read incomplete until referee and operator accept them; (5) the real-browser proof stays UNVERIFIED: nx_cdp_capture has no Browser.grantPermissions and no ServiceWorker domain, and the served routes are wave-16 locked; (6) the plan plane plan-connect-push- is seeded but refused managed-owned-definition-required until nx_pm_owned_define binds it with a RACI Accountable; (7) no treat row is declared, because the api surface (a served push_vapid_key) and the workflow binding are not both present; (8) debt 1790632360 (the video lane wscs_connect key space) stays with its owner; (9) the operator ACCEPT row in knowledge/store/accept- is the third signature this rung still lacks.
2026-09-28	CN13	land	THE 429 BRANCH IS MEASURED, NOT PROVEN BY CONSTRUCTION (closes item (8) of debt 1790636396, a new gate file; none of the leased daemon sources was touched after row 1790636840). NEW runtime/_hdl_build/nx_connect_alpha_rate_gate.nx (25535 B sha256 6af3... superseded by the window edit, see below): it forks the daemon ELF named by argv[1] with the STAGED arguments (port, /alpha/connect, alpha) in a fresh /tmp directory holding its own knowledge/connect_device.conf, whose route budgets and window the run chooses from its clock, plus placeholder device assets so the device path turns ON; the staged instance binds 127.0.0.1 and is killed and reaped on every path. On the alpha's own binary bdeb97bc it read 16/16 GREEN in the build lane (job 1790637707: budget 4, window 15 s, four params 200 then 429 rate_limited ok 0 retry_after_s 15, the challenge route 503 from its own handler, after 16 s params 200 ok 1); on the banked pre-budget alpha bf1534cd it read 11/16 RED (job 1790637743) failing exactly R2 R3 R4 R6 R6b with every fixture tooth PASS (params answered 200 at budget plus one, no retry_after_s). FIRST SHIP 54305c99 (64908 B, release flavour) then run through /api/organ_run: killed at the 12000 ms organ_run deadline mid-wait (job 1790637898, verdict TIMEOUT-OR-SIGNAL, 783 B prefix), and nx_proc_observe then saw ONE process of that binary, the alpha pid 20441, so no scratch child was orphaned. FIX: the window span is now 3 to 5 s so the whole run ends inside that deadline (source 25535 B); rebuilt 16/16 on bdeb97bc (job 1790637995: budget 2, window 3, retry 3, waited 4) and 11/16 RED on bf1534cd again (job 1790638017, the same five teeth); PROMOTED a57c21bf 75432 B (debug flavour, job 1790638085) with expect_sha256, registered callable (job 1790637860), offc twin installed (job 1790638104), and the PROMOTED binary run through /api/organ_run with the alpha subject read exit 0, 16/16 GREEN inside the deadline (job 1790638105: budget 3, window 4, 429 then 200 after 5 s). Its no-argument default runs the served PRODUCTION binary in staged mode, so after a production ship it witnesses that the served bytes carry the budgets (today that default reads RED by design: production predates them); it is not on the gate roster or connect.gates for that reason, and its row belongs to the release owner once production carries the budgets.
2026-09-28	CN13	lesson	A GATE WHOSE RUN OUTLIVES ITS CALLER'S DEADLINE CAN ORPHAN THE FIXTURE CHILD IT FORKED, AND ITS OWN REAP TOOTH NEVER RUNS TO SAY SO: the first rate gate waited out a 15 s window and /api/organ_run killed it at 12000 ms; this time the kill took the child with it (one process of that binary afterwards, read by nx_proc_observe), but nothing in the gate guaranteed that. The fix was to derive the fixture from the caller's bound (every window the run can choose ends, with its wait, inside the deadline), never to lengthen the deadline; and after any killed gate run that forks a daemon, observe the binary's processes before running anything else.
2026-09-28	CN13	retract	Correction to row 1790638140, whose NEW-file clause pairs the edited size with the first version's hash: nx_connect_alpha_rate_gate.nx was 25260 B sha256 6af345894e5805e6eb7b8f2efdd97babef3e2e75bddc4f10c84b52ea3e0d9d6b when first written (built as 54305c99), and is 25535 B sha256 501889f503da42a078fe8eff4178de0e92150f82bbe371cd859c61ddbea1a9fc after the window edit (built and promoted as a57c21bf). Every other figure in that row stands.
2026-09-28	CN13	queue	W16 ALPHA-SIGNUP-DOOR, THE OPEN LIST AFTER THE RATE GATE: debt 1790638192 now carries it (it supersedes 1790636396, eaten with DEBT-EATEN read from job 1790638215), so rows 1790636702 and 1790636840 point one link back. One item is restated more precisely: UNDER_MIN is not merely unexercised, it is UNREACHABLE on the live table today, because none of the 45 jur rows of knowledge/connect_jurisdictions.conf sets a minimum account age (every SOURCED row's fifth field is a dash; nx_txtscan counted 0 SOURCED rows with a number there), so the verdict is proven only on nx_connect_juris_gate's fixture place XA-S2; it becomes live the day a sourced law with an account-age floor is admitted. The three alpha gates (nx_connect_alpha_signup_gate 695236aa, nx_connect_alpha_device_gate 3b346c56, nx_connect_alpha_rate_gate a57c21bf) read REGISTERED-UNAUTHORISED in nx_catalog: callable through nx_job_run and /api/organ_run, with no cap minted that names them for a direct MCP call; this seat was told to write no token anywhere, so the mint is left to the connect owner's lane.
2026-09-28	FRONTDOOR	land	W17 FRONTDOOR-FINISH NINTH BATCH SHIPPED: signup_legal (CN13), the verb request of row 1790635700. A NEW row beside signup_admit, which stays not_yet_wired with its reason: signup_legal is the PURE legal half of sign-up, csu_juris_admit (runtime/_hdl_build/nx_connect_signup.nx, imported, not edited) over a band, the youngest age the band admits, a SELF-DECLARED place (never IP geolocation, never a device signal), the method rank of a guardian consent the caller verified and the day asked, over knowledge/connect_jurisdictions.conf loaded by jur_conf_load, the ONE law table. No challenge is spent, no account is created, nothing is stored; the stateful half (challenge, work, window) stays with the daemon that owns the sign-up door. GRAMMAR: signup_legal band age_lo place guardian_rank today_yyyymmdd. The day is an argument, one more than the suggested grammar, so the verb stays a pure function of its arguments and the table exactly as juris_rules does; the caller passes its own clock's day. The reply carries verdict and verdict_name in the door's own vocabulary (csu_code_slug), the door's text only for a refusal (csu_code_text says your account was created for an admit, which a check that creates nothing must not say), admitted, judged (0 for an adult band, which is never judged here), created 0 and table_bytes. LANDED under CAS: nx_connect_api_lib.nx 162354 to 167030 B (ha3255417cd90b4ea, job 1790637866), nx_connect_api_gate.nx 146869 to 150085 B (h6895fe7ad37f98a2, job 1790637933). CATALOG PARTITION before rows 44 = wired 24 + not_yet_wired 20 + not_yet_landed 0; after rows 45 = wired 25 + not_yet_wired 20 + not_yet_landed 0. PROOFS: RED on the eighth-batch lib 74/77 with exactly T73, T74 and T75 failing (job 1790637725); GREEN 77/77 on the landed tree in the build lane (job 1790637965) and in the ship prove; the request's five teeth are all carried (AU at 13 jurisdiction_barred, US at 12 without a guardian rank parental_consent_required, a minor with no place country_required, neg-control AU at 16 admitted, neg-control an adult with no place admitted and judged 0) plus door refusals (band 2, a malformed day, a short call). SHIPPED nx_connect_api by nx_organ_ship noregister (job 1790638038): prove 77/77, content GREEN, behave help IDENTICAL, promoted 630c8bd4 728816 B, .prev verified 6655290c by nx_filehash, then nx_behaveprobe prev IDENTICAL STRONG on activity_plan (469 B), push_vapid_key (288 B) and juris_rules AU (510 B) (jobs 1790638170 to 1790638189). GATE by nx_organ_ship (job 1790638149): content GREEN, behave DIFFERS for the new teeth, promoted bbc383fd, _offc twin, registered. SERVED /api/gate_run FAST GREEN 77/77 exit 0, 15118 of 16384 B, capture_truncated 0 (job 1790638287). THE ALPHA COMPILES on the landed lib: nx_connect_appd_w17check (a fresh byte copy of the 116620 B nx_connect_appd.nx, never run) built 1211275 B (job 1790637985). LIVE through /api/organ_run nx_connect from the nishihost root: signup_legal 0 13 AU -1 20260928 answered jurisdiction_barred, verdict 19, the door's text, created 0, table_bytes 88644 (job 1790638197); signup_legal 0 16 AU -1 20260928 answered admitted with no text, created 0 (job 1790638207). WATCH: the gate prints 15118 of the 16384 B FAST capture, 1266 B of headroom, so the next verb's teeth go in a sibling gate declared beside this one in organ_gate.conf. Shipped, gate 77/77, awaiting acceptance.
2026-09-28	FRONTDOOR	queue	W17 FRONTDOOR-FINISH HAND-OFF at the seat's time box (catalog rows 45 = wired 25 + not_yet_wired 20 + not_yet_landed 0; nx_connect_api 630c8bd4, nx_connect_api_gate bbc383fd served 77/77). (1) CN20 kr_policy (request 1790634202) is NOT wired this leg and needs no engine work, only the door: runtime/nx_connect_pqratchet.nx already exports kxr_accept(self_adv, peer_adv, pinned, has_hdr) answering KXR_OK_RATCHET, KXP_REFUSE_DOWNGRADE or KXR_JUDGE_KX2, kxr_send_mode(peer_adv, pinned) with the same three answers, and kxr_skip_ok(nr, held, n) answering 1 or 0 against KXR_MAX_SKIP. Proposed grammar: kr_policy self_adv peer_adv pinned has_hdr, kr_policy send peer_adv pinned, kr_policy window nr held n; name the verdicts through the incumbent vocabulary the kx_policy row already uses (nx_connect_frontdoor2), never a second spelling. Its four teeth (both advertise without the header refused, a pinned peer refused once the directory strips kx=3, a legacy peer judged by the kx=2 rule as the positive control, the window edge admitted and one past it refused) go in a SIBLING gate: nx_connect_api_gate prints 15118 of the 16384 B FAST capture of /api/gate_run, so a new gate (for example nx_connect_api_kx_gate) is declared beside it in knowledge/organ_gate.conf so nx_organ_ship proves both, then registered and rostered. (2) The own-account rows stay not_yet_wired with their reasons until the daemon hands the door an identity-carrying entry point (row 1790625380): realm_unify, msg_append (already repointed to nx_chat_store_lib cs_msg_append), signup_admit (its stateful half), franking_verify, play_open, play_join, play_move, play_state, date_share, date_checkin, date_block_report, date_extend, date_cancel, date_update, date_plan, mod_report, mod_queue_mine, mod_act, push_subscribe and push_unsubscribe (20 rows). (3) For the alpha lane (wave 16, whose files this seat did not edit): the CLI now sizes its reply from its inputs, but the mount's reply buffer is the alpha's; it must hold the catalog (33067 B at 45 rows) and an activity_plan whose participant list grows with the call. push_vapid_key on the mount answers 503 vapid-key-absent-or-unreadable by design, since the instance directory holds no key; serving the public key there is a key-custody decision for the push lane (a public-point file for the instance), never a copy of the private scalar. The activity_plan row names the rung tag ACTIVITY because the board carries no activity rung yet (request 1790361300); the board owner declares it. (4) LIFECYCLE: the seat's scratch twins are ARCHIVED reversibly by nx_retire_path into knowledge/retired/ (nx_connect_api_w17scratch.nx-1790638453, nx_connect_api_lib_w17scratch.nx-1790638483 byte-equal to the landed lib b27c54b5, nx_connect_api_gate_w17scratch.nx-1790638484, nx_connect_appd_w17check.nx-1790638485); mining receipt: none of them carried an MCP verb, API route, plan step, RACI row, clock row or ritual, each is a scratch twin of a landed file or a compile-only copy. Two build fossils remain because the retire organ refuses the .elf name by rule: buildroot/_build/nx_connect_api_gate_w17scratch.sov.elf and buildroot/_build/nx_connect_appd_w17check.sov.elf, neither registered nor on any execution surface. The /tmp payloads nx_connect_api_gate_w17land7.nx and nx_connect_api_gate_w17land9.nx and the gate fixture tree /tmp/nx_connect_api_gate reap with /tmp.
2026-09-28	CN2	land	THE GONE RULE, LIVE ON A REAL ENDPOINT: the UA probe's accept rule gained GONE (declared in its source before the tooth's first run) and P22 -- after both channels unregister, push_deliver to channel A must answer 404 or 410 and leave A's record a tombstone. Against Mozilla autopush with the production VAPID key: 23/23 GREEN, gone_post_status=410, cpush_sub_load then answers CPUSH_ERR_NOSUB (-26), so the owner's later unsubscribe finds nothing live; RED 22/23 on a planted gone rule that keeps the record (gone_record_load_rc=234, the endpoint length of a live record), failing exactly P22; restore proven byte-exact by a build-cache HIT on the pristine key 29aa521f and a third live run 23/23. /api/build + /api/promote expect_sha256 db3c2b72 (the qualify runs used these exact bytes), nx_offc_install. The matrix row restated (23/23, ten live runs).
2026-09-28	CN2	queue	SUPERSEDED, SUPERSEDING ROW 1790637412: nx_connect_push_probe's one unique leg (a 404 or 410 turning a record into a tombstone, measured on a token nobody was issued) is now repeated more strongly by the UA probe's P22 on a real, unregistered endpoint, so the old probe is SUPERSEDED by nx_connect_push_ua_probe. Mined before archive: it carries no MCP verb, API route, plan step, RACI row, clock row or ritual and sits on no execution surface (BUILT-UNPROMOTED, unregistered, unrostered). Archival through nx_retire_path is owed by the push lane owner; this seat's caps do not name nx_retire_path, so it is left in place with this row as its lifecycle record rather than deleted.
2026-09-28	CN13	land	THE DOOR'S OWN BURST LIMIT IS MEASURED TOO (the scripted-burst tooth this seat owed; still a new gate file, no leased source touched): nx_connect_alpha_rate_gate.nx 25535 to 30431 B (sha256 ef4e047e097032034c9e810cd90c5f94f078f62ad6e598d3e77a3ad7098bdc55) now also writes the run's own knowledge/connect_signup.conf (pow_bits_base, window_s, window_budget and challenge_ttl_s chosen by the run; lc_geti reads the CWD copy before the estate path) and copies knowledge/connect_jurisdictions.conf whole (88644 B) into the scratch directory, so the private sign-up door ARMS in the scratch instance from the run's policy; the challenge ROUTE budget is set two above the door's rows so the door answers first. New teeth: G1c the door fixture landed whole; P3 fixture-reached, the daemon's banner reads SIGNUP door ARMED with this run's window_budget; D1 the door issues exactly window_budget live challenges (the neg-control's one included); D2 the next answers HTTP 429; D3 it names door_busy, the door's own refusal, and not the route limiter's rate_limited; a gv_need makes the door teeth SKIP if the burst outlives one challenge lifetime. On bdeb97bc 21/21 GREEN in the build lane (job 1790638776: budget 3, window 4, three challenges then 429 door_busy, params 429 then 200 after 5 s); on the banked pre-door alpha bf1534cd 12/21 RED (job 1790638806), failing exactly R2 R3 R4 R6 R6b P3 D1 D2 D3 with every fixture tooth PASS. PROMOTED 47ceaadb 79424 B (job 1790638866, expect_sha256), offc twin installed (job 1790638886), and the PROMOTED binary through /api/organ_run read exit 0, 21/21 GREEN inside the 12000 ms deadline at the widest window the run can choose (job 1790638888: budget 4, window 5, waited 6 s). Afterwards nx_proc_observe with a 65536 B read window saw only the alpha pid 20441 for bdeb97bc and no process of bf1534cd, both scans complete, so every scratch instance was reaped.
2026-09-29	CN13-DEVICE	queue	EDIT-START W16 SEAT CONNECT-SHIP-2 (T0 1790639249, first run of this seat: no predecessor row names it, no bank of it exists): the production device switch, one edit batch on runtime/_hdl_build/nx_connect_appd.nx (sha256 57edfb76 116620 B before, the file the alpha bdeb97bc was built from; no SEALED edit-start row is open and SOTA-SEALED-MESSAGING has journaled no row yet). Scope: a data switch cd_dev_prod_switch reading device_production from knowledge/connect_device.conf; production enters the device block only when it reads 1, turns the device path on only when the assets load AND the sign-up door arms, and then runs the door and writes the S1 record on both register paths exactly as the alpha does; the device routes answer wherever the device path is on; /api, /try and /features stay stage-only; nothing else changes. nx_connect_serve.nx and nx_connect_ui.nx are NOT edited. EDIT-DONE follows with the landed hash.
2026-09-29	CN13-DEVICE	measure	RESUME W16 SEAT CONNECT-SHIP-2 (second run, T0 1790654696, after the operator pause at about 19:07 CDT): the predecessor EDIT-START row 1790640450 is open without its EDIT-DONE. MEASURED the file it names: buildroot/runtime/_hdl_build/nx_connect_appd.nx is now sha256 a6662efd 119428 B (57edfb76 116620 B before), mtime 1790640378, carrying the LANDED half of that batch: cd_dev_prod_switch (the device_production row of knowledge/connect_device.conf on the circles ladder, announced ON or OFF at startup), devwant (production enters the device block only on 1), the door armed behind it, sudoor (production runs the door only when its device path came up with the door ARMED, else dev_on goes back to 0 and the zero-JS forms stay), and cd_su_form_refused, cd_su_form_commit and the su stamp keyed on sudoor; 0 occurrences of SEALED and 4 of CONNECT-SHIP-2 in the file. NOT LANDED: the device routes still answer only inside the staged block (if staged == 1 then if album_n == 0 then if dev_on == 1), so production would render the device form while its /connect/device/ paths fell through to the pages. This run completes the SAME batch with ONE exact edit that lifts the device-route branch out of the staged block (album_n 0 and dev_on 1) and leaves /api, /try and /features stage-only. No other seat holds an open EDIT-START on this file (SOTA-SEALED-MESSAGING has journaled no row; FRONTDOOR-FINISH last row 1790638510 is a hand-off). EDIT-DONE follows with the landed hash.
2026-09-29	CN13-DEVICE	land	EDIT-DONE W16 SEAT CONNECT-SHIP-2 (closes EDIT-START row 1790640450): runtime/_hdl_build/nx_connect_appd.nx a6662efd 119428 B to sha256 261d59c87d17ad96 119815 B by ONE content-CAS edit (expect hc5341c9b7e5b1c38, job 1790655280): the device-route branch now runs outside the staged block (album_n 0 and dev_on 1), so it answers on every staged instance holding the assets and on PRODUCTION only when device_production reads 1, the assets load and the door arms; /api, /try and /features stay inside the staged block. COMPILES: nx_sov_build_run nx_connect_appd --build-only (job 1790655316) debug flavour 1324376 B sha256 50055a7c9e9118c8, build-cache MISS then STORE, admission GRANT, serving-root twin HELD (nothing installed). The batch as a whole since 57edfb76: cd_dev_prod_switch, devwant, sudoor, the form door and su stamp keyed on sudoor, and this routing lift; nx_connect_serve.nx and nx_connect_ui.nx NOT edited. This tree carries no SEALED change (SOTA-SEALED-MESSAGING has journaled no row). The edit lease on nx_connect_appd.nx, nx_connect_serve.nx and nx_connect_ui.nx returns to SOTA-SEALED-MESSAGING at this row; this seat now builds and gates from exactly these bytes.
2026-09-29	CN7	measure	RESUME W16 SEAT SOTA-SEALED-MESSAGING (third run, T0 1790654755, after the operator pause): the predecessor journaled NO row and banked nothing. MEASURED nx_connect_appd.nx against the retired byte copy of the source that built the alpha bdeb97bc (knowledge/retired/buildroot_runtime__hdl_build_nx_connect_appd_w17check.nx-1790638485, sha256 57edfb76 116620 B) with nx_srcdiff (job 1790654999, complete surplus listing): every surplus line belongs to CONNECT-SHIP-2's CN13-DEVICE batch, closed by its EDIT-DONE row 1790655420 (261d59c8 119815 B), and the file holds 0 occurrences of seal; nx_connect_serve.nx (sha256 54aed8ae 141624 B, mtime 1790625396) and nx_connect_ui.nx (sha256 ddd7c780 33585 B, mtime 1790460071) predate the alpha build. No half-applied SEALED batch exists, so there is nothing to complete or revert. PLAN, stage-gated end to end: a NEW lib runtime/_hdl_build/nx_connect_sealed_api.nx composing nx_connect_franking (mfr_relay into the recipient's own C1 room with the youth wall as the channel verdict, the server tag re-verified before any stored record is served, mfr_report_verify for a franking report) behind <mount>/secure/v1/ send, inbox, report and whoami on a STAGED instance only; the daemon wiring lands as ONE content-CAS write of nx_connect_appd.nx from a compile-checked scratch copy, between an EDIT-START and an EDIT-DONE row; nx_connect_serve.nx and nx_connect_ui.nx are not planned to change.
2026-09-29	CN13-DEVICE	queue	EDIT-START W16 SEAT CONNECT-SHIP-2, second batch on runtime/_hdl_build/nx_connect_appd.nx (sha256 261d59c87d17ad96 119815 B, the EDIT-DONE bytes of row 1790655420; no SEALED edit-start row is open and SOTA-SEALED-MESSAGING has journaled no row): ONE line, an explicit import of runtime/nx_crash.nx as the FIRST import. MEASURED CAUSE: the candidate built from 261d59c8 (job 1790655316, 50055a7c 1324376 B) carries NO crash guard -- the content ruler against the alpha bdeb97bc reads lost_from_live=16, all of them the nx_crash.nx handler text (the program crashed: signal, SIGSEGV SIGBUS SIGILL SIGFPE, where: the instruction at) and the bounds-trap message that only nx_crash.nx fixed-array buffers emit; count 0 in 50055a7c against 1 in bdeb97bc and 1 in the served 872a9cc9; the assembly _build/nx_connect_appd.s names nx_crash_guard 0 times. The wave-17 check build _build/nx_connect_appd_w17check.sov.elf (mtime 1790637991) lacks it too, while nx_connect_api.elf over the same api_lib carries it. RULED OUT by measurement: the 4 MiB expansion cap (nx_closurehash nx_connect_appd buildroot: files=258 unresolved=0 bytes=3821533, so 372771 B of room) and --no-crash-guard (no build path passes it). REMAINING CLASS: the compiler's forward-registration prepass (debt 1788324631, eaten: a brace-count walk that loses depth swallows every later function, and nx_crash.nx is appended LAST, so main's guard call is skipped and DCE drops the guard); the compiler's warning is muted because nx_sov_build_run silences nx_cc stderr on a successful build. An explicit first import puts nx_crash_guard ahead of any swallow point; the driver's own append then dedups and arms. EDIT-DONE follows.
2026-09-29	CN13-DEVICE	land	EDIT-DONE W16 SEAT CONNECT-SHIP-2 second batch (closes EDIT-START row 1790656400): REVERTED, the file is back to sha256 261d59c87d17ad96 119815 B exactly (nx_filehash after job 1790656799). The explicit first import of nx_crash.nx made the build FAIL (job 1790656454: COMPILE-FAIL, nx_cc says expand_imports failed, and the builder's own closure hash read key-unavailable, closure could not be expanded), which REFUTES the prepass class this row's EDIT-START named and points at the expander's capacity instead: 11065 B of nx_crash.nx at the FRONT does not fit, so the driver's append of the same file at the END was failing and degrading to an unguarded build; the driver prints that as crash-guard source not found on a stderr nx_sov_build_run mutes on success. The raw closure is 3821533 B against the 4194304 B NX_COMPILE_X86_EXPAND_CAP, so the expanded text carries more than the raw sources (the cause of that gap is not yet measured). The lease on nx_connect_appd.nx, nx_connect_serve.nx and nx_connect_ui.nx returns to SOTA-SEALED-MESSAGING at this row; this seat will not edit them again this run.
2026-09-29	CN13-DEVICE	lesson	ROOT CAUSE MEASURED, and a WARNING for SOTA-SEALED-MESSAGING before its planned new lib: the nx_connect_appd closure sits EXACTLY at the compiler's import-table cap. buildroot/runtime/nx_import.nx declares const MAX_IMPORTS 256 and import_add returns 0 at n 256, which expand_imports_inner turns into ERR_IMPORTS_FULL. The appd closure is 256 distinct files (the debug line table of build job 1790655316 reads files=256; nx_closurehash lists 258 spellings, bytes 3821533, so the 4194304 B expansion buffer is not the limit), so the driver's default append of runtime/nx_crash.nx is the 257th file, fails, and nx_compile_x86 logs it as crash-guard source not found and builds UNGUARDED on a stderr nx_sov_build_run mutes on success; the explicit first import of nx_crash.nx (this seat, reverted) made the 257th file a USER import and the build failed outright (job 1790656454, expand_imports failed). It began with the wave-17 api_lib batches of 1790637600 (activity_plan and push_vapid_key pull nx_connect_activity, nx_connect_push, nx_webpush and the HTTPS client stack into every appd build): the retired copy that built the alpha bdeb97bc, rebuilt over that api_lib as _build/nx_connect_appd_w17check.sov.elf at 1790637991, already has no guard, while bdeb97bc and the served 872a9cc9 have it. CONSEQUENCES: (1) every appd build from this tree ships with no crash guard; (2) ONE more import anywhere in the appd closure, including a new sealed-messaging lib, fails the build with a message that blames import spelling. The fix is the compiler's (grow or derive the import table, name ERR_IMPORTS_FULL instead of source not found, and stop muting that warning on success), owned by the lang lane through the canaried toolchain lane; a debt row follows. Until then a new appd capability must add no new file to the closure.
2026-09-29	R1	measure	DEPLOYS UNBLOCKED FOR WAVE 16 (W19 CLOCK-PIN, operator authority Fix both, staged (Recommended)): loadgov, the shared-fate RED that refused every health-checked deploy, is out of RED_DOMAINS. The cause was the stale reviewed-writer pin in nx_clock_reregister_gate (debt 1790636764); the gate is re-pinned to the served writer aa68b408 after a review and promoted bdddf98c, served /api/gate_run GREEN 36/36 (job 1790656861). nx_swcompare_evidence loadgov 7/7 GREEN MEASURED-HONEST (job 1790656910); nx_sota_status (job 1790656984) rewrote knowledge/status/evidence_honesty.log: RED_DOMAINS= webscraping finance videocodec softbody synthroom autodev ecosystem pmdash. nx_deploy_ready check knowledge/registry/deploy_checks.tsv docportal (job 1790657026) and ... connect (job 1790657050) both read DEPLOY-SAFE-WITH-WARNINGS, blockers 0, 8 WARN rows, evidence-honesty PASS scoped domain:search and domain:connect. CONNECT-SHIP-2 may proceed with /api/deploy target=connect under its own gates. This seat now ships docportal f8be3c96 (the takeover-fix last door) through /api/deploy target=docportal.
2026-09-29	CN7	queue	EDIT-START W16 SEAT SOTA-SEALED-MESSAGING, ONE batch on runtime/_hdl_build/nx_connect_appd.nx (sha256 261d59c87d17ad96 119815 B, CONNECT-SHIP-2's EDIT-DONE bytes of row 1790655420 restated by row 1790656830; no other seat holds an open EDIT-START on it): the sealed message lane behind <mount>/secure/v1/ send, inbox, report and whoami on a STAGED instance only, landed as ONE content-CAS write-file from the compile-checked scratch copy runtime/_hdl_build/nx_connect_appd_cn7w16.nx (136487 B, built 1226368 B sha256 20983e1d in job 1790657624). HEEDING row 1790656990 (the appd closure is at the compiler's 256-module import cap, which this seat also measured independently: job 1790656520 COMPILE-FAIL when the scratch imported the new lib, the lib alone building in job 1790656778), the batch adds NO file to the closure: the lane runs in a HELPER PROCESS ./nx_connect_sealed.elf (NEW runtime/_hdl_build/nx_connect_sealed.nx over the NEW lib runtime/_hdl_build/nx_connect_sealed_api.nx, which composes nx_connect_franking), forked and exec'd per call over sys_pipe2, sys_fork, sys_dup3 and sys_execve_clean already in the closure; the daemon keeps the session, the account-log resolution of a recipient handle and the S1 bands. Stage-only: production never arms the lane, never probes the helper and keeps its SIGPIPE disposition (a staged instance now ignores SIGPIPE, inherited by the helper). nx_connect_serve.nx and nx_connect_ui.nx are NOT edited. EDIT-DONE follows with the landed hash.
2026-09-29	R1	queue	DEPLOY-START W19 CLOCK-PIN docportal (operator-approved takeover-fix rollout, the last door): POST /api/deploy target=docportal confirm=yes expect_sha256=f8be3c96 now. Pre-state: live e20601bc 1717472 B pid 32420 (ppid 1, digest_match 1, the only match in a complete scan of 762 pids), banked knowledge/bank/nx_docportal_admin_daemon.elf-live-e20601bc-predoors-20260928 (hash-verified) with .prev 335f08ac banked beside it; candidate nx_docportal_admin_daemon.sov.elf.new f8be3c96 1744488 B re-hashed, and a --build-only --debug build of the current tree HITS the cache at the same sha (key b2ba971b), so the staged bytes are the tree's; no stale .elf.new; nx_docportal_admin_daemon_gate on the current tree 21/21 incl. a new tooth R4 (the taken handle with a fresh live invite answers 400, the original still logs in, the attacker cannot), job 1790657780; health OK 16 services; edge GET https://admin.andelinwest.com/admin 200 (login shell, 2748 B). Rollback: docportalrollback restores .prev.
2026-09-29	CN7	land	EDIT-DONE W16 SEAT SOTA-SEALED-MESSAGING (closes EDIT-START row 1790657850): runtime/_hdl_build/nx_connect_appd.nx 261d59c8 119815 B to sha256 1c56d7bc78b64769 136487 B by ONE content-CAS write-file (expect h2ca35bcc3b6f8284, job 1790657880), byte-identical to the compile-checked scratch (nx_filehash cmp identical 1). COMPILES: nx_sov_build_run nx_connect_appd --build-only (job 1790657905), debug flavour, 1338512 B sha256 5a5784a13ae61eb4, debug-line files=256 (the batch added no file to the closure), serving-root twin HELD, nothing installed. What the batch adds, all stage-gated: cd_sealed_new (the lane's hoisted scratch), cd_acct_of_handle (a recipient handle resolved as the account log keys it), cd_acct_band (the S1 band through the lib's own reader), cd_sealed_exec and cd_sealed_call (fork, exec and the pipe protocol of the helper), cd_sealed_route (the <mount>/secure/v1/<verb> door; the probe verb is never forwarded from the web), cd_sealed_probe at startup, sys_ignore_sigpipe on a staged instance, and the route branch inside the staged api block. Production's own paths are untouched: staged 0 never arms, probes, forks or changes SIGPIPE. KNOWN, inherited from the tree and measured by CONNECT-SHIP-2 (row 1790656990): this build, like every appd build from this tree, carries NO crash guard because nx_crash.nx would be the 257th file; the lang lane owns the fix. The helper and the gate are NEW files (runtime/_hdl_build/nx_connect_sealed.nx 7838 B built 155033 B sha256 a5b62a6b, job 1790657333; runtime/_hdl_build/nx_connect_alpha_sealed_gate.nx 26793 B built 522663 B sha256 9b3598da, job 1790657778) and knowledge/connect_sealed.conf is the lane's store conf (1165 B). The edit lease stays with this seat for the alpha restart that follows.
2026-09-29	R1	land	W19 CLOCK-PIN DOCPORTAL SHIPPED AND VERIFIED -- the last door of the operator-approved takeover-fix rollout. POST /api/deploy target=docportal confirm=yes expect_sha256=f8be3c96 (job 1790657895): PROMOTED, pre_deploy_gate DEPLOY-SAFE, gate_blockers 0, gate_override none; deploy_status DEPLOYED-GREEN listen=UNVERIFIED-may-be-outgoing-process, settled by identity instead: nx_proc_observe f8be3c96 PRESENT one process pid 11863 (ppid 11563, the hostctl supervisor) digest_match 1, the only name match; e20601bc ABSENT_IN_COMPLETED_SCAN (complete=1, 785 pids). Artifact: live nx_docportal_admin_daemon.elf f8be3c96 1744488 B, .prev e20601bc (banked). Edge: GET https://admin.andelinwest.com/admin 200 login shell 2748 B, nx_page_verify VERDICT=GREEN (3 a11y-lite notes, pre-existing), GET https://nishifamily.com/search?q=estate 200. Health OK 16 services 0 down before and after, swap 849 then 845 permil. New process /proc sample at about 1 min: VmSize 11690848 kB (shard mappings, VmLib 7653568 kB), VmRSS 2007380 kB, VmSwap 0, 1 thread -- one sample, re-sampled below. BEHAVIOUR OF THE FIX, never a real account: nx_docportal_admin_daemon_gate gained R4 (source 2d6a4f99 banked knowledge/bank/nx_docportal_admin_daemon_gate.nx-pre-r4takeover-w19-20260928): a second POST /admin/register of the taken handle with a FRESH live invite answers 400 (the account log refuses, the invite gate passed), the original passphrase still logs in and the attacker's does not; R1 (fresh handle, fresh invite, 200) is its positive control and R2 R3 (403) name the other rule. On the current tree (the closure that builds f8be3c96, build-cache key b2ba971b) 21/21 GREEN (job 1790657780). R4 was not bitten against the pre-fix account log this leg (that needs a mutant of a shared hub lib during wave 16 builds); its RED on the old code is argued from debt 1790372520's measurement, not shown. The gate's domain log now reads rows= and verdict= from the base counter instead of a typed 20. The gate ship follows.
2026-09-29	CN7	land	THE SEALED MESSAGE LANE IS LIVE ON THE ALPHA, PROVEN OVER THE EDGE: https://nishifamily.com/alpha/connect/secure/v1/ send, inbox, report and whoami now run on nx_connect_appd 5a5784a13ae61eb4 (1338512 B, built from nx_connect_appd.nx 1c56d7bc, row 1790657960) with its helper alpha_connect/nx_connect_sealed.elf (a5b62a6b 155033 B, mode 0755). RESTART BY THE ALPHA RECIPE: the prior alpha bdeb97bc stays banked (knowledge/bank/nx_connect_appd.elf-alpha-bdeb97bc-20260928) and daemons.reg was banked first (knowledge/bank/daemons.reg-pre-cn7-bdeb97bc-20260928, 14783 B); the connect_alpha row repointed under content CAS (expect h33f415a19977760a, job 1790658048), re-signed by nx_reg_sign (job 1790658065: SIGNED daemons.reg.sig), nx_proc_kill exact 20441 start_ticks 525039228 digest bdeb97bc signal 15 (job 1790658104: signal_sent 1, the process went to state Z within the 5000 ms deadline and its parent the supervisor reaped it), and nx_proc_observe then read ONE process of 5a5784a1: pid 3843, start_ticks 527411182, parent 25615, digest_match 1, with bdeb97bc ABSENT in a complete scan. GATE: NEW runtime/_hdl_build/nx_connect_alpha_sealed_gate.nx (26793 B, built 9b3598da 522663 B) is both devices -- it seals with mfr_frank on the sender's side and opens with mfr_receive on the recipient's, posting only envelopes: 26/26 GREEN against the new alpha (job 1790658162: whoami per session; envelope 160 B for 80 B of plaintext stored at seq 2 and a replay answering seq 2; the stored record 224 B carries none of the plaintext and sits only in the recipient's room; the recipient opens the exact 80 B; a flipped ciphertext byte refused -45, a flipped commitment -46, a relabelled sender -45; the franking report verifies on the server naming the sender whoami named, routed safety; the server refuses a framed text opening_mismatch, a relabelled record server_tag_mismatch, the sender's own report not_recipient, an adult's private message to the 16-17 year old fixture channel_denied 403 with nothing stored, a signed-out call sign_in_required 401, an unknown handle and a short envelope). RED 0/26 against the old alpha bdeb97bc (job 1790657835: the fixture accounts were made through the door, token 204 B each, and every lane path fell through to an HTML page). Each run makes three alphaseal* accounts in the ALPHA realm only. Shipped, gate 26/26, awaiting acceptance (referee and operator ACCEPT still owed).
2026-09-29	R1	land	W19 CLOCK-PIN closed the takeover debts on evidence, each by the job artifact DEBT-EATEN: 1790372520 (job 1790658330, open=2959) and 1790372837 (job 1790658367, open=2958). Grounds: every door the census named now refuses a second register of a taken handle on the SERVED bytes -- docportal f8be3c96 (this seat, row 1790658100: create-only account log, R4 in-process 400 with the original intact), email_portal, studio, gallery, mesh, vault and gen (W16 DOORS-REST land rows 1790625100 to 1790632070 and 1790636720, the gateway door gate v3), the production connect nx_connect_appd.elf 872a9cc9 carries the signup door's existence check (nx_txtscan count connect_signup.conf=2, the row's own positive control; its predecessor row 1790359363 is already EATEN), and lan_signup_routes, olg_route_ip and the opaque login daemon keep their per-handle invite state. The root fix itself (nx_uas_create refusing NX_UAS_EXISTS, nx_modern_auth_register mapping it to NX_MAUTH_USER_EXISTS) is in hub/nx_user_account_store.nx and hub/nx_modern_auth_flow.nx with its own gate (nx_user_account_store_gate create-of-an-existing-user-refuses-EXISTS). Not claimed: R4 bitten against the pre-fix log (argued, not shown), and a real-browser register on admin.andelinwest.com (no real account was touched).
2026-09-29	CN13-DEVICE	measure	W16 CONNECT-SHIP-2 PRE-DEPLOY, the candidate 50055a7c9e9118c8 1324376 B (build job 1790655316 from appd 261d59c8; banked knowledge/bank/nx_connect_appd.elf-prodcand-50055a7c-cs2device-20260928, staged byte-exact as nx_connect_appd.sov.elf.new, job 1790658413). GATES ON THE CANDIDATE BYTES: nx_connect_prod_register_gate EXTENDED (source 89f19c21 31054 B banked knowledge/bank/nx_connect_prod_register_gate.nx-89f19c21-pre-cs2device-20260928, now 76385 B) 75/75 GREEN (job 1790658001): the switch-off instance keeps every earlier tooth plus P2 (switch announced OFF) and neg-control P3 (no device route answers), and a second scratch PRODUCTION instance with device_production 1 proves the device form and nameless secret on /connect/register and /connect/login, the zero-JS fallbacks, the assets byte-exact, a door-solved device registration, sign-in through ke1 and ke3 with the production cookie on Path=/ and X-Nishi-Session, the account page record with 9 purposes OFF, the taken handle refused 409 at respond, no-challenge 403, minor-without-country 403, the form fallback registering through the door with its recovery phrase, the DEVICE account signing in through the zero-JS form (DF3), no passphrase or its SHA-256 in any device POST body, and /api /try /features stage-only. KNOWN-BAD: the served 872a9cc9 reads RED 47/75 (job 1790658068), failing exactly P2 and the 27 device teeth. nx_connect_alpha_rate_gate 21/21 on the candidate in staged mode (job 1790658194). CONTENT RULER vs the served 872a9cc9 (job 1790655408): lost_from_live=20, reconciled by count: 16 are the nx_crash.nx guard (15 handler strings and the bounds-trap message its fixed arrays emit; the same 16 are lost against the alpha bdeb97bc, job 1790655404) and 4 are superseded by other seats' landed source (the archived engine name nx_connect_msgstore.msg_store_append, the needs and study try-page rows, and the device-thresholds message reworded to name the route rates). The guard loss is the import-table cap of row 1790656990 and debt 1790657243: every appd build from this tree loses it; the daemon still dies by the original signal and is revived as before, only the printed fault diagnostic is gone. nx_contentdiff_export cannot write the full inventory here (it refuses a subject over its FSX_READ_CAP, exit 3). ASSETS placed in the production instance directory by nx_filecopy from the release home, hashes equal to its MANIFEST (dfa0d09d 15409 B, 5af5f9c0 210492 B). SWITCH: knowledge/connect_device.conf 6ea80da8 3186 B (banked) to 4075 B with device_production 1 and its comment. nx_deploy_ready check scoped to connect: DEPLOY-SAFE-WITH-WARNINGS, 0 blockers (loadgov unblocked by CLOCK-PIN row 1790657040).
2026-09-29	CN7	measure	CN7 REGRESSION AND REFEREE EVIDENCE on the new alpha 5a5784a1 (pid 3843): nx_connect_prod_register_gate 31/31 GREEN in PRODUCTION mode on a scratch instance of the same bytes (job 1790658243, subject alpha_connect/nx_connect_appd-5a5784a1.elf, scratch port 18151, takeover teeth T1 to T5b, M1 to M3 production serves no API, K1 to K4 the legacy /sealed vf flag honest both ways, Z1 reaped) -- the stage-gated lane changed nothing on the production path; over the edge on the live alpha nx_connect_alpha_signup_gate 23/23 GREEN (job 1790658443) and nx_connect_alpha_api_gate 32/32 GREEN (job 1790658445). THE GATE IS SHIPPED: nx_organ_ship nx_connect_alpha_sealed_gate (job 1790658366): build 857446a1, PROVE 26/26 GREEN (a third live run), adoptgate first promote announced, promoted, offc twin installed, REGISTERED callable. PIXEL REFEREE on https://nishifamily.com/alpha/connect/secure: CM13 nx_cdp_capture could not run on the MCP surface (CD-BROWSER-ABSENT candidates=2, this seat measured it) so the oracle ran where the browser is, the laptop Edge through WSL, the lane prior seats used (rows 1790439130 and 1790439132) -- a named non-MCP exception whose gap is a browser door on the estate surface: phone 390x844 dsf 2 and desktop 1440x900 both OK, CM6 nx_page_pixjudge on the production bars: contrast_fails 0, overlap_pairs 0, hierarchy_violations 0, worst ratio 4.71 (the footer, above 4.5), motion settled; the /secure page itself is unchanged by this rung. PROVENANCE: the lib's comment-only edits after the install rebuilt the helper byte-identical (job 1790658431: sha256 a5b62a6b 155033 B, the installed bytes); the pre-change daemon source is BANKED by hash, reconstructed by exactly reversing the three inserted blocks and verified sha256 261d59c8 119815 B (knowledge/bank/nx_connect_appd.nx-261d59c8-pre-cn7-20260928).
2026-09-29	CN13-DEVICE	land	W16 SEAT CONNECT-SHIP-2 SHIPPED PRODUCTION DEVICE SIGN-IN: POST /api/deploy target=connect with expect_sha256 50055a7c9e9118c8 (job 1790658507: PROMOTED, pre_deploy_gate DEPLOY-SAFE, gate_blockers 0, override none), deploy_status DEPLOYED-GREEN listen=VERIFIED (job 1790658597). PROCESS IDENTITY: before, pid 9825 start_ticks 523520552 parent 25615 digest_match 872a9cc9; after, pid 12437 start_ticks 527451534 parent 25615 digest_match 1 for 50055a7c (nx_proc_observe, 755 pids read, complete); the served nishihost/nx_connect_appd.elf hashes 50055a7c 1324376 B; the replaced 872a9cc9 is banked (knowledge/bank/nx_connect_appd.elf-prodcand-872a9cc9-20260928, re-hashed equal to the served file before the ship) and now sits in .prev, with e0998c6b banked beside it. SERVED BEHAVIOUR over the edge (nx_https_get on 127.0.0.1:8443): /connect/register answers 200 with the DEVICE form (id nxc-device, method get to /connect/register/form, data-mount /connect), the nameless password field nxc-secret, the neutral age screen and place field, the consent-OFF sentence and /connect/device/opaque.js (job 1790658563); /connect/device/opaque.js answers 200 text/javascript Content-Length 15409, the release home's bytes (job 1790658591); /connect/register/form answers the FORM FALLBACK with the door's work form and exactly one field named pw (job 1790658596); GET /connect/device/params answers 400 post_required from the device handler, not a page (job 1790658645). Health OK 16 services, 0 down, 0 degraded before the ship. This build includes NO SEALED change. KILL SWITCH: device_production 0 in knowledge/connect_device.conf and a restart returns production to the zero-JS forms (proven by the gate's switch-off instance); ROLLBACK: .prev holds 872a9cc9, or copy the bank to nx_connect_appd.sov.elf.new and POST /api/deploy target=connect with expect_sha256 872a9cc9. KNOWN LOSS, named: the nx_crash.nx fault diagnostic (row 1790658470, debt 1790657243).
2026-09-29	R1	land	W19 CLOCK-PIN SHIPPED nx_docportal_admin_daemon_gate with the takeover tooth R4 through nx_organ_ship (job 1790658687): build d6a98acd (src_path names the gate), PROVE 21/21 on the fresh build, content losses approved by exact record f76abce5 (nine enumerated: the seq1730 ss_commit message superseded by the SS-WRITE-SEG guard, a reworded store-lock message, the typed rows=20 text this change retired, four helper symbols), behaviour reviewed by NISHI-SHIP-BEHAVIOR-REVIEW/1 knowledge/status/harness/review-docportal-gate-r4-20260928.txt (sha256 a27d3d51) over the retained observation 15c56d3c (live 20/20 and candidate 21/21, both exit 0, first difference at byte 556 is the R4 line), promoted live=staged=d6a98acd 1756112 B, _offc twin installed, already registered; the prior served gate 5b65c7a8 is banked (knowledge/bank/nx_docportal_admin_daemon_gate.elf-live-pre-r4takeover-w19-20260928). SERVED /api/gate_run GREEN 21/21 exit 0, R4 PASS, domain line rows=21 pass=21 (job 1790658810). The docportal daemon itself (f8be3c96, pid 11863) is steady: VmRSS 2007380, 2007384 and 2007396 kB over about 10 min, VmSize flat, VmSwap 0.
2026-09-29	CN7	land	CN7 ON THE BOARD, and the rest of the alpha re-proven on the new bytes: nx_connect_alpha_device_gate 42/42 GREEN over the edge (job 1790658670) and nx_connect_alpha_rate_gate 21/21 GREEN on a scratch staged instance of 5a5784a1 (job 1790658673; the scratch directory holds no helper, so its lane announced OFF by name and the device budgets were untouched). connect.matrix gains the watch row Sealed messages live on a served instance (CN7, ALPHA) on runtime/_hdl_build/nx_connect_sealed_api.nx cs_sealed_aead (31759 to 32593 B under size CAS, job 1790658871); its rival codes are copied from the grounded sealing row and the note says ALPHA only. nx_compare_regen_scoped --domain connect (job 1790658909) published /compare/connect index.html 1602484 B (prev 1560060) and api.json 132497 B, the CN7 dossier linking cell-cs_sealed_aead PRESENT, verdict GREEN with fork freshness reconciled; nx_page_verify https://nishifamily.com/compare/connect/ GREEN (job 1790658955, a11y-issues 0). knowledge/organ_gate.conf now declares nx_connect_sealed_api and nx_connect_sealed to nx_connect_alpha_sealed_gate, so the dossier's NO-GATE-DECLARED clears on the next publish. LIFECYCLE: the two scratch sources are ARCHIVED reversibly by nx_retire_path (knowledge/retired/buildroot_runtime__hdl_build_nx_connect_appd_cn7w16.nx-1790658805, the compile-checked copy byte-identical to the landed daemon source; knowledge/retired/buildroot_runtime__hdl_build_nx_connect_sealed_cc.nx-1790658807, a never-run compile check); mining receipt: neither carried an MCP verb, API route, plan step, RACI row, clock row or ritual. Two build fossils stay because the retire organ refuses .elf by rule: buildroot/_build/nx_connect_appd_cn7w16.sov.elf and buildroot/_build/nx_connect_sealed_cc.sov.elf, neither registered nor on any execution surface. ALPHA RELEASE RECIPE, one file more from now on: alpha_connect/nx_connect_sealed.elf (built from runtime/_hdl_build/nx_connect_sealed.nx, mode 0755) beside the daemon; the daemon's startup probe announces SEALED lane ON or OFF by name, and knowledge/connect_sealed.conf is the store conf it reads.
2026-09-29	CN7	land	IN-PROCESS GATE for the lane lib (wave 16 SOTA-SEALED-MESSAGING): nx_connect_sealed_api_gate (buildroot/runtime/_hdl_build/nx_connect_sealed_api_gate.nx, 21677 B) 29/29 GREEN (job 1790659406) over lib sha256 51576d7c (25054 B): K1-K4 key custody (loaded, created owner-only, never rewritten when present), S1-S6 send and the channel verdict, I1-I3 inbox budget, A1-A3 AT-REST TAMPER (one ctx byte flipped in the stored record) withheld from the inbox and its report refused server_tag_mismatch, R1-R5 report, V1-V4 values emitted. The first run read 28/29 RED: tooth A3 flipped a TF byte, so the commitment check fired first and the reply read opening_mismatch -- the plant now flips a ctx byte so only the relay stamp can see it; and a gate that chdirs into its fixture must chdir home before the verdict or the gate journal append fails (fixed). BITE: nx_gate_bite aim cnsl_inbox site 42 KILLED, restore verified byte-identical 25054 B (job 1790659493). SHIPPED by nx_organ_ship 9b6e3c09 prove=GREEN, registered (job 1790659518). knowledge/organ_gate.conf declares nx_connect_sealed_api -> nx_connect_sealed_api_gate (the lib's own proof) and nx_connect_sealed -> nx_connect_alpha_sealed_gate (the helper's edge proof), one row per name (edit job 1790659572 OK bytes=50765).
2026-09-29	CN13-DEVICE	land	W16 CONNECT-SHIP-2 POST-DEPLOY, VERIFIED ON THE SERVED BYTES. Production nx_connect_appd.elf is 50055a7c9e9118c8e3653ae85190bf6df216c0c6c2634fc4ac2d0d1cdccb3657 (1324376 B; /api/deploy target=connect job 1790658507 PROMOTED DEPLOYED-GREEN listen=VERIFIED; .prev holds 872a9cc9, also banked knowledge/bank/nx_connect_appd.elf-prodcand-872a9cc9-20260928): nx_proc_observe inspect pid 12437 start_ticks 527451534 parent 25615 state S, executable sha equal before and after, cwd nishihost, the SAME process before and after every browser leg below. OVER THE EDGE (127.0.0.1:8443): /connect/register and /connect/login serve the device form (nameless secret field, opaque.js 200 15409 B), nx_page_verify GREEN on both (a11y-issues 0, jobs 1790660009 and 1790660019); /connect/register/form serves the door form. GATE: the extended nx_connect_prod_register_gate PROMOTED 9a49fea0951d93ff (305656 B, /api/promote expect_sha256 job 1790659333; content ruler vs the live 525b4f16 69449 B GREEN lost_from_live=0 ONE-WAY-GAIN 726 runs gained, job 1790659313; the live gate banked knowledge/bank/nx_connect_prod_register_gate.elf-live-525b4f16-pre-cs2device-20260929; offc twin job 1790659355) and the PROMOTED binary run through nx_job_run against the served appd reads 75/75 GREEN (/tmp/cs2dev_cprg_promoted_1790659380.out: js 15409 and wasm 210492 served equal to the release, session token 204 B, 9 purposes OFF, the taken handle refused at respond). REAL BROWSER, CM13 (break-glass declared: the NAS carries no browser and nx_cdp_capture answers CD-BROWSER-ABSENT there, so the laptop build of the same organ drove the laptop Edge through wsl -e, one desktop door, a FRESH profile per journey, poll 1000 ms so each heading click is the wait the journeys grammar lacks): cs2devreg registered the TEST handle test_cs2dev_0929a through the device path on https://nishifamily.com/connect/register, the status read Ready before submit, and it landed on /connect/account showing the handle 4 heading clicks after submit (29 steps, verdict OK); cs2devlogin signed the same handle in from a fresh profile through ke1 and ke3 and landed on /connect/account (22 steps, OK); cs2formreg registered the TEST handle test_cs2form_0929a through the form fallback, the page script solving the door work into the hidden fields, and landed on Welcome to Connect with Save your recovery phrase now (24 steps, OK). CM6 nx_page_pixjudge on production /connect/register and /connect/login at phone 390x844 dsf 2 and desktop 1440x900: four verdicts OK, contrast_fails 0, overlap_pairs 0, hierarchy_violations 0, worst ratio 5.33 and 4.71 on register and 4.71 on login, one unmeasured h1 each. TEST ACCOUNTS: test_cs2dev_0929a and test_cs2form_0929a are this seat's throwaway PRODUCTION accounts with every sharing purpose OFF, so neither is discoverable; the daemon exposes no disable verb (nx_txtscan count disable=0 and suspend=0 in the appd source), so they are RECORDED here as test accounts. BOX: nx_health overall OK, 16 services, 0 degraded, 0 down; resmon swap_used 845 to 846 permil and mem_avail 438 to 452 permil across the deploy window, sustained_growers 0, worst committed nx_sovgit_git, not connect. The alpha is NOT this seat's: daemons.reg connect_alpha runs nx_connect_appd-5a5784a1.elf, pid 3843 start_ticks 527411182 digest_match 1, started before this deploy by another seat. Shipped, gate 75/75, referee grade OK, awaiting acceptance (operator ACCEPT owed).
2026-09-29	CN13-DEVICE	queue	W16 CONNECT-SHIP-2, WHAT IS OPEN after the production device sign-in shipped. (1) THE CRASH GUARD: every nx_connect_appd build from this tree loses the nx_crash.nx fault diagnostic because the import table is full (MAX_IMPORTS 256 in runtime/nx_import.nx; the compiler's crash-guard append is refused ERR_IMPORTS_FULL and the build proceeds UNGUARDED), so the served 50055a7c prints no fault diagnostic; the daemon still dies by the original signal and is revived as before. Debt 1790657243 (sev 7) names the root fix, owed to the toolchain owner; the SEALED lane's next import into appd meets the same wall (row 1790656990). (2) THE PRODUCTION PAGE STILL SAYS ALPHA: a device-created account has no recovery phrase yet and /connect/register says so in an ALPHA note; the device-side recovery credential is the next rung. (3) THE FORM FALLBACK IS NOT ZERO-JS FOR SIGN-UP: the door needs the page script to solve its work (debt 1790636396 item a); sign-in by form stays zero-JS. (4) ACCOUNT HYGIENE, A MISSING VERB: production exposes no account disable or suspend verb through the daemon, so a test account can only be recorded (row 1790660210 records two); an owner and moderator disable verb, soft and additive, is owed as a rung WITH its rungrole row so the ladder contract holds. (5) The age band is self-declared and the guardian consent lane is not wired into the device path. (6) NOT RUN ON 50055a7c, WITH THE REASON: the alpha lane gates (nx_connect_alpha_device_gate, nx_connect_alpha_signup_gate, nx_connect_alpha_api_gate) drive the LIVE alpha, which is another seat's 5a5784a1, and the in-process gates (auth, mount, opaque client) test libraries this change did not touch; the production-mode evidence is the prod register gate 75/75 on the promoted gate plus the staged-mode rate gate 21/21 on the candidate bytes (job 1790658194). (7) THE KILL SWITCH IS DATA: device_production 0, or the row removed, in knowledge/connect_device.conf plus a daemon restart (the switch is read once at startup) returns production to its zero-JS forms byte for byte; the rollback binary is .prev 872a9cc9, banked. (8) ACCEPTANCE: referee grade OK (CM6 four verdicts, CM13 three journeys) and the seat's attestation are in; the operator ACCEPT row in knowledge/store/accept- is owed before CN13-DEVICE reads complete.
2026-09-29	CN13-DEVICE	lesson	W16 CONNECT-SHIP-2, three laws. (1) A GATE WHOSE OLD VERSION IS CORRECTLY RED AGAINST THE NEW SUBJECT SHIPS BY THE ENUMERATED CONTENT RULER, /api/promote WITH expect_sha256 AND A RE-RUN OF THE PROMOTED BINARY AGAINST THE DEPLOYED SUBJECT (the W16 ALPHA law of row 1790636701, re-applied): here the ruler lost nothing, so no loss flag was needed, and the re-run is what proves the promoted bytes judge the served bytes. (2) THE JOURNEYS GRAMMAR HAS NO WAIT STEP, AND THE CAPTURE CONF'S poll_ms IS THE WAIT: every click settles and sleeps one poll, so a scratch capture conf with poll_ms 1000 turned 18 heading clicks into 18 seconds of patience for the door's work and the KSF runs without pushing the step count past the 32-step cap, and the production register finished inside 4 of them; a data row, not a new step kind. (3) A PROCESS IDENTITY QUOTED FROM EARLIER WORK GOES STALE WHILE YOU WORK: this seat's own notes carried the alpha as bdeb97bc pid 20441 while daemons.reg and nx_proc_observe read 5a5784a1 pid 3843, re-deployed by another seat before this deploy; re-derive an identity from the registry and the process table before citing it, and give nx_proc_observe's argv0 mode the basename exactly as daemons.reg spells it (the inherited name read name_matches=0, which only says nothing ran under that name).
2026-09-29	CN7	measure	DECLARED, NOT PROMOTED, ON PURPOSE (wave 16): buildroot/_build/nx_connect_appd.sov.elf now holds the CN7 alpha build 5a5784a1 (1,338,512 B) while production serves 1,324,376 B, so nx_catalog reads BUILT != PROMOTED for nx_connect_appd; the sealed lane is stage-gated (inert on a production instance) and production belongs to CONNECT-SHIP-2 -- do NOT promote from this row. The helper nx_connect_sealed (a5b62a6b, 155,033 B) reads BUILT-UNPROMOTED because it is an alpha-local artifact installed at alpha_connect/nx_connect_sealed.elf, a root the catalogue cannot see. LIVE WITNESS at 1790660000: nx_proc_observe nx_connect_appd-5a5784a1.elf pid 3843 digest_match=1, enumeration_complete=1. Two scratch fossils of this leg remain, sources already retired: buildroot/_build/nx_connect_appd_cn7w16.sov.elf (1,226,368 B) and buildroot/_build/nx_connect_sealed_cc.sov.elf (146,058 B); nx_retire_path REFUSES any .elf by name (code=4 token=.elf), so their disposition belongs to the build-artifact owner. The import census (knowledge/status/importers.tsv, 789,891 B) carries no nx_connect_sealed_api.nx row yet, which is why the ranker reads LIB-UNCENSUSED until its daily nx_eco_graph_build then nx_importcensus pass.
2026-09-29	CN7	land	ACCEPTANCE WATCH ROW on connect.matrix, right below the CN7 mechanical row: 'Sealed messages ACCEPTED as complete (CN7: operator, referee, seat)', organ runtime/nx_accept_decl.nx, symbol _ABSENT_:ga_accept_connect_sealed (CAS edit on h9a29455e1b151e87, 32593 -> 33374 B). It flips only through nx_accept emit on an operator ACCEPT row whose targets carry ga_accept_connect_sealed plus a referee row and a seat attestation. Republished by nx_compare_regen_scoped (job 1790660235: published=2 fails=0 verdict=GREEN, index.html 1,612,134 B prev 1,602,484, api.json 133,293 B, fork FRESH a892f53b); nx_page_verify GREEN status 200, a11y-issues 0 (job 1790660275).
2026-09-29	CN7	lesson	THE NEW ACCEPTANCE CELL RENDERS DARK ('EXISTS but does not declare ga_accept_connect_sealed: something shipped at this path under another name') -- and so does every acceptance row measured (charsim ga_accept_face over the same organ; dcc ga_accept_boneheat and ga_accept_curveskel, whose organ runtime/nx_accept_gate.nx can never carry a subject declaration at all). A DARK predicate that cannot tell the GENERATED acceptance-declarations file (empty of every unaccepted subject by design) from a hand-written organ convicts every awaiting subject of having shipped under another name. Filed debt 1790660361 (sev 5) for the compare-emitter RACI lane: an AWAITING-ACCEPTANCE state for that one organ, a neg-control that any other organ lacking its symbol still reads DARK, and a repoint of the nx_accept_gate.nx rows. The cell is left in place because the doctrine requires it and its note tells the truth.
2026-09-29	CN13-DEVICE	land	W16 CONNECT-SHIP-2, THE PRODUCTION GATE IS ON AN EXECUTION SURFACE NOW: nx_connect_prod_register_gate was on no roster and no connect.gates row (a gate nobody runs is a comment), so it went through the mechanical admission, never a hand edit: nx_gate_roster_run trial over a one-row list (/tmp/cs2dev_roster_trial.jrnl: GREEN exit=0 ms=15425, 75/75 again, the runner forking the gate BARE so its default subject, the served nishihost/nx_connect_appd.elf, is what it judges), then nx_gate_roster_run admit with deadline 60000 ms, the beat's own per-gate kill bound GRR_MS_DEFAULT: admitted_new=1 already=0 suspects=0 rejected=0, partition reconciles, knowledge/gateroster.conf 109289 to 109319 B ending in the gate's name. Each beat run forks two scratch production instances of the served binary on a scratch port and writes only under /tmp/nx_connect_prod_register_gate/run-EPOCH (one dir per run, nothing reaps them yet, as with nx_connect_sealed_api_gate). /compare/connect republished through nx_compare_regen_scoped --domain connect (job 1790660405, verdict GREEN, fork fresh, index.html 1612134 to 1621783 B carrying rows 1790660210 to 1790660230), nx_page_verify GREEN on the page.
2026-09-29	CN7	land	ROSTERED AND SELF-CLEANING: nx_connect_sealed_api_gate is on knowledge/gateroster.conf, hand-added with its reason (its edge twin nx_connect_alpha_sealed_gate is deliberately NOT rostered: every run registers three alpha accounts with no reap). Before the beat could run it, the gate learned to remove its own scratch: csag_rm walks each run directory (files, the knowledge/ conf directory, then the directory itself; it walks again after any walk that removed something and COUNTS what it could not remove) and tooth C1 asserts nothing is left. Three CAS edits on a predicted size ladder (21677 -> 22223 -> 24542 -> 24866 B: consts first, the function second, the use last), SHIPPED by nx_organ_ship 6b667a2d prove=GREEN 30/30, ADOPT APPROVED content GREEN (job 1790660911), and the PROVE run's directories are gone. BITE: aim csag_rm site 28 (depth > 0, so the conf directory is never walked) KILLED, restore byte-identical 24866 B, both twins RESTORED, mutant_live=0 (job 1790661056). LEFT BEHIND, named: 7 directory pairs under /tmp/nx_connect_sealed_api_gate/ written by the pre-C1 binary (this leg's dev runs and ship proves, the old live binary's adopt probe) and the killed mutant; no delete verb this seat may call reaches a /tmp tree, and the promoted gate removes only its own run. NOTE for the syscall owner: this is the eighth hand-rolled unlinkat AT_REMOVEDIR in buildroot/runtime (nx_absent REMOVEDIR: 15 matches, coverage_complete=1); nx_syscalls has sys_unlinkat but no directory twin.
2026-09-29	CN7	queue	OPEN on CN7 at return (wave 16 SOTA-SEALED-MESSAGING, T0 1790654755). The mechanical cell reads done on its symbol; the done-rule is NOT fully met and the rung awaits acceptance (ga_accept_connect_sealed row added). (1) THE UNAUTHENTICATED STREAM IS NOT RETIRED: /connect/secure's in-browser client (runtime/nx_connect_e2e_client.nx) still seals with ChaCha20 plus a SHA3-256 tag and does not call this lane. Retirement needs a wasm build of the cseal envelope (ChaCha20-Poly1305 via nx_connect_seal) and the franking commitment, the per-sender key as nx_connect_franking derives it from the device X25519 agreement, POST <mount>/secure/v1/send, inbox open with the recipient check, and the report verb -- and debt 1790457092 (two DEVICES of one sender reuse a ChaCha20-Poly1305 nonce) turns live the moment that client runs on two devices, so per-device keys land first. (2) A VERIFIED REPORT FILES NOTHING DURABLE: no queue row, no CSAE sink attempt -- debt 1790660252 (sev 6), incumbent semantics nx_connect_groupmod cgm_report_message and cgm_file. (3) production /connect is not on the lane (CONNECT-SHIP-2's lane; nothing promoted from this leg). (4) acceptance: operator ACCEPT row, referee row and seat attestation owed; the acceptance cell renders DARK by a generator rule (debt 1790660361). (5) FINISH reads LIB-UNCENSUSED until the daily nx_eco_graph_build then nx_importcensus pass. (6) the appd crash guard stays absent (debt 1790657243, the 256-module import cap). (7) each edge-gate run leaves three alpha accounts (alphasealsnd, alphasealrcv, alphasealmin plus epoch) with no reap. (8) two scratch _build fossils await the build-artifact owner (nx_retire_path refuses .elf).
2026-10-01	CN18	measure	BARFRESH 2026-10-01 (seat residue-fleet, T0 1790856940): before STALE (SB-CONNECT-2609 UNATTESTED on the October clock), after FRESH (1 of 1 ATTESTED). The W3C Digital Credentials editor's draft was re-fetched over the sovereign fetcher and hashes to the 25 Sep pin (sha256 fc73f35013fb93e0, 729218 B); its publishISODate and its dt-published element still read 04 September 2026, so the bar month stands and nothing newer exists at the bar's own ref. The page needs a regen to show the October barscan.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/connect.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain connect, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from connect.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	6
scanned	6
fetched	5
reused	1
failed	0
named	6
candidates	6
mentions	6
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	Tandem	1	1	col0-tandem	named	https://tandem.net/
2	HelloTalk	1	1	col1-hellotalk	named	https://www.hellotalk.com/
3	Meetup	1	1	col2-meetup	named	https://help.meetup.com/hc/en-us/articles/40508976428941-Can-I-switch-from-a-paid-plan-to-a-cheaper-or-free-plan-to-organize-groups-on-Meetup
4	Discord	1	1	col3-discord	named	https://discord.com/blog/meet-dave-e2ee-for-audio-video
5	Signal	1	1	col4-signal	named	https://signal.org/blog/spqr/
6	Matrix	1	1	col5-matrix	named	https://matrix.org/blog/2026/08/14/this-week-in-matrix-2026-08-14/

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 64 capabilities: 38 exclusive to it and 26 shared with other boards. Shared rows on this page: 26 = home here 14 + home elsewhere 0 + ambiguous 0 + undecided 12 + refused 0 (partition 26); undecided = unmapped 0 + unproven 12 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=6414.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
mx_inter_popc	`nx_connect_match_lib.nx`	connect*, faithsocial	connect	rung	plan	home here
ln_min	`nx_connect_lanes_lib.nx`	connect, faithsocial, youthsafety	—	none	unproven	undecided
hmix	`nx_connect_idage.nx`	connect+, faithsocial, youthsafety	connect	gates	gates	home here
yw_may_channel	`nx_connect_youth_lib.nx`	connect, faithsocial, youthsafety	—	none	unproven	undecided
sink_fails	`nx_connect_csae_report_lib.nx`	connect, youthsafety	—	none	unproven	undecided
ev_rsvp	`nx_connect_events_lib.nx`	connect, faithsocial	—	none	unproven	undecided
ty_active	`nx_connect_presence.nx`	connect+, youthsafety	connect	gates	gates	home here
hx_find	`nx_connect_h2h_exceed.nx`	connect, faithsocial	—	none	unproven	undecided
rc_inter_popc	`nx_connect_lds_reconnect_lib.nx`	connect, faithsocial	—	none	unproven	undecided
abuse_score	`nx_connect_blind_abuse_lib.nx`	connect, faithsocial, youthsafety	—	none	unproven	undecided
grp_can_post	`nx_connect_group_lib.nx`	connect, faithsocial, youthsafety	—	none	unproven	undecided
pl_vote	`nx_connect_polls_lib.nx`	connect, sharehub	—	none	unproven	undecided
wd_forbidden_count	`nx_connect_wards_lib.nx`	connect, faithsocial	—	none	unproven	undecided
room_admit	`nx_connect_lds_room_lib.nx`	connect, faithsocial, youthsafety	—	none	unproven	undecided
ce_emit_html	`nx_connect_e2e_client.nx`	connect+, faithsocial, youthsafety	connect	gates	gates	home here
cs_page_login	`nx_connect_serve.nx`	connect+, faithsocial	connect	gates	gates	home here
gini_permil	`nx_connect_fair_rank.nx`	connect, faithsocial	—	none	unproven	undecided
cl_mobile_shell	`nx_connect_client.nx`	connect*+, faithsocial	connect	rung	plan	home here
lq_cohort_seed	`nx_connect_liquidity.nx`	connect*+, faithsocial	connect	rung	plan	home here
nn_match_train	`nx_connect_neural.nx`	connect*+, faithsocial	connect	rung	plan	home here
csu_signup_admit	`nx_connect_signup.nx`	connect*+, faithsocial, youthsafety+	connect	rung	plan	home here
ccl_circle_reach	`nx_connect_circles.nx`	connect*+, faithsocial, youthsafety+	connect	rung	plan	home here
cfa_tradition_admit	`nx_connect_faith.nx`	connect*+, faithsocial	connect	rung	plan	home here
csh_need_match	`nx_connect_service.nx`	connect*+, faithsocial	connect	rung	plan	home here
cvh_person_attest	`nx_connect_personhood.nx`	connect*+, faithsocial, youthsafety	connect	rung	plan	home here
acc_realm_unify	`nx_connect_realm.nx`	connect*+, faithsocial	connect	rung	plan	home here

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395519 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[tandem] Tandem. Tandem Language Exchange App -- find conversation exchange partners; FAQ on the page: Tandem is free to use, and Tandem Pro is a premium subscription offering unlimited translations, profile visitor insights, advanced search filters and an ad-free experience. Vendor page. publisher · read in our library knowledge/fetched/cmp_connect_tandem.html · pin h5b678043305e296087286752697a787bcfd6a4f6525359ea8b9117c7e4fae4b9 · accessed 2026-08-20 · vendor-docGrounds: The Tandem column: Best on "Reciprocal language-partner matching" (Tandem defined the category at scale) and the "Zero paywalled connection features (incl unlimited translation)" row -- the vendor's own FAQ states unlimited translation sits behind Tandem Pro, which is what the row's zero-paywall grade is measured against.
[hellotalk] HelloTalk. Learn Languages with Native Speakers -- connect with 70M+ language learners, practice 260+ languages (page description); built-in aids for translation, pronunciation, transliteration and corrections; the correction feature lets learners receive instant feedback from native speakers. Vendor page. publisher · read in our library knowledge/fetched/cmp_connect_hellotalk.html · pin h67ebbb25ccc4f2d8d8f7407946397202220e6e67a49e9b3f06dd9082e71d25c1 · accessed 2026-08-18 · vendor-docGrounds: The HelloTalk column: Best on "In-chat correction learning loop" (the note: HelloTalk correction is its signature), "Inline in-chat translation" and "Profile + moments feed" (Moments is core to it) -- the vendor page names corrections, translation and Moments as its features, which is what those Best codes describe.
[meetup-plans] Meetup Help Center. Can I switch from a paid plan to a cheaper or free plan to organize groups on Meetup? -- organizer subscriptions are Standard or Pro (paid); the free Starter plan is only for first-time organizers and includes one group, two events per month and a 10-person limit per event. publisher · read in our library knowledge/fetched/cmp_connect_meetup_plans.html · pin h5b45d5540889e24340a5ead9c0967c75f609e304ab0b6e3ad6b2182f55eb3633 · accessed 2026-08-18 · vendor-docGrounds: The Meetup column: Best on "Real-world events + RSVP" (the category king) and the "Zero paywalled connection features" row -- the help center states organizing beyond the Starter limits is a paid subscription, which is the fee the row's zero-fee grade is measured against (the exact monthly price is on the prices page cited separately).
[discord-dave] Discord. Meet DAVE: Discord's New End-to-End Encryption for Audio and Video (Discord blog) -- E2EE for voice and video calls using Messaging Layer Security (RFC 9420) for group key exchange, per-sender media keys, an SFU that cannot decrypt media, and an epoch-authenticator Voice Privacy Code. publisher · read in our library knowledge/fetched/cmp_connect_discord_dave.html · pin h87d903549189a1f79746c7373b2daaceb1e153d9529d462c9511bb4215926f5a · accessed 2026-08-18 · vendor-docGrounds: The "E2E content-blind group video receive (SVC, server decodes 0)" row: Discord DAVE is the parity bar the row names and codes Best for Discord; the same page states DAVE is built on MLS, which is why the "E2E scale ceiling" row cites RFC 9420 as the shared architectural ground.
[discord-terms] Discord. Terms of Service -- age requirements: by accessing the services you confirm you are at least 13 years old and meet the minimum age required by the laws in your country; the services are not directed at users under 13. publisher · read in our library knowledge/fetched/cmp_connect_discord_terms.html · pin hf4199c0c5a5534da11975604d617f3cd7b37d6983a8fcd6a115e764855586672 · accessed 2026-08-18 · vendor-docGrounds: The "Structural adult-minor wall (two-deep, SERVES youth)" exceed row note ("Discord admits 13 up"): the vendor's own terms set the 13-plus admission, against which the two-deep youth wall is the differentiator; the row's grooming-problem clause is grounded separately by the banked bytes named in the matrix, not by this reference.
[rfc9420] Barnes, R., Beurdouche, B., Robert, R., Millican, J., Omara, E., Cohn-Gordon, K. RFC 9420: The Messaging Layer Security (MLS) Protocol. IETF, July 2023. publisher · read in our library knowledge/fetched/cmp_connect_rfc9420.html · pin h158ab3ce6241c8bb8516bebe57a27d316846d34e62099d6feab2992a90110827 · accessed 2026-08-18 · published-standardGrounds: The "E2E scale ceiling (MLS RFC9420 thousands; O(page) receive)" row: the logarithmic group-key tree that lets a group scale to thousands is this protocol, and the row is honest that ours is a cited architectural model while the 2026 field ships this protocol in production.
[rfc6238] M'Raihi, D., Machani, S., Pei, M., Rydell, J. RFC 6238: TOTP: Time-Based One-Time Password Algorithm. IETF, May 2011. publisher · read in our library knowledge/fetched/cmp_connect_rfc6238.html · pin h3913d8c109d2193e9dec319cacd8712b6423af5cc027b766c15081a3255f1c91 · accessed 2026-08-18 · published-standardGrounds: The "TOTP-class 2FA + single-use recovery + lockout" row: the OTP function is a named RFC-6238 drop-in on the in-tree HMAC-SHA1 (the estate's totp extvec gate verifies it against this RFC's test vectors), so the row's Yes across all columns has one published definition.
[gdpr-art9] Regulation (EU) 2016/679 (GDPR), Article 9 -- Processing of special categories of personal data (religious or philosophical beliefs among the prohibited categories absent explicit consent or another listed basis); consolidated text as mirrored by gdpr-info.eu. publisher · read in our library knowledge/fetched/cmp_connect_gdpr_art9.html · pin h24fde5a68cbd32beec7bc5f67d2d5fa91f9448b6b03acf0e707e219b01004a10 · accessed 2026-09-25 · published-standardGrounds: The "Profile + moments feed + stories" row note ("faith-consent-gated (Art.9)") and the "Contextual brought-to-you-by ads (minor-walled, faith-blind)" row: faith is an Article 9 special category, which is why the schema gates it on explicit consent and the ad engine is faith-blind by construction.
[usc-2258a] United States Code, Title 18, Section 2258A -- Reporting requirements of providers (mandatory reporting of apparent child sexual exploitation to the NCMEC CyberTipline). Legal Information Institute, Cornell. publisher · read in our library knowledge/fetched/cmp_connect_usc2258a.html · pin h373447aab6e8264f653e833cd90f2fbde5eabd017e503606312f3421f310892d · accessed 2026-08-18 · published-standardGrounds: The "Fail-closed mandatory CSAE reporting" row: the mandatory-report duty on providers is this statute; ours refuses to proceed when the report sink fails (sink_fails), whereas the incumbents' pipelines are best-effort -- the row's Part codes reflect a duty met, not a fail-closed guarantee.
[signal-spqr] Signal blog. SPQR -- the Sparse Post-Quantum Ratchet joins the Double Ratchet as a Triple Ratchet, so eventually all conversations move to the new protocol without user action. Signal, 2 Oct 2025. publisher · read in our library knowledge/fetched/cmp_connect_signal_spqr.html · pin h8c585add8e569e52c05086f44137e841f0393fce904318e20830788f5a6c3ade · accessed 2026-08-18 · vendor-docGrounds: The "Post-quantum hybrid key agreement" watch row: Signal is coded Best because SPQR is rolling out in production while our PQ composition is an open contract.
[signal-akv] Signal blog. Automatic key verification -- key transparency that complements safety numbers, with external auditors. Signal, 11 Aug 2026. publisher · read in our library knowledge/fetched/cmp_connect_signal_akv.html · pin h8a6a5bf14f3b9e23204a0eae47caccf5a10f09145650d58a7e9f7175e896329f · accessed 2026-08-18 · vendor-docGrounds: The "Identity-bound public-key directory (TOFU closed)" row: Signal shipped the same property at depth this month, which is why Signal codes Best beside our gate-proven binding.
[signal-calls] Signal blog. Call links post, carrying the 2026 update that group calls are supported for up to 75 people. publisher · read in our library knowledge/fetched/cmp_connect_signal_calllinks.html · pin h06a3b50f5346daed149f6a560665afc814400478d006f1ff7c76b050828f71c6 · accessed 2026-08-18 · vendor-docGrounds: The "E2E scale ceiling" row note: the Signal-calls-75 product cap is quoted from this page, replacing the old note's unsourced pairing of that number with Telegram's group cap.
[whatsapp-translate] WhatsApp blog. Introducing message translations -- translations occur on the device where WhatsApp cannot see them; six languages on Android and 19 plus on iPhone at launch, free. 23 Sep 2025. publisher · read in our library knowledge/fetched/cmp_connect_whatsapp_translate.html · pin h7df51ba944b7f5c91399ce1968b6c15b1fa0b751e17b14f1d717d90c84660d06 · accessed 2026-08-18 · vendor-docGrounds: The "Inline in-chat translation (unlimited, free)" row note: free on-device translation shipped by a 3-billion-user messenger is what moved the field, so unlimited-free inline translation is no longer an exceed for anyone.
[whatsapp-u13] WhatsApp blog. Introducing parent-managed accounts on WhatsApp -- accounts a parent or guardian sets up for pre-teens, messaging and calling only, still end-to-end encrypted. 11 Mar 2026. publisher · read in our library knowledge/fetched/cmp_connect_whatsapp_u13.html · pin he4aac6845c0d0a4708781d0117a06b14a3e0dd740d220225ba9cacb86a42f3bb · accessed 2026-08-18 · vendor-docGrounds: The "Privacy-preserving age assurance (band only, no ID stored)" row: the strongest incumbent under-13 approach of 2026, a guardianship model rather than a band attestation, which the row's Part codes describe.
[discord-dave-all] Discord blog. Every voice and video call on Discord is now end-to-end encrypted -- DMs, group DMs, voice channels and Go Live streams, by default, with no current plans to extend E2EE to text messages. 18 May 2026. publisher · read in our library knowledge/fetched/cmp_connect_discord_dave_all.html · pin heec9c7df775b0e582df47c87af845dcb00312e30133518f91a832c3cdd86b2bd · accessed 2026-08-18 · vendor-docGrounds: The "E2E content-blind group video receive" row (DAVE went universal, the parity bar moved) and the "Authenticated message sealing" row (Discord text staying non-E2E is why Discord codes No there); also the retirement ground for the old E2E-scale exceed.
[discord-teen] Discord press release. Discord launches teen-by-default settings globally -- all new and existing users worldwide get a teen-appropriate experience; only age-assured adults reach age-restricted spaces. 9 Feb 2026. publisher · read in our library knowledge/fetched/cmp_connect_discord_teen.html · pin h097a996931598e8bd6d5e562bebe945166accc294400c35f147ddabfe45f373a · accessed 2026-08-18 · vendor-docGrounds: The "Structural adult-minor wall (two-deep, SERVES youth)" exceed row: Discord's 2026 posture upgrades its column to Part, and the exceed survives because teen-by-default still permits adult-minor private DMs with no visible-context two-adult rule.
[discord-age] Discord blog. Getting global age assurance right -- the global rollout is delayed to the second half of 2026, and any partner offering facial age estimation must perform it entirely on-device. 24 Feb 2026. publisher · read in our library knowledge/fetched/cmp_connect_discord_age.html · pin h900f459ae3ed614d5f23dca436071cfcddafeba8544a46398c7b9fc071f52594 · accessed 2026-08-18 · vendor-docGrounds: The "Privacy-preserving age assurance (band only, no ID stored)" row: Discord's 2026 method set (on-device face estimation or ID) against which the band-only no-ID design is graded.
[discord-polls] Discord support. Polls FAQ -- native polls with up to 10 answers and up to a week duration. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_discord_polls.html · pin hff0ed16a30d302c8fbbdf0d0705a64cf4545a521e1a672578128a02c2eed9464 · accessed 2026-08-18 · vendor-docGrounds: The "Polls + quizzes (one voter one ballot, revote replaces)" row: the Discord Yes.
[apple-rcs] Apple Newsroom. End-to-end encrypted RCS messaging begins rolling out today in beta -- iOS 26.5 with the latest Google Messages on supported carriers, encryption on by default. 11 May 2026. publisher · read in our library knowledge/fetched/cmp_connect_apple_rcs.html · pin hd68f2cde5738f5582505fb2f6c98efee9e922bc4af75c0ba9ca24d71f6cb4db8 · accessed 2026-08-18 · vendor-docGrounds: The "E2E scale ceiling" row (MLS shipped cross-vendor, retiring the exceed) and the "Federation and third-party E2E interop" watch row: iPhone-Android interoperable E2EE is the 2026 shift the watch names.
[apple-livetranslate] Apple Newsroom. New Apple Intelligence features are available today -- Live Translation in Messages, FaceTime and Phone runs entirely on device. 15 Sep 2025. publisher · read in our library knowledge/fetched/cmp_connect_apple_livetranslate.html · pin h7a54508249746c6e649daa5e75638105df5eedb76bf87c366231cd5405799cde · accessed 2026-08-18 · vendor-docGrounds: The "Inline in-chat translation" row note (on-device translation as table stakes) and the "Live voice translation inside calls" watch row: the on-device field bar.
[gsma-rcs] GSMA. RCS encryption -- a leap towards secure and interoperable messaging: RCS becomes the first large-scale messaging service to support interoperable E2EE between client implementations from different providers, built on MLS. 14 Mar 2025. publisher · read in our library knowledge/fetched/cmp_connect_gsma_rcs.html · pin h540ea147ebdbb20778d6da067969341b2b5a80ca5ea3f14f118be7398a76c60e · accessed 2026-08-18 · vendor-docGrounds: The "Federation and third-party E2E interop" watch row: the published standard behind the cross-vendor shift.
[wire-mls] Wire blog. Wire MLS is now generally available -- the GA release has been tested to support up to two thousand group members, each with up to eight devices. April 2025. publisher · read in our library knowledge/fetched/cmp_connect_wire_mls.html · pin hca8f68fecf942edc975aa30b904ee8a2516d55a17a7b01ff158faf00fb22a2aa · accessed 2026-08-18 · vendor-docGrounds: The "E2E scale ceiling" row: a shipped MLS deployment at the thousands scale our model cites, part of why the exceed retired.
[webex-mls] Webex Help Center. End-to-end encryption with identity verification for Webex meetings -- zero-trust E2EE using MLS, up to 1000 participants. Updated 13 Jul 2026. publisher · read in our library knowledge/fetched/cmp_connect_webex_mls.html · pin hf79c6a5889185846c4f3ec21bd29d641c5ad8ec33c95e31710d265ad47d0ec00 · accessed 2026-08-18 · vendor-docGrounds: The "E2E scale ceiling" row: a second shipped MLS deployment at four-digit scale.
[element-bundeswehr] Element case study. Bundeswehr -- with more than 100000 active users, secure open source messaging on Matrix is the real-time communications standard of the German Armed Forces. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_element_bundeswehr.html · pin hc2e47623cde9a3d2f17adda220c207293a0c7a7f250d68911d75fe8b76877f3b · accessed 2026-08-18 · vendor-docGrounds: The "Sovereign self-host + zero vendor metadata" row: self-hosted secure messaging ships at national scale, which is why Matrix codes Best there and the old exceed retired.
[matrix-twim] Matrix.org blog. This Week in Matrix, 14 Aug 2026 -- the Spec Core Team continues to focus on Matrix 2.0 MSCs with an aim of cutting the release soon. publisher · read in our library knowledge/fetched/cmp_connect_matrix_twim.html · pin h06f6ff4be6f2e9e44d3a84c60d3bd1b838a79b6b92d238fc3e432581722b2430 · accessed 2026-08-18 · vendor-docGrounds: The Matrix column baseline: Matrix 2.0 is still uncut and MLS-in-Matrix remains research as of this issue, which grounds the Part codes on the Matrix E2E rows.
[telegram-faq] Telegram FAQ. Groups can hold up to 200000 members; server-client encryption is used in cloud chats, and only Secret Chats add client-client encryption. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_telegram_faq.html · pin ha77362d4d46479b8e3535953641b8771d6069f1b3645240a4c38fc691eb259cf · accessed 2026-08-18 · vendor-docGrounds: The "E2E scale ceiling" row note correction: Telegram's 200000 is a group-size cap, not an E2E cap -- its groups are not end-to-end encrypted at all, which the old note conflated.
[ep-csar] European Parliament press release. Child sexual abuse online -- Parliament supports extending the voluntary-detection rules until 3 August 2027 and states voluntary measures should not apply to end-to-end encrypted communications. 11 Mar 2026. publisher · read in our library knowledge/fetched/cmp_connect_ep_csar.html · pin hb934ded57b1bec39e8677d321e2f43bc2a9dbff57b4767873daa200dcb41817f · accessed 2026-08-18 · published-standardGrounds: The "Fail-closed mandatory CSAE reporting" and "Content-blind abuse detection" rows: the 2026 EU frame keeps E2E content out of scanning duties, which is the legal ground under content-blind behavioral detection.
[snap-u16] Snap Newsroom. A friends-only way to create and share for Snapchatters under 16, with an optional, safeguarded introduction to public sharing at 16-17. 10 Jun 2026. publisher · read in our library knowledge/fetched/cmp_connect_snap_u16.html · pin h708aeaf6abb575610eb5526271fadf296cd14011506ffa6b61578406c818c4c3 · accessed 2026-08-18 · vendor-docGrounds: The "Structural adult-minor wall (two-deep, SERVES youth)" exceed row: the strongest minor-default outside the column set in 2026, still a visibility default rather than a structural two-adult rule.
[eu-avapp] European Commission news. Commission urges fast rollout of the EU age verification app -- member states should accelerate deployment by the end of 2026 so users can prove their age without sharing unnecessary personal data. 29 Apr 2026. publisher · read in our library knowledge/fetched/cmp_connect_eu_avapp.html · pin hd0b285a50f52d5a54fc3493a488d58f04fc911debc57fef94cc75362997f0789 · accessed 2026-08-18 · published-standardGrounds: The "Privacy-preserving age assurance (band only, no ID stored)" row: the EU blueprint converges on exactly the minimal-disclosure shape the band-only design implements.
[iso27566] ISO/IEC 27566-1:2025. Information security, cybersecurity and privacy protection -- age assurance systems, part 1: framework. Published December 2025 and made freely available. publisher · read in our library knowledge/fetched/cmp_connect_iso27566.html · pin h35744b70b3ccead47b8cb5fe4f42e59d4a4ab6d876ef76715d6a67dbbc967146 · accessed 2026-08-18 · published-standardGrounds: The "Privacy-preserving age assurance (band only, no ID stored)" row: the published framework the band attestation aligns to.
[meetup-prices] Meetup Help Center. Organizer subscription prices overview -- Standard 29.99 USD per month, Pro from 47 USD per group per month on longer terms. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_meetup_prices.html · pin h17323dad20662f25a6cfba230ed2578e37f66bc56cae7e0825d58d6a0dae66c1 · accessed 2026-08-18 · vendor-docGrounds: The "Real-world events + RSVP" and "Zero paywalled connection features" rows: the organizer fees the zero-fee note quotes.
[meetup-starter] Meetup blog. Introducing Meetup Starter -- the free plan holds one group, up to two in-person events per month and up to ten attendees per event. 11 Oct 2024. publisher · read in our library knowledge/fetched/cmp_connect_meetup_starter.html · pin h5ea5da3236629dcb0120a2f89ef27d7f6dcee7f50d1419cc81dcbefc15d5bed2 · accessed 2026-08-18 · vendor-docGrounds: The "Real-world events + RSVP" row: the free-tier caps behind the Meetup Best-with-fees grade.
[meetup-age] Meetup Help Center. Meetup member restrictions -- members and organizers must be at least 18 years of age. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_meetup_age.html · pin h67ab02c86cc49bb665ffebe367f7e5d3e730e83522601feb7add1816c4468edb · accessed 2026-08-18 · vendor-docGrounds: The "Structural adult-minor wall (two-deep, SERVES youth)" exceed row: Meetup serves no youth at all -- exclusion, not protection -- which is what the two-deep wall differentiates against.
[timeleft] Timeleft. Dinners with strangers across 52 countries and 200 plus cities, 3M plus members, 18 plus. Vendor page, accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_timeleft.html · pin hc03cc3c6d5be4cf5440d5a80c08cbc4ba6c5340ea3589fec8078814e4fd578cb · accessed 2026-08-18 · vendor-docGrounds: The "Connection-quality funnel (replies/meetings, not time-on-app)" row: the 2026 IRL-first challenger class whose success metric is met strangers, the same funnel philosophy the row measures.
[luma] Luma pricing. The free plan takes 5 percent of paid tickets; Luma Plus at 59 USD per month takes 0 percent. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_luma.html · pin hcdeb98712168d3b9401184b87717e3cb74ea360134a936a21f22d8b4d1698f20 · accessed 2026-08-18 · vendor-docGrounds: The "Real-world events + RSVP" row: event-fee context beyond Meetup, against which zero-fee events are graded.
[hellotalk-vip] HelloTalk FAQ. What does VIP membership unlock -- no ads, unlimited translations, unlimited transliteration, unlimited voice-to-text transcription, contact 25 new partners per day, learn multiple languages, search by gender, view profile visits. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_hellotalk_vip.html · pin h8e46cef04a187a783a5e60c0088a78a60f75593ea9819bff0700665d3b161d76 · accessed 2026-08-18 · vendor-docGrounds: The "Zero paywalled connection features (incl unlimited translation)" row: the VIP paywall list quoted from the vendor's own FAQ.
[hellotalk-minor] HelloTalk FAQ. Partner matching -- minors under 18 years old can only search for other minors. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_hellotalk_minor.html · pin h21c257633ef382f5058d6ccc600ec839859e1a4155e1df02912fbea3d2e09e0e · accessed 2026-08-18 · vendor-docGrounds: The "Structural adult-minor wall (two-deep, SERVES youth)" exceed row: HelloTalk's minor-segregated search is the nearest incumbent analogue and still stops short of a visible-context two-adult rule.
[tandem-overview] Tandem blog. Tandem app overview -- Tandem Pro unlocks the AI Toolkit (Translate, Grammar Check, Word Finder, Inspire, Rewrite, Explain Corrections), unlimited translations and audio transcription; all limits and caps are removed on Pro. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_tandem_overview.html · pin ha947823ad93d1d10ce14cb63b70e44286bc46e0dfa9833fa4619d5c586912436 · accessed 2026-08-20 · vendor-docGrounds: The "Inline in-chat translation" row (the Pro gate) and the "AI conversation-practice partner" watch row (the AI Toolkit is Tandem's in-column AI state).
[tandem-guidelines] Tandem community guidelines. Tandem is not a dating app -- those with no interest in learning are asked to look elsewhere. 14 Jul 2025. publisher · read in our library knowledge/fetched/cmp_connect_tandem_guidelines.html · pin hccac900f8278de544e97741ecf69c6f3a39dd168296fa27b1f83db5f43012e4e · accessed 2026-08-18 · vendor-docGrounds: The "Consented intent lanes (mutual-min escalation)" row: the policy-only intent model the lanes row replaces with a consent state machine.
[duolingo-videocall] Duolingo blog. Product highlights -- Video Call with Lily is available in Spanish, Portuguese, French, Italian, German, Chinese, Japanese and Korean for speakers of 28 languages. 10 Dec 2025. publisher · read in our library knowledge/fetched/cmp_connect_duolingo_videocall.html · pin hf342a673518a38c6da55af9a3ee478b5ea9f2b59bb9354d278ae9aff42b79579 · accessed 2026-08-18 · vendor-docGrounds: The "AI conversation-practice partner" watch row: the mainstream AI-practice bar the watch is graded against.
[google-practice] Google blog. Language learning and live translation in Google Translate -- a beta practice mode for learners plus live conversation translation. 26 Aug 2025. publisher · read in our library knowledge/fetched/cmp_connect_google_practice.html · pin h87f7cbd9a3951f9d773cb969ee764a16e688b6a239cb9707fe2c6594fd5697b8 · accessed 2026-08-18 · vendor-docGrounds: The "AI conversation-practice partner" watch row: free AI practice from a platform vendor, part of the bar outside the column set.
[google-livetranslate] Google blog. Gemini 3.5 Live Translate -- near real-time speech-to-speech translation in over 70 languages. 9 Jun 2026. publisher · read in our library knowledge/fetched/cmp_connect_google_livetranslate.html · pin h95869961eb5d829caeb95090a0585e9e87c327a43f9444b6ef4b081c875dd591 · accessed 2026-08-18 · vendor-docGrounds: The "Live voice translation inside calls" watch row: the 2026 speech-to-speech field bar.
[wmt25] Kocmi, T. et al. Findings of the WMT25 General Machine Translation Shared Task -- 60 systems evaluated; the best overall system was a general-purpose LLM and human references won only a minority of language pairs. ACL Anthology, November 2025. publisher · read in our library knowledge/fetched/cmp_connect_wmt25.html · pin hb06e91b1e5fba2a03052be4cc5e5c182b6504514ea617fef22a893018069c670 · accessed 2026-08-18 · published-paperGrounds: The "Inline in-chat translation" row and rung CN9: LLM-class systems lead the published translation benchmark, which is why real NMT routes through the estate's LLM serve rather than a dedicated MT engine.
[church-gh20] General Handbook 20.7.1, The Church of Jesus Christ of Latter-day Saints -- at least two adults must be present at all Church activities attended by children and youth. publisher · read in our library knowledge/fetched/cmp_connect_church_gh20.html · pin h22557b24bf96e49ea5db246efaed3b0f82c19ff802f02d5986260dabeec64126 · accessed 2026-08-18 · published-standardGrounds: The "Structural adult-minor wall (two-deep, SERVES youth)" exceed row and the "Youth game and hangout rooms" row: the published two-deep norm the wall encodes as a hard information-flow invariant.
[church-membertools] About Member Tools, The Church of Jesus Christ of Latter-day Saints -- directory, messages, organizations, calendar and reports; version 5.6, planned around August 2026, adds group administration. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_church_membertools.html · pin hdad65bca4f7d2a8cdc93b1bb07d37371b5622d618f07b38d14bc75d5d3c6a8f1 · accessed 2026-08-18 · vendor-docGrounds: The "Ward and branch community boundary" row (the admin tooling whose field classes the registry refuses by construction) and the "Member-missionary reconnection" row (the official app shares mission-leader contacts one-way only, so two-way service-era reconnection remains unmodeled by any incumbent).
[ncmec] NCMEC CyberTipline data -- 21.3 million reports in 2025 and online enticement up 158 percent. Accessed 2026-08-18. publisher · read in our library knowledge/fetched/cmp_connect_ncmec.html · pin hdbcff254933b1735fcaad414c979894002d85128ff49b2089c295ad675a7dee0 · accessed 2026-08-18 · datasetGrounds: The "Fail-closed mandatory CSAE reporting" row: the caseload trend behind refusing to proceed when the report sink fails.
[rfc7748] Langley, A., Hamburg, M., Turner, S. RFC 7748: Elliptic Curves for Security. IETF, January 2016. publisher · read in our library knowledge/fetched/cmp_connect_rfc7748.html · pin h6f29d1b3f33586e99a191e8158b0aa1d0040d892d56506c11fc0573b354cec10 · accessed 2026-08-18 · published-standardGrounds: The "In-browser E2E client (X25519 agreement on the shipped wasm)" row: the X25519 function and the section 6.1 exchange the keyx gate proves on the shipped wasm bytes.
[rfc8439] Nir, Y., Langley, A. RFC 8439: ChaCha20 and Poly1305 for IETF Protocols. IETF, June 2018. publisher · read in our library knowledge/fetched/cmp_connect_rfc8439.html · pin h74a1cee6e19a9c9be8e3f7b9850ac0287f22dbd6823864cc0ed6e6434b00019c · accessed 2026-08-18 · published-standardGrounds: The "Authenticated message sealing (ChaCha20-Poly1305 AEAD, RFC 8439)" row: the AEAD construction the seal gate verifies, tamper-rejection included.
[rfc9807] Bourdrez, D., Krawczyk, H., Lewi, K., Wood, C. A. RFC 9807: The OPAQUE Augmented Password-Authenticated Key Exchange (aPAKE) Protocol. IETF, 2025. publisher · read in our library knowledge/fetched/cmp_connect_rfc9807.html · pin h0e1ee56460c024fff7057d3743eb73aa4382a4fc274eb484597d6d43b41274cb · accessed 2026-08-18 · published-standardGrounds: The "Passwordless-at-rest login (OPAQUE aPAKE, RFC 9807)" row: the protocol the live login runs, with no password-equivalent at rest.
[dcapi-2609] W3C Federated Identity Working Group. Digital Credentials -- W3C Editor's Draft 04 September 2026, editors from Apple Inc., Okta and Google Inc.; its presentation-protocol registry names org-iso-mdoc (ISO/IEC 18013-7:2025 Annex C, mobile driving licence add-on functions), it cites the ISO/IEC 18013-5 mDL formats, and its privacy considerations name the increased potential for surveillance and restrictions on pseudonymous use of online services. Mirrored from the latest editor's draft URL the spec itself names, because w3.org/TR answered the sovereign fetcher 403. publisher · read in our library knowledge/fetched/cmp_connect_w3c_dcapi.html · pin hfc73f35013fb93e0242cea7d60cf349ec8e53e99b650e68f2369c6258b47d805 · accessed 2026-09-25 · published-standardGrounds: The "Verified person without storing identity (credential presentation or two-member vouch)" watch row, the dated bar SB-CONNECT-2609 and the frontier target T-FRONT-CONNECT: the September 2026 browser-mediated credential presentation over a mobile driving licence that rung CN18 composes into a personhood and age-band claim with nothing else stored.
[fido-passkeys] FIDO Alliance. Passkeys -- unlike passwords, passkeys are phishing-resistant, are always strong, and are designed so that there are no shared secrets; passkeys simplify account registration for apps and websites; device-bound passkeys offer a phishing-resistant, hardware-backed root of trust. Page modified 16 Sep 2026 (dateModified in the page metadata). publisher · read in our library knowledge/fetched/cmp_connect_fido_passkeys.html · pin h78887a689fa59155ce98653c78c72a4166af2362f4fe2d149b891906d99fba0e · accessed 2026-09-25 · vendor-docGrounds: The "Private, secure sign-up (OPAQUE, no phone or email, consent off by default)" watch row and the best-in-class target T-BIC-CONNECT: the phishing-resistant, no-shared-secret sign-up bar that rung CN13 meets beside the OPAQUE envelope.
[arxiv-ageassure] arXiv listing, all:"age assurance" sorted by submission date, read 2026-09-25 (4 results). Newest: Ma, Dumaru, Synaepa-Addison, Kropczynski, Wisniewski. Reconceptualizing Age Assurance as a Sociotechnical Problem (arXiv 2609.13598, 11 Sep 2026) -- reviews 85 publications on children's age assurance from 2020 through February 2026 and introduces the Age-Assurance Process Framework connecting evidence, evaluation, claims and decisions. Also Lueks, Dreyer, Federrath, Simon. Assessing Age Assurance Technologies (arXiv 2603.25695, Mar 2026) -- online, offline device-based and offline credential-based architectures weighed in a graduated hierarchy of effectiveness against side effects. publisher · read in our library knowledge/fetched/cmp_connect_arxiv_ageassure.xml · pin h4691ab63fbae44be3f5d856267f36941483a500314ddbf9ff219b26dbc04b09c · accessed 2026-09-25 · mirrored-indexGrounds: The barscan attesting newest=2026-09 for age assurance, the dated bar SB-CONNECT-2609 and the "Verified person without storing identity (credential presentation or two-member vouch)" watch row: September's framing of age assurance as an accountable process from evidence to a claim to a decision.
[arxiv-passkeys] arXiv listing, all:passkeys sorted by submission date, read 2026-09-25 (10 entries), classified by subject before taking the newest: 4 are machine-learning passkey-retrieval homonyms (2608.21308, 2608.03994, 2608.02347, 2606.18781) and 1 is SSH credential rotation (2608.09066); the newest on subject is Vaulted Passkeys, a device-bound proposal for authenticated credential export and import (arXiv 2608.13806, 13 Aug 2026), beside an analysis of attack vectors against FIDO2 authentication (2604.20826) and a census of passkey authentication on the top 100K sites (2602.15135). publisher · read in our library knowledge/fetched/cmp_connect_arxiv_passkeys.xml · pin hfe381eaaa5ded6c99ac07536141af4a348532b9ec2ad5c66e4195b3d47c6bc5a · accessed 2026-09-25 · mirrored-indexGrounds: The barscan attesting newest=2026-08 for passkeys on subject and the "Private, secure sign-up (OPAQUE, no phone or email, consent off by default)" watch row: the research edge of passkeys is device-bound export and import, not whether to use them.
[arxiv-datingapp] arXiv listing, all:"dating app" sorted by submission date, read 2026-09-25 (10 entries). Newest: Everyone Says Them -- deception typologies, probabilistic trust and grassroots safety knowledge among gay dating-app users in China (arXiv 2606.27284, Jun 2026); Hidden Elo -- private matchmaking through encrypted rating systems (arXiv 2603.26407, revised 14 Apr 2026); online dating romance scams targeting minors in Iran through parental pressure (arXiv 2601.16321, Jan 2026). publisher · read in our library knowledge/fetched/cmp_connect_arxiv_datingapp.xml · pin ha486f74b71322fae71107fac5f0b001bf39a688e35ce15870d46e70535a1cb54 · accessed 2026-09-25 · mirrored-indexGrounds: The barscan attesting newest=2026-06 for dating apps and the frontier target T-FRONT-CONNECT: private matching over encrypted signals is the research edge, and scams against minors are why the two-deep wall and adult-only dating lanes hold.
[signal-usernames] Signal blog. Keep your phone number private with Signal usernames -- your phone number is no longer visible to everyone you chat with by default, an optional username lets you connect without handing out your number, and you will still need a phone number to register for Signal. 20 Feb 2024. publisher · read in our library knowledge/fetched/cmp_connect_signal_usernames.html · pin hd289280a0bcbf6395e9b20fdbcabc8fe61bab106567bc0a2485da6cfca488d1b · accessed 2026-09-25 · vendor-docGrounds: The "Private, secure sign-up (OPAQUE, no phone or email, consent off by default)" watch row: the privacy leader keeps the number private after sign-up but still gates registration on it, which is why Signal codes Part there.
[mutual] Mutual. The LDS Dating App -- the largest dating app for members of The Church of Jesus Christ of Latter-day Saints, serving Latter-day Saint singles worldwide since 2016; tens of thousands of couples have met on Mutual and gone on to marry. Vendor page. publisher · read in our library knowledge/fetched/cmp_connect_mutual.html · pin he4977107e5ae747c20bdbabec94810ab09a61fc03556496b3152b2a548af6c74 · accessed 2026-09-25 · vendor-docGrounds: The "Christian traditions at equal fidelity (self-declared, consent-gated, never a filter)" watch row and the best-in-class target T-BIC-CONNECT: the one Latter-day Saint dating lane, single-tradition and adults-only, against which the consented adult intent lanes and the equal-fidelity tradition table are graded.
[bumble-safety] Bumble safety centre -- meet new people without sharing your phone number or email before you are ready; Photo Verification to help make sure a potential match is who they say they are; ID Verification among the features added in March 2025. Vendor page. publisher · read in our library knowledge/fetched/cmp_connect_bumble_safety2.html · pin h8e591d0a57ddda0b81747a998ea241fcf93c7d901e90b4793987430843c10468 · accessed 2026-09-25 · vendor-docGrounds: The "Private, secure sign-up (OPAQUE, no phone or email, consent off by default)" and "Verified person without storing identity (credential presentation or two-member vouch)" watch rows: dating-grade photo and ID verification with pre-contact privacy, outside the six columns.
[tinder-press] Tinder press room, read 2026-09-25 -- Tinder to Expand Facial Verification Feature Across the U.S., Setting a New Standard for Dating Safety (22 Oct 2025, Face Check); Tinder Launches Events, a new in-app feature bringing online sparks into real life (16 Mar 2026, the newest release on the page). publisher · read in our library knowledge/fetched/cmp_connect_tinder_press.html · pin hb227085eb22efdebb7eedca1d83f0f2f59334a38ccfb6b38e2fa5824bc3a0a46 · accessed 2026-09-25 · mirrored-indexGrounds: The "Verified person without storing identity (credential presentation or two-member vouch)" watch row: facial verification is the dating incumbents' 2025-26 norm, where ours presents a credential claim and stores nothing else.
[hinge-press] Hinge newsroom, read 2026-09-25 -- the Selfie Verification badge confirms someone looks like their photos and is required for the Signals badge; Face Check testing in the US as a quick step when users set up their profile to show they are a real person, with liveness checks among the enhanced verification processes. publisher · read in our library knowledge/fetched/cmp_connect_hinge_newsroom.html · pin h0742e1b3bd3821bf5c9f55cceda4c705fd33b4a3081c4c430ae7402eec407d0b · accessed 2026-09-25 · vendor-docGrounds: The "Verified person without storing identity (credential presentation or two-member vouch)" watch row: selfie and liveness checks at profile setup are the dating bar for proving a real person.
[hallow] Hallow, the Catholic prayer app -- the community surface named in the page's own interface strings: churches, groups and small groups, group chat, events, private groups, QR invites, parish and network broadcasts, pray-with-your-group, and member flagging for harmful behavior and inappropriate content. Vendor page. publisher · read in our library knowledge/fetched/cmp_connect_hallow.html · pin hd3d99e2102ebdcbc8014973948a915c2c67405b3e5a1666843f1aa979ae2a71e · accessed 2026-09-25 · vendor-docGrounds: The "Concentric community circles (family to mission to ward to stake to other Christians)" and "Scripture study circles (reading plan as data, verse-anchored, public-domain corpus)" watch rows: the nearest faith-community structure (parish, network, small group) outside the six columns, single-tradition.
[youversion] YouVersion. The Bible App -- brings Scripture to life on any device, in thousands of languages, all completely free; a verse before school, a devotional with friends, or a shared prayer in a church group: a community of people staying connected to God through His Word. Vendor page. publisher · read in our library knowledge/fetched/cmp_connect_youversion_bibleapp.html · pin h8f3138361b32bafa4e1c4f0ffd02d8677c7b7e79e49806fa4552d3532facd883 · accessed 2026-09-25 · vendor-docGrounds: The "Scripture study circles (reading plan as data, verse-anchored, public-domain corpus)" watch row: free study with friends and church groups is the bar rung CN16 meets from the public-domain corpus.
[church-gospellibrary] Gospel Library, The Church of Jesus Christ of Latter-day Saints -- the official gospel study app of the Church: study and teach from the scriptures, general conference, manuals, music and more. Accessed 2026-09-25. publisher · read in our library knowledge/fetched/cmp_connect_church_gospellibrary2.html · pin h0cb5d4a57247dfa93af7092228e4b2c0b27b42a3d67cb42858ed75ae18e8ba27 · accessed 2026-09-25 · vendor-docGrounds: The "Scripture study circles (reading plan as data, verse-anchored, public-domain corpus)" watch row: the Church's own study app is the boundary rung CN16 complements and never replaces; its headings, footnotes and cross-references are never copied.
[meta-groups] Meta Newsroom, Groups tag listing, read 2026-09-25 -- newest: New Facebook Update Gives Group Admins More Flexibility While Protecting Member Privacy (3 Nov 2025); earlier: Introducing New Features to Facebook Groups (20 Oct 2022), Introducing Community Chats on Messenger and Facebook (13 Sep 2022, updated 26 Sep 2025), How We Approach Safety and Privacy in Community Chats (13 Sep 2022), New Tools to Help Group Admins Protect, Manage and Grow Their Facebook Groups (9 Mar 2022). Listing titles and dates only; the articles themselves were not read. publisher · read in our library knowledge/fetched/cmp_connect_meta_groups_news.html · pin h5aa63bb85c2d5613b91bbf62d6e00634193d496288452ddb42576be90fe61b3a · accessed 2026-09-25 · mirrored-indexGrounds: The "Concentric community circles (family to mission to ward to stake to other Christians)" watch row: Facebook Groups, the scale incumbent outside the six columns, grows admin controls and member-privacy settings inside one flat group rather than nested, vouched circles.
[rfc9576] Davidson, A., Iyengar, J., Wood, C. A. RFC 9576: The Privacy Pass Architecture. IETF, 2024. publisher · read in our library knowledge/fetched/cmp_connect_rfc9576.txt · pin h51f781afa07f32364203969b26fd31e63c415fc6f0fbd1f2e44d38433223b404 · accessed 2026-09-25 · published-standardGrounds: The CN13 private sign-up rung: the unlinkable-token frontier named as the successor to its hashcash-plus-window anti-automation, which needs an issuer the estate does not have yet.
[nist80063c4] National Institute of Standards and Technology. SP 800-63C-4, Digital Identity Guidelines: Federation and Assertions, section 3.8.1 Account Linking. publisher · read in our library knowledge/fetched/cmp_connect_nist80063c4.html · pin h01e2808bc02416b2196885f75a425110a8820bc7fa673ff981e327b127b8ebf9 · accessed 2026-09-25 · published-standardGrounds: The CN5 family-realm account unification rung: linking requires an authenticated session with the account, and removing an identifier stops access from it.
[matrix-rooms-v11] The Matrix.org Foundation. Matrix Specification v1.19, Room Version 11 (redaction algorithm). publisher · read in our library knowledge/fetched/cmp_connect_matrix_rooms_v11.html · pin h77be4fcfb4ccb236b986dff78c4468e1d7a1ea3b6fb2778e45232e2b41cfb7d1 · accessed 2026-09-25 · published-standardGrounds: The CN6 durable message store rung: a delete is an appended redaction event and the target keeps its skeleton with content stripped, the model msg_store_append mirrors with a tombstoned row.
[arxiv-vouching] arXiv listing, all:vouching sorted by submission date, read 2026-09-25 (23 results, newest 2608.22025v1, RepuLink two-layer trust with backward endorsement penalty and reward propagation, ISWC 2026 poster). publisher · read in our library knowledge/fetched/cmp_connect_arxiv_vouching_202609.xml · pin hc6d2f7b484fc7344a830d2294aeed08439f5858ab576927b82217ad2e7056fb7 · accessed 2026-09-25 · mirrored-indexGrounds: The CN14 concentric circles rung: vouched admission with endorser accountability, the named gap beyond CN14's forward-only two-vouch rule.
[gdpr-art7] Regulation (EU) 2016/679 (GDPR), Article 7: Conditions for consent, including 7(3) withdrawal as easy as giving consent. publisher · read in our library knowledge/fetched/cmp_connect_gdpr_art7.html · pin h3a998bda366cf73dcbf97a59869b753b7b571875f440b6e6734783ea17bafb2b · accessed 2026-09-25 · published-standardGrounds: The CN15 Christian traditions rung: withdrawing faith consent removes the member from faith discovery at once.
[discord-activities] Discord Developer Documentation. Activities Overview -- Discord Activities are multiplayer games and social experiences; whether developing a multiplayer game or a new social experience, an Activity is built as a web app run in an iframe in Discord on desktop, mobile and web (page dateModified 2026-03-09). publisher · read in our library knowledge/fetched/cmp_connect_discord_activities_docs.html · pin h23cfea259c210ad6b6303b13de6a92cf59c429736577dfc9c58bcb9035b7d902 · accessed 2026-09-28 · vendor-docGrounds: The "Games together, one to one or in groups" row (rung CN19): Discord's embedded multiplayer Activities are the Best code for playing together inside a community, the bar the play session is graded against.
[meetup-home-2609] Meetup home page, read 2026-09-25 -- lists Games among its topic categories (meetup.com/topics/games/), the topic under which its groups organise events. publisher · read in our library knowledge/fetched/cmp_connect_meetup_home_202609.html · pin hbcff6060eba9f8c87759fe5989e75302eef845c7867d53ce0aecb561d4bf6ae3 · accessed 2026-09-25 · vendor-docGrounds: The "Games together, one to one or in groups" row (rung CN19): Meetup is Part because games are a topic its groups organise events around, with no play inside the app.
[apple-pq3] Apple Security Engineering and Architecture blog. iMessage with PQ3 -- post-quantum cryptography in the initial key establishment and in periodic rekeying (a Kyber-768 ratchet about every 50 messages and at least once every 7 days, combined with an ECDH step on every response), which Apple names Level 3 and ranks above Signal PQXDH at Level 2. Apple, 21 Feb 2024, read 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_apple_pq3.html · pin hd3c9d37938ab307cc9db6653aab2c3b07a1b3c26bf8dba707cda778f3626d691 · accessed 2026-09-28 · vendor-docGrounds: The "Post-quantum ratchet" watch row and rung CN20: the Level 3 bar -- post-quantum rekeying that heals a conversation after a point-in-time key compromise -- which the static-key CN8 hybrid key agreement does not reach.
[rfc8291] Thomson, M. RFC 8291, Message Encryption for Web Push. IETF, November 2017 -- the aes128gcm key schedule (ECDH on P-256 with the subscription's p256dh, the 16-octet auth secret, HKDF-SHA-256 into PRK_key, IKM, PRK, CEK and NONCE) with the section 5 worked example and every Appendix A intermediate; read from the mirrored text 2026-09-28 (the canonical RFC Editor text hashes identical to the mirror). publisher · read in our library knowledge/fetched/cmp_connect_rfc8291.txt · pin hd7130962cbe0940465ca375a9fcecfaaa33afb0febd71dd58e2712502fdc0504 · accessed 2026-09-28 · published-standardGrounds: The Push notifications + real presence at scale row and rung CN2: nx_webpush reproduces the section 5 example byte for byte at every intermediate, gated by nx_connect_push_gate.
[rfc8292] Thomson, M. and P. Beverloo. RFC 8292, Voluntary Application Server Identification (VAPID) for Web Push. IETF, November 2017 -- an ES256 JWT with aud, exp at most 24 hours ahead and sub, carried as Authorization vapid t= k=; the section 2.4 example token and its signing key; read from the mirrored text 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_rfc8292.txt · pin h2165418a7737a041133d3bb51caf1b5eb0421a19bf1e2ce847c0d6bc9fd49b04 · accessed 2026-09-28 · published-standardGrounds: The Push notifications + real presence at scale row and rung CN2: the RFC's own token verifies under its own key with the estate ECDSA verifier and our claims reproduce its signing input byte for byte.
[rfc8030] Thomson, M., E. Damaggio and B. Raymor. RFC 8030, Generic Event Delivery Using HTTP Push. IETF, December 2016 -- the push message POST with TTL, Urgency and Topic, the 201 acceptance, 404 and 410 for a subscription that no longer exists, and the 4096-octet payload a push service must accept; read from the mirrored text 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_rfc8030.txt · pin hbc8b9646c153e2d1ac79b35e1d8850a92608fabf6fae8a54b223dc39791a0e13 · accessed 2026-09-28 · published-standardGrounds: The Push notifications + real presence at scale row and rung CN2: push_deliver sends the RFC 8030 request and a live probe got 404 from Mozilla autopush and 410 from FCM, each tombstoning the record.
[apple-webpush] Apple Developer Documentation. Sending web push notifications in web apps and browsers -- Safari web push follows RFC 8030, 8291 and 8292; a server behind a restrictive network allows access for https://*.push.apple.com; read from the mirrored documentation JSON 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_apple_webpush.json · pin h9ead973af5668b51fbaac433286e8ee678cda73912ac437ce9c355e83987a0f0 · accessed 2026-09-28 · vendor-docGrounds: The Push notifications + real presence at scale row and rung CN2: the hostsuffix .push.apple.com row of the SSRF fence in knowledge/connect_push.conf.
[wns-channel] Microsoft Learn. Windows Push Notification Services (WNS) overview -- a cloud service must ensure a channel URI uses the domain notify.windows.com and never push to a channel on any other domain; read from the mirrored page 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_wns_overview_2609.html · pin hb831fc1399d30029399288e2d6e104b32979e76b64df4a1fae2066b6fac1bdec · accessed 2026-09-28 · vendor-docGrounds: The Push notifications + real presence at scale row and rung CN2: the hostsuffix .notify.windows.com row of the SSRF fence, the same domain rule WNS asks every sender to enforce.
[autopush-http] Mozilla Services. Autopush documentation, HTTP Endpoints for Notifications -- the /wpush/ endpoint takes an RFC 8030 POST with TTL and Topic, shown against the example host push.services.mozilla.com; read from the mirrored page 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_autopush_http.html · pin h3b9cc5f13a342805a74412e674637b01f45e5e7ca7216f69d266e7d16059e49f · accessed 2026-09-28 · vendor-docGrounds: The Push notifications + real presence at scale row and rung CN2: the push.services.mozilla.com host row of the SSRF fence.
[autopush-protocol] Mozilla Services. autopush-rs, autoconnect-common src/protocol.rs (master) -- the user-agent WebSocket messages: hello, register with a channelID and an optional key, notification with channelID, version, data and headers, ack with updates and a code; read from the mirrored source 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_autopush_protocol_rs.txt · pin h065915111cd895f339f41d40bc5cfd41a00db0511938a66b03816ec561d40be1 · accessed 2026-09-28 · source-readGrounds: The Push notifications + real presence at scale row and rung CN2: nx_connect_push_ua_probe speaks these messages as the user agent that receives push_deliver.
[autopush-notification] Mozilla Services. autopush-rs, autopush-common src/notification.rs (master) -- the notification fields a push service serializes to a user agent: channelID, version, data and headers; read from the mirrored source 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_autopush_notification_rs.txt · pin hb055a8f33d8b6ac1da8266edf000c1813ecacde2acac6081527c46766ee153ed · accessed 2026-09-28 · source-readGrounds: The Push notifications + real presence at scale row and rung CN2: the fields nx_connect_push_ua_probe reads from each notification it receives.
[autopush-endpoint] Mozilla Services. autopush-rs, autopush-common src/endpoint.rs (master) -- make_endpoint: a register key yields a v2 endpoint carrying the sha256 of that key; read from the mirrored source 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_autopush_endpoint_rs.txt · pin h397f7db692756ccc3e912d439abe9e448e7e4dd9aab1b34de32f1bca39ff2a9a · accessed 2026-09-28 · source-readGrounds: The Push notifications + real presence at scale row and rung CN2: why a POST signed by another key must be refused, which the probe measured as 401.
[mozpush-design] Mozilla Services. Mozilla Push Service documentation, Push Service Design -- the WebPush protocol over a WebSocket between user agent and push service: hello, register, unregister, notification and ack; read from the mirrored page 2026-09-28. publisher · read in our library knowledge/fetched/cmp_connect_mozpush_design.html · pin h926ccba0e47c9c5e3c1a702a0c56d9bb45326d4e6080931a4c72f8ba86fb940b · accessed 2026-09-28 · vendor-docGrounds: The Push notifications + real presence at scale row and rung CN2: the handshake order nx_connect_push_ua_probe follows.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/connect.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls