Nishi Family › Compare › Data I/O Integrity

Nishi Compare · capabilities, evidence and delivery

Data I/O Integrity

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

Fixed ceilings, silent truncation, derived buffers, chunked and resumable transfer, integrity on the wire -- measured over every source and every rostered ledger of the estate, then graded against RFC 9110, RFC 9112, RFC 9530, RFC 9457, the IETF resumable-upload and Idempotency-Key drafts, tus, restic's content-defined chunking and BLAKE3's verified streaming.

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. MEASURED 2026-09-05, full population. The literal 4194304 appears 1,430 times in 717 source files across both trees (1,415 in code: 607 named constants, 718 bare literals inside a call, 90 other; 15 in comments; partition reconciles; coverage_complete=1 over 23,663 files). The silent-truncation cap detector (nx_janitor_caps over nx_cap_detect_lib) existed SOURCE-ONLY since 2026-07-15 and had never been compiled or run; its gate was PROMOTED-UNREGISTERED. The ledger-cliff forecaster reads 4 of 18 rostered append-only ledgers OVER the 4 MiB nominal reader window (actlog.jrnl 54.6 MB, tool_diff.log 32.7 MB, dup_source.log 15.0 MB, orchestrate.log 5.2 MB); every consumer of actlog.jrnl this census could read is TAIL-anchored by declaration, two are unverified. Two organs were re-derived from their input the same day: the Claude-action gauge and the action miner now read their 54 MB journal whole through sys_read_file instead of a 4 MiB head, and the miner's gram tables size themselves from a frame census (16,900 distinct pairs counted exactly where a 16,384 cap had silently dropped 516). On the wire: chunked framing decoded per RFC 9112, Range pulls per RFC 9110 with a refused wrong digest, a chunked sha-receipted resumable content lane with a commit compare-and-swap; ABSENT: content-defined chunking (proven absent on every board), per-chunk verified streaming, the IETF resumable-upload door, and idempotency keys on unsafe writes -- nine Outcome-Unknown writes in one seat session, each adjudicated by hand.

Where we need to go. Make every ceiling in the estate either DERIVED from its input or ANNOUNCED in its envelope, with the silent remainder measured on a beat and ratcheted to zero; make every unsafe write safe to retry by construction; and bring the content lane to the September-2026 wire -- content-defined chunking, per-chunk verification, offset-resumable upload -- without a third party in the path. The exceed the estate already holds and must keep: a commit that refuses bytes not hashing to their declared digest, and a read envelope that says OUTPUT-IS-PARTIAL when it is.

The unit. 1 u = one measured session-leg (organ plus gate plus a re-measured row), the estate calibration. Native calibration point this domain: the frame-census fix to the action miner landed in one leg (source, teeth T16 and T17, control run, NAS landing by five size-CAS edits) -- estimates below are relative to that leg.

Cost to make the ceilings visible: 3.5 u. DI1 the cap census on a beat, DI2 the envelope census, DI3 the derived-buffer ratio and DI8 the ledger-consumer audit. These four are one milestone because each publishes a different partition of the same population and the board is honest only when all four sum.

Cost to make writes safe to retry: 1.5 u more. DI4 idempotency keys on the tools API write verbs. Cheap and early because it removes a whole class of hand adjudication from every seat every day.

Cost to reach the September-2026 wire: 4.5 u more. DI5 content-defined chunking, DI6 per-chunk verified streaming, DI7 the offset-resumable door. Program total 9.5 u and the three figures sum.

Research bar. IETF HTTP is measured on the framing, range, integrity and error-shape standards every transport here must meet. Theirs: chunked framing complete only at the zero-size chunk, byte ranges with 206, Content-Digest and Repr-Digest, problem details, resumable uploads and idempotency keys in working-group drafts. Ours: DI4 DI6 and DI7 measure against these.

Research bar. tus is measured on the deployed resumable-upload protocol. Theirs: Upload-Offset via HEAD, PATCH at offset, Upload-Length, checksum extension. Ours: DI7 must match it and keep the mandatory commit digest tus leaves optional.

Research bar. restic is measured on content-defined chunking in a shipping tool. Theirs: blobs of 512 KiB to 8 MiB addressed by SHA-256, files under 512 KiB unsplit. Ours: DI5 must re-upload fewer than three chunks after a one-byte insertion at offset zero of a 64 MiB fixture.

Research bar. BLAKE3 is measured on verified streaming as a hash-function property. Theirs: per-1 KiB-chunk verification as bytes arrive. Ours: DI6 must refuse a truncated final chunk before commit, not after.

MCP boundary resilience uses existing data contracts: DI2/DI4/DI18 with loadgov LV22/LV23 and deploy DL12. Resolve the observed connector input-limit exit through declared byte admission, complete framing, correlated recoverable errors and continued operation after a rejected request. Preserve unknown write outcomes without blind replay; compose existing idempotency and upload-resume capabilities. Acceptance includes oversized-request-then-valid-request in one process, interrupted transfer recovery, complete readback and exact artifact identity. Native fallback success does not mark the stdio connector repaired.

2026-09-09 MCP completion evidence repair: PARTIAL. Output and marker write failures now propagate in the candidate tested15/15; matching live file and responding service observed after guarded deployment. Original deploy job receipt remains unresolved, some parallel clients lost transport, and no browser is available for Compare review. Retain these gaps; no end-to-end durability or estate SOTA claim.

2026-09-09 measurement API and MCP release: PARTIAL. Native nx_sota_status json produces evidence-aware domain measurements; nishi_compare measurement serves the same snapshot as https://nishifamily.com/compare/maturity/measurement.json. Current research informs the next adoption work; no estate-wide SOTA or complete investment measurement is claimed. Pending: inventory joins, repeatable frontier comparisons, refresh integration and browser review.

2026-09-10 native API MCP timing release: RUNNING - deployment receipt needs intervention. Tested daemon382032B SHA256f759851bb28ff3c93d27ee6aeec39550533b580af36959e88c02e7c7ac52b8f8 is live: native hash1789023849, watchdog1789023812 DEPLOYED-GREEN listen=VERIFIED and actual MCP phase observations. Existing bindings manifest and Unicode retrieval still work. Correlated local monotonic request, runner, acknowledgement and publication durations reuse actlog; client/result first byte remain unobserved. Native timing20/20 and real socket integration51/51 passed;23 retained observations independently checked. Deployment1789023777 still has no terminal receipt after bounded rechecks despite live success; claim alone does not prove process liveness. No repeat deployment or invented ETA; next action is reconcile existing receipt lifecycle. Evidence observed2026-09-10 before07:11UTC. No artifact awaits another deployment for this increment. Actual investment savings, full estate joins, SOTA attainment and served visual review remain unfinished.

2026-09-10 plan watch measurement release: RUNNING - declared gaps preserved. Existing bindings API/MCP now normalizes authored watch and withheld contracts with the same matrix symbol reader, retains raw contracts and preconditions and never infers completion. All105 rungs retained; charsim34 unique joins, gameengine54 unique joins, two more gameengine watches connected. Native48/48 parser and30/30 actual artifact checks passed; complete independent matrix/rank and old-field checks passed. Producer195832B SHA25633719b5d8aecef49b8828307c7ae0ed7912e46f82805a6b9daed5c30f8e9a85e promoted1789025483. Reports published1789025522/5523; live MCP manifest names357433B gameengine artifact. Source declaration observations do not prove execution; API/behavior evidence, actual savings, SOTA and visual review remain open.

2026-09-10 listener observation API MCP release: RUNNING - source identity still required for restart. Existing nx_portcheck listeners port row_capacity read_capacity_bytes now emits nishi.port-listeners v1 JSON through the management API and MCP. Live55624B SHA256c31573bddd66400963b7e71382597052528de9897c268c6b41049129910b1ebe promoted1789028995; staged29/29 and independent complete JSON/schema/inode checks passed, legacy5/5 retained. Actual MCP observation1789029148 finds one18096 loopback listener inode996033039; separate proc-file reads are not an atomic snapshot or process identity. No restart authority, blanket kill or daemon rollout added.

2026-09-10 read-only timing observations API and MCP: RUNNING - measured phases available, investment joins unfinished. Existing nx_toolatency observations offset read_capacity row_capacity now emits versioned nishi.tool-observations JSON over management API and MCP. It reads the retained timing journal without route or journal mutation. WINDOW means bounded pagination, not a complete-history result; unknown client/result first byte and domain/rung/function/artifact/investment joins remain explicit nulls.

2026-09-10 native timing command discovery: RUNNING - API/MCP discovery verified, measurement coverage growing. Existing nx_toolatency now advertises observations offset read_capacity row_capacity in its MCP argument description. The tool-wide read-only hint is corrected because legacy census mode appends records and can update routing; the observations branch remains read-only. Clients obtain the new metadata on a fresh tools/list request.

Latest recorded release

2026-09-23 · DI20

ONE EXE-DIRECTORY RESOLVER, THREE HAND-ROLLED COPIES RETIRED: pon_self_dir(out, cap) in nx_os_introspect.nx (29373 B bb548965, composes the lib's own pon_readlink over /proc/self/exe, never argv[0]). Consumers on both trees: nx_https_fetch_lib.nx 39097 B 44fcc4fc (hf_self_dir is now a thin alias), nx_sota_why_gate.nx 10426 B d1566bd9 (sg_selfdir alias), nx_torrent_daemon.nx 89293 B 17b4873a and nx_torrent_get.nx 86194 B c0bc0f3c (exe-link primary path; the argv cut kept only as the no-/proc fallback, because a bare launch used to send every sibling-executable and conf lookup to their /tmp fallback). Laptop: fetch lib gate 20/20, get client gate 16/16, put client gate 13/13, sota_why gate 14/14, both torrent organs compile; get client from the home directory still fetches through rung 2. NAS: fetch lib gate 613192 B c03fc0ee and sota_why gate 55480 B 8adbe675 built, PROMOTED prev=1, gate_run 20/20 and 14/14 GREEN; torrent daemon and torrent_get compiled --build-only (compile proof only; the daemon deploy belongs to its lane). nx_crash (a self-contained crash handler with no imports) and the ship behaviour lib (which hashes the exe, a different question) keep their own readers by design. Manifests re-pushed: 21747/21747 identical.

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

22 of 25 capability source symbols found|5 of them authored stronger-claims|3 open|coverage 880/1000|adoption 21 full / 1 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 22 vs present 22 · named + unnamed + withheld = 2 vs open 2 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 19215 bytes · gates map: PRIMARY · stamped 32d 3h ago · STALE against the shared TTL of 604800s — this is evidence about a build nobody can vouch for now · source ../knowledge/status/evstamp_dataio.verdict

Gap class	What it is, and the work it names
FLIP-READY	A watch contract symbol is now present in the organ it named: the cell can flip on a pure data edit with no new code. These are the cheapest closures on this board and they belong before any new work.
STALE	This profile is older than the shared TTL, or its clock ran backwards. It is reported as unusable rather than as fresh, because being wrong in the direction of refusing is the safe direction.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence dataio itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_INCONSISTENT. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Retained ranking is not bound to the current plan and matrix: STALE_INCONSISTENT. Historical data remains retained. Refresh the ranking after resolving the input differences. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Silent-truncation cap census on a beat with a named-set ratchet (DI1)	jc_has_bound	nx_janitor_caps PROMOTED and REGISTERED; one full-tree run published as a partition (files scanned, files flagged, three-part hits) with the worklist; a truncate-written verdict log knowledge/status/capcensus.log with a canonical last line; the daily beat; the ratchet baseline is the SET of flagged files so a new offender names itself. ACCEPT RULE declared in advance: the gate plants one file carrying all three parts and one carrying only two, and the census must flag exactly the first. A detector that finds nothing has not found nothing until it has found something planted	Organ	1 u
Every capped reader announces or derives: the envelope census (DI2) after DI1	ie_scan	An organ enumerates every sys_read and sys_read_at call site whose length argument is a bare literal, classifies DERIVED (the length comes from stat or lseek), ANNOUNCING (the enclosing organ prints an envelope naming the cap) or SILENT, prints a partition that sums to the call-site count, and makes SILENT the worklist. ACCEPT RULE declared in advance: a planted silent reader is found; every sys_read_file caller reads DERIVED; and the false-positive rate is published over the whole tree as a number, never asserted zero	Organ	1.5 u
Derived-buffer adoption published as a ratio with its denominator (DI3) after DI2	sys_read_file	The DI2 census emits derived, announcing and silent counts per beat and the silent count may not rise (a count ratchet with the names beside it, because a count-only ratchet on a shared tree reports a regression without saying whose). ACCEPT RULE: the ratio is emitted as three integers and no percentage without them	Organ	0.5 u
Idempotency keys on unsafe MCP writes (DI4)	ta_idempotency_key	nx_fs_write write, edit and append accept a caller-supplied key; a retry carrying the same key returns the FIRST outcome and its original bytes without re-applying; a missing key on a documented idempotent verb is refused with problem details. ACCEPT RULE declared in advance: a self-anchored insert edit issued twice with one key applies ONCE and the second reply equals the first; the same edit issued with two different keys applies twice (the neg-control proves the key is what makes the difference); the edge-window Outcome-Unknown body then names the key so the caller can retry without reading the artifact	Organ	1.5 u
Content-defined chunking for the content lane (DI5)	cp_cdc_gear	nx_content_put chunks by a gear-hash content-defined chunker with declared minimum, average and maximum sizes read from conf, never from a constant. ACCEPT RULE declared in advance: on a 64 MiB fixture a one-byte insertion at offset zero re-uploads fewer than three chunks; the bite control is the current fixed-size chunker, which must re-upload every chunk after the insertion	Organ	2 u
Per-chunk verified streaming, and a short body can never commit (DI6) after DI5	cp_stream_verify	The receiver verifies each chunk digest on arrival and refuses commit when the declared total is not met, so a corrupt or truncated stream is refused at the first bad chunk rather than after every byte was accepted. ACCEPT RULE declared in advance: the gate plants a truncated final chunk and a wrong-digest middle chunk in separate runs, both are refused with the offending chunk NAMED, and the complete upload is accepted; the refusal arrives before commit	Organ	1 u
Offset-resumable upload on the public door per the IETF draft (DI7) after DI6	cp_resume_offset	The content door answers an offset query and accepts append-at-offset so a killed upload resumes from the server's record without re-sending accepted bytes, keeping the mandatory commit digest. ACCEPT RULE declared in advance: a gate kills an upload mid-stream, resumes it, and the committed digest equals the fixture's; bytes sent on resume equal total minus the server's offset, measured not asserted	Organ	1.5 u
Ledger consumers audited for anchoring (DI8)	cc_size	For every ledger nx_capcliff reads OVER, every consumer names its anchoring in a census row: TAIL-declared, or head-capped and therefore blind to the newest rows. Head-capped consumers of an append-only ledger are the worklist. ACCEPT RULE: the two consumers this admission could not verify (nx_replyreserve_lib, nx_capsweep) are classified by reading their read sites, and a planted head-capped fixture consumer is flagged	Organ	0.5 u

Milestones

Milestone	Rungs	Cumulative
M1 · The ceilings are measured	DI1,DI2,DI3,DI8	3.5 u
M2 · Writes are safe to retry	DI4	1.5 u
M3 · The content lane is on the September-2026 wire	DI5,DI6,DI7	4.5 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The transfer sends only the chunks the receiver lacks: dedupe by content-defined plan (DI9) after DI5	v_have	The receiver keeps the committed artifact's plan digests beside the destination (or derives them from the incumbent at begin) and answers have <id> with the digests it already holds; the client diffs its cdcplan against that answer and sends only the missing chunks; commit assembles by plan order and re-verifies each chunk against its receipt. ACCEPT RULE declared in advance: on a 64 MiB fixture a one-byte insertion at offset zero re-sends fewer than three chunks, measured as bytes on the wire, with the current whole-file re-send as the control; the committed sha256 equals the fixture's	Organ	3 u
A bad chunk is refused on arrival, not at commit (DI10) after DI6	cp_chunk_expect	chunk <id> <index> <b64> sha256=<hex>: the client declares each chunk's digest with the chunk and the receiver refuses a mismatch ON ARRIVAL (CP-REFUSED-CHUNK-DIGEST index=N) before writing staging, so a corrupted or truncated stream is refused at the first bad chunk; the DI6 commit re-verify stays as defence in depth. ACCEPT RULE declared in advance: the gate sends a wrong-digest middle chunk and a truncated final chunk with declared digests in separate runs, both refused on arrival naming the index, and the complete upload is accepted	Organ	1 u
The public door speaks the drafts' wire: byte-offset append and RFC 9530 digests (DI11) after DI7	cp_append_at	Append-at-offset per the IETF resumable-upload draft (a byte offset, not a chunk index) and Content-Digest / Repr-Digest on begin and commit receipts, so a tus- or IETF-shaped client can drive the door without learning its index grammar. ACCEPT RULE declared in advance: a killed upload resumed by offset from the server's answer commits byte-identical; bytes sent on resume equal total minus the offset, measured; a wrong Repr-Digest is refused by name	Organ	2 u
Every silent reader derives or announces: the DI2 worklist driven to zero (DI12) after DI3	ie_ratchet	The DI2 census's SILENT set (596 named readers at first census) becomes an adoption campaign: each converted reader reads DERIVED through sys_read_file or ANNOUNCES its envelope; the daily beat's named-set ratchet refuses a rise and publishes the fall with the converted names. ACCEPT RULE declared in advance: silent falls monotonically across beats with names in the ledger; a planted new silent reader turns the beat RED naming its file; the false-positive rate is published as a number over the whole tree	Organ	4 u
No ledger nears its cliff unguarded (DI13) after DI8	cc_remedy	Each of the four OVER ledgers (actlog.jrnl, tool_diff.log, dup_source.log, orchestrate.log) either has every consumer TAIL-anchored by the DI8 census or carries a loud pre-cliff refusal through nx_sizeguard with a derived budget; never a rotation (a shrinking journal reads as a clobber to nx_jrnlguard). ACCEPT RULE declared in advance: nx_capcliff reads over=0, or every OVER row names its guard and its consumers' anchoring in the census	Organ	1.5 u

Milestones

Milestone	Rungs	Cumulative
M4 · The content lane dedupes, refuses on arrival, and speaks the drafts' wire	DI9,DI10,DI11	6 u
M5 · Every reader derives or announces and no ledger nears its cliff unguarded	DI12,DI13	5.5 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Reuse stages by clone where the kernel allows and never pays a per-row fsync (DI14) after DI9	cp_stage_clone	A reuse row stages the incumbent's chunk by FICLONERANGE into the transfer's slot, re-hashes the clone, and falls back to a copy that is NAMED in the batch receipt with the kernel's rc and the first refusal's inputs. MEASURED 2026-09-06 on the NAS (btrfs, same volume): clone_rc=-22 EINVAL on every row because FICLONERANGE requires filesystem-block alignment and a content-defined boundary is never aligned (first refusal off=0 len=41240), so on CDC chunks the copy path is the path by construction; the batch's real cost was one fsync per 48 KB row (95 rows = 803,991 ms), removed by staging reuse rows without a per-file fsync and fsyncing the staging directory once (95 rows = 7,993 ms, 100x). ACCEPT RULE declared in advance and met: a reuse batch stages in about one chunk post's time on the same box (7.99 s for 95 rows against 8.5 s for one fsynced chunk write in the same hour), the staged slot's sha256 equals the incumbent chunk's, and a link that cannot be made falls back to the copy and NAMES it (clone_rc, clone_first_refusal) in the receipt. The aligned-window clone that would make a true link possible on CDC chunks is DI17	Organ	2 u
LOOPED is judged, not parked (DI15) after DI12	ie_loop_exit	The census classifies a looped read by its loop's exit: EOF-driven (the read result or a flag it sets ends the loop) is STREAMING and acquitted; a loop that also breaks on a byte or count bound is CAPPED-IN-LOOP and joins the silent worklist with the bound named; a loop whose exit cannot be read is UNJUDGED. ACCEPT RULE declared in advance: the 1,273 LOOPED sites of 2026-09-06 partition into the three classes with a printed sum, nx_sizeguard and nx_restage read STREAMING, a planted loop with a count bound reads CAPPED-IN-LOOP, and the gate carries all three as teeth	Organ	3 u
The silent worklist reaches zero (DI16) after DI15	ie_worklist_zero	Every remaining SILENT site is converted (sys_read_file, an announced envelope, or a hand kind=false adjudication with its reason in the ledger) until the ratchet's baseline is empty; a `worklist` verb prints the remaining rows grouped by file so a seat can take a file at a time. ACCEPT RULE declared in advance: io_envelope.status reads silent=0 with new_silent=0, every departure is in the ratchet ledger with its now= class, the false-positive rate is published over the whole set, and a planted new silent reader still turns the daily beat RED	Organ	8 u

Milestones

Milestone	Rungs	Cumulative
M6 · Dedupe that is cheap on the box and a census with nothing parked	DI14,DI15,DI16,DI17	18 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
No silent cut on the wire: a reply larger than the capture window is chunked with a continuation cursor and reassembled by the reader, the window is a conf row never a literal, on send and on receive across the estate (operator 2026-09-06) (DI18) after DI7	tsv_reply_cursor	Done-rule: the tools-API reply lane and the job artifact readers (nx_fs job, nx_fs read, nx_https_get) return total_bytes and next_off beside every window instead of the bare NX-TRUNCATED marker; the reader follows the cursor until total is reached and refuses to publish a prefix as a whole; the window value lives in a conf row (announced, derived from the daemon's reply reserve, its reason beside it); the send side keeps the content-put CDC lane (DI5-DI7) as the ONE chunker; a gate plants a body of three windows plus one byte and proves byte-identical reassembly, with a neg-control that a reader stopping at the first window is refused by the total	Organ	3 u
Windowed clone for content-defined chunks (DI17) after DI14	cp_stage_window	A reuse row clones the filesystem-block-ALIGNED window that contains the chunk (FICLONERANGE on an aligned src_off and an aligned length) into the slot and records skip and len in a sidecar the assembler honours, so a content-defined chunk shares the incumbent's extents instead of being copied. ACCEPT RULE declared in advance: on the NAS btrfs volume di14_slot_batch_cloned equals rows, the commit sha256 equals the fixture's, every sidecar skip is below one filesystem block, and on a filesystem without reflink every row falls back to the copy and says so in the receipt	Organ	5 u
A capped COLLECTOR announces, not only a capped reader (DI19) after DI12	ie_collector_cap	DI12 made every silent READER derive or announce. The same defect exists one step over in functions that COLLECT into a caller-supplied slot table and return a bare count: nx_search_emerge.em_collect_yms(buf,n,openm,flat,maxd) exits at nd>=maxd by setting i=n and returns nd, so its return value cannot distinguish 'there were exactly maxd' from 'there were more and I stopped'. It feeds nx_cap_harvest, the DAILY frontier watch, so a future consumer that composes it without reading its body publishes a capped sample as a population. Extend nx_io_envelope_census to classify capped COLLECTORS (a function taking a max or cap parameter and returning a bare count with no cap signal) as its own named class beside the reader classes, with the same named-set ratchet so a rise names the offender. Done-rule: the census names every collector, the ratchet holds at its measured floor, and the bite plants a collector that hits its cap and must be NAMED.	Organ	4 u
The content clients name the failing stage, and the trust store is found from the tree root by construction (DI20) after DI18	hf_store_locate	nx_content_get_client failed three times as post failed (transport) with the door, the URL and the cap all innocent: hf_store_load reads data/mozilla_certdata.txt relative to the current directory, the client was launched from the home directory, and the missing store surfaced as a transport fault. Done-rule: (1) both clients refuse at the load site naming the path and the cwd with nothing posted (landed 2026-09-22 as CG-IO and CC-IO, rc 3) and the transport messages carry the follower rc; (2) hf_store_locate resolves the store on a declared ladder (the cwd, then the tree root the executable lives under) and announces which rung answered, so a client works from any cwd and no consumer of hf_store_load can be blind to an unreadable store; (3) both client gates carry a from-HOME bite.	Organ	1.5 u

Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read NO-BAR against the current month 2026-10.

Bar freshness, counted
Class	Count	Note
bars	0	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	0	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	0	RECONCILED: the parts sum to the total 0
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 20. Rank input binding: STALE_INCONSISTENT. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 8435e1811609af5d12b261e9d09d74ef8efd33f4532a674e59e5e410dcdba30e. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 20 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

DI1 — Silent-truncation cap census on a beat with a named-set ratchet
Prerequisites: None declared; this does not establish execution eligibility.
Contract: jc_has_bound
Acceptance: nx_janitor_caps PROMOTED and REGISTERED; one full-tree run published as a partition (files scanned, files flagged, three-part hits) with the worklist; a truncate-written verdict log knowledge/status/capcensus.log with a canonical last line; the daily beat; the ratchet baseline is the SET of flagged files so a new offender names itself. ACCEPT RULE declared in advance: the gate plants one file carrying all three parts and one carrying only two, and the census must flag exactly the first. A detector that finds nothing has not found nothing until it has found something planted
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI2 — Every capped reader announces or derives: the envelope census
Prerequisites: DI1 (acceptance unverified)
Contract: ie_scan
Acceptance: An organ enumerates every sys_read and sys_read_at call site whose length argument is a bare literal, classifies DERIVED (the length comes from stat or lseek), ANNOUNCING (the enclosing organ prints an envelope naming the cap) or SILENT, prints a partition that sums to the call-site count, and makes SILENT the worklist. ACCEPT RULE declared in advance: a planted silent reader is found; every sys_read_file caller reads DERIVED; and the false-positive rate is published over the whole tree as a number, never asserted zero
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI3 — Derived-buffer adoption published as a ratio with its denominator
Prerequisites: DI2 (acceptance unverified)
Contract: sys_read_file
Acceptance: The DI2 census emits derived, announcing and silent counts per beat and the silent count may not rise (a count ratchet with the names beside it, because a count-only ratchet on a shared tree reports a regression without saying whose). ACCEPT RULE: the ratio is emitted as three integers and no percentage without them
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI4 — Idempotency keys on unsafe MCP writes
Prerequisites: None declared; this does not establish execution eligibility.
Contract: ta_idempotency_key
Acceptance: nx_fs_write write, edit and append accept a caller-supplied key; a retry carrying the same key returns the FIRST outcome and its original bytes without re-applying; a missing key on a documented idempotent verb is refused with problem details. ACCEPT RULE declared in advance: a self-anchored insert edit issued twice with one key applies ONCE and the second reply equals the first; the same edit issued with two different keys applies twice (the neg-control proves the key is what makes the difference); the edge-window Outcome-Unknown body then names the key so the caller can retry without reading the artifact
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI5 — Content-defined chunking for the content lane
Prerequisites: None declared; this does not establish execution eligibility.
Contract: cp_cdc_gear
Acceptance: nx_content_put chunks by a gear-hash content-defined chunker with declared minimum, average and maximum sizes read from conf, never from a constant. ACCEPT RULE declared in advance: on a 64 MiB fixture a one-byte insertion at offset zero re-uploads fewer than three chunks; the bite control is the current fixed-size chunker, which must re-upload every chunk after the insertion
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI6 — Per-chunk verified streaming, and a short body can never commit
Prerequisites: DI5 (acceptance unverified)
Contract: cp_stream_verify
Acceptance: The receiver verifies each chunk digest on arrival and refuses commit when the declared total is not met, so a corrupt or truncated stream is refused at the first bad chunk rather than after every byte was accepted. ACCEPT RULE declared in advance: the gate plants a truncated final chunk and a wrong-digest middle chunk in separate runs, both are refused with the offending chunk NAMED, and the complete upload is accepted; the refusal arrives before commit
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI7 — Offset-resumable upload on the public door per the IETF draft
Prerequisites: DI6 (acceptance unverified)
Contract: cp_resume_offset
Acceptance: The content door answers an offset query and accepts append-at-offset so a killed upload resumes from the server's record without re-sending accepted bytes, keeping the mandatory commit digest. ACCEPT RULE declared in advance: a gate kills an upload mid-stream, resumes it, and the committed digest equals the fixture's; bytes sent on resume equal total minus the server's offset, measured not asserted
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI8 — Ledger consumers audited for anchoring
Prerequisites: None declared; this does not establish execution eligibility.
Contract: cc_size
Acceptance: For every ledger nx_capcliff reads OVER, every consumer names its anchoring in a census row: TAIL-declared, or head-capped and therefore blind to the newest rows. Head-capped consumers of an append-only ledger are the worklist. ACCEPT RULE: the two consumers this admission could not verify (nx_replyreserve_lib, nx_capsweep) are classified by reading their read sites, and a planted head-capped fixture consumer is flagged
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI9 — The transfer sends only the chunks the receiver lacks: dedupe by content-defined plan
Prerequisites: DI5 (acceptance unverified)
Contract: v_have
Acceptance: The receiver keeps the committed artifact's plan digests beside the destination (or derives them from the incumbent at begin) and answers have <id> with the digests it already holds; the client diffs its cdcplan against that answer and sends only the missing chunks; commit assembles by plan order and re-verifies each chunk against its receipt. ACCEPT RULE declared in advance: on a 64 MiB fixture a one-byte insertion at offset zero re-sends fewer than three chunks, measured as bytes on the wire, with the current whole-file re-send as the control; the committed sha256 equals the fixture's
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI10 — A bad chunk is refused on arrival, not at commit
Prerequisites: DI6 (acceptance unverified)
Contract: cp_chunk_expect
Acceptance: chunk <id> <index> <b64> sha256=<hex>: the client declares each chunk's digest with the chunk and the receiver refuses a mismatch ON ARRIVAL (CP-REFUSED-CHUNK-DIGEST index=N) before writing staging, so a corrupted or truncated stream is refused at the first bad chunk; the DI6 commit re-verify stays as defence in depth. ACCEPT RULE declared in advance: the gate sends a wrong-digest middle chunk and a truncated final chunk with declared digests in separate runs, both refused on arrival naming the index, and the complete upload is accepted
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI11 — The public door speaks the drafts' wire: byte-offset append and RFC 9530 digests
Prerequisites: DI7 (acceptance unverified)
Contract: cp_append_at
Acceptance: Append-at-offset per the IETF resumable-upload draft (a byte offset, not a chunk index) and Content-Digest / Repr-Digest on begin and commit receipts, so a tus- or IETF-shaped client can drive the door without learning its index grammar. ACCEPT RULE declared in advance: a killed upload resumed by offset from the server's answer commits byte-identical; bytes sent on resume equal total minus the offset, measured; a wrong Repr-Digest is refused by name
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI12 — Every silent reader derives or announces: the DI2 worklist driven to zero
Prerequisites: DI3 (acceptance unverified)
Contract: ie_ratchet
Acceptance: The DI2 census's SILENT set (596 named readers at first census) becomes an adoption campaign: each converted reader reads DERIVED through sys_read_file or ANNOUNCES its envelope; the daily beat's named-set ratchet refuses a rise and publishes the fall with the converted names. ACCEPT RULE declared in advance: silent falls monotonically across beats with names in the ledger; a planted new silent reader turns the beat RED naming its file; the false-positive rate is published as a number over the whole tree
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI13 — No ledger nears its cliff unguarded
Prerequisites: DI8 (acceptance unverified)
Contract: cc_remedy
Acceptance: Each of the four OVER ledgers (actlog.jrnl, tool_diff.log, dup_source.log, orchestrate.log) either has every consumer TAIL-anchored by the DI8 census or carries a loud pre-cliff refusal through nx_sizeguard with a derived budget; never a rotation (a shrinking journal reads as a clobber to nx_jrnlguard). ACCEPT RULE declared in advance: nx_capcliff reads over=0, or every OVER row names its guard and its consumers' anchoring in the census
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI14 — Reuse stages by clone where the kernel allows and never pays a per-row fsync
Prerequisites: DI9 (acceptance unverified)
Contract: cp_stage_clone
Acceptance: A reuse row stages the incumbent's chunk by FICLONERANGE into the transfer's slot, re-hashes the clone, and falls back to a copy that is NAMED in the batch receipt with the kernel's rc and the first refusal's inputs. MEASURED 2026-09-06 on the NAS (btrfs, same volume): clone_rc=-22 EINVAL on every row because FICLONERANGE requires filesystem-block alignment and a content-defined boundary is never aligned (first refusal off=0 len=41240), so on CDC chunks the copy path is the path by construction; the batch's real cost was one fsync per 48 KB row (95 rows = 803,991 ms), removed by staging reuse rows without a per-file fsync and fsyncing the staging directory once (95 rows = 7,993 ms, 100x). ACCEPT RULE declared in advance and met: a reuse batch stages in about one chunk post's time on the same box (7.99 s for 95 rows against 8.5 s for one fsynced chunk write in the same hour), the staged slot's sha256 equals the incumbent chunk's, and a link that cannot be made falls back to the copy and NAMES it (clone_rc, clone_first_refusal) in the receipt. The aligned-window clone that would make a true link possible on CDC chunks is DI17
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI15 — LOOPED is judged, not parked
Prerequisites: DI12 (acceptance unverified)
Contract: ie_loop_exit
Acceptance: The census classifies a looped read by its loop's exit: EOF-driven (the read result or a flag it sets ends the loop) is STREAMING and acquitted; a loop that also breaks on a byte or count bound is CAPPED-IN-LOOP and joins the silent worklist with the bound named; a loop whose exit cannot be read is UNJUDGED. ACCEPT RULE declared in advance: the 1,273 LOOPED sites of 2026-09-06 partition into the three classes with a printed sum, nx_sizeguard and nx_restage read STREAMING, a planted loop with a count bound reads CAPPED-IN-LOOP, and the gate carries all three as teeth
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI16 — The silent worklist reaches zero
Prerequisites: DI15 (acceptance unverified)
Contract: ie_worklist_zero
Acceptance: Every remaining SILENT site is converted (sys_read_file, an announced envelope, or a hand kind=false adjudication with its reason in the ledger) until the ratchet's baseline is empty; a `worklist` verb prints the remaining rows grouped by file so a seat can take a file at a time. ACCEPT RULE declared in advance: io_envelope.status reads silent=0 with new_silent=0, every departure is in the ratchet ledger with its now= class, the false-positive rate is published over the whole set, and a planted new silent reader still turns the daily beat RED
Authored effort: 8. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI18 — No silent cut on the wire: a reply larger than the capture window is chunked with a continuation cursor and reassembled by the reader, the window is a conf row never a literal, on send and on receive across the estate (operator 2026-09-06)
Prerequisites: DI7 (acceptance unverified)
Contract: tsv_reply_cursor
Acceptance: Done-rule: the tools-API reply lane and the job artifact readers (nx_fs job, nx_fs read, nx_https_get) return total_bytes and next_off beside every window instead of the bare NX-TRUNCATED marker; the reader follows the cursor until total is reached and refuses to publish a prefix as a whole; the window value lives in a conf row (announced, derived from the daemon's reply reserve, its reason beside it); the send side keeps the content-put CDC lane (DI5-DI7) as the ONE chunker; a gate plants a body of three windows plus one byte and proves byte-identical reassembly, with a neg-control that a reader stopping at the first window is refused by the total
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI17 — Windowed clone for content-defined chunks
Prerequisites: DI14 (acceptance unverified)
Contract: cp_stage_window
Acceptance: A reuse row clones the filesystem-block-ALIGNED window that contains the chunk (FICLONERANGE on an aligned src_off and an aligned length) into the slot and records skip and len in a sidecar the assembler honours, so a content-defined chunk shares the incumbent's extents instead of being copied. ACCEPT RULE declared in advance: on the NAS btrfs volume di14_slot_batch_cloned equals rows, the commit sha256 equals the fixture's, every sidecar skip is below one filesystem block, and on a filesystem without reflink every row falls back to the copy and says so in the receipt
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI19 — A capped COLLECTOR announces, not only a capped reader
Prerequisites: DI12 (acceptance unverified)
Contract: ie_collector_cap
Acceptance: DI12 made every silent READER derive or announce. The same defect exists one step over in functions that COLLECT into a caller-supplied slot table and return a bare count: nx_search_emerge.em_collect_yms(buf,n,openm,flat,maxd) exits at nd>=maxd by setting i=n and returns nd, so its return value cannot distinguish 'there were exactly maxd' from 'there were more and I stopped'. It feeds nx_cap_harvest, the DAILY frontier watch, so a future consumer that composes it without reading its body publishes a capped sample as a population. Extend nx_io_envelope_census to classify capped COLLECTORS (a function taking a max or cap parameter and returning a bare count with no cap signal) as its own named class beside the reader classes, with the same named-set ratchet so a rise names the offender. Done-rule: the census names every collector, the ratchet holds at its measured floor, and the bite plants a collector that hits its cap and must be NAMED.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DI20 — The content clients name the failing stage, and the trust store is found from the tree root by construction
Prerequisites: DI18 (acceptance unverified)
Contract: hf_store_locate
Acceptance: nx_content_get_client failed three times as post failed (transport) with the door, the URL and the cap all innocent: hf_store_load reads data/mozilla_certdata.txt relative to the current directory, the client was launched from the home directory, and the missing store surfaced as a transport fault. Done-rule: (1) both clients refuse at the load site naming the path and the cwd with nothing posted (landed 2026-09-22 as CG-IO and CC-IO, rc 3) and the transport messages carry the follower rc; (2) hf_store_locate resolves the store on a declared ladder (the cwd, then the tree root the executable lives under) and announces which rung answered, so a client works from any cwd and no consumer of hf_store_load can be blind to an unreadable store; (3) both client gates carry a from-HOME bite.
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence dataio writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

DI1 Silent-truncation cap census on a beat with a named-set ratchet · cell PRESENT · gate NO-GATE-DECLARED

Contract	`jc_has_bound` · executor Organ · 1 u · stands on nothing
Definition of done	nx_janitor_caps PROMOTED and REGISTERED; one full-tree run published as a partition (files scanned, files flagged, three-part hits) with the worklist; a truncate-written verdict log knowledge/status/capcensus.log with a canonical last line; the daily beat; the ratchet baseline is the SET of flagged files so a new offender names itself. ACCEPT RULE declared in advance: the gate plants one file carrying all three parts and one carrying only two, and the census must flag exactly the first. A detector that finds nothing has not found nothing until it has found something planted
Matrix cell	Silent-truncation cap census over every source (fixed array, a bound on the same literal, an unbounded source) · `runtime/_hdl_build/nx_cap_detect_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_cap_detect_lib`; declare `nx_cap_detect_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-05 measure nx_capcliff scan 2026-09-05: rows=18 over=4 near=0 missing=0; actlog.jrnl 54589357 B (13015 permil of the 4194304 window), tool_diff.log 32710926 B, dup_source.log 14954968 B, orchestrate.log 5223094 B; consumers of actlog.jrnl read TAIL-anchored by declaration in nx_catalog (cl_slurp_tail), nx_execsurface (es_read_tail), nx_toolatency (tl_read_tail), nx_wirecensus, nx_gateadjudicate; nx_replyreserve_lib and nx_capsweep unverified 2026-09-05 measure literal 4194304 census 2026-09-05 over buildroot/runtime (nx_shelltool, coverage_complete=1 corpus_complete=1 files=23663): hits=1430 distinct_files=717 code=1415 comments=15 named_consts=607 bare_call_literals=718 other_code=90 (607+718+90=1415); files by tree _hdl_build=337 runtime=380. The first read of this census was cut at the 163840 B capture cap and ANNOUNCED it, so the 1389-line floor was re-measured in four 400-line windows to the exact 1430 2026-09-05 land nx_janitor_caps shipped through nx_organ_ship (build queued under admission, BQ-nx_janitor_caps, promote as the deliberate second pass); nx_janitor_caps_gate is its declared proof. Same day: nx_actlog gram tables derived from a frame census (T16 16900 exact, T17 gmax 33801), nx_claude_harvest and nx_actlog journal reads moved to sys_read_file 2026-09-05 measure nx_domain_admit dataio at first run: REFUSE with two named reasons -- one organ path unresolvable (chunked_decode lives in runtime/_hdl_build/nx_http_chunked.nx, corrected) and no barcheck row nor UNPINNED declaration. Closed by reading three rivals LIVE from api.github.com (restic v0.19.1, BLAKE3 1.8.7, tus protocol repo v0.2.2, JSON mirrored with provenance) into knowledge/barcheck.conf and declaring the IETF column UNPINNED with its reason in the matrix header; knowledge/compare/dataio.gates written with five promoted gates so the second-method axis has an executable map 2026-09-05 land BOARD LIVE: /compare/dataio published by the compare regen (holder regen-1788632942, the beat's own run -- a second regen I launched was correctly refused LS-BUSY), nx_page_verify status=200 bytes=79289 a11y-issues=0 VERDICT=GREEN through the pinned sovereign edge. Admission ADMIT (rows=14 grounded=9 absent=4 ungrounded=0, bars pinned=3 unpinned-declared=1, gates=1), evidence MEASURED-HONEST with the two vacuous rows resolved (janitor gate migrated onto gv_check_eq and shipping; record gate removed with its reason), ranker critical path DI2 > DI7 > DI6 > DI5 > DI4. Root fix for the false-green build class landed in nx_hostctl cmd_buildrun (debt 1788634371 supersedes the mechanism in 1785363417); ship in flight, deploy via /api/deploy target=hostctl owed 2026-09-05 land nx_actlog SHIPPED THROUGH THE FIXED LOOP: promoted 91fbd6facca41718204bb8e9c04275966c0038ca95566aa754aafe3c67e8920b (117760 B, the fresh source's build; the stale 111648 B generation is gone), PROVE GREEN with nx_actlog_gate REBUILT this run because its closure bank drifted -- so the T5 generation-identity tooth is what passed, and the previous generation could no longer have. Adopt: 1 named lost run (the verdict-note reword) allowed. The gram tables are now DERIVED from the frame census on the live miner (16,900 exact where 16,384 silently capped) 2026-09-05 land nx_actlog_gate T5 generation SHIPPED on the NAS: 7/7 GREEN, promoted 803eb6aa, offc twin fresh; its identity tooth now pins the frame-derived index generation (T16 index sized from the frame count) so a stale miner binary can no longer pass as current. The miner itself (nx_actlog 91fbd6fa, gram tables derived from the frame census, index_overflow announced) was promoted earlier today. Two admission refusals and a false-BUILT stage from the builder lay between the source edit and this receipt; the hostctl exit+token verdict that closes that class is deployed inline and its lib refactor is staged 6122278d awaiting deploy. 2026-09-05 land hostctl DEPLOY #2 (the lib refactor of the builder verdict): /api/deploy target=hostctl expect_sha256=6122278d -> PROMOTED, pre_deploy_gate DEPLOY-SAFE, deploy_status DEPLOYED-GREEN (listen UNVERIFIED-may-be-outgoing-process, the honest third state); live nishihost/nx_hostctl = 6122278d 291,864 B. Both declared gates GREEN on the ship (nx_hostctl_keepbackoff_gate, nx_hostctl_buildrun_gate 9/9). Banks before the deploy, hash-verified: pre-change 4cab397e and the inline-fix generation ab32babd under knowledge/status/. The _offc twin (forked by nx_hub_publish_hostctl, which ships it OUTWARD) was the pre-fix original: nx_offc_install cannot see a live name without .elf, so the twin is refreshed by the verifying copier and the installer's blind spot is a named gap. 2026-09-05 measure FIRST NAS RUN of the promoted nx_janitor_caps detector (nx_job_run, root buildroot/runtime, floor=32): scanned=19489 .nx files, FLAGGED=54 candidates -- a fixed-count array whose literal also bounds a fill loop, in a file that reads an unbounded source. Candidates, not verdicts: each needs review and data-driven sizing makes the flag disappear. Named daemons and servers on the list: nx_relate_serve (64), nx_survey_serve (32), nx_office_serve (64), nx_nofloat_serve_core (256), nx_seg_store (256, the class that dropped 680 of 936 segments with no error), nx_arcade_serve (289), nx_qserver (128), nx_gen_orchestrator (4096), nx_paramplumb (4096), the whole nx_vizsla_* family (26 files, 32..512), nx_compare_unified and nx_swcompare_evidence (the compare surface itself). Full list in /tmp/janitor_caps_first.out (reaped hourly) -- the beat that persists it is the next step once the migrated gate ships. 2026-09-05 land nx_janitor_caps_gate MIGRATED generation SHIPPED: promoted c263e75f, 6/6 GREEN on gv_check_eq with named neg-controls F2..F5 (data-driven, no-source, byte-buffer, shift), registered; allow_loss=11 named the D001 literals the old hand-rolled dialect printed (got/want, F1..F4 labels) and every one is journalled as an ADOPT-LOST row. The evidence referee read this gate as VACUOUS (pass=0/0) before today because its verdict was unreadable from outside; re-run of nx_swcompare_evidence dataio requested. nx_janitor_caps (the detector) promoted c63d0c74 earlier today; its daily beat is the next wiring step. Also today: ioenvbeat 86400 nx_io_envelope_census.elf declared in the clockjobs- desired-state plane (172 rows) under a minted nx_clockjob cap -- the envelope census now runs daily and its ratchet names any NEW silent reader. 2026-09-06 lesson nx_fsops_write_gate was RED 9/11 on every referee pass because it never removed the file its NEW-file tooth creates -- a gate that is not idempotent reports on its first run and lies about every run after; fixed at setup, 11/11 twice, built in the SAME lane as live (/api/build) because the laptop lane loses 56 symbol-name runs against a NAS-built live binary (lost_other=0, a flavour difference the ruler names), PROMOTED 93f05ed7

DI2 Every capped reader announces or derives: the envelope census · cell LANDED · gate NO-GATE-DECLARED

Contract	`ie_scan` · executor Organ · 1.5 u · stands on DI1
Definition of done	An organ enumerates every sys_read and sys_read_at call site whose length argument is a bare literal, classifies DERIVED (the length comes from stat or lseek), ANNOUNCING (the enclosing organ prints an envelope naming the cap) or SILENT, prints a partition that sums to the call-site count, and makes SILENT the worklist. ACCEPT RULE declared in advance: a planted silent reader is found; every sys_read_file caller reads DERIVED; and the false-positive rate is published over the whole tree as a number, never asserted zero
Matrix cell	Every capped reader announces or derives: a census of fixed-length reads without an envelope · `runtime/nx_io_envelope_census.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_io_envelope_census`; declare `nx_io_envelope_census TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-05 measure nx_compare_rank dataio on admission day: rungs=8 done=3 open=5 (partition sums), matrix_rows=14, unmapped=0. Critical path for TARGET VERSION 0.1: #1 DI2 the envelope census (priority 133, all rivals absent: a lead nobody holds), then DI7 offset-resumable door (1200), DI6 per-chunk verified streaming (1000), DI5 content-defined chunking (666), DI4 idempotency keys (133). PM filed 1 of the top 3 into pm_intake. The three rungs the ranker reads as done are done by SYMBOL PRESENCE only (jc_has_bound, sys_read_file, cc_size exist); their done-rules are not yet met and the log rows say so -- the flip is the receipt, never the proof 2026-09-05 land nx_io_envelope_census SHIPPED on the NAS: promoted 2b006735, offc twin installed, REGISTERED; PROVE by nx_io_envelope_census_gate 6/6 GREEN (bank CURRENT, run on the banked build artifact). The classifier: sys_read( sites as LITERAL / NAMED (const NAME: i64 = decimal, same file) / DYNAMIC (not judged), ANNOUNCING when the file carries an envelope token (TRUNCATED, OUTPUT-IS-PARTIAL, coverage_complete, capture_cap, scan_cap, truncated=, partial=), sys_read_file( counted on a separate DERIVED axis; walker = nx_shelltool grep with its coverage PROPAGATED (partial walk = UNPROVEN, never a smaller number); named-set baseline knowledge/status/io_envelope_silent.baseline, --accept rewrites it deliberately; status knowledge/status/io_envelope.status with the verdict LAST. Selftest 12/12 (comment, string and the derived primitive are never sites; a prefix-named const resolves to its own declaration; a call expression is DYNAMIC). First NAS run launched via nx_job_run; the ie_scan watch flips on the next regen beat. 2026-09-05 measure FIRST NAS CENSUS (nx_io_envelope_census over buildroot/runtime, nx_job_run, knowledge/status/io_envelope.status ts=1788639582): walker matches=2328 coverage_complete=1 corpus_complete=1 cap_hit=0; hits=2328 = fixed 640 + dynamic 1637 + not_a_site 51 (partition RECONCILES); SILENT (fixed length, no envelope token in the file) = 596 = the worklist, named file:line in knowledge/status/io_envelope_silent.baseline (CREATED this run, so new_silent=0 and verdict=GREEN is the ratchet floor, not a clean bill); DYNAMIC 1637 is NOT JUDGED (a computed length can still be a cap wearing a variable); DERIVED sys_read_file sites = 3298 on the separate remedy axis. false_positive_rate UNMEASURED adjudicated=0 of 596 -- the worklist needs adjudication before any SILENT row is called a defect. Daemons on the list that read a request body through a silent fixed length include nx_sites_daemon (20480), nx_andelinwest_daemon (8192), nx_opaque_login_tls_daemon (65536), nx_media_server (262144 x7), nx_mesh_gateway (262144), nx_dev_api_serve (262144): request-path readers are the highest-value adjudication order. 2026-09-10 measure 2026-09-09 shared native measurement release: nx_sota_status json emits 120 local domains and 3568 declared axes with explicit source and cached-evidence age. Independent four-directory census reconciled all 120; seven corrupted records rejected. Published compare/maturity/measurement.json 50989 bytes SHA25683ca0bceef04a90abc19223cd652fdcf11d257b4fa11f75a8bdcd5287235d7dc via guarded publisher job1789010176. nx_compare_serve promoted job1789010246 SHA256b3874a8606e6c56774f92078abe1c0367af291b5b6a1f536bd1701dbad4f76d0; live nishi_compare measurement equals public snapshot bytes. Index and OpenAPI legacy bytes preserved; traversal refused. Snapshot refresh is not automated. Nine Compare-index domains lack measurement coverage; function/API/MCP/rung bindings, investment estimates and dated matched frontier benchmarks remain unbound. Browser unavailable: visual and interaction delivery review unfinished. 2026-09-10 measure 2026-09-09 native measurement contract discovery: nx_swcompare_hub now emits /compare/maturity/measurement.json and SotaBoardMeasurement schema without changing OpenAPI3.1.0 or existing API contracts. Native9656byte document validates with independent JSONSchema2020-12 validator against real120domain snapshot; false estate-wide claim rejected. Existing index output98666bytes is byte-identical in live/candidate comparison. Promoted155720B SHA256d0a4a2a41018a5eac910c2f8559b7dd29b1fce9cb1e29bc8dc62291029999f45; _offc hash matched job1789010999. Contentdiff lost legacy shared headings/CSS strings; full emitted HTML diff contains shared stylesheet changes only, browser review unavailable. Guarded OpenAPI publication1789010838 and nishi_compare openapi return exact9656bytes SHA25635d91c33872f1b99c2ffec47277844a1b9098a5671461f872562aec4248b75ef. HTTPS validation found a separate gateway defect: /compare/openapi.json returns200 text/html index14150bytes, not this contract. Do not claim HTTP contract delivery until policy-preserving route correction is exercised. Scoped measurement API remains separate from complete estate maturity. 2026-09-10 measure 2026-09-09 release: Compare OpenAPI discovery is served as JSON with access-policy projection. Gateway deployment1789011982 is DEPLOYED-GREEN; live269232B SHA256462ac942b2287be3ef46d799813879d592b09b214d2f59bd2a04f40def75d906 matched the staged build. HTTPS /compare/openapi.json returns200 application/json9655bytes, identical to validated native projection; all schemas and routes preserved. Public index200 JSON16424bytes excludes hidden board; hidden-board request404. Tests:29 projection/token fixtures,36 existing access checks,30 tokenizer selftest checks,10 existing JSON-completeness checks. Character stamp refreshed by evidence text mode:77 checks in4 gates,26 grounded claims and36 gaps; JSON mode alone intentionally does not stamp. Measurement snapshot1789011729 published50987B SHA256cbbeeaeacb395049d0b0b0880a805478e30898dda3baee1f595266f9a641360e and HTTPS bytes match; charsim MECH-OK is not SOTA. Research retrieved2026-09-09 informs benchmarks: MCP2026-07-28 and optional Tasks, OpenAPI3.2 reference without contract upgrade, OTel HTTP metrics, SLSA1.2 provenance,2026 ReSTIR graphics papers. Investment schema prototype locally validates measured/forecast separation and rejects9 invalid records; native integration, full inventory joins, comparable frontier runs, renderer integration and visual/interaction review remain unfinished. No browser instance is available; UI delivery remains partially verified. 2026-09-10 measure 2026-09-09 reused counted-cost comparator nx_cost_oracle: exact admitted metric IDs only, equal costs tie even with zero margin, negative costs/margins refused and ordered nonnegative subtraction avoids signed overflow. Empty samples no longer count as reproducibility evidence. Legacy five function signatures and result IDs retained; counted instructions/toggles/bytes explicitly do not prove lower latency, universal reproducibility or hardware portability. Canonical36/36 test replaces seven narrow tests and is promoted35904B SHA25690b675f4320b18e91db392956524a205fd72f4e1fa8e93accd3b26e021db7f27. Investment reuse audit also found native nx_tokroi report and existing comparerank/plan stores, preventing a duplicate ledger. Actual ROI report has five rows but truncated evidence, floor payback and declared historical assumptions; financial/token savings are not reverified by this read. ROI boundary hardening and native investment projection remain underway; no all-estate or SOTA-complete claim. 2026-09-10 measure 2026-09-09 investment release: reused nx_tokroi and its retained five-row ledger, preserved all legacy numeric fields/totals, added signed_delta and ceiling break_even_uses, excluded unknown status from aggregates, retained full evidence and declared evidence_verified=false, units_verified=false, history_complete=null. Native25/25 boundary checks plus5/5 existing selftests passed; missing plane emits structured error/nonzero. Promoted166344B SHA256d1f8393a8158fd4affd151e04e596cbca2f5b068c6921cdf29a1bce865ff6bc1 after full18-token audit:15 re-encoded JSON fragments and3 corrected measurement claims, explicit reviewed capability-loss exception; no commands/fields removed. Extended existing contentdiff display from default8 to optional bounded limit,18/18 checks, no verdict weakening. Compare investment alias and OpenAPI schema share published3085B report SHA25673f3b946344c1650e69e431fc8569823f690d9bbd6370ec25f0da8534f789208; HTTPS200 application/json and direct sovereign MCP nishi_compare investment bytes match. OpenAPI retains old paths/schemas and returns14026B authorized projection. Attached nishi transport closed; sovereign ELF API fallback exercised. Boundary escaping mismatch was detected/corrected in unpublished temp data. Domain/rung/function bindings, actual saved-cost verification, first-byte-to-delivery spans and SOTA comparisons remain unfinished; browser list empty, visual/interaction acceptance unresolved. 2026-09-10 measure 2026-09-10 release: first-byte-to-SOTA measurement investment continues through existing sovereign APIs. nx_sota_status bindings domain preserves raw full/partial rung contracts and independent older rank stamps, null unresolved behavior/source/API/MCP joins; producer170888B SHA2564959166184838839aa5da3d0a576f79b9f31b9f385301e01b333a3f5bd8295c3 promoted1789018343. Native49/49 parser/rank checks and30/30 complete-artifact/invalid-input/board-preservation checks; actual charsim37 and gameengine68 rows fully parsed. Published /compare/charsim/bindings.json63987B and /compare/gameengine/bindings.json222060B, full HTTPS200 bodies byte-identical in44/44 delivery gate1789019042. Live nishi_compare bindings gameengine returns1048B artifact manifest; existing investment3085B unchanged; adapter23/23 public policy/read checks and zero content losses. OpenAPI3.1 remains stable: only bindings route/schema added, whole generated old/new objects identical after removing additions and generation time; reviewed one printable JSON-fragment split before explicit capability-loss exception promoting hub164872B80b6567fa518401293704fc341b4a69f76b27da95e4872463cb362c6c9bebc74. Unicode MCP shared decoder52/52 and actual-caller19/19 gates; live escaped Unicode exact and malformed surrogate returns-32602 before dispatch, live serving hash15ab45ad2bb8d85215fc2d4042f054aa492d9cb8e7eadfdd2d3e211d0f725df7. Deployment1789017242 terminal receipt still absent; watchdog/live hash/behavior pass independently; needs-intervention to reconcile stale claimed job, no duplicate deployment. Today primary research: MCP2026-07-28 versioned Tasks, OpenAPI3.2, OTel HTTP metrics stable/mixed, SLSA1.2 and July2026 ReSTIR papers guide bounded adoption, not claimed estate SOTA. Still unfinished: correlated first-byte-to-complete-delivery spans, full estate evidence joins, verified savings/resource spend, matched rendering frontier and served visual/interaction review. Parallel gates do not prove time-to-market improvement. 2026-09-10 measure 2026-09-10 release: existing bindings API/MCP now joins all105 retained rungs to exact current matrix symbols, with34 charsim and52 gameengine unique joins,14 unmatched,3 unsupported and2 without contract symbols. Declaration text observations remain separate from syntax, deployed behavior, rank and SOTA;8 gameengine watches retain declared gaps despite present text. Source reader reports full read or unobservable; no unavailable source is called absent. Existing49/49 parser/rank and30/30 new join-rule checks plus30/30 actual staged artifact checks; full independent JSON/matrix/raw-rank and previous-field parity passed. Producer193480B SHA25609ab34359ab0f6ec06838e1df4ac34d27367e0fe5861f75572b2b0b4284bcc1b promoted1789021557 after review of one intentionally split JSON literal. Guarded reports published1789021595/1596: charsim124424B SHA25692d35e52d3ac63b4fa0d52f4b28ce5de9fc825c10e7294aa38907e4eba7ce2bf; gameengine336300B SHA2567442f3a97c672b89b01e451f4101e36801140fe7d2793fe4019ab73445c46d3b. Entire HTTPS200 bodies equal published files;44/44 delivery gate1789021645, actual nishi_compare bindings gameengine1048B manifest names336300B artifact. API/MCP operation and behavior joins, client first-byte timing, independently captured source provenance, actual investment returns and matched SOTA frontier remain unfinished. Timing candidates reuse actlog but are not deployed. Research refreshed2026-09-10; protocol specs and rendering papers are targets, not estate attainment. Served visual/interaction review remains unavailable and unresolved. 2026-09-10 measure 2026-09-10 retained timing worklog: full daemon build1789022928 and zero printable losses1789023037 reviewed; dedicated loopback gate1789023687 passed51/51 after copied fixture execution was diagnosed as EACCES and replaced with the original byte-verified executable. Gate exercises real sync, positive exit7 result, async/promoted IDs and publication, disconnected write failures; promoted capture explicitly unreaped. Native gates are not client TTFB or throughput benchmarks. Health-checked toolsapi deployment1789023777 and exact live binary/behavior independently verified; terminal job receipt remains NEEDS-INTERVENTION, not a waiting recommendation. Latest primary research checked2026-09-10 guides versioned task lifecycle, distinct HTTP/local timing and matched rendering comparisons. Specifications/papers are comparison targets, not evidence of Nishi completion. Ready: tested native timing evidence; running: live timing daemon; waiting: no justified automatic queue; intervention: missing deployment terminal receipt and unavailable served visual/interaction review. Preserve prior failed tests and unfinished work. 2026-09-10 measure 2026-09-10 retained worklog: parser48/48 job1789025031, actual staged producer artifact30/30 job1789025307, zero content losses3/3 job1789025308; all105 report rows independently compared with exact matrix, raw rank and prior contracts before promotion. Charsim133708B SHA256c8e2166e0ba6bb747e652678b7ebe3dc1a7a1db0ffde63735f6c2eebadfd6aef; gameengine357433B SHA2560cc879138bbdd96316f59838ea9405c435f40bf47b1961cf83bf97993ab3cd3d. Ready: tested measurement contracts; running: promoted producer and published reports; waiting: no justified automatic queue; needs intervention: prior deployment terminal receipts and full Compare receipt journal. Signal-free native process gate1789025371 passed5/5: detached child matched existing restart substring predicate, then exited normally with no signals; this proves selection risk, not historical deployment cause. Stop and guard need coherent listener ownership before repair; no live restart or claim rewrite performed. Beach loader/browser, independently verified resource returns and full estate coverage remain unfinished. 2026-09-10 measure 2026-09-10 native restart prerequisites: tools request children now close inherited listener in source; actual source-linked socket gate1789026317 passed19/19, preserves accepted socket, parent second connection and exact268B HTTP response. Candidate daemon382272B SHA256695ea70403064bff4a625efde779a24b2b7ecd6e5576fd5fab71586152a78944 is staged, NOT deployed. Existing OS observation owner adds all encountered inode PID/FD references with unknown/capacity errors; native18/18 gate1789026165. Actual allproc census747PIDs found2 references but662 reads inaccessible(first_error=-13), so result UNKNOWN, not restart authority. Ready: isolated prerequisite evidence; running: prior live daemon; waiting: no automatic deployment claimed; next action: complete listener/service identity and coherent stop/guard repair before rollout. Prior lost deployment receipts and full publication journal remain needs-intervention; no replay or history deletion. Native Beach resident-loader candidate remains local, real assets/WASM growth/renderer and served visual acceptance unfinished. 2026-09-10 measure 2026-09-10 retained worklog: shared all-listener census validates actual IPv4/IPv6 headers, preserves all matching raw addresses/inodes and refuses truncated input or row capacity. Native29/29 job1789027643, actual two loopback addresses and132281 proc bytes. First gate build rejected reserved keyword match; corrected unpublished gate to matched and retained failure1789027556. Existing portcheck source19770B SHA256506c7de68eb48bc0599b4a04834a428035600442eb4f0c0312308dc387c2f564; staged build1789028271 fully reviewed. Real child CLI gate1789028805 passed29/29, captures independently validate four JSON results and legacy5/5. Management API1789029065 returned COMPLETE771B; scoped MCP observation1789029148 returned COMPLETE771B. Ready: tested observer; running: promoted existing organ; waiting: no automatic queue claimed; next: join observations to stable process identity and repair stop/guard coherently. Prior lost deployment receipts, full Compare journal, unavailable visual review, client first-byte spans, full estate joins and independently verified investment returns remain unfinished. Research checked2026-09-10 remains comparison guidance, not SOTA attainment. 2026-09-10 measure 2026-09-10 retained worklog: existing nx_toolatency60632B SHA2563fd38b41b8022f22e22d04d6609cd2fc829a0013ab9f9de48c992e35813004c6 promoted1789032682 and actual live hash verified. Native strict parser33/33 job1789031841 on unchanged8165B journal23 observations; actual staged CLI48/48 job1789032165 covers complete output, row/read windows, malformed/overflow/arity, missing input, UTF8/signed minimum and closed stdout exit4, with source/config unchanged. Independent JSON Schema and exact raw-span validation passed all9 captures; representative legacy20/20 job1789032596 preserved622B identical stdout and journal payload apart from valid timestamps. Original build1789031979 log was overwritten by unrelated build; repeat1789032069 exact cache hash/full proper log reviewed. Actual management call1789032728 and MCP both returned5283B WINDOW with four identical rows, checked against independent journal span; cursor63245586 resumed four next rows to63246945 with no skipped leading bytes. Live source initially observed63259957B; each response records its own initial-size observation, never an atomic snapshot. Read-only library16337B and existing owner26198B; no second event store or tool registration. One-day capability scoped only to existing nx_toolatency retained privately. Ready: checked phase reader; running: promoted API/MCP command; needs intervention: first-byte/result-retrieval instruments, explicit artifact/rung/investment joins, full Compare receipt journal and unavailable browser review. No raw operator journal published to Compare, no verified return or general speedup claim. Dated research refreshed2026-09-10 remains a guide for matched comparisons rather than proof of SOTA attainment. 2026-09-10 measure 2026-09-10 retained worklog: corrected existing knowledge/tool_schemas.conf row948 through exact guarded replacement job1789033713 DONE; resulting468494B SHA256b8ce847de62a5cf0c9b6442878dd10de78f5efa92592107e7dc66526cb965840. Actual MCP tools/list cursor896 returned the complete nx_toolatency item with authored observations grammar and readOnlyHint=false; destructive/idempotent/openWorld flags remain false. Canonical runtime/nx_tools_api.nx rereads metadata per request, so no daemon rebuild or restart was needed. Existing output fields and legacy entrypoint retained. Ready: reviewed metadata; running: fresh discovery response verified; needs intervention: browser visual review and full Compare receipt journal. First-byte/result retrieval and explicit execution/artifact/rung/investment joins remain unfinished. Existing benchmark receipt plane and binding source observations identified for reuse; investment report still declares five rows with evidence_verified=false and units_verified=false. No new store, verified ROI or universal SOTA claim.

DI3 Derived-buffer adoption published as a ratio with its denominator · cell PRESENT · gate NO-GATE-DECLARED

Contract	`sys_read_file` · executor Organ · 0.5 u · stands on DI2
Definition of done	The DI2 census emits derived, announcing and silent counts per beat and the silent count may not rise (a count ratchet with the names beside it, because a count-only ratchet on a shared tree reports a regression without saying whose). ACCEPT RULE: the ratio is emitted as three integers and no percentage without them
Matrix cell	Derived read buffer: the buffer is sized from the file, never from a constant · `runtime/nx_syscalls.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_syscalls`; declare `nx_syscalls TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DI4 Idempotency keys on unsafe MCP writes · cell LANDED · gate NO-GATE-DECLARED

Contract	`ta_idempotency_key` · executor Organ · 1.5 u · stands on nothing
Definition of done	nx_fs_write write, edit and append accept a caller-supplied key; a retry carrying the same key returns the FIRST outcome and its original bytes without re-applying; a missing key on a documented idempotent verb is refused with problem details. ACCEPT RULE declared in advance: a self-anchored insert edit issued twice with one key applies ONCE and the second reply equals the first; the same edit issued with two different keys applies twice (the neg-control proves the key is what makes the difference); the edge-window Outcome-Unknown body then names the key so the caller can retry without reading the artifact
Matrix cell	Idempotency key on every unsafe write so an Outcome-Unknown retry is safe by construction · `runtime/nx_tools_api.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_tools_api`; declare `nx_tools_api TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-05 measure Outcome-Unknown writes in one seat session 2026-09-05: nine (edits, appends, a ship launch, a listing), each adjudicated by re-reading the artifact; two classes cannot be re-issued safely (INSERT-SELF-ANCHORED edits and appends); the transport already answers with RFC 9457 problem details but carries no key the caller could replay 2026-09-05 lesson MEASURED THE SAME HOUR THIS BOARD WAS WRITTEN: nx_organ_ship shipped a STALE nx_actlog under a fresh 65611 B source with prove GREEN, because /api/build dedups an identical body for about an hour and re-stages the stale .sov.elf.new as BUILT (debt 1785363417, open since 2026-07-29, recurred), and the promoted gate's identity tooth pinned a string both generations carry. Fixed at the root in the ship loop: a per-run bust nonce on both /api/build bodies (target build and gate rebuild), and a generation-specific identity tooth (T5) in nx_actlog_gate. The sovereign-lane build of the same source MISSed the cache and produced the fresh 104983 B artifact, which is how the replay was attributed rather than assumed 2026-09-05 retract RETRACTED the mechanism in the DI4 lesson row above, same day: the stale nx_actlog promote was NOT an /api/build idempotency replay. Refuted by reading the source: no organ in the tree sends an Idempotency-Key header (grep over 23,667 files, coverage_complete=1) and the mgmt dedup keys on that header, so a bare target= body was never being deduplicated. THE TRUE MECHANISM, read in nx_hostctl cmd_buildrun: the host controller forks the builder, prints its exit code, and then probes _build/<name>.sov.elf regardless -- when the builder REFUSES under its own admission check (rc=4 in the I/O storm) the PREVIOUS build's artifact is still there, validates as an ELF, is echoed as BUILT size= and re-staged with a fresh mtime, and the mgmt API emits action=BUILT with that stale digest. Root fix landed in source: stage only when the builder exited 0 AND printed its own SOVEREIGN build token (the positive marker), never on the absence of an error. The ship-loop nonce shipped earlier is harmless and stays; its comment is corrected to say so. A hypothesis restated in three debt rows since 2026-07-29 was still a hypothesis until the controller's source was read 2026-09-05 land ROOT FIX DEPLOYED: nx_hostctl cmd_buildrun now stages only when the builder exited 0 AND printed its own SOVEREIGN build token; a refused or dead builder returns BUILDRUN FAIL naming the exit code and the artifact on disk as a PREVIOUS build, so /api/build can no longer answer action=BUILT with a stale digest. Shipped through nx_organ_ship (BUILT ab32babd17ebb051, prove: named absence, gate nx_hostctl_keepbackoff_gate now declared in organ_gate.conf for future ships), promote correctly refused as DECLARED-DAEMON, then /api/deploy target=hostctl with expect_sha256 -> PROMOTED, pre_deploy_gate DEPLOY-SAFE, watchdog running; live digest re-read ab32babd17ebb051 291088 B. Pre-change binary banked by digest at knowledge/status/nx_hostctl.bank-20260905-prebuildrunfix (4cab397ea2775d87, 289624 B, mode 0755). Content ruler live vs staged: lost 0, gained 5 (exactly the new refusal strings), strict superset. Owed: nx_hostctl_buildrun_gate with a fixture builder that exits 4, asserting NOT staged (a green that has not yet had its red) 2026-09-05 land THE BUILDRUN FIX GOT ITS RED: the stage decision moved out of nx_hostctl into nx_buildrun_verdict_lib (one pure function, bv_verdict: exit 0 AND the builder's own SOVEREIGN build token, evaluated in that order) and nx_hostctl_buildrun_gate drives it with the incident's own capture shapes -- 9 of 9 GREEN locally: the measured refusal (exit 4 + REFUSED-BUILD-ADMIT) reads EXIT_NONZERO, a real compile and a cache hit read OK, a hit line alone, an empty capture and a split token read NO_TOKEN, exit 127 with a stale token reads EXIT_NONZERO, exit wins over token. Declared for nx_hostctl in organ_gate.conf beside nx_hostctl_keepbackoff_gate. Sources byte-identical NAS and laptop (hostctl c1c4fb82d174a5b5 341459 B); gate ship in flight, controller re-ship and second /api/deploy follow 2026-09-05 measure IDEMPOTENCY KEYS BUILT AND GATED (local proof, ship pending): nx_fsops_write (the binary behind nx_fs_write) takes an optional key=<token> on write, edit and append; the first APPLIED outcome (rc=0 verb path bytes hash) is recorded in the estate's append-only ledger knowledge/status/fswrite_idem.jrnl through nx_apistack_idempotency (first-write-wins, composed not duplicated), and a retry carrying the same key is REPLAYED with the first outcome and NOTHING re-executed; refusals are never recorded; expect= and key= are order-free so a key can never be misread as an expect. nx_fsops_write_gate (the write path's FIRST gate) 11 of 11 GREEN on a fixture tree: keyed write replayed, keyed self-anchored insert applied once then replayed with size unchanged, a DIFFERENT key applies again, NO key applies again (legacy exact), keyed append twice lands one row, a would-clobber refusal does not poison its key. DI3 bonus: the ledger lib read its ledger through a 262144-byte cap (an append-only ledger loses its NEWEST keys first, so a SEEN key would read NEW and double-execute) -- replaced by sys_read_file, its own gate 4 of 4 2026-09-05 land nx_fsops_write PROMOTED sha 6dbf2d9a (63,352 B), offc twin fresh, REGISTERED: key=<token> idempotency on write, edit and append; ledger knowledge/status/fswrite_idem.jrnl (nx_apistack_idempotency, read whole via sys_read_file, its 262,144 cap removed). LIVE PROOF through the MCP tool: a same-key re-issue answered NX-FS-IDEM REPLAY first_outcome=rc=0 bytes=26 hash=h27f809e5c788f4b1 and the file was NOT rewritten. Gate nx_fsops_write_gate 11/11 GREEN locally (keyed write replayed, keyed self-anchored insert applied once, different key applies again, no key unchanged, keyed append twice = one row, refusal never recorded); the ship PROVE stage ran the older nx_fsops_gate 41/41 by name-strip because the new gate was source-only on the NAS: its own ship is in flight. 2026-09-05 measure LIVE through the MCP tool nx_fs_write, both verbs: write key=di4-probe-20260905-a first call OK bytes=26, same-key re-issue REPLAY first_outcome rc=0 bytes=26 hash h27f809e5c788f4b1, file unchanged; append key=di4-append-20260905-a first call OK total=58, same-key re-issue REPLAY bytes=58, file unchanged. Two verb shapes that had NO safe retry after an Outcome-Unknown now have one. This row itself was appended under key=di4-plan-row-20260905-a. Gate nx_fsops_write_gate SHIPPED on the NAS: 11/11 GREEN, promoted b9cca743, registered; organ_gate.conf now declares BOTH nx_fsops_gate (41 teeth) and nx_fsops_write_gate for nx_fsops_write so the convention cannot displace the family gate. 2026-09-05 land TRANSPORT-LEVEL IDEMPOTENCY KEY LIVE (ta_idempotency_key): nx_tools_api_serve 58fcfa74 (320,016 B) DEPLOYED via /api/deploy target=toolsapi expect_sha256, DEPLOYED-GREEN listen=VERIFIED; pre-change 991b2522 banked at knowledge/status/nx_tools_api_serve.bank-20260905-preidem. Mechanism: params._idem (sibling of _cap and _async) is classified by nx_toolcall_idem_lib BEFORE execution -- BADKEY refused, INFLIGHT (O_EXCL claim _jobs/idem_<digest>.claim held by another call) not executed with the claim age named, REPLAY answers the recorded first outcome; NEW is recorded at every outcome point (async and promote lanes record the job id the instant it is reserved, before the reply; sync and http lanes record exit+bytes and keep the bytes in _jobs/idem_<digest>.out) and released on harness-fail, HTTP-backend error and not-on-allowlist. Gates: nx_toolcall_idem_gate 22/22 (promoted e8d61bb6), nx_tools_api_gate rebuilt 25/25, both declared in organ_gate.conf. LIVE PROOF through the deployed transport: nx_fs_write append with _idem=di4-transport-20260905-a -> JOB-STARTED id=1788643130 (file 58 -> 107 B); same _idem re-issued -> NX-IDEM REPLAY first_outcome=lane=async tool=nx_fs_write job=1788643130 NOT re-executed; ledger knowledge/status/toolcall_idem.jrnl holds exactly that row. Every Outcome-Unknown 503 on this transport now has a safe retry: carry the same _idem. Named limit: a daemon killed between reserve and record leaves the key IN-FLIGHT with its age reported (the deploy that shipped this killed its own receipt job that way). 2026-09-06 land CLIENT HALF: nx_jobfollow_parse gains jf_outcome_unknown / jf_req_keyed / jf_inflight / jf_should_reissue and parses NX-IDEM REPLAY ... job= as a pointer; nx_https_post_lib.hp_post_json_reissue re-posts a KEYED request whose reply the edge lost (503 read-after-accept) or that is IN-FLIGHT, once per poll interval, bounded by the poll budget; jf_post_follow and hp_post_json_follow both route through it; an unkeyed request is never re-posted. nx_jobfollow_parse_gate 22/22. Put client carries _idem at begin/chunk/commit/status and echoes the door's answer when a receipt has no id. Receiver accepts expect= beside expect_sha256= and refuses a malformed CAS token BY NAME (CP-REFUSED-EXPECT-MALFORMED) instead of as a stale file 2026-09-06 retract The buildroot source of nx_content_put and its gate were BEHIND the served binaries by one feature (EC26 CAS-on-source, built 2026-09-02 from a laptop-only copy and shipped through the door itself). The first candidate would have deleted expect_sha256 and three named refusals; nx_contentdiff caught it (lost_from_live=8 BIDIRECTIONAL) and the promote guard would have too (CAPLOSS 142 permil on the gate). Remedy was a merge onto the laptop base, not a promote; both trees now carry the union. Lesson: a laptop build of a laptop-ahead source is the AHEAD class wearing a fresh timestamp -- pull the NAS copy, then check the LIVE binary's runs against the source you hold before editing 2026-09-06 measure Idempotency proven live on the promote lane three times this session: a 503 read-after-accept on /api/promote re-issued under the same _idem answered NX-IDEM REPLAY job=<id>, the job artifact carried the real PROMOTED receipt, no second execution. Receiver PROMOTED 3336ac3b (73,671 B) gate PROMOTED 2315998e (73,474 B, 32/32) client PROMOTED 506df502 (420,788 B); all three strict supersets under nx_contentdiff (lost_from_live=0) 2026-09-06 land Client half widened: a KEYED request that gets NO REPLY (transport failure) is re-posted like an outcome-unknown one -- MEASURED under load1 19: the FIRST post of a run failed on 5 of 11 transfers and every re-run succeeded; after the widening JF-REISSUE fired live and all 11 completed. nx_jobfollow_parse_gate 23/23 (the old neg-control retired, split into keyed-yes / unkeyed-no). Parse gate PROMOTED 70927e8d, get client rebuilt on the rule. The evidence referee's door-gate deadline override row landed (2x the measured 1,034 s run) 2026-09-10 measure 2026-09-09 native MCP completion evidence repair: nx_job_put_error_gate promoted with SHA2561105b1de1e4196b0298e14d5fb49475fa302d9456ebff72962523d3525583032 then passed15/15 real filesystem tests in job1789008990. Old5/5 binary detected and excluded before measurement. nx_tools_api_serve built in job1789008999; contentdiff job1789009138 retained1009/1009 live printable runs. toolsapi domain mapping added to dataio; scoped predeploy check1789009273 had0 blockers and7 warnings without override. Deployment1789009286 changed live file; filehash1789009387 verified SHA256a049d5c51c167ed7e56b0dff5440d68fd7c29132a07589f9990157f1c1b4e19e bytes360368. Services1789009350 shows toolsapi UP and native calls respond. Original deploy job claim remains unresolved; generic deploy_status is not target-bound proof. Crash durability, abandoned-claim recovery and full client reconnect remain gaps.

DI5 Content-defined chunking for the content lane · cell LANDED · gate UNRECORDED

Contract	`cp_cdc_gear` · executor Organ · 2 u · stands on nothing
Definition of done	nx_content_put chunks by a gear-hash content-defined chunker with declared minimum, average and maximum sizes read from conf, never from a constant. ACCEPT RULE declared in advance: on a 64 MiB fixture a one-byte insertion at offset zero re-uploads fewer than three chunks; the bite control is the current fixed-size chunker, which must re-upload every chunk after the insertion
Matrix cell	Content-defined chunking so an insertion does not re-key every following chunk · `runtime/nx_content_put.nx` · LANDED decl
Gate	`nx_cdc_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-06 land nx_cdc_lib (FastCDC gear, normalized masks, every parameter DERIVED from the wire chunk: max=chunk_raw avg=max/2 min=max/8, gear table = sha256(named seed concat byte) built per call) + nx_cdc_gate 17/17 GREEN laptop AND NAS (chunks=43 mean_len=24385 over 1 MiB pseudo-random; after a 37-byte insertion cdc keeps 42/43 digests while the fixed-size control keeps 2/22); receiver gains cp_cdc_gear + verb cdcplan <src>; gate PROMOTED 45f75a91 + REGISTERED + _offc twin; organ_gate.conf binds nx_content_put -> nx_cdc_gate 2026-09-06 lesson nx_gate_bite over nx_cdc_lib: 6 mutants, 4 VOID (admission refused their builds under the storm), 1 uncompilable, 1 VALID SURVIVOR at lib line 84 (`while go == 1` flipped -- disables the strict-mask phase, leaving loose-only gear chunking) that passed every statistical tooth: mean within 2x of avg, partition, determinism, insertion resilience all hold for a plain gear chunker too. A distribution tooth cannot separate normalized chunking from its unnormalized twin. Fixed with a KAT: T17 pins the seeded corpus at exactly 43 chunks (the mutant yields 78); planted locally -> 17/18 RED, pristine restore -> 18/18 GREEN, byte-identical lib verified by hash. Gate PROMOTED 4a965008 (52,047 B, superset of live). A KAT on a deterministic corpus is the honest discriminator for an algorithm whose statistics are shared by its degenerate cousins 2026-09-06 measure nx_gate_bite re-run on the PROMOTED nx_cdc_gate 4a965008 with the KAT tooth: valid_mutants=1 killed=1 (the loose-only comparison mutant at lib line 84 now goes RED), void_build_lane=1 (admission), not_reached=0, twins RESTORED byte-identical -> verdict=GREEN (gate BITES). Before the tooth: same harness, same mutant, SURVIVED (INCONCLUSIVE). Both bite runs on the NAS, both artifact-custody clean (mutant_live=0) 2026-09-06 measure ACCEPT RULE status after the 2026-09-05 landing: PARTIAL. Met: content-defined plan with derived min/avg/max (derived from the wire chunk rather than read from conf -- stricter than the rule, nothing to tune), deterministic gear, insertion resilience proven (42 of 43 digests kept vs 2 of 22 fixed) on a 1 MiB pseudo-random corpus, KAT-pinned and bite-proven. NOT met: the wire still re-sends fixed-size chunks; the 64 MiB one-byte-insertion re-send test cannot pass until the transfer itself uses the plan. Declared as DI9

DI6 Per-chunk verified streaming, and a short body can never commit · cell LANDED · gate UNRECORDED

Contract	`cp_stream_verify` · executor Organ · 1 u · stands on DI5
Definition of done	The receiver verifies each chunk digest on arrival and refuses commit when the declared total is not met, so a corrupt or truncated stream is refused at the first bad chunk rather than after every byte was accepted. ACCEPT RULE declared in advance: the gate plants a truncated final chunk and a wrong-digest middle chunk in separate runs, both are refused with the offending chunk NAMED, and the complete upload is accepted; the refusal arrives before commit
Matrix cell	Verified streaming: each chunk verifiable as it arrives · `runtime/nx_content_put.nx` · LANDED decl
Gate	`nx_cdc_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-06 land cp_stream_verify: every staged chunk is re-hashed against its receipt BEFORE its bytes join the assembly; a mismatch refuses CP-REFUSED-CHUNK-CORRUPT index=N exit 7 and assembles nothing; CP-ASSEMBLE now prints stream_verified=; gate neg-control flips a byte in staged chunk 2 ON DISK (same length, invisible to a size check) and the commit names index 2 2026-09-06 measure NAS proof on the PROMOTED binaries (nx_job_run, serving root, under a load1 of 19): nx_content_put_gate 32/32 GREEN against ./nx_content_put.elf 3336ac3b (2,589,160 B fixture, 54 chunks, disk-corrupt index 2 refused before assembly, resume_offset actual=48402 expected=48402, cdcplan total=2589160 max=48402, both CAS spellings, malformed token named); nx_cdc_gate 17/17 GREEN (chunks=43 mean_len=24385 cdc_shared 42/43 fixed_shared 2/22); nx_jobfollow_parse_gate 22/22 GREEN (REPLAY job parse, outcome-unknown shape, keyed/unkeyed re-issue decision both directions). Referee deferred itself under the heavy-I/O bound (running=7) while these ran -- re-run owed once the regen releases it 2026-09-06 measure ACCEPT RULE status: PARTIAL. Met: a wrong-digest chunk is refused NAMING its index and nothing is assembled; refusal precedes assembly. NOT met: the refusal arrives at commit, not on arrival, because the client declares no per-chunk digest with the chunk; a truncated final chunk is caught by the byte-total check at commit. Declared as DI10

DI7 Offset-resumable upload on the public door per the IETF draft · cell LANDED · gate UNRECORDED

Contract	`cp_resume_offset` · executor Organ · 1.5 u · stands on DI6
Definition of done	The content door answers an offset query and accepts append-at-offset so a killed upload resumes from the server's record without re-sending accepted bytes, keeping the mandatory commit digest. ACCEPT RULE declared in advance: a gate kills an upload mid-stream, resumes it, and the committed digest equals the fixture's; bytes sent on resume equal total minus the server's offset, measured not asserted
Matrix cell	Resumable upload on the public wire per the IETF draft · `runtime/nx_content_put.nx` · LANDED decl
Gate	`nx_cdc_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-06 land cp_resume_offset: status prints resume_offset= (the IETF resumable-upload Upload-Offset shape, bytes stored contiguously from 0) beside the index-based missing list; gate tooth: first missing index 1 -> offset = 1 x chunk_raw 2026-09-06 measure ACCEPT RULE status: PARTIAL. Met: the door answers an offset (resume_offset) and a killed upload resumes from the server's record by index (client resume proven by its gate). NOT met: append is index-addressed, not byte-offset per the IETF draft, and no Content-Digest or Repr-Digest field is spoken. Declared as DI11 2026-09-06 lesson THE OFF-LAN CONTENT-PUT CONTRACT, MEASURED AND CLOSED 2026-09-06: from an off-LAN laptop the LAN vantage (192.168.8.240:8443) is unreachable (the client saw 44 JF-REISSUE then CC-BEGIN post failed), and on the public vantage the FIRST failure was the edge answering the JSON-RPC begin with Content-Encoding gzip because nx_http_client's builder derives Accept-Encoding from every codec the estate compiles (hc_put_caps advertises gzip) while the POST completer returns the reply verbatim with no gzip stage -- a client that cannot decode must not advertise. Fix in BOTH trees: nx_https_post_lib hp_post_json_nofollow sends Accept-Encoding: identity as xhdr, and nx_http_client suppresses hc_put_caps when the caller's xhdr already carries Accept-Encoding (hc_xhdr_has_field is now the ONE case-insensitive field scanner behind hc_xhdr_has_ua and the new hc_xhdr_has_ae). Second failure: the URL must be the /mcp door (a bare host posts to the home page). Third: the edge promotes begin to the job lane, so the client needs readcap=<nx_fs read cap file> to follow JOB-STARTED. Working recipe: nx_content_put_client <local> <dest.new> contentput.cap https://nishifamily.com/mcp readcap=fsread.cap -> E2E OK 720,208 B in 15 chunks. Owed: the POST completer should decode what it advertises (then the identity ask can go).

DI8 Ledger consumers audited for anchoring · cell PRESENT · gate NO-GATE-DECLARED

Contract	`cc_size` · executor Organ · 0.5 u · stands on nothing
Definition of done	For every ledger nx_capcliff reads OVER, every consumer names its anchoring in a census row: TAIL-declared, or head-capped and therefore blind to the newest rows. Head-capped consumers of an append-only ledger are the worklist. ACCEPT RULE: the two consumers this admission could not verify (nx_replyreserve_lib, nx_capsweep) are classified by reading their read sites, and a planted head-capped fixture consumer is flagged
Matrix cell	Reader-cap cliff forecast for append-only ledgers (OVER, NEAR, OK, MISSING against the nominal window) · `runtime/_hdl_build/nx_capcliff.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_capcliff`; declare `nx_capcliff TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DI9 The transfer sends only the chunks the receiver lacks: dedupe by content-defined plan · cell LANDED · gate UNRECORDED

Contract	`v_have` · executor Organ · 3 u · stands on DI5
Definition of done	The receiver keeps the committed artifact's plan digests beside the destination (or derives them from the incumbent at begin) and answers have <id> with the digests it already holds; the client diffs its cdcplan against that answer and sends only the missing chunks; commit assembles by plan order and re-verifies each chunk against its receipt. ACCEPT RULE declared in advance: on a 64 MiB fixture a one-byte insertion at offset zero re-sends fewer than three chunks, measured as bytes on the wire, with the current whole-file re-send as the control; the committed sha256 equals the fixture's
Matrix cell	Dedupe on the wire: only the chunks the receiver lacks are sent · `runtime/nx_content_put.nx` · LANDED decl
Gate	`nx_cdc_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-06 land Dedupe on the wire, MECHANISM landed on the door and the client: `plan <id> <count>` switches a transfer to plan-addressed variable-length chunks (marker <id>.cdc, read back as nchunks by the ONE meta reader; refused once chunk 0 is staged); the begin receipt publishes cdc_min/cdc_avg/cdc_max so both sides cut by one rule; `have <id> [from=k]` lists the incumbent's content-defined digests paginated within the wire cap (next= says where to continue; row width derived, never counted); `reuse <id> <b64 rows>` stages chunks from the incumbent after re-hashing each against the declared digest (a stale have-list or a changed incumbent is refused BY INDEX and stops the batch; a CAS conflict likewise); `chunk` and `reuse` share ONE staging writer. Client `cdc` token: plan, declare, read have pages, send only missing chunks, batch reuse rows to the wire chunk, fall back to bytes on a refused batch, print CC-DEDUPE with bytes on the wire. Gate 44/44 on the mechanism: have equals the local plan chunk for chunk, a transfer assembled ENTIRELY from reuse rows commits to the fixture's own sha256, a mismatched row is refused by index and stages nothing, reuse on a fixed transfer is refused by name. Receiver PROMOTED 6d0aec6d (86,945 B) gate PROMOTED 9368cab8 (90,106 B) 2026-09-06 measure ACCEPT RULE status: the 64 MiB one-byte-insertion wire measurement is PENDING, and the reason is a number: MEASURED 2026-09-06 a live fixed upload costs ~27 s per 48,402-byte chunk on this box (each post rides the job lane and its 3 s follow poll; 76 chunks in 34 min), so a 64 MiB fixed baseline is ~1,400 chunks = ~10 h before the dedupe pass can be measured against it. A 5.9 MB live trial (122 chunks, then a one-byte change at offset 0 through `cdc`) is running now and its CC-DEDUPE line will be journaled with reused/sent/wire_bytes. Recipe for the 64 MiB rule: fixture knowledge/rigcorpus/toon3d8_rigged.nxa (61.9 MB), fixed upload to /tmp/di9_64.bin, then the same file with byte 0 changed via `cdc` to the same dest; the accept rule reads fewer than three chunks SENT and wire_bytes measured 2026-09-06 measure DEDUPE ON THE WIRE, MEASURED LIVE 2026-09-06 on a 5,894,477-byte mesh (122 chunks, every boundary at max because the mesh's repetitive bytes never trip the gear mask -- so this measures the client and the door, not the chunker). PASS 2 (one byte changed at offset 0, first client): CC-DEDUPE plan_chunks=122 incumbent_chunks=122 reused=0 sent=122 wire_bytes=7,919,315 -- the have page had parsed ZERO rows (a sync reply escapes its newlines) and every chunk went as bytes. PASS 3 (parser fixed): parsed=122, the 122-row reuse batch was ACCEPTED by the door and outlived the single-post follow budget; the client read HP-PENDING as failure and re-sent every chunk while the door was still staging the same rows. PASS 4 (batch budget derived from rows): parsed=122, the door staged all 122 reuse rows from the incumbent (witnessed in knowledge/contentput, ~5-10 s per staged write on the storming array, four content-put pushes running beside it) while the laptop killed the client for memory mid-follow; the transfer was finished FROM THE DOOR SIDE: `commit` -> CP-ASSEMBLE received=122/122 stream_verified=122, CP-COMMIT OK sha256=6b54f0c2 verified by re-read, with ZERO chunk bytes posted (the wire carried begin, plan, one have page and one reuse batch of 122 rows, roughly 30 KB, against 7,919,315 B for the full send). RESULT: the mechanism dedupes end to end; the client's own CC-DEDUPE line for a completed run is UNWITNESSED because the host killed it, and the 64 MiB accept-rule measurement stays PENDING with its recipe above. Client defects fixed on the way: the two-shape line scan and the row-scaled batch budget (both in nx_content_put_client.nx, pushed; binary 45a8c35c staged as a strict superset) 2026-09-06 land The door's per-post fsync was the latency of every push, not only of reuse rows: nx_content_put PROMOTED 394ab379 (97,309 B, strict superset) stages chunk posts and appends with sync=0 and prints durable=at-commit on the CP-CHUNK and CP-APPEND receipts; the durability point is commit, which re-hashes every staged chunk against its declared digest and fsyncs the assembled destination, so a torn or empty post-crash chunk is refused by index and re-sent after status (the resumable-upload contract). The META, PLAN and index markers keep their fsync (their loss would orphan a transfer). nx_content_put_gate PROMOTED 545da9a2 (98,727 B, 54/54 locally, a tooth reads the receipt's durability declaration); twins installed. First live push through it: a 5.9 MB fixture from the laptop, per-post receive times 3-150 ms on the wire with occasional multi-second edge stalls and one JF-REISSUE (an edge-lost reply re-posted under its key, replayed not re-executed) -- the wire and the edge window are the cost now, not the array. 2026-09-06 measure Client-side witness, pass A (fresh upload of the 5,894,477-byte fixture from the laptop through the promoted no-fsync door to /tmp/nx_content_put_gate/di9_tally.bin): E2E OK chunks_sent=122 of 122 in 1,052 s; the log carries 38 JF-REISSUE lines, i.e. the edge lost the reply of 31 percent of keyed posts under the storm and each was replayed from its recorded outcome, never re-executed. Per-post receive on the wire was 3-150 ms; the 8.6 s per chunk is the job-lane poll granularity plus the edge window, not the array and not the door. The 64 MiB one-byte-insertion measurement (about 1,400 posts) would cost about 3 hours at this rate and stays queued for a calmer edge; pass B (one byte changed, cdc) runs next for the CC-DEDUPE tally. 2026-09-06 measure CLIENT-SIDE CC-DEDUPE TALLY WITNESSED FOR A COMPLETED RUN (the owed witness): pass B from the laptop, the same fixture with one byte changed at offset 0, mode=cdc against the pass-A incumbent: CC-HAVE incumbent_bytes=5894477 chunks=122 parsed=122 pages=1; CC-DEDUPE plan_chunks=122 incumbent_chunks=122 reused=121 sent=1 reuse_batches=1 wire_bytes=79025 total=5894477 (reused + sent = plan_chunks); E2E OK bytes=5894477 chunks_sent=1 of 122; elapsed 69 s with one JF-REISSUE. Against pass A's 1,052 s and 7.9 MB for the full send, the dedupe pass moved 1.3 percent of the bytes in 6.6 percent of the time, and the door-side commit verified the destination's sha256 by re-read. The DI9 accept rule at 5.9 MB is met on the client's own tally; the 64 MiB rule stays queued behind the edge window. 2026-09-06 measure THE POLL LADDER: the shared follow and re-issue loops in nx_https_post_lib (the ONE place every organ polls a job) waited a flat sleep_ms=3000 before every poll, so a chunk whose artifact was ready in 100 ms still paid 3 s. hp_ladder_first (sleep over 16, floor 50 ms) and hp_ladder_next (double, cap at sleep_ms) keep the wall budget polls x sleep_ms unchanged and reach the flat interval by the fifth wait; nx_https_post_lib_gate PROMOTED 4b35997a (16/16, eight ladder teeth, first promote) and REGISTERED. MEASURED on the same 5,894,477-byte fixture from the same laptop within the hour: pass A flat = 1,052 s with 38 JF-REISSUE; pass A2 laddered = 88 s with 0 JF-REISSUE and E2E OK 122 of 122 -- 12x, and the re-issue storm was the flat wait exceeding the edge window, not the edge losing replies. A 15-chunk client push fell to 32 s (2.1 s per chunk from 8.6). The 64 MiB one-byte-insertion rule is now affordable and runs next.

DI10 A bad chunk is refused on arrival, not at commit · cell LANDED · gate UNRECORDED

Contract	`cp_chunk_expect` · executor Organ · 1 u · stands on DI6
Definition of done	chunk <id> <index> <b64> sha256=<hex>: the client declares each chunk's digest with the chunk and the receiver refuses a mismatch ON ARRIVAL (CP-REFUSED-CHUNK-DIGEST index=N) before writing staging, so a corrupted or truncated stream is refused at the first bad chunk; the DI6 commit re-verify stays as defence in depth. ACCEPT RULE declared in advance: the gate sends a wrong-digest middle chunk and a truncated final chunk with declared digests in separate runs, both refused on arrival naming the index, and the complete upload is accepted
Matrix cell	A bad chunk is refused on arrival, not at commit · `runtime/nx_content_put.nx` · LANDED decl
Gate	`nx_cdc_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-06 land cp_chunk_expect: `chunk <id> <index> <b64> sha256=<hex>` -- the receiver compares the declared digest with what ARRIVED before any byte reaches staging and refuses CP-REFUSED-CHUNK-DIGEST index=N exit 7 (a malformed declaration is CP-REFUSED-CHUNK-DIGEST-MALFORMED exit 3, a caller defect named as such); the size refusal now names its index too, so a truncated final chunk is refused on arrival by index; a legacy caller without a declaration is unchanged. The put client declares every chunk's digest (sha256_digest over the chunk, buffers allocated once outside the loop). Gate 36/36: wrong digest refused on arrival with nothing staged, right digest accepted, malformed named, truncated tail named. Receiver PROMOTED b5c1886f (75,247 B) gate PROMOTED 706370e8 (78,329 B) client PROMOTED 450fe305 (421,286 B), all strict supersets or content-identical under nx_contentdiff, twins installed. ACCEPT RULE status: MET on arrival for both planted cases; the DI6 commit re-verify remains as defence in depth

DI11 The public door speaks the drafts' wire: byte-offset append and RFC 9530 digests · cell LANDED · gate UNRECORDED

Contract	`cp_append_at` · executor Organ · 2 u · stands on DI7
Definition of done	Append-at-offset per the IETF resumable-upload draft (a byte offset, not a chunk index) and Content-Digest / Repr-Digest on begin and commit receipts, so a tus- or IETF-shaped client can drive the door without learning its index grammar. ACCEPT RULE declared in advance: a killed upload resumed by offset from the server's answer commits byte-identical; bytes sent on resume equal total minus the offset, measured; a wrong Repr-Digest is refused by name
Matrix cell	Byte-offset append and RFC 9530 digests on the public door · `runtime/nx_content_put.nx` · LANDED decl
Gate	`nx_cdc_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-06 land Byte-offset append per the IETF resumable-upload draft: `append <id> <offset> <b64> [sha256=]` is accepted only at the current upload offset (the contiguous staged prefix; status now prints it as upload_offset beside resume_offset) and lands in the slot that offset addresses (fixed: offset/chunk_raw with the last chunk shorter; plan-addressed: the next index); a stale or future offset is refused NAMING the current offset (CP-REFUSED-OFFSET current= requested=), never silently re-based; the declared digest is checked on arrival as for chunk. Gate 49/49 (append advances upload_offset by its length; stale refused naming current; future refused; status agrees). Receiver PROMOTED 0c57ee0e (92,195 B) gate PROMOTED 6fda41c7 (93,233 B). HONEST LIMIT: an append must carry exactly one chunk on a fixed transfer, and the Repr-Digest field is the begin's whole-file sha256 rather than an RFC 9530 header (the wire is JSON-RPC, not HTTP semantics)

DI12 Every silent reader derives or announces: the DI2 worklist driven to zero · cell LANDED · gate NO-GATE-DECLARED

Contract	`ie_ratchet` · executor Organ · 4 u · stands on DI3
Definition of done	The DI2 census's SILENT set (596 named readers at first census) becomes an adoption campaign: each converted reader reads DERIVED through sys_read_file or ANNOUNCES its envelope; the daily beat's named-set ratchet refuses a rise and publishes the fall with the converted names. ACCEPT RULE declared in advance: silent falls monotonically across beats with names in the ledger; a planted new silent reader turns the beat RED naming its file; the false-positive rate is published as a number over the whole tree
Matrix cell	Every silent fixed-length reader converted: the DI2 worklist driven to zero · `runtime/nx_io_envelope_census.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_io_envelope_census`; declare `nx_io_envelope_census TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-06 land The DI2 worklist is now a RATCHET WITH MEMORY: nx_io_envelope_census grew `ie_ratchet` (keyed baseline rows path 2026-09-06 measure FIRST LIVE PASS 2026-09-06 (knowledge/status/io_envelope.status): hits=2338 fixed=349 silent=332 dynamic=654 looped=1273, partition RECONCILES, coverage_complete=1; baseline MIGRATED from 596 legacy rows: new_silent=0 left_silent=264 (263 now=looped -- the first census had named 263 streaming loops, nx_sizeguard's own read loop among them, as capped readers; 1 now=converted -- nx_gatefresh gf_has_main moved from a 262,144-byte scan to sys_read_file, the first true conversion); false_positive_permil=996 adjudicated=264 true_positive=1 false_positive=263. HONEST READING: the rate is over ADJUDICATED sites only; the 332 that remain are the unadjudicated worklist and the rate says nothing about them yet. ACCEPT RULE status: monotone fall with names in the ledger = WITNESSED (596 -> 332, every departure journaled); planted-new-silent-turns-RED = gate-proven on fixtures (T14), live rise not yet witnessed; the rate = PUBLISHED as a number. Verdict GREEN

DI13 No ledger nears its cliff unguarded · cell LANDED · gate NO-GATE-DECLARED

Contract	`cc_remedy` · executor Organ · 1.5 u · stands on DI8
Definition of done	Each of the four OVER ledgers (actlog.jrnl, tool_diff.log, dup_source.log, orchestrate.log) either has every consumer TAIL-anchored by the DI8 census or carries a loud pre-cliff refusal through nx_sizeguard with a derived budget; never a rotation (a shrinking journal reads as a clobber to nx_jrnlguard). ACCEPT RULE declared in advance: nx_capcliff reads over=0, or every OVER row names its guard and its consumers' anchoring in the census
Matrix cell	No append-only ledger nears its cliff unguarded · `runtime/_hdl_build/nx_capcliff.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_capcliff`; declare `nx_capcliff TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-06 land nx_capcliff grew the REMEDY CENSUS: knowledge/capcliff_remedy.conf declares, per OVER ledger, its readers (file:line of the READ SITE -- the organ reads that line and classifies WHOLE/TAIL/HEAD/UNVERIFIED itself, never copying the claim), writers (verified to append), a guard (sizeguard:<bytes>:<lines>, FORKED on the ledger; its exit is the verdict) and mentions. States NO-READER / GOVERNED / BREACHED / UNGOVERNED; the exit carries RED only for UNGOVERNED or BREACHED, and the remedy partition is printed and must sum. Selftest migrated onto the base class (22 teeth: size ruler with opposites, anchoring classifier on planted read sites incl. the numeric SEEK_END spelling, the forked guard GREEN and RED, NO-READER, scan verdict both ways, empty roster refused); new nx_capcliff_gate forks it (identity teeth T9/T10, planted-RED witnessed as over_ungoverned=1). nx_capcliff PROMOTED 563a6b11 (68,784 B, /api/build lane; 27 lost runs = the reworded OVER text and the old hand-rolled selftest format, all superseded), gate promoted and registered, twins installed 2026-09-06 measure LIVE 2026-09-06 (/tmp/di13_scan3.txt): rows=18 over=4 near=0 missing=0 over_governed=2 over_noreader=2 over_ungoverned=0 over_breached=0 remedy_partition=RECONCILES verdict=GREEN. actlog.jrnl: 11 readers all TAIL (catalog x2, toolatency, execsurface, wirecensus, capsweep, gateadjudicate, trajscan, actlog miner, replyreserve, statuscensus -- the two the DI8 accept rule named unverified are now measured TAIL), 3 writers verified; dup_source.log: 3 readers all WHOLE; tool_diff.log and orchestrate.log: NO READER in the tree (writer only). The first scan read actlog UNGOVERNED on one UNVERIFIED row -- a declared line number one off -- and the organ named it; the row was corrected from the source, not the classifier loosened. ACCEPT RULE: every OVER row names its guard and its consumers' anchoring in the census = MET (over=0 was the other branch and is not claimed) 2026-09-06 queue OWED, with the recipe: (1) the evidence referee (nx_swcompare_evidence dataio) DEFERRED twice on 2026-09-06 under the heavy-I/O bound (HEAVYIO storm_budget=4 then 0, verdict=DEFER -- an abstention, never a verdict), so the two new .gates rows (nx_io_envelope_census_gate, nx_capcliff_gate) are unrefereed until a pass with storm_budget>0; re-run via nx_job_run nx_swcompare_evidence /tmp/<out> dataio and read the row verdicts. (2) DI9's client-side CC-DEDUPE tally for a COMPLETED run is unwitnessed: the laptop host kills any client run longer than a few minutes for memory (three kills today); run the promoted client (45a8c35c) FROM THE NAS via nx_job_run against a local incumbent once a runner cap exists, or from a host that does not reap long processes -- the door side is proven (CP-COMMIT of 122 reuse rows with zero chunk posts). (3) The 64 MiB one-byte-insertion accept rule (recipe in the DI9 measure row above) needs a calm array: at the measured 5-10 s per staged write, 1,400 rows is 2-4 hours; a door-side reuse that stages by reflink instead of copying is the rung that makes it cheap. (4) The census ratchet's live RISE path (planted new silent reader -> RED) is gate-proven on fixtures only; the first real rise will be witnessed by the daily ioenvbeat 2026-09-06 lesson THE REFEREE'S ALL-DAY DEFER WAS A WEDGED MUTEX, NOT LOAD: nx_swcompare_evidence printed HEAVYIO running=1 width=4 storm_budget=4 slot=-1 verdict=DEFER, i.e. headroom on every axis and no slot. Read from the lease store: all four knowledge/lease/heavyio-slot-N.lock stamps were RELEASED (gens 236, 96, 163, 157) while the next generation gate dirs g237, g97, g164, g158 already existed -- takeovers killed between their mkdir and their stamp rename (the storm's kills), so every later takeover re-derived the same gate, hit EEXIST and reported BUSY forever. nx_lease_wedge_gate had DETECTED this shape on 2026-09-04 and declared the remedy owed; two days later the same four slots were wedged again. REMEDY LANDED in nx_lease_lib (the ONE primitive): the temp stamp is written first under a pid-unique name so a refused write cannot strand a gate, and on EEXIST an orphan gate at least max(ttl, 30 s) old with the stamp still one generation behind is removed and retaken, while a fresh gate stays a lost takeover; nothing unlinks a stamp. nx_lease selftest 11/11 (both 4-racer rounds), nx_lease_wedge_gate 25/25 with the remedy planted both ways, nx_lease PROMOTED 6fc85ac1 and nx_lease_wedge_gate PROMOTED cd777444. HEALED LIVE: four acquires through the promoted primitive each printed LS-ORPHAN-GATE reclaimed for its gate and LS-ACQUIRED, and the referee then took a slot for the first time today. Adopters compiled against the old lib (the regen, the evidence referee, plan_run, crawl_step, artifactdrift, seg_compact, eco_graph_build, shard_compact) keep working on healed stamps and inherit the self-heal on their next rebuild. 2026-09-06 measure THE REFEREE RAN (the owed verdict): nx_swcompare_evidence dataio, HEAVYIO running=3 width=4 storm_budget=6 slot=0 ADMIT, verdict=MEASURED-HONEST -- gates_green=12/12 (every row on dataio.gates including the three added today: nx_io_envelope_census_gate 9/9, nx_capcliff_gate 8/8, nx_readcap_gate 26/26, and the door 54/54), present_axes=22 grounded=22 ungrounded=0, absent=2 both named (ie_worklist_zero, cp_stage_window), landed=13, partition and composition reconcile (24 = 9 claimed + 2 gaps + 13 landed), liar-kill all four. The first pass of the day that did not abstain, one minute after the four slots were healed. 2026-09-06 land The two heavy-I/O adopters this lane depends on were rebuilt against the remedied lease lib from NAS-equal sources (nx_swcompare_evidence, nx_ioadmit_lib, nx_heavyio_lib, nx_poolgov and nx_lease_lib all hash-identical laptop vs NAS): nx_swcompare_evidence PROMOTED b7e3e0f6 (166,992 B) and nx_compare_regen PROMOTED 50e7dc44 (180,856 B), each with symbol-name-only losses under the laptop lane and each gaining the ioadmit storm witness strings the older binaries predated; twins installed. Both now self-heal an orphaned slot gate instead of deferring on it. The remaining adopters (plan_run, crawl_step, artifactdrift, seg_compact_cli, eco_graph_build, web_shard_compact) still carry the old lib and are the next rebuild list; until then a kill mid-claim in one of them re-wedges a slot that the next new-lib acquirer reclaims after 30 s.

DI14 Reuse stages by clone where the kernel allows and never pays a per-row fsync · cell LANDED · gate UNRECORDED

Contract	`cp_stage_clone` · executor Organ · 2 u · stands on DI9
Definition of done	A reuse row stages the incumbent's chunk by FICLONERANGE into the transfer's slot, re-hashes the clone, and falls back to a copy that is NAMED in the batch receipt with the kernel's rc and the first refusal's inputs. MEASURED 2026-09-06 on the NAS (btrfs, same volume): clone_rc=-22 EINVAL on every row because FICLONERANGE requires filesystem-block alignment and a content-defined boundary is never aligned (first refusal off=0 len=41240), so on CDC chunks the copy path is the path by construction; the batch's real cost was one fsync per 48 KB row (95 rows = 803,991 ms), removed by staging reuse rows without a per-file fsync and fsyncing the staging directory once (95 rows = 7,993 ms, 100x). ACCEPT RULE declared in advance and met: a reuse batch stages in about one chunk post's time on the same box (7.99 s for 95 rows against 8.5 s for one fsynced chunk write in the same hour), the staged slot's sha256 equals the incumbent chunk's, and a link that cannot be made falls back to the copy and NAMES it (clone_rc, clone_first_refusal) in the receipt. The aligned-window clone that would make a true link possible on CDC chunks is DI17
Matrix cell	Reuse stages by clone where the kernel allows and never pays a per-row fsync · `runtime/nx_content_put.nx` · LANDED decl
Gate	`nx_cdc_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-06 retract The clone_rc=-1 read as EPERM on three hosts (ext4, DrvFs, btrfs) was the GATE PARSER's not-found sentinel: g_num_after in nx_content_put_gate accepted digits only, so clone_rc=-95 read as no digits and returned -1. A throwaway local probe (bogus request -25 ENOTTY, ext4 and DrvFs FICLONERANGE -95 EOPNOTSUPP) proved the syscall shim returns raw -errno. The parser now reads a sign; the door announces the FIRST refused clone with every input the kernel saw (rc, inc_fd, dst_fd, off, len) in the reuse receipt and on stderr, and the gate lifts them into gv_kv rows. Local truth after the fix: clone_rc=-95 inc_fd=4 dst_fd=5 off=0 len=48402. 2026-09-06 measure First NAS end-to-end run on the promoted door (ae1f9146): di14_slot_batch_rows=95 cloned=0 copied=95 ms=803,991, i.e. 8.5 s per 48 KB reuse row on the storming array, 53/53 GREEN; the accept rule (a batch under one chunk post's time) was NOT met. Cause read from the source: cp_write_atomic fsynced every staged chunk. FICLONERANGE also requires block-aligned offsets and CDC boundaries are content-defined, so on btrfs the expected kernel answer for an interior chunk is -22 EINVAL; a windowed clone (clone the aligned window, record skip and len) is the rung after this one if the copy is still the cost once the fsync is gone. 2026-09-06 land nx_content_put PROMOTED b45eea2c (97,359 B, strict superset) and nx_content_put_gate PROMOTED c3f0b819 (98,383 B), twins installed: reuse rows stage with cp_write_atomic_x sync=0 and the batch fsyncs the staging DIRECTORY once (cp_dir_sync); the receipt carries ms_rows, ms_dirsync, dirsync_rc, clone_rc and clone_first_refusal. Durability argument: the batch's durability point is the receipt plus commit's per-chunk re-hash, so a torn or empty post-crash chunk is refused by index and re-sent, never assembled. Local gate 53/53 with the batch at 4,134 ms for 609 rows; the NAS re-measure is the number that decides the rung. 2026-09-06 measure NAS re-measure on the promoted door b45eea2c, same btrfs volume: di14_slot_batch_rows=95 cloned=0 copied=95 clone_rc=-22 (EINVAL: FICLONERANGE requires block alignment; first refusal inc_fd=5 dst_fd=6 off=0 len=41240) ms=7,993 against 803,991 before the per-row fsync was removed, a 100x fall; 53/53 GREEN. The accept rule's time leg is met (one fsynced chunk write cost about 8.5 s in the same hour); the link leg is refused by the kernel by construction for content-defined ranges and is NAMED in the receipt; the rung row was rewritten to say so and the aligned-window clone became DI17. 2026-09-06 lesson Two instruments lied in the same direction before the door was touched: the gate parser returned its own -1 for any negative number, and the reuse receipt printed only the last rc, so three hosts read EPERM where the kernel had said -95 and -22. A probe that varies the filesystem while the door stays fixed measures the door; a parser that cannot represent the value it parses returns a sentinel wearing the value's clothes. Fix the instrument, then measure, then touch the subject. 2026-09-06 measure NAS end-to-end gate on the promoted no-fsync door 394ab379 (gate 545da9a2): 54/54 GREEN; di14_slot_batch_rows=95 cloned=0 copied=95 clone_rc=-22 ms=1,516 -- the same 95-row reuse batch that cost 803,991 ms this morning and 7,993 ms after the reuse fsync went now costs 1.5 s (16 ms per row) once no chunk post on the box fsyncs either; the receipt declares durable=at-commit and the interleaved, EC24 and EC26 refusals all still fire.

DI15 LOOPED is judged, not parked · cell LANDED · gate NO-GATE-DECLARED

Contract	`ie_loop_exit` · executor Organ · 3 u · stands on DI12
Definition of done	The census classifies a looped read by its loop's exit: EOF-driven (the read result or a flag it sets ends the loop) is STREAMING and acquitted; a loop that also breaks on a byte or count bound is CAPPED-IN-LOOP and joins the silent worklist with the bound named; a loop whose exit cannot be read is UNJUDGED. ACCEPT RULE declared in advance: the 1,273 LOOPED sites of 2026-09-06 partition into the three classes with a printed sum, nx_sizeguard and nx_restage read STREAMING, a planted loop with a count bound reads CAPPED-IN-LOOP, and the gate carries all three as teeth
Matrix cell	A looped read is judged by its exit, not parked · `runtime/nx_io_envelope_census.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_io_envelope_census`; declare `nx_io_envelope_census TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-06 land nx_io_envelope_census PROMOTED 97259b57 (114,384 B debug flavour, _offc twin) and nx_io_envelope_census_gate PROMOTED feb753111 (9/9 on the NAS against the promoted binary, T4d pins the DI15 generation). ie_loop_exit judges every LOOPED read by its loop's exit: STREAMING (result tested against zero, acquitted) / CAPPED (a count bound on a literal above 1, an ALL-CAPS name or a cap-named variable, bound NAMED per row, split by the same file-level announce test fixed sites use) / UNJUDGED (a foreign exit, counted never acquitted). LOOPED itself now means the read DRIVES the loop (result tested in the span, a running fill in the call's arguments, or a prime read driving a later while); a read that merely sits inside an accept loop is a FIXED site. Selftest 46/46 with teeth T20-T29. 2026-09-06 measure Live over buildroot/runtime, coverage_complete=1: hits 2,349; looped 1,210 = 423 STREAMING + 699 CAPPED-silent + 62 CAPPED-announcing + 26 UNJUDGED (looped_partition=RECONCILES); fixed 404; silent worklist 1,082 = 332 fixed silent + 699 capped loops + 51 accept-loop reads reclassified as fixed. First cut (every read inside a loop LOOPED) read 1,273 = 423 + 797 + 53 and a 5-site sample refuted it: 2 of 5 capped loops were one request read per accepted connection with an unrelated bound elsewhere in the loop body. Accept rule met: nx_sizeguard and nx_restage shapes read STREAMING (T20, T21), a planted count-bound loop reads CAPPED with its bound named (T22, T22b), the partition prints and sums. Baseline REWRITTEN by --accept to the 1,082 reviewed rows (ledger kind=new x750); the next scan must read new_silent=0. 2026-09-06 lesson The census read its own selftest fixture as the walker's envelope: two complete walks reported UNPROVEN because the parser searched the whole capture for coverage_complete= and the first hit was a grep line of a fixture string spelling coverage_complete=0. Fixed by ie_walker_env, which parses ONLY the last line that starts with -- matches= (teeth T29, T29b, T29c, T29d: a data line that spells the fields, and a capture with no envelope reads -1 UNPROVEN). Anchor every parse on the report line; a fixture that spells a field name is data the moment a walker prints it.

DI16 The silent worklist reaches zero · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ie_worklist_zero` · executor Organ · 8 u · stands on DI15
Definition of done	Every remaining SILENT site is converted (sys_read_file, an announced envelope, or a hand kind=false adjudication with its reason in the ledger) until the ratchet's baseline is empty; a `worklist` verb prints the remaining rows grouped by file so a seat can take a file at a time. ACCEPT RULE declared in advance: io_envelope.status reads silent=0 with new_silent=0, every departure is in the ratchet ledger with its now= class, the false-positive rate is published over the whole set, and a planted new silent reader still turns the daily beat RED
Matrix cell	The silent worklist reaches zero · `runtime/nx_io_envelope_census.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_io_envelope_census`; declare `nx_io_envelope_census TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-06 land nx_io_envelope_census PROMOTED 81f05e45 (121,872 B) adds the worklist verb: the baseline IS the worklist, printed grouped by file with the biggest file first and a partition line (rows equal listed), selftest 49/49 with the T30 teeth. The DI16 campaign starts from silent=1,082 (332 fixed + 699 capped loops + 51 accept-loop reads), GREEN with new_silent=0 after --accept, ratchet armed. 2026-09-06 measure The worklist verb on the accepted baseline (promoted census a91eb706, NAS run 2026-09-06): rows=1082 files=803 listed=1082 shapes=608 shared_shapes=125 rows_in_shared_shapes=599 singleton_rows=483 partition=RECONCILES. The campaign is sized by causes, not sites: 125 shared reader shapes cover 599 rows and the top of the table is ONE helper family copied by hand (x28 sys_read(fd, buf+n, cap-1-n), x22 sys_read(fd, buf+total, CAP-total), x20 sys_read(fd, base+n, cap-n), x19 sys_read(fd, buf+n, cap-n), x15 var nrd = sys_read(fd, buf, cap), x13 the while nrd loop), i.e. a read-into-a-caller's-cap loop that never says when the cap filled. FIRST CAUSE TO EAT: one shared announcing helper (a read-into-cap that returns the truncation as a named state, sys_read_file where the whole file is wanted) adopted through nx_oo_extract across the copies, which turns dozens of silent sites into announcing ones in one proof cycle. A second class is legitimate by contract and is adjudicated with kind=false rows carrying the record size: fixed-record reads (8, 16, 24 and 32-byte headers, 31 and 63-byte ids) whose length IS the record. The biggest single file is nx_torrent_get.nx with 14 rows. 2026-09-06 land First cause shipped: nx_readcap_lib (runtime/nx_readcap_lib.nx, the ONE read-into-a-caller's-cap loop) with states EOF, CAPPED-unprobed (socket-safe), TRUNCATED-more-remains and EXACT (files, decided by a one-byte probe), ERR with the rc, and rc_complete as the one question a consumer asks; nx_readcap_gate PROMOTED 17abb91a (35,672 B, 26/26, neg-controls named, values emitted) and listed on dataio.gates. Adoption is the campaign: the worklist's shared shapes (125 shapes, 599 rows) are converted onto rc_fill or rc_read_file_into (or sys_read_file where the whole file is wanted) file by file via nx_oo_extract, each conversion removing the consumer's own sys_read site so the census counts it CONVERTED and the ratchet tightens. No incumbent existed: nx_capsearch returned the TLS truncation gate, the cap-detect core and the token cutter, none a read-into-cap helper; fsx_read_at in nx_fsops_lib is the announcing WINDOW reader for the nx_fs tool and stays the window primitive. 2026-09-06 measure nx_gate_bite nx_readcap_gate runtime/nx_readcap_lib.nx 2 on the NAS: baseline green, one comparison mutant VOID (build lane exit 6, admission refused it, excluded not a survivor), one compiled and was KILLED (the gate went RED), restore verified byte-identical (4,187 B), both twins restored, mutant_live=0, verdict GREEN (the gate BITES). The void mutant is a floor on coverage, not a pass; re-bite when the admission storm clears. 2026-09-06 measure THE JUDGE COULD NOT READ TIGHT SPELLING: nx_io_envelope_census PROMOTED 61edfd74 (118,350 B, selftest 56/56 with T31..T31e) walks to the enclosing while from the READ SITE (a same-line `while go==1 { k=sys_read(..); if k<=0 {go=0} }` was invisible from the line start) and matches the eof and bound idioms on a CANONICAL copy of the span (` op ` around every comparison, blanks collapsed, -> << >> verbatim), and a partial walk no longer creates or tightens the baseline. NAS re-scan on the same 2,368-site walk (coverage_complete=1 corpus_complete=1): new_silent=449, left_silent=49, silent_now=1,482, verdict RED (the ratchet refuses the rise by name). The 449 are capped loops spelled without spaces that the old matchers read as UNJUDGED, three sampled and all true: nx_cap_census.nx:73 `while r>0 { r=sys_read(fd,dst,fcap-tot); if tot>=fcap { r=0 } }`, nx_swcompare_crm.nx:36 `while tot < cap { r = sys_read(fd, buf+tot, cap - tot); if r <= 0 { break } }`, nx_orchestrate.nx:29 `if n>=cap-1 { r=0 }`. The 49 are one-line streaming copies the old ruler had listed as capped one-shots (nx_ccheck:31, nx_media_server:207/273, nx_gallery_gateway:161, nx_fs:19/33 among them), acquitted by their exit and journaled kind=left now=looped, so the ledger's own false-positive rate reads 996 permil over 313 adjudicated (312 were the old ruler's loops, 1 a conversion). The rise is accepted into the baseline by --accept (kind=new rows), and the worklist grows from 1,082 to 1,482 rows because the ruler now sees what it was blind to, not because readers got worse. 2026-09-06 measure Re-scan on the accepted baseline (promoted census 61edfd74, NAS, walker matches=2368 coverage_complete=1 corpus_complete=1): hits=2368 not_a_site=88 dynamic=125 looped=1799 (streaming 560, capped 1148, capped-announcing 91, UNJUDGED 0 where the old judge left 26) fixed=356 (literal silent 194, named silent 140, announcing 22) silent=1482 partition RECONCILES, baseline PRESENT rows=1482 new_silent=0 left_silent=0, verdict GREEN. The DI16 campaign now starts from 1,482 rows: 1,148 capped loops that never announce plus 334 fixed silent reads, the whole population judged (no UNJUDGED bucket left to hide in). 2026-09-06 measure Worklist on the accepted 1,482-row baseline: rows=1482 files=1138 listed=1482 shapes=732 shared_shapes=164 rows_in_shared_shapes=914 singleton_rows=568 partition=RECONCILES. The top shapes are hand-copied read-into-cap helpers, each a cause not a site: x51 `while go == 1 { r = sys_read(fd, buf+n, cap-1-n); ... if n >= cap-1 { go = 0 } }`, x40+x40 the prime-read plus `while r > 0 { ... if n >= cap-1 { r = 0 } ... }` pair, x36 `while tot < cap { r = sys_read(fd, buf+tot, cap-tot); if r <= 0 { break } tot = tot + r }`, x33 the `let base = buf as i64` variant, x32+x22+x15+x11 the `nrd` family. 164 shared shapes cover 914 rows; the incumbent conductor for mapping a duplicate group onto a shared lib is nx_map_delegate (nx_capsearch rank 1, `<listfile> <blockfile> <anchor> <impline>`), so the campaign is a delegation of each top shape onto nx_readcap_lib (rc_fill_file for the read-into-cap body, announcing TRUNCATED-more-remains), one shape per proof cycle, never a hand edit per file.

DI18 No silent cut on the wire: a reply larger than the capture window is chunked with a continuation cursor and reassembled by the reader, the window is a conf row never a literal, on send and on receive across the estate (operator 2026-09-06) · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`tsv_reply_cursor` · executor Organ · 3 u · stands on DI7
Definition of done	Done-rule: the tools-API reply lane and the job artifact readers (nx_fs job, nx_fs read, nx_https_get) return total_bytes and next_off beside every window instead of the bare NX-TRUNCATED marker; the reader follows the cursor until total is reached and refuses to publish a prefix as a whole; the window value lives in a conf row (announced, derived from the daemon's reply reserve, its reason beside it); the send side keeps the content-put CDC lane (DI5-DI7) as the ONE chunker; a gate plants a body of three windows plus one byte and proves byte-identical reassembly, with a neg-control that a reader stopping at the first window is refused by the total
Matrix cell	NO-MATRIX-ROW — no matrix row carries `tsv_reply_cursor`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-06 lesson OPERATOR 2026-09-06 (verbatim): things like this need to be caught before they get cut off or truncated both on send and receive across the entire estate we dont want to have our laws be magic numbers and if real hard limits it should intelligently chunk and reassemble. MEASURED THE SAME HOUR: /compare/ecosystem is 307,528 B; nx_https_get, nx_fs job and nx_fs read each cut it at capture_cap=163840 and the seat read the missing tail as an absent section until it paged the job artifact by line window (nx_fs lines). The cut is ANNOUNCED (NX-TRUNCATED OUTPUT-IS-PARTIAL), which is the only reason it was caught, but announcement is the floor: the reader must be able to CONTINUE, and the number must be a declared conf value with its reason beside it, never a literal in three organs 2026-09-06 queue BUILD ORDER: (1) name the window in a knowledge conf row beside its reason (the daemon's reply reserve); (2) every windowed reply carries total_bytes and next_off (nx_fs lines already prints scanned= and next= -- extend read, job and the https body the same way); (3) a reader verb that follows the cursor to the end into a local artifact the seat can read whole (nx_fs job <id> full); (4) the gate with the three-windows-plus-one fixture and the stop-early neg-control; (5) the envelope census DI2 gains the class SILENT-CUT-ON-WIRE so every capped reply path in the estate is named, not just the three met today

DI17 Windowed clone for content-defined chunks · cell WATCHING · gate UNRECORDED

Contract	`cp_stage_window` · executor Organ · 5 u · stands on DI14
Definition of done	A reuse row clones the filesystem-block-ALIGNED window that contains the chunk (FICLONERANGE on an aligned src_off and an aligned length) into the slot and records skip and len in a sidecar the assembler honours, so a content-defined chunk shares the incumbent's extents instead of being copied. ACCEPT RULE declared in advance: on the NAS btrfs volume di14_slot_batch_cloned equals rows, the commit sha256 equals the fixture's, every sidecar skip is below one filesystem block, and on a filesystem without reflink every row falls back to the copy and says so in the receipt
Matrix cell	Windowed clone for content-defined chunks · `runtime/nx_content_put.nx` · WATCHING decl
Gate	`nx_cdc_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-06 land COMMIT-CLONE SHIPPED AND WITNESSED ON BTRFS: nx_content_put PROMOTED 14d754d0 (104,345 B, strict superset) keeps a reuse ledger <id>.rl (k off len) and at commit reflinks the block-aligned interior of every offset-preserving run of reused chunks straight from the incumbent (FICLONERANGE src_off == dst_off, len a multiple of st_blksize read from the incumbent's stat, never assumed), copying only the run's two edges; the whole-file re-read still judges the assembly. Receipt: CP-ASSEMBLE from_incumbent= clone_runs= cloned_bytes= incumbent_copied_bytes= chunk_copied_bytes= clone_rc= blk= plus the first refusal's inputs. nx_content_put_gate PROMOTED 6cb29a52 (the DI14 slot fixture now COMMITS over the identical incumbent; 4 teeth + 9 values): laptop 58/58 on DrvFs (blk=512, clone_rc=-95, 609 chunks copied from the incumbent, partition sums); NAS 58/58 on btrfs: clone_runs=1 cloned_bytes=2,588,672 = floor(2,589,160/4096)*4096, incumbent_copied=488, chunk_copied=0, clone_rc=0, blk=4096, 95 of 95 chunks sourced from the incumbent, commit 22.5 s under the storm. The reflink win is real where offsets are preserved; twins installed.

DI19 A capped COLLECTOR announces, not only a capped reader · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ie_collector_cap` · executor Organ · 4 u · stands on DI12
Definition of done	DI12 made every silent READER derive or announce. The same defect exists one step over in functions that COLLECT into a caller-supplied slot table and return a bare count: nx_search_emerge.em_collect_yms(buf,n,openm,flat,maxd) exits at nd>=maxd by setting i=n and returns nd, so its return value cannot distinguish 'there were exactly maxd' from 'there were more and I stopped'. It feeds nx_cap_harvest, the DAILY frontier watch, so a future consumer that composes it without reading its body publishes a capped sample as a population. Extend nx_io_envelope_census to classify capped COLLECTORS (a function taking a max or cap parameter and returning a bare count with no cap signal) as its own named class beside the reader classes, with the same named-set ratchet so a rise names the offender. Done-rule: the census names every collector, the ratchet holds at its measured floor, and the bite plants a collector that hits its cap and must be NAMED.
Matrix cell	A capped collector announces, not only a capped reader · `runtime/nx_io_envelope_census.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_io_envelope_census`; declare `nx_io_envelope_census TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-06 lesson A SILENT CAP AT THE FUNCTION AND AN HONEST ANNOUNCEMENT AT ITS ONE CONSUMER LOOK IDENTICAL FROM THE LIBRARY SIDE, AND THE DIFFERENCE IS THE WHOLE VERDICT. Found while checking-before-building an arXiv census: em_collect_yms exits on nd>=maxd and returns a bare count, which reads exactly like a silent cap. A first pass was one step from filing that as a defect against nx_search_emerge. The CONTROL that refuted it was reading the CONSUMER rather than the library function: nx_search_emerge main prints 'sampled hits=' beside 'total volume=', so it already announces and already carries the two-counters-are-a-free-audit shape. The lesson is symmetric and both halves matter. First, NEVER indict a library function on its own body when a consumer decides whether the cap is announced. Second, DO NOT then acquit the function, because the next composer inherits the silence and 'no live victim yet' is not 'not a defect'; that is why this is DI19 and not a closed note. This is the DI2 and DI12 rule reaching one step further out, from readers to collectors.

DI20 The content clients name the failing stage, and the trust store is found from the tree root by construction · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`hf_store_locate` · executor Organ · 1.5 u · stands on DI18
Definition of done	nx_content_get_client failed three times as post failed (transport) with the door, the URL and the cap all innocent: hf_store_load reads data/mozilla_certdata.txt relative to the current directory, the client was launched from the home directory, and the missing store surfaced as a transport fault. Done-rule: (1) both clients refuse at the load site naming the path and the cwd with nothing posted (landed 2026-09-22 as CG-IO and CC-IO, rc 3) and the transport messages carry the follower rc; (2) hf_store_locate resolves the store on a declared ladder (the cwd, then the tree root the executable lives under) and announces which rung answered, so a client works from any cwd and no consumer of hf_store_load can be blind to an unreadable store; (3) both client gates carry a from-HOME bite.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `hf_store_locate`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-22 lesson A CLIENT THAT NAMES THE WRONG STAGE COSTS THE INVESTIGATION IT EXISTS TO SAVE: three transport failures tonight were one cwd defect. The discriminators were one call from the harness to the door (CG-BEGIN answered with the NAS hash, so the door, the URL and the cap were innocent) and one re-run from the tree root (E2E OK 150690 B in 30 ms). hf_store_load returns 0 with no diagnosis and every consumer inherits the silence; the message fix is landed at both clients' load sites (CG-IO and CC-IO name the path and the cwd, nothing posted) and the loader-level remedy is this rung. The three failed runs were launched from the home directory by this seat, not by any transport. 2026-09-22 land DONE-RULE PART 1 LANDED ON BOTH TREES: nx_content_get_client.nx 19331 B (dba7be20) and nx_content_put_client.nx 50595 B (78261397) edited on the NAS under size CAS (five edits, every predicted size exact), flowed back to the laptop through the get door itself, rebuilt on the laptop lane (428021 B 5a6c5816 and 456962 B c736f998), gates 12/12 and 9/9 GREEN. Bite from the home directory: rc=3 CG-IO trust store unreadable at data/mozilla_certdata.txt (resolved against the CURRENT DIRECTORY, launch from the tree root, nothing was posted). Control from the tree root: E2E OK 150690 B with the NAS hash. Parts 2 (the hf_store_locate ladder in the lib) and 3 (the from-home bite as a gate tooth) remain open. 2026-09-23 land DONE-RULE PART 2 LANDED ON BOTH TREES: nx_https_fetch_lib.nx 39242 B (ea3b2e22) carries hf_self_dir (readlinkat /proc/self/exe, never argv[0]), hf_store_probe, hf_store_candidate, hf_store_locate (the pure decision; 0 names every candidate joined by semicolons) and the composed hf_store_load (rung 1 silent and byte-for-byte, a later rung announced once on stderr, total failure named); nx_https_fetch_lib_gate.nx 11422 B (538dc6ff) adds L1-L5 over fixture roots and reads 20/20 GREEN on the laptop; NAS build 612584 B 8340b82a src_stable=1, PROMOTED prev=1. Clients rebuilt on the closure (get 431592 B e83ef269, put 460548 B e9de261a) with their refusal lines deferring to the HF-STORE line; gates 12/12 and 9/9. Bites: from the home directory the get client now fetches 150690 B with the NAS hash and announces rung 2; a copy placed far from any store refuses rc=3 naming all three candidates with 0 B on stdout. Part 3 (those two bites as teeth in the client gates) remains open; the three incumbent self-dir copies (nx_sota_why_gate, nx_torrent_daemon, nx_torrent_get, two of them reading argv) are an nx_oo_extract candidate onto hf_self_dir. 2026-09-23 measure NAS PROOF: /api/gate_run nx_https_fetch_lib_gate (promoted 8340b82a) passed 20/20 verdict=GREEN with capture_truncated=0; on the NAS the foreign-cwd tooth L5 resolved the store through rung 3 (the serving root's own data/mozilla_certdata.txt) where the laptop resolved through rung 2 (_build/../data), so the ladder is proven on both hosts with the same source and no host-specific expectation. Laptop manifests re-pushed after the ladder sources landed: HASHDIVERGE 21738/21738 identical, nas-ahead 0. 2026-09-23 land DONE-RULE PART 3 LANDED ON BOTH TREES AND PROVEN ON BOTH HOSTS: the ladder bites are teeth in both client gates. nx_content_get_client_gate.nx 20280 B (efe438c0) and nx_content_put_client_gate.nx 16378 B (97296d27) each carry cgg_abs/cpg_abs (an absolute subject path, since a relative one fails to exec after the chdir and reads as the refusal under test), a fixture tooth asserting no store on any rung of the far copy, T13/T10 a dryrun forked from a foreign cwd exits 0 and emits its envelope, a fixture tooth asserting the far copy is the subject's bytes and executable, and T14/T11 the far copy refuses exit 3 naming every rung, unlinked after the run. Laptop 16/16 and 13/13 twice each; NAS builds 55416 B 82449b37 and 53152 B cdb66cf7 PROMOTED prev=1, gate_run 16/16 and 13/13 GREEN. LESSON: the first NAS run read 15/16 with the far copy exiting 127 while its bytes-and-mode fixture tooth PASSED, because the NAS mounts /tmp noexec; a fixture that must EXECUTE is placed beside the subject (its filesystem executes by construction), two directories down so no rung reaches a store, never under /tmp. A host may mount /tmp noexec, and an exec failure reads exactly like the refusal under test. 2026-09-23 land ONE EXE-DIRECTORY RESOLVER, THREE HAND-ROLLED COPIES RETIRED: pon_self_dir(out, cap) in nx_os_introspect.nx (29373 B bb548965, composes the lib's own pon_readlink over /proc/self/exe, never argv[0]). Consumers on both trees: nx_https_fetch_lib.nx 39097 B 44fcc4fc (hf_self_dir is now a thin alias), nx_sota_why_gate.nx 10426 B d1566bd9 (sg_selfdir alias), nx_torrent_daemon.nx 89293 B 17b4873a and nx_torrent_get.nx 86194 B c0bc0f3c (exe-link primary path; the argv cut kept only as the no-/proc fallback, because a bare launch used to send every sibling-executable and conf lookup to their /tmp fallback). Laptop: fetch lib gate 20/20, get client gate 16/16, put client gate 13/13, sota_why gate 14/14, both torrent organs compile; get client from the home directory still fetches through rung 2. NAS: fetch lib gate 613192 B c03fc0ee and sota_why gate 55480 B 8adbe675 built, PROMOTED prev=1, gate_run 20/20 and 14/14 GREEN; torrent daemon and torrent_get compiled --build-only (compile proof only; the daemon deploy belongs to its lane). nx_crash (a self-contained crash handler with no imports) and the ship behaviour lib (which hashes the exe, a different question) keep their own readers by design. Manifests re-pushed: 21747/21747 identical.

dossiers=20 cells_joined=18 no_matrix_row=2 (sum 20) gates_recorded=0 gates_unrecorded=8 no_gate_declared=10 (sum 18 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 25 feature rows mapped of 25 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/dataio.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 0–1000, distinctiveness 300–900 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 1 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 819 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 0–1000 · distinctiveness 300–900 · breadth 0–800 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 1 · off-canvas 2 · unresolved labels 1 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 457 permil of the plot

Nishi IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts) tus resumable upload 1.0 restic (content-defined chunking) BLAKE3 (verified streaming)
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 2 (a fact of the data: two players that close are that close) · data spread 642 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Aspirational	978	564	653	742	0 since 2026-09-23	22	10	2026-09-15
IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts)	Mainstream	673	500	360	818	0 since 2026-09-23	11	10	2026-09-15
tus resumable upload 1.0	Mainstream	565	385	253	791	0 since 2026-09-23	8	10	2026-09-15
restic (content-defined chunking)	Unconventional	86	833	80	1000	0 since 2026-09-23	2	10	2026-09-15
BLAKE3 (verified streaming)	Peripheral	217	500	106	888	0 since 2026-09-23	3	10	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	25	5
2026-09-16	25	5
2026-09-17	25	5
2026-09-18	25	5
2026-09-19	25	5
2026-09-20	25	5
2026-09-21	25	5
2026-09-22	25	5
2026-09-23	25	5
2026-10-08	25	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 100, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts)	tus resumable upload 1.0	restic (content-defined chunking)	BLAKE3 (verified streaming)
Silent-truncation cap census over every source (fixed array, a bound on the same literal, an unbounded source) Source present; authored stronger claim: `jc_has_bound` in `runtime/_hdl_build/nx_cap_detect_lib.nx`, verified at emit. MEASURED 2026-09-05: the detector core and its tree walk (nx_janitor_caps) existed SOURCE-ONLY since 2026-07-15 and had NEVER RUN; shipped through nx_organ_ship this admission with nx_janitor_caps_gate as its proof. First estate-wide fact from the literal census it complements: 4194304 appears 1,430 times in 717 files, 718 of them as a bare literal inside a call. No column runs a census of its own source for this smell Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Reader-cap cliff forecast for append-only ledgers (OVER, NEAR, OK, MISSING against the nominal window) Source present; authored stronger claim: `cc_size` in `runtime/_hdl_build/nx_capcliff.nx`, verified at emit. MEASURED 2026-09-05: rows=18 over=4 near=0 missing=0 -- actlog.jrnl 54,589,357 B (13,015 permil of the window), tool_diff.log 32,710,926 B, dup_source.log 14,954,968 B, orchestrate.log 5,223,094 B. Consumers of actlog.jrnl read TAIL-anchored by declaration (nx_catalog cl_slurp_tail, nx_execsurface, nx_toolatency, nx_wirecensus, nx_gateadjudicate), so the OVER is a size fact; nx_replyreserve_lib and nx_capsweep are unverified and named in DI8 Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Derived read buffer: the buffer is sized from the file, never from a constant Measured: `sys_read_file` exists in `runtime/nx_syscalls.nx`, verified at emit. The primitive that ends the cap class for file reads: it sizes from lseek END and cannot short-read. Adopted today in the Claude-action gauge and the action miner's mine, freq and harden verbs, which had each read into a fixed 4 MiB buffer against a 54 MB journal. Adoption is a census question (DI3), not an assertion Adoption: `LIB-WIRED importers=16742 nonval=10087` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Gram tables sized from a frame census of the input, not a constant Measured: `al_ix_build` exists in `runtime/_hdl_build/nx_actlog.nx`, verified at emit. MEASURED 2026-09-05: the bigram and trigram tables were fixed at 16,384 entries and set index_overflow=1 when full while the miner still published a ranking; now derived from a newline census with the old constant as a floor, the overflow split into named reasons, and a tooth proving 130 x 130 = 16,900 distinct pairs counted EXACTLY with gmax = frames + 1 Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Chunked transfer framing with a terminating last chunk Measured: `chunked_decode` exists in `runtime/_hdl_build/nx_http_chunked.nx`, verified at emit. IETF is Best: the coding is complete only when a chunk with a chunk-size of zero is received, so a body whose terminating chunk never arrived is INCOMPLETE by definition [rfc9112]. Ours decodes it as the fetch unit's framing Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons behind IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts) (leads)	●	◉	○	○	○
Range requests and 206 partial content for resumable pulls Measured: `mg_fetch` exists in `runtime/nx_model_get.nx`, verified at emit. IETF defines the mechanism [rfc9110]; tus resumes by offset on the upload side. Ours pulls Range-windowed, hashes as it lands, resumes from its .part and REFUSES a wrong expected digest with the partial deleted (repointed from gen MODEL, proven live against a publisher's lfs.oid) Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separate; ahead of restic (content-defined chunking), BLAKE3 (verified streaming)Cons behind IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts) (leads); not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	◉	●	○	○
Chunked, sha-receipted, resumable upload with a commit compare-and-swap Source present; authored stronger claim: `v_commit` in `runtime/nx_content_put.nx`, verified at emit. tus is Best on the protocol (HEAD Upload-Offset, PATCH at offset, optional checksum extension) [tus]. Ours carries per-chunk sha256 receipts and a resume map and REFUSES a commit whose bytes do not hash to the declared sha -- the check tus leaves optional is mandatory here (repointed from sharehub UPLOAD) Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	●	◉	○	○
Integrity digest on the wire so a short body cannot pass as complete Measured: `v_commit` exists in `runtime/nx_content_put.nx`, verified at emit. IETF is Best: Content-Digest and Repr-Digest are the integrity fields and Want-Content-Digest asks for one [rfc9530]. tus verifies per PATCH by extension; BLAKE3 verifies per chunk by construction. Ours verifies the declared sha at commit [slsaprov12] Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of restic (content-defined chunking); fully adopted on the estate ladderCons behind IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts) (leads)	●	◉	●	○	●
Content-defined chunking so an insertion does not re-key every following chunk Measured: `cp_cdc_gear` exists in `runtime/nx_content_put.nx`, verified at emit. restic is Best: content-defined blobs of 512 KiB to 8 MiB addressed by SHA-256 so unchanged regions are stored once [restic]; FastCDC is the algorithm to adopt, gear hash with normalized chunking and cut-point skipping [fastcdc16]. Ours now plans content-defined boundaries with a FastCDC gear (nx_cdc_lib: sha256-derived gear table, normalized masks, every parameter derived from the wire chunk: max = chunk_raw, avg = max/2, min = max/8) and exposes the plan as data through the cdcplan verb; on a 1 MiB corpus a 37-byte insertion keeps 42 of 43 chunk digests where fixed-size keeps 2 of 22 (nx_cdc_gate, KAT-pinned at 43 chunks, bite-proven). HONEST LIMIT: the wire still carries the plan's chunks through the same 48,402-byte call and the receiver does not yet dedupe against a prior generation's digests. Was ABSENT-PROVEN across every board at admission. Rung DI5 Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, BLAKE3 (verified streaming); fully adopted on the estate ladderCons behind restic (content-defined chunking) (leads)	●	○	○	◉	○
Verified streaming: each chunk verifiable as it arrives Measured: `cp_stream_verify` exists in `runtime/nx_content_put.nx`, verified at emit. BLAKE3 is Best: the tree structure over 1 KiB chunks lets a receiver verify each chunk on arrival instead of the whole at the end [blake3]. Ours receipts every chunk's sha256 on arrival and, at commit, re-hashes each stored chunk against its receipt BEFORE its bytes join the assembly, refusing by index (CP-REFUSED-CHUNK-CORRUPT, nothing assembled); the whole-file digest is the final check. HONEST LIMIT: a flat receipt manifest, not a tree -- a chunk verifies against its own receipt, not against one root as BLAKE3 does. Rung DI6 Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking); fully adopted on the estate ladderCons behind BLAKE3 (verified streaming) (leads)	●	○	○	○	◉
Resumable upload on the public wire per the IETF draft Measured: `cp_resume_offset` exists in `runtime/nx_content_put.nx`, verified at emit. The IETF draft standardises offset retrieval and append-at-offset [httpbis-resumable]; tus ships it today. Ours now answers status with resume_offset (the contiguous prefix from index 0 -- the Upload-Offset shape) beside the index-based missing map, so a client that knows only offsets can resume and one that kept its record resumes by index; append-at-offset stays index-addressed (chunk id index), not byte-addressed as the draft's PATCH. Rung DI7 Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons behind IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts) (leads), tus resumable upload 1.0 (leads)	●	◉	◉	○	○
Idempotency key on every unsafe write so an Outcome-Unknown retry is safe by construction Measured: `ta_idempotency_key` exists in `runtime/nx_tools_api.nx`, verified at emit. The 2026 IETF draft makes POST and PATCH fault-tolerant with a client-generated key the resource uses to recognise a retry [idempotency-key], answering a missing or reused key with problem details [rfc9457]. MEASURED 2026-09-05 in one seat session: nine writes returned Outcome-Unknown at the edge window, each adjudicated by re-reading the artifact, and a self-anchored insert edit or an append cannot be re-issued safely at all. Rung DI4 [mcp20260728] [mcptasks20260909] Adoption: `LIB-WIRED importers=26 nonval=11` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	○
Every deliberate truncation announces itself (the read envelope prints its cap and a cursor) Source present; authored stronger claim: `tc_cut` in `runtime/nx_textcut.nx`, verified at emit. The estate's one truncation ruler cuts on token boundaries and COUNTS hard cuts; the file-read surface prints OUTPUT-IS-PARTIAL with capture_cap and next=. MEASURED 2026-09-05: this board's own 4194304 census read was cut at 163,840 B and said so, which is how a 1,389-line floor was recognised as a floor and re-measured to 1,430. No column announces a partial at the transport Adoption: `LIB-WIRED importers=4 nonval=3` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Every capped reader announces or derives: a census of fixed-length reads without an envelope Measured: `ie_scan` exists in `runtime/nx_io_envelope_census.nx`, verified at emit. The instrument this board still lacks: enumerate every read into a bare-literal length, classify DERIVED (from stat or lseek), ANNOUNCING (the envelope names the cap) or SILENT, print a partition that sums, and make SILENT the ratcheted worklist. Rung DI2 Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
A keyed call whose reply the edge lost is re-issued by the client and replayed by the transport, never executed twice Measured: `jf_should_reissue` exists in `runtime/nx_jobfollow_parse.nx`, verified at emit. The client half of the idempotency key [idempotency-key]: the re-issue decision is a pure function a gate walks without a socket -- re-post iff the reply is the edge's outcome-unknown envelope (503 read-after-accept) or the transport's IN-FLIGHT answer AND the request carries a key; an unkeyed request is never re-posted and its 503 is returned honestly. MEASURED 2026-09-05: a source push failed with an empty CP-BEGIN receipt three times while the receiver had accepted every begin; the fix landed ONCE in the shared post spine so every keyed client inherits it, and nx_jobfollow_parse_gate carries both directions as teeth. Rung DI4 Adoption: `LIB-WIRED importers=3 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	○
Dedupe on the wire: only the chunks the receiver lacks are sent Measured: `v_have` exists in `runtime/nx_content_put.nx`, verified at emit. restic is Best: a repository stores each content-defined blob once and a changed file re-sends only its new blobs [restic]; FastCDC boundaries make that dedupe survive insertions [fastcdc16]. Ours now plans the boundaries (DI5), lists the incumbent's content-defined digests (have, paginated inside the wire cap) and stages a chunk FROM the incumbent by digest (reuse, re-hashed on the receiver and refused by index on mismatch), so only the chunks the receiver lacks cross the wire; the client's cdc mode batches reuse rows and falls back to bytes on a refused batch, printing CC-DEDUPE with wire bytes. Gate 49/49 on the mechanism (a transfer assembled entirely from reuse rows commits to the fixture's own sha256). The 64 MiB one-byte-insertion wire measurement is PENDING at the box's measured 27 s per chunk, recipe on the plan log; a 5.9 MB live trial is journaled there. Rung DI9 Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, BLAKE3 (verified streaming); fully adopted on the estate ladderCons behind restic (content-defined chunking) (leads)	●	○	○	◉	○
A bad chunk is refused on arrival, not at commit Measured: `cp_chunk_expect` exists in `runtime/nx_content_put.nx`, verified at emit. BLAKE3 is Best: each chunk verifies against the root as it arrives [blake3]; the tus checksum extension and Content-Digest verify per request [tus] [rfc9530]. Ours now refuses a wrong or malformed declared chunk digest and a truncated tail ON ARRIVAL, by index, with nothing staged (the client declares sha256= with every chunk and every reuse row), and still refuses a chunk corrupted ON DISK before assembly (DI6). Gate 49/49 on the promoted door; measured live 2026-09-05 when the door named the seat's own truncated token in one line. Rung DI10 Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of restic (content-defined chunking); fully adopted on the estate ladderCons behind BLAKE3 (verified streaming) (leads)	●	●	●	○	◉
Byte-offset append and RFC 9530 digests on the public door Measured: `cp_append_at` exists in `runtime/nx_content_put.nx`, verified at emit. The IETF draft standardises offset retrieval and append-at-offset [httpbis-resumable]; tus ships Upload-Offset and PATCH-at-offset today [tus]; Repr-Digest names the whole representation [rfc9530]. Ours now accepts a byte-offset append only at the current upload offset (status prints upload_offset beside resume_offset) and refuses a stale or future offset NAMING the current one, never silently re-basing; the declared digest is checked on arrival as for chunk. Gate 49/49 on the promoted door. HONEST LIMIT: the digest field is the begin's whole-representation sha256 rather than an RFC 9530 header, because the wire is JSON-RPC and not HTTP semantics, and a fixed transfer's append must carry exactly one chunk. Rung DI11 Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons behind IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts) (leads), tus resumable upload 1.0 (leads)	●	◉	◉	○	○
Every silent fixed-length reader converted: the DI2 worklist driven to zero Measured: `ie_ratchet` exists in `runtime/nx_io_envelope_census.nx`, verified at emit. No column runs a census of fixed-length reads over its own source; the bar is our own DI2 measurement and the remedy is sys_read_file or an announced envelope per site, ratcheted by name. Ours now: the census carries a keyed named-set ratchet (a rise refused by name and never laundered into the baseline, a fall named with what each site became, journaled, and tightened), a LOOPED class for the streaming idiom, and a false-positive rate DERIVED from that ledger. MEASURED 2026-09-06 on the first live pass: SILENT 596 to 332 with every departure journaled (263 were streaming loops the first ruler had misnamed, 1 a real conversion), false_positive_permil=996 over the 264 adjudicated, verdict GREEN; the 332 that remain are the unadjudicated worklist. Rung DI12 Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
No append-only ledger nears its cliff unguarded Measured: `cc_remedy` exists in `runtime/_hdl_build/nx_capcliff.nx`, verified at emit. No column publishes a cliff forecast for its own ledgers; the bar is nx_capcliff reading over=0, or every OVER row naming its guard and its consumers' anchoring -- a loud refusal before the cliff, never a rotation. Ours now: the remedy census reads each declared consumer's READ SITE and classifies its anchoring itself (WHOLE, TAIL, HEAD, UNVERIFIED), verifies writers append, FORKS the declared sizeguard for its verdict, and carries RED only for an ungoverned or breached cliff. MEASURED 2026-09-06 live: over=4 (actlog.jrnl 11 readers all TAIL, dup_source.log 3 readers all WHOLE, tool_diff.log and orchestrate.log with NO reader in the tree) governed=2 noreader=2 ungoverned=0 breached=0, partition RECONCILES, verdict GREEN; the accept rule's second branch is met, over=0 is not claimed. Rung DI13 Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Reuse stages by clone where the kernel allows and never pays a per-row fsync Source present; authored stronger claim: `cp_stage_clone` in `runtime/nx_content_put.nx`, verified at emit. restic reuses a stored blob without rewriting it [restic]; ours now tries FICLONERANGE per reuse row, re-hashes the clone and names the kernel's refusal with the first refusal's inputs in the batch receipt; on btrfs the answer for a content-defined chunk is -22 EINVAL by construction (the range is never block-aligned), and the batch's real cost was one fsync per 48 KB row: 95 rows fell from 803,991 ms to 7,993 ms once reuse rows stage without a per-file fsync and the staging directory is fsynced once. The aligned-window clone is DI17. Rung DI14 Adoption: `RUN-BY:cron` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	●	○	○	○
A looped read is judged by its exit, not parked Measured: `ie_loop_exit` exists in `runtime/nx_io_envelope_census.nx`, verified at emit. No column classifies its own read loops; ours parks 1,273 LOOPED sites as not judged after the first ratchet pass, and a loop that breaks on a count bound is a cap wearing a loop. Rung DI15 Adoption: `RUN-BY:clock` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts), tus resumable upload 1.0, restic (content-defined chunking), BLAKE3 (verified streaming); fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
The silent worklist reaches zero DARK — `runtime/nx_io_envelope_census.nx` EXISTS but does not declare `ie_worklist_zero`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. No column drives a census of its own capped readers to zero; ours holds 332 SILENT sites after the first ratchet pass, every departure journaled with what it became. Rung DI16 dossierwatching ie_worklist_zero Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Windowed clone for content-defined chunks DARK — `runtime/nx_content_put.nx` EXISTS but does not declare `cp_stage_window`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. restic and every reflink-aware store share extents only on block-aligned ranges [restic]; ours will clone the filesystem-block-aligned window that contains a content-defined chunk and record skip and len for the assembler, so a CDC chunk is shared with the incumbent instead of copied; measured 2026-09-06 on btrfs every reuse row reads clone_rc=-22 EINVAL and takes the copy path. Rung DI17 dossierwatching cp_stage_window Pros none measured yetCons behind IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts); open contract; expected source declaration not established	○	●	○	○	○
A capped collector announces, not only a capped reader DARK — `runtime/nx_io_envelope_census.nx` EXISTS but does not declare `ie_collector_cap`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The census classifies readers and not collectors, so a function that fills a caller-supplied slot table and returns a bare count is unclassified; em_collect_yms stops at its maxd and returns a count that cannot say whether it stopped early, and it feeds the daily frontier watch. No live false claim today because its one consumer prints sampled hits beside total volume, which is why a first reading nearly filed a FALSE defect against a correct organ; the defect is latent and belongs to the function, not that consumer. Rung DI19 dossierwatching ie_collector_cap Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	14	rows carrying a Yes, Best or Part in a rival column
cited	14	a reference mark resolves to a pinned mirror
uncited	0	an observation read, badged until a reference lands
rows, summed	14	RECONCILED: the parts sum to the total 14

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-05	DI1	measure	nx_capcliff scan 2026-09-05: rows=18 over=4 near=0 missing=0; actlog.jrnl 54589357 B (13015 permil of the 4194304 window), tool_diff.log 32710926 B, dup_source.log 14954968 B, orchestrate.log 5223094 B; consumers of actlog.jrnl read TAIL-anchored by declaration in nx_catalog (cl_slurp_tail), nx_execsurface (es_read_tail), nx_toolatency (tl_read_tail), nx_wirecensus, nx_gateadjudicate; nx_replyreserve_lib and nx_capsweep unverified
2026-09-05	DI1	measure	literal 4194304 census 2026-09-05 over buildroot/runtime (nx_shelltool, coverage_complete=1 corpus_complete=1 files=23663): hits=1430 distinct_files=717 code=1415 comments=15 named_consts=607 bare_call_literals=718 other_code=90 (607+718+90=1415); files by tree _hdl_build=337 runtime=380. The first read of this census was cut at the 163840 B capture cap and ANNOUNCED it, so the 1389-line floor was re-measured in four 400-line windows to the exact 1430
2026-09-05	DI1	land	nx_janitor_caps shipped through nx_organ_ship (build queued under admission, BQ-nx_janitor_caps, promote as the deliberate second pass); nx_janitor_caps_gate is its declared proof. Same day: nx_actlog gram tables derived from a frame census (T16 16900 exact, T17 gmax 33801), nx_claude_harvest and nx_actlog journal reads moved to sys_read_file
2026-09-05	DI4	measure	Outcome-Unknown writes in one seat session 2026-09-05: nine (edits, appends, a ship launch, a listing), each adjudicated by re-reading the artifact; two classes cannot be re-issued safely (INSERT-SELF-ANCHORED edits and appends); the transport already answers with RFC 9457 problem details but carries no key the caller could replay
2026-09-05	DI2	measure	nx_compare_rank dataio on admission day: rungs=8 done=3 open=5 (partition sums), matrix_rows=14, unmapped=0. Critical path for TARGET VERSION 0.1: #1 DI2 the envelope census (priority 133, all rivals absent: a lead nobody holds), then DI7 offset-resumable door (1200), DI6 per-chunk verified streaming (1000), DI5 content-defined chunking (666), DI4 idempotency keys (133). PM filed 1 of the top 3 into pm_intake. The three rungs the ranker reads as done are done by SYMBOL PRESENCE only (jc_has_bound, sys_read_file, cc_size exist); their done-rules are not yet met and the log rows say so -- the flip is the receipt, never the proof
2026-09-05	DI1	measure	nx_domain_admit dataio at first run: REFUSE with two named reasons -- one organ path unresolvable (chunked_decode lives in runtime/_hdl_build/nx_http_chunked.nx, corrected) and no barcheck row nor UNPINNED declaration. Closed by reading three rivals LIVE from api.github.com (restic v0.19.1, BLAKE3 1.8.7, tus protocol repo v0.2.2, JSON mirrored with provenance) into knowledge/barcheck.conf and declaring the IETF column UNPINNED with its reason in the matrix header; knowledge/compare/dataio.gates written with five promoted gates so the second-method axis has an executable map
2026-09-05	DI4	lesson	MEASURED THE SAME HOUR THIS BOARD WAS WRITTEN: nx_organ_ship shipped a STALE nx_actlog under a fresh 65611 B source with prove GREEN, because /api/build dedups an identical body for about an hour and re-stages the stale .sov.elf.new as BUILT (debt 1785363417, open since 2026-07-29, recurred), and the promoted gate's identity tooth pinned a string both generations carry. Fixed at the root in the ship loop: a per-run bust nonce on both /api/build bodies (target build and gate rebuild), and a generation-specific identity tooth (T5) in nx_actlog_gate. The sovereign-lane build of the same source MISSed the cache and produced the fresh 104983 B artifact, which is how the replay was attributed rather than assumed
2026-09-05	DI4	retract	RETRACTED the mechanism in the DI4 lesson row above, same day: the stale nx_actlog promote was NOT an /api/build idempotency replay. Refuted by reading the source: no organ in the tree sends an Idempotency-Key header (grep over 23,667 files, coverage_complete=1) and the mgmt dedup keys on that header, so a bare target= body was never being deduplicated. THE TRUE MECHANISM, read in nx_hostctl cmd_buildrun: the host controller forks the builder, prints its exit code, and then probes _build/<name>.sov.elf regardless -- when the builder REFUSES under its own admission check (rc=4 in the I/O storm) the PREVIOUS build's artifact is still there, validates as an ELF, is echoed as BUILT size= and re-staged with a fresh mtime, and the mgmt API emits action=BUILT with that stale digest. Root fix landed in source: stage only when the builder exited 0 AND printed its own SOVEREIGN build token (the positive marker), never on the absence of an error. The ship-loop nonce shipped earlier is harmless and stays; its comment is corrected to say so. A hypothesis restated in three debt rows since 2026-07-29 was still a hypothesis until the controller's source was read
2026-09-05	DI1	land	BOARD LIVE: /compare/dataio published by the compare regen (holder regen-1788632942, the beat's own run -- a second regen I launched was correctly refused LS-BUSY), nx_page_verify status=200 bytes=79289 a11y-issues=0 VERDICT=GREEN through the pinned sovereign edge. Admission ADMIT (rows=14 grounded=9 absent=4 ungrounded=0, bars pinned=3 unpinned-declared=1, gates=1), evidence MEASURED-HONEST with the two vacuous rows resolved (janitor gate migrated onto gv_check_eq and shipping; record gate removed with its reason), ranker critical path DI2 > DI7 > DI6 > DI5 > DI4. Root fix for the false-green build class landed in nx_hostctl cmd_buildrun (debt 1788634371 supersedes the mechanism in 1785363417); ship in flight, deploy via /api/deploy target=hostctl owed
2026-09-05	DI4	land	ROOT FIX DEPLOYED: nx_hostctl cmd_buildrun now stages only when the builder exited 0 AND printed its own SOVEREIGN build token; a refused or dead builder returns BUILDRUN FAIL naming the exit code and the artifact on disk as a PREVIOUS build, so /api/build can no longer answer action=BUILT with a stale digest. Shipped through nx_organ_ship (BUILT ab32babd17ebb051, prove: named absence, gate nx_hostctl_keepbackoff_gate now declared in organ_gate.conf for future ships), promote correctly refused as DECLARED-DAEMON, then /api/deploy target=hostctl with expect_sha256 -> PROMOTED, pre_deploy_gate DEPLOY-SAFE, watchdog running; live digest re-read ab32babd17ebb051 291088 B. Pre-change binary banked by digest at knowledge/status/nx_hostctl.bank-20260905-prebuildrunfix (4cab397ea2775d87, 289624 B, mode 0755). Content ruler live vs staged: lost 0, gained 5 (exactly the new refusal strings), strict superset. Owed: nx_hostctl_buildrun_gate with a fixture builder that exits 4, asserting NOT staged (a green that has not yet had its red)
2026-09-05	DI1	land	nx_actlog SHIPPED THROUGH THE FIXED LOOP: promoted 91fbd6facca41718204bb8e9c04275966c0038ca95566aa754aafe3c67e8920b (117760 B, the fresh source's build; the stale 111648 B generation is gone), PROVE GREEN with nx_actlog_gate REBUILT this run because its closure bank drifted -- so the T5 generation-identity tooth is what passed, and the previous generation could no longer have. Adopt: 1 named lost run (the verdict-note reword) allowed. The gram tables are now DERIVED from the frame census on the live miner (16,900 exact where 16,384 silently capped)
2026-09-05	DI4	land	THE BUILDRUN FIX GOT ITS RED: the stage decision moved out of nx_hostctl into nx_buildrun_verdict_lib (one pure function, bv_verdict: exit 0 AND the builder's own SOVEREIGN build token, evaluated in that order) and nx_hostctl_buildrun_gate drives it with the incident's own capture shapes -- 9 of 9 GREEN locally: the measured refusal (exit 4 + REFUSED-BUILD-ADMIT) reads EXIT_NONZERO, a real compile and a cache hit read OK, a hit line alone, an empty capture and a split token read NO_TOKEN, exit 127 with a stale token reads EXIT_NONZERO, exit wins over token. Declared for nx_hostctl in organ_gate.conf beside nx_hostctl_keepbackoff_gate. Sources byte-identical NAS and laptop (hostctl c1c4fb82d174a5b5 341459 B); gate ship in flight, controller re-ship and second /api/deploy follow
2026-09-05	DI4	measure	IDEMPOTENCY KEYS BUILT AND GATED (local proof, ship pending): nx_fsops_write (the binary behind nx_fs_write) takes an optional key=<token> on write, edit and append; the first APPLIED outcome (rc=0 verb path bytes hash) is recorded in the estate's append-only ledger knowledge/status/fswrite_idem.jrnl through nx_apistack_idempotency (first-write-wins, composed not duplicated), and a retry carrying the same key is REPLAYED with the first outcome and NOTHING re-executed; refusals are never recorded; expect= and key= are order-free so a key can never be misread as an expect. nx_fsops_write_gate (the write path's FIRST gate) 11 of 11 GREEN on a fixture tree: keyed write replayed, keyed self-anchored insert applied once then replayed with size unchanged, a DIFFERENT key applies again, NO key applies again (legacy exact), keyed append twice lands one row, a would-clobber refusal does not poison its key. DI3 bonus: the ledger lib read its ledger through a 262144-byte cap (an append-only ledger loses its NEWEST keys first, so a SEEN key would read NEW and double-execute) -- replaced by sys_read_file, its own gate 4 of 4
2026-09-05	DI4	land	nx_fsops_write PROMOTED sha 6dbf2d9a (63,352 B), offc twin fresh, REGISTERED: key=<token> idempotency on write, edit and append; ledger knowledge/status/fswrite_idem.jrnl (nx_apistack_idempotency, read whole via sys_read_file, its 262,144 cap removed). LIVE PROOF through the MCP tool: a same-key re-issue answered NX-FS-IDEM REPLAY first_outcome=rc=0 bytes=26 hash=h27f809e5c788f4b1 and the file was NOT rewritten. Gate nx_fsops_write_gate 11/11 GREEN locally (keyed write replayed, keyed self-anchored insert applied once, different key applies again, no key unchanged, keyed append twice = one row, refusal never recorded); the ship PROVE stage ran the older nx_fsops_gate 41/41 by name-strip because the new gate was source-only on the NAS: its own ship is in flight.
2026-09-05	DI4	measure	LIVE through the MCP tool nx_fs_write, both verbs: write key=di4-probe-20260905-a first call OK bytes=26, same-key re-issue REPLAY first_outcome rc=0 bytes=26 hash h27f809e5c788f4b1, file unchanged; append key=di4-append-20260905-a first call OK total=58, same-key re-issue REPLAY bytes=58, file unchanged. Two verb shapes that had NO safe retry after an Outcome-Unknown now have one. This row itself was appended under key=di4-plan-row-20260905-a. Gate nx_fsops_write_gate SHIPPED on the NAS: 11/11 GREEN, promoted b9cca743, registered; organ_gate.conf now declares BOTH nx_fsops_gate (41 teeth) and nx_fsops_write_gate for nx_fsops_write so the convention cannot displace the family gate.
2026-09-05	DI1	land	nx_actlog_gate T5 generation SHIPPED on the NAS: 7/7 GREEN, promoted 803eb6aa, offc twin fresh; its identity tooth now pins the frame-derived index generation (T16 index sized from the frame count) so a stale miner binary can no longer pass as current. The miner itself (nx_actlog 91fbd6fa, gram tables derived from the frame census, index_overflow announced) was promoted earlier today. Two admission refusals and a false-BUILT stage from the builder lay between the source edit and this receipt; the hostctl exit+token verdict that closes that class is deployed inline and its lib refactor is staged 6122278d awaiting deploy.
2026-09-05	DI2	land	nx_io_envelope_census SHIPPED on the NAS: promoted 2b006735, offc twin installed, REGISTERED; PROVE by nx_io_envelope_census_gate 6/6 GREEN (bank CURRENT, run on the banked build artifact). The classifier: sys_read( sites as LITERAL / NAMED (const NAME: i64 = decimal, same file) / DYNAMIC (not judged), ANNOUNCING when the file carries an envelope token (TRUNCATED, OUTPUT-IS-PARTIAL, coverage_complete, capture_cap, scan_cap, truncated=, partial=), sys_read_file( counted on a separate DERIVED axis; walker = nx_shelltool grep with its coverage PROPAGATED (partial walk = UNPROVEN, never a smaller number); named-set baseline knowledge/status/io_envelope_silent.baseline, --accept rewrites it deliberately; status knowledge/status/io_envelope.status with the verdict LAST. Selftest 12/12 (comment, string and the derived primitive are never sites; a prefix-named const resolves to its own declaration; a call expression is DYNAMIC). First NAS run launched via nx_job_run; the ie_scan watch flips on the next regen beat.
2026-09-05	DI2	measure	FIRST NAS CENSUS (nx_io_envelope_census over buildroot/runtime, nx_job_run, knowledge/status/io_envelope.status ts=1788639582): walker matches=2328 coverage_complete=1 corpus_complete=1 cap_hit=0; hits=2328 = fixed 640 + dynamic 1637 + not_a_site 51 (partition RECONCILES); SILENT (fixed length, no envelope token in the file) = 596 = the worklist, named file:line in knowledge/status/io_envelope_silent.baseline (CREATED this run, so new_silent=0 and verdict=GREEN is the ratchet floor, not a clean bill); DYNAMIC 1637 is NOT JUDGED (a computed length can still be a cap wearing a variable); DERIVED sys_read_file sites = 3298 on the separate remedy axis. false_positive_rate UNMEASURED adjudicated=0 of 596 -- the worklist needs adjudication before any SILENT row is called a defect. Daemons on the list that read a request body through a silent fixed length include nx_sites_daemon (20480), nx_andelinwest_daemon (8192), nx_opaque_login_tls_daemon (65536), nx_media_server (262144 x7), nx_mesh_gateway (262144), nx_dev_api_serve (262144): request-path readers are the highest-value adjudication order.
2026-09-05	DI1	land	hostctl DEPLOY #2 (the lib refactor of the builder verdict): /api/deploy target=hostctl expect_sha256=6122278d -> PROMOTED, pre_deploy_gate DEPLOY-SAFE, deploy_status DEPLOYED-GREEN (listen UNVERIFIED-may-be-outgoing-process, the honest third state); live nishihost/nx_hostctl = 6122278d 291,864 B. Both declared gates GREEN on the ship (nx_hostctl_keepbackoff_gate, nx_hostctl_buildrun_gate 9/9). Banks before the deploy, hash-verified: pre-change 4cab397e and the inline-fix generation ab32babd under knowledge/status/. The _offc twin (forked by nx_hub_publish_hostctl, which ships it OUTWARD) was the pre-fix original: nx_offc_install cannot see a live name without .elf, so the twin is refreshed by the verifying copier and the installer's blind spot is a named gap.
2026-09-05	DI1	measure	FIRST NAS RUN of the promoted nx_janitor_caps detector (nx_job_run, root buildroot/runtime, floor=32): scanned=19489 .nx files, FLAGGED=54 candidates -- a fixed-count array whose literal also bounds a fill loop, in a file that reads an unbounded source. Candidates, not verdicts: each needs review and data-driven sizing makes the flag disappear. Named daemons and servers on the list: nx_relate_serve (64), nx_survey_serve (32), nx_office_serve (64), nx_nofloat_serve_core (256), nx_seg_store (256, the class that dropped 680 of 936 segments with no error), nx_arcade_serve (289), nx_qserver (128), nx_gen_orchestrator (4096), nx_paramplumb (4096), the whole nx_vizsla_* family (26 files, 32..512), nx_compare_unified and nx_swcompare_evidence (the compare surface itself). Full list in /tmp/janitor_caps_first.out (reaped hourly) -- the beat that persists it is the next step once the migrated gate ships.
2026-09-05	DI1	land	nx_janitor_caps_gate MIGRATED generation SHIPPED: promoted c263e75f, 6/6 GREEN on gv_check_eq with named neg-controls F2..F5 (data-driven, no-source, byte-buffer, shift), registered; allow_loss=11 named the D001 literals the old hand-rolled dialect printed (got/want, F1..F4 labels) and every one is journalled as an ADOPT-LOST row. The evidence referee read this gate as VACUOUS (pass=0/0) before today because its verdict was unreadable from outside; re-run of nx_swcompare_evidence dataio requested. nx_janitor_caps (the detector) promoted c63d0c74 earlier today; its daily beat is the next wiring step. Also today: ioenvbeat 86400 nx_io_envelope_census.elf declared in the clockjobs- desired-state plane (172 rows) under a minted nx_clockjob cap -- the envelope census now runs daily and its ratchet names any NEW silent reader.
2026-09-05	DI4	land	TRANSPORT-LEVEL IDEMPOTENCY KEY LIVE (ta_idempotency_key): nx_tools_api_serve 58fcfa74 (320,016 B) DEPLOYED via /api/deploy target=toolsapi expect_sha256, DEPLOYED-GREEN listen=VERIFIED; pre-change 991b2522 banked at knowledge/status/nx_tools_api_serve.bank-20260905-preidem. Mechanism: params._idem (sibling of _cap and _async) is classified by nx_toolcall_idem_lib BEFORE execution -- BADKEY refused, INFLIGHT (O_EXCL claim _jobs/idem_<digest>.claim held by another call) not executed with the claim age named, REPLAY answers the recorded first outcome; NEW is recorded at every outcome point (async and promote lanes record the job id the instant it is reserved, before the reply; sync and http lanes record exit+bytes and keep the bytes in _jobs/idem_<digest>.out) and released on harness-fail, HTTP-backend error and not-on-allowlist. Gates: nx_toolcall_idem_gate 22/22 (promoted e8d61bb6), nx_tools_api_gate rebuilt 25/25, both declared in organ_gate.conf. LIVE PROOF through the deployed transport: nx_fs_write append with _idem=di4-transport-20260905-a -> JOB-STARTED id=1788643130 (file 58 -> 107 B); same _idem re-issued -> NX-IDEM REPLAY first_outcome=lane=async tool=nx_fs_write job=1788643130 NOT re-executed; ledger knowledge/status/toolcall_idem.jrnl holds exactly that row. Every Outcome-Unknown 503 on this transport now has a safe retry: carry the same _idem. Named limit: a daemon killed between reserve and record leaves the key IN-FLIGHT with its age reported (the deploy that shipped this killed its own receipt job that way).
2026-09-06	DI5	land	nx_cdc_lib (FastCDC gear, normalized masks, every parameter DERIVED from the wire chunk: max=chunk_raw avg=max/2 min=max/8, gear table = sha256(named seed concat byte) built per call) + nx_cdc_gate 17/17 GREEN laptop AND NAS (chunks=43 mean_len=24385 over 1 MiB pseudo-random; after a 37-byte insertion cdc keeps 42/43 digests while the fixed-size control keeps 2/22); receiver gains cp_cdc_gear + verb cdcplan <src>; gate PROMOTED 45f75a91 + REGISTERED + _offc twin; organ_gate.conf binds nx_content_put -> nx_cdc_gate
2026-09-06	DI6	land	cp_stream_verify: every staged chunk is re-hashed against its receipt BEFORE its bytes join the assembly; a mismatch refuses CP-REFUSED-CHUNK-CORRUPT index=N exit 7 and assembles nothing; CP-ASSEMBLE now prints stream_verified=; gate neg-control flips a byte in staged chunk 2 ON DISK (same length, invisible to a size check) and the commit names index 2
2026-09-06	DI7	land	cp_resume_offset: status prints resume_offset= (the IETF resumable-upload Upload-Offset shape, bytes stored contiguously from 0) beside the index-based missing list; gate tooth: first missing index 1 -> offset = 1 x chunk_raw
2026-09-06	DI4	land	CLIENT HALF: nx_jobfollow_parse gains jf_outcome_unknown / jf_req_keyed / jf_inflight / jf_should_reissue and parses NX-IDEM REPLAY ... job= as a pointer; nx_https_post_lib.hp_post_json_reissue re-posts a KEYED request whose reply the edge lost (503 read-after-accept) or that is IN-FLIGHT, once per poll interval, bounded by the poll budget; jf_post_follow and hp_post_json_follow both route through it; an unkeyed request is never re-posted. nx_jobfollow_parse_gate 22/22. Put client carries _idem at begin/chunk/commit/status and echoes the door's answer when a receipt has no id. Receiver accepts expect= beside expect_sha256= and refuses a malformed CAS token BY NAME (CP-REFUSED-EXPECT-MALFORMED) instead of as a stale file
2026-09-06	DI4	retract	The buildroot source of nx_content_put and its gate were BEHIND the served binaries by one feature (EC26 CAS-on-source, built 2026-09-02 from a laptop-only copy and shipped through the door itself). The first candidate would have deleted expect_sha256 and three named refusals; nx_contentdiff caught it (lost_from_live=8 BIDIRECTIONAL) and the promote guard would have too (CAPLOSS 142 permil on the gate). Remedy was a merge onto the laptop base, not a promote; both trees now carry the union. Lesson: a laptop build of a laptop-ahead source is the AHEAD class wearing a fresh timestamp -- pull the NAS copy, then check the LIVE binary's runs against the source you hold before editing
2026-09-06	DI4	measure	Idempotency proven live on the promote lane three times this session: a 503 read-after-accept on /api/promote re-issued under the same _idem answered NX-IDEM REPLAY job=<id>, the job artifact carried the real PROMOTED receipt, no second execution. Receiver PROMOTED 3336ac3b (73,671 B) gate PROMOTED 2315998e (73,474 B, 32/32) client PROMOTED 506df502 (420,788 B); all three strict supersets under nx_contentdiff (lost_from_live=0)
2026-09-06	DI6	measure	NAS proof on the PROMOTED binaries (nx_job_run, serving root, under a load1 of 19): nx_content_put_gate 32/32 GREEN against ./nx_content_put.elf 3336ac3b (2,589,160 B fixture, 54 chunks, disk-corrupt index 2 refused before assembly, resume_offset actual=48402 expected=48402, cdcplan total=2589160 max=48402, both CAS spellings, malformed token named); nx_cdc_gate 17/17 GREEN (chunks=43 mean_len=24385 cdc_shared 42/43 fixed_shared 2/22); nx_jobfollow_parse_gate 22/22 GREEN (REPLAY job parse, outcome-unknown shape, keyed/unkeyed re-issue decision both directions). Referee deferred itself under the heavy-I/O bound (running=7) while these ran -- re-run owed once the regen releases it
2026-09-06	DI5	lesson	nx_gate_bite over nx_cdc_lib: 6 mutants, 4 VOID (admission refused their builds under the storm), 1 uncompilable, 1 VALID SURVIVOR at lib line 84 (`while go == 1` flipped -- disables the strict-mask phase, leaving loose-only gear chunking) that passed every statistical tooth: mean within 2x of avg, partition, determinism, insertion resilience all hold for a plain gear chunker too. A distribution tooth cannot separate normalized chunking from its unnormalized twin. Fixed with a KAT: T17 pins the seeded corpus at exactly 43 chunks (the mutant yields 78); planted locally -> 17/18 RED, pristine restore -> 18/18 GREEN, byte-identical lib verified by hash. Gate PROMOTED 4a965008 (52,047 B, superset of live). A KAT on a deterministic corpus is the honest discriminator for an algorithm whose statistics are shared by its degenerate cousins
2026-09-06	DI5	measure	nx_gate_bite re-run on the PROMOTED nx_cdc_gate 4a965008 with the KAT tooth: valid_mutants=1 killed=1 (the loose-only comparison mutant at lib line 84 now goes RED), void_build_lane=1 (admission), not_reached=0, twins RESTORED byte-identical -> verdict=GREEN (gate BITES). Before the tooth: same harness, same mutant, SURVIVED (INCONCLUSIVE). Both bite runs on the NAS, both artifact-custody clean (mutant_live=0)
2026-09-06	DI5	measure	ACCEPT RULE status after the 2026-09-05 landing: PARTIAL. Met: content-defined plan with derived min/avg/max (derived from the wire chunk rather than read from conf -- stricter than the rule, nothing to tune), deterministic gear, insertion resilience proven (42 of 43 digests kept vs 2 of 22 fixed) on a 1 MiB pseudo-random corpus, KAT-pinned and bite-proven. NOT met: the wire still re-sends fixed-size chunks; the 64 MiB one-byte-insertion re-send test cannot pass until the transfer itself uses the plan. Declared as DI9
2026-09-06	DI6	measure	ACCEPT RULE status: PARTIAL. Met: a wrong-digest chunk is refused NAMING its index and nothing is assembled; refusal precedes assembly. NOT met: the refusal arrives at commit, not on arrival, because the client declares no per-chunk digest with the chunk; a truncated final chunk is caught by the byte-total check at commit. Declared as DI10
2026-09-06	DI7	measure	ACCEPT RULE status: PARTIAL. Met: the door answers an offset (resume_offset) and a killed upload resumes from the server's record by index (client resume proven by its gate). NOT met: append is index-addressed, not byte-offset per the IETF draft, and no Content-Digest or Repr-Digest field is spoken. Declared as DI11
2026-09-06	DI10	land	cp_chunk_expect: `chunk <id> <index> <b64> sha256=<hex>` -- the receiver compares the declared digest with what ARRIVED before any byte reaches staging and refuses CP-REFUSED-CHUNK-DIGEST index=N exit 7 (a malformed declaration is CP-REFUSED-CHUNK-DIGEST-MALFORMED exit 3, a caller defect named as such); the size refusal now names its index too, so a truncated final chunk is refused on arrival by index; a legacy caller without a declaration is unchanged. The put client declares every chunk's digest (sha256_digest over the chunk, buffers allocated once outside the loop). Gate 36/36: wrong digest refused on arrival with nothing staged, right digest accepted, malformed named, truncated tail named. Receiver PROMOTED b5c1886f (75,247 B) gate PROMOTED 706370e8 (78,329 B) client PROMOTED 450fe305 (421,286 B), all strict supersets or content-identical under nx_contentdiff, twins installed. ACCEPT RULE status: MET on arrival for both planted cases; the DI6 commit re-verify remains as defence in depth
2026-09-06	DI4	land	Client half widened: a KEYED request that gets NO REPLY (transport failure) is re-posted like an outcome-unknown one -- MEASURED under load1 19: the FIRST post of a run failed on 5 of 11 transfers and every re-run succeeded; after the widening JF-REISSUE fired live and all 11 completed. nx_jobfollow_parse_gate 23/23 (the old neg-control retired, split into keyed-yes / unkeyed-no). Parse gate PROMOTED 70927e8d, get client rebuilt on the rule. The evidence referee's door-gate deadline override row landed (2x the measured 1,034 s run)
2026-09-06	DI1	lesson	nx_fsops_write_gate was RED 9/11 on every referee pass because it never removed the file its NEW-file tooth creates -- a gate that is not idempotent reports on its first run and lies about every run after; fixed at setup, 11/11 twice, built in the SAME lane as live (/api/build) because the laptop lane loses 56 symbol-name runs against a NAS-built live binary (lost_other=0, a flavour difference the ruler names), PROMOTED 93f05ed7
2026-09-06	DI9	land	Dedupe on the wire, MECHANISM landed on the door and the client: `plan <id> <count>` switches a transfer to plan-addressed variable-length chunks (marker <id>.cdc, read back as nchunks by the ONE meta reader; refused once chunk 0 is staged); the begin receipt publishes cdc_min/cdc_avg/cdc_max so both sides cut by one rule; `have <id> [from=k]` lists the incumbent's content-defined digests paginated within the wire cap (next= says where to continue; row width derived, never counted); `reuse <id> <b64 rows>` stages chunks from the incumbent after re-hashing each against the declared digest (a stale have-list or a changed incumbent is refused BY INDEX and stops the batch; a CAS conflict likewise); `chunk` and `reuse` share ONE staging writer. Client `cdc` token: plan, declare, read have pages, send only missing chunks, batch reuse rows to the wire chunk, fall back to bytes on a refused batch, print CC-DEDUPE with bytes on the wire. Gate 44/44 on the mechanism: have equals the local plan chunk for chunk, a transfer assembled ENTIRELY from reuse rows commits to the fixture's own sha256, a mismatched row is refused by index and stages nothing, reuse on a fixed transfer is refused by name. Receiver PROMOTED 6d0aec6d (86,945 B) gate PROMOTED 9368cab8 (90,106 B)
2026-09-06	DI9	measure	ACCEPT RULE status: the 64 MiB one-byte-insertion wire measurement is PENDING, and the reason is a number: MEASURED 2026-09-06 a live fixed upload costs ~27 s per 48,402-byte chunk on this box (each post rides the job lane and its 3 s follow poll; 76 chunks in 34 min), so a 64 MiB fixed baseline is ~1,400 chunks = ~10 h before the dedupe pass can be measured against it. A 5.9 MB live trial (122 chunks, then a one-byte change at offset 0 through `cdc`) is running now and its CC-DEDUPE line will be journaled with reused/sent/wire_bytes. Recipe for the 64 MiB rule: fixture knowledge/rigcorpus/toon3d8_rigged.nxa (61.9 MB), fixed upload to /tmp/di9_64.bin, then the same file with byte 0 changed via `cdc` to the same dest; the accept rule reads fewer than three chunks SENT and wire_bytes measured
2026-09-06	DI11	land	Byte-offset append per the IETF resumable-upload draft: `append <id> <offset> <b64> [sha256=]` is accepted only at the current upload offset (the contiguous staged prefix; status now prints it as upload_offset beside resume_offset) and lands in the slot that offset addresses (fixed: offset/chunk_raw with the last chunk shorter; plan-addressed: the next index); a stale or future offset is refused NAMING the current offset (CP-REFUSED-OFFSET current= requested=), never silently re-based; the declared digest is checked on arrival as for chunk. Gate 49/49 (append advances upload_offset by its length; stale refused naming current; future refused; status agrees). Receiver PROMOTED 0c57ee0e (92,195 B) gate PROMOTED 6fda41c7 (93,233 B). HONEST LIMIT: an append must carry exactly one chunk on a fixed transfer, and the Repr-Digest field is the begin's whole-file sha256 rather than an RFC 9530 header (the wire is JSON-RPC, not HTTP semantics)
2026-09-06	DI12	land	The DI2 worklist is now a RATCHET WITH MEMORY: nx_io_envelope_census grew `ie_ratchet` (keyed baseline rows path
2026-09-06	DI12	measure	FIRST LIVE PASS 2026-09-06 (knowledge/status/io_envelope.status): hits=2338 fixed=349 silent=332 dynamic=654 looped=1273, partition RECONCILES, coverage_complete=1; baseline MIGRATED from 596 legacy rows: new_silent=0 left_silent=264 (263 now=looped -- the first census had named 263 streaming loops, nx_sizeguard's own read loop among them, as capped readers; 1 now=converted -- nx_gatefresh gf_has_main moved from a 262,144-byte scan to sys_read_file, the first true conversion); false_positive_permil=996 adjudicated=264 true_positive=1 false_positive=263. HONEST READING: the rate is over ADJUDICATED sites only; the 332 that remain are the unadjudicated worklist and the rate says nothing about them yet. ACCEPT RULE status: monotone fall with names in the ledger = WITNESSED (596 -> 332, every departure journaled); planted-new-silent-turns-RED = gate-proven on fixtures (T14), live rise not yet witnessed; the rate = PUBLISHED as a number. Verdict GREEN
2026-09-06	DI13	land	nx_capcliff grew the REMEDY CENSUS: knowledge/capcliff_remedy.conf declares, per OVER ledger, its readers (file:line of the READ SITE -- the organ reads that line and classifies WHOLE/TAIL/HEAD/UNVERIFIED itself, never copying the claim), writers (verified to append), a guard (sizeguard:<bytes>:<lines>, FORKED on the ledger; its exit is the verdict) and mentions. States NO-READER / GOVERNED / BREACHED / UNGOVERNED; the exit carries RED only for UNGOVERNED or BREACHED, and the remedy partition is printed and must sum. Selftest migrated onto the base class (22 teeth: size ruler with opposites, anchoring classifier on planted read sites incl. the numeric SEEK_END spelling, the forked guard GREEN and RED, NO-READER, scan verdict both ways, empty roster refused); new nx_capcliff_gate forks it (identity teeth T9/T10, planted-RED witnessed as over_ungoverned=1). nx_capcliff PROMOTED 563a6b11 (68,784 B, /api/build lane; 27 lost runs = the reworded OVER text and the old hand-rolled selftest format, all superseded), gate promoted and registered, twins installed
2026-09-06	DI13	measure	LIVE 2026-09-06 (/tmp/di13_scan3.txt): rows=18 over=4 near=0 missing=0 over_governed=2 over_noreader=2 over_ungoverned=0 over_breached=0 remedy_partition=RECONCILES verdict=GREEN. actlog.jrnl: 11 readers all TAIL (catalog x2, toolatency, execsurface, wirecensus, capsweep, gateadjudicate, trajscan, actlog miner, replyreserve, statuscensus -- the two the DI8 accept rule named unverified are now measured TAIL), 3 writers verified; dup_source.log: 3 readers all WHOLE; tool_diff.log and orchestrate.log: NO READER in the tree (writer only). The first scan read actlog UNGOVERNED on one UNVERIFIED row -- a declared line number one off -- and the organ named it; the row was corrected from the source, not the classifier loosened. ACCEPT RULE: every OVER row names its guard and its consumers' anchoring in the census = MET (over=0 was the other branch and is not claimed)
2026-09-06	DI9	measure	DEDUPE ON THE WIRE, MEASURED LIVE 2026-09-06 on a 5,894,477-byte mesh (122 chunks, every boundary at max because the mesh's repetitive bytes never trip the gear mask -- so this measures the client and the door, not the chunker). PASS 2 (one byte changed at offset 0, first client): CC-DEDUPE plan_chunks=122 incumbent_chunks=122 reused=0 sent=122 wire_bytes=7,919,315 -- the have page had parsed ZERO rows (a sync reply escapes its newlines) and every chunk went as bytes. PASS 3 (parser fixed): parsed=122, the 122-row reuse batch was ACCEPTED by the door and outlived the single-post follow budget; the client read HP-PENDING as failure and re-sent every chunk while the door was still staging the same rows. PASS 4 (batch budget derived from rows): parsed=122, the door staged all 122 reuse rows from the incumbent (witnessed in knowledge/contentput, ~5-10 s per staged write on the storming array, four content-put pushes running beside it) while the laptop killed the client for memory mid-follow; the transfer was finished FROM THE DOOR SIDE: `commit` -> CP-ASSEMBLE received=122/122 stream_verified=122, CP-COMMIT OK sha256=6b54f0c2 verified by re-read, with ZERO chunk bytes posted (the wire carried begin, plan, one have page and one reuse batch of 122 rows, roughly 30 KB, against 7,919,315 B for the full send). RESULT: the mechanism dedupes end to end; the client's own CC-DEDUPE line for a completed run is UNWITNESSED because the host killed it, and the 64 MiB accept-rule measurement stays PENDING with its recipe above. Client defects fixed on the way: the two-shape line scan and the row-scaled batch budget (both in nx_content_put_client.nx, pushed; binary 45a8c35c staged as a strict superset)
2026-09-06	DI13	queue	OWED, with the recipe: (1) the evidence referee (nx_swcompare_evidence dataio) DEFERRED twice on 2026-09-06 under the heavy-I/O bound (HEAVYIO storm_budget=4 then 0, verdict=DEFER -- an abstention, never a verdict), so the two new .gates rows (nx_io_envelope_census_gate, nx_capcliff_gate) are unrefereed until a pass with storm_budget>0; re-run via nx_job_run nx_swcompare_evidence /tmp/<out> dataio and read the row verdicts. (2) DI9's client-side CC-DEDUPE tally for a COMPLETED run is unwitnessed: the laptop host kills any client run longer than a few minutes for memory (three kills today); run the promoted client (45a8c35c) FROM THE NAS via nx_job_run against a local incumbent once a runner cap exists, or from a host that does not reap long processes -- the door side is proven (CP-COMMIT of 122 reuse rows with zero chunk posts). (3) The 64 MiB one-byte-insertion accept rule (recipe in the DI9 measure row above) needs a calm array: at the measured 5-10 s per staged write, 1,400 rows is 2-4 hours; a door-side reuse that stages by reflink instead of copying is the rung that makes it cheap. (4) The census ratchet's live RISE path (planted new silent reader -> RED) is gate-proven on fixtures only; the first real rise will be witnessed by the daily ioenvbeat
2026-09-06	DI15	land	nx_io_envelope_census PROMOTED 97259b57 (114,384 B debug flavour, _offc twin) and nx_io_envelope_census_gate PROMOTED feb753111 (9/9 on the NAS against the promoted binary, T4d pins the DI15 generation). ie_loop_exit judges every LOOPED read by its loop's exit: STREAMING (result tested against zero, acquitted) / CAPPED (a count bound on a literal above 1, an ALL-CAPS name or a cap-named variable, bound NAMED per row, split by the same file-level announce test fixed sites use) / UNJUDGED (a foreign exit, counted never acquitted). LOOPED itself now means the read DRIVES the loop (result tested in the span, a running fill in the call's arguments, or a prime read driving a later while); a read that merely sits inside an accept loop is a FIXED site. Selftest 46/46 with teeth T20-T29.
2026-09-06	DI15	measure	Live over buildroot/runtime, coverage_complete=1: hits 2,349; looped 1,210 = 423 STREAMING + 699 CAPPED-silent + 62 CAPPED-announcing + 26 UNJUDGED (looped_partition=RECONCILES); fixed 404; silent worklist 1,082 = 332 fixed silent + 699 capped loops + 51 accept-loop reads reclassified as fixed. First cut (every read inside a loop LOOPED) read 1,273 = 423 + 797 + 53 and a 5-site sample refuted it: 2 of 5 capped loops were one request read per accepted connection with an unrelated bound elsewhere in the loop body. Accept rule met: nx_sizeguard and nx_restage shapes read STREAMING (T20, T21), a planted count-bound loop reads CAPPED with its bound named (T22, T22b), the partition prints and sums. Baseline REWRITTEN by --accept to the 1,082 reviewed rows (ledger kind=new x750); the next scan must read new_silent=0.
2026-09-06	DI15	lesson	The census read its own selftest fixture as the walker's envelope: two complete walks reported UNPROVEN because the parser searched the whole capture for coverage_complete= and the first hit was a grep line of a fixture string spelling coverage_complete=0. Fixed by ie_walker_env, which parses ONLY the last line that starts with -- matches= (teeth T29, T29b, T29c, T29d: a data line that spells the fields, and a capture with no envelope reads -1 UNPROVEN). Anchor every parse on the report line; a fixture that spells a field name is data the moment a walker prints it.
2026-09-06	DI14	retract	The clone_rc=-1 read as EPERM on three hosts (ext4, DrvFs, btrfs) was the GATE PARSER's not-found sentinel: g_num_after in nx_content_put_gate accepted digits only, so clone_rc=-95 read as no digits and returned -1. A throwaway local probe (bogus request -25 ENOTTY, ext4 and DrvFs FICLONERANGE -95 EOPNOTSUPP) proved the syscall shim returns raw -errno. The parser now reads a sign; the door announces the FIRST refused clone with every input the kernel saw (rc, inc_fd, dst_fd, off, len) in the reuse receipt and on stderr, and the gate lifts them into gv_kv rows. Local truth after the fix: clone_rc=-95 inc_fd=4 dst_fd=5 off=0 len=48402.
2026-09-06	DI14	measure	First NAS end-to-end run on the promoted door (ae1f9146): di14_slot_batch_rows=95 cloned=0 copied=95 ms=803,991, i.e. 8.5 s per 48 KB reuse row on the storming array, 53/53 GREEN; the accept rule (a batch under one chunk post's time) was NOT met. Cause read from the source: cp_write_atomic fsynced every staged chunk. FICLONERANGE also requires block-aligned offsets and CDC boundaries are content-defined, so on btrfs the expected kernel answer for an interior chunk is -22 EINVAL; a windowed clone (clone the aligned window, record skip and len) is the rung after this one if the copy is still the cost once the fsync is gone.
2026-09-06	DI14	land	nx_content_put PROMOTED b45eea2c (97,359 B, strict superset) and nx_content_put_gate PROMOTED c3f0b819 (98,383 B), twins installed: reuse rows stage with cp_write_atomic_x sync=0 and the batch fsyncs the staging DIRECTORY once (cp_dir_sync); the receipt carries ms_rows, ms_dirsync, dirsync_rc, clone_rc and clone_first_refusal. Durability argument: the batch's durability point is the receipt plus commit's per-chunk re-hash, so a torn or empty post-crash chunk is refused by index and re-sent, never assembled. Local gate 53/53 with the batch at 4,134 ms for 609 rows; the NAS re-measure is the number that decides the rung.
2026-09-06	DI18	lesson	OPERATOR 2026-09-06 (verbatim): things like this need to be caught before they get cut off or truncated both on send and receive across the entire estate we dont want to have our laws be magic numbers and if real hard limits it should intelligently chunk and reassemble. MEASURED THE SAME HOUR: /compare/ecosystem is 307,528 B; nx_https_get, nx_fs job and nx_fs read each cut it at capture_cap=163840 and the seat read the missing tail as an absent section until it paged the job artifact by line window (nx_fs lines). The cut is ANNOUNCED (NX-TRUNCATED OUTPUT-IS-PARTIAL), which is the only reason it was caught, but announcement is the floor: the reader must be able to CONTINUE, and the number must be a declared conf value with its reason beside it, never a literal in three organs
2026-09-06	DI18	queue	BUILD ORDER: (1) name the window in a knowledge conf row beside its reason (the daemon's reply reserve); (2) every windowed reply carries total_bytes and next_off (nx_fs lines already prints scanned= and next= -- extend read, job and the https body the same way); (3) a reader verb that follows the cursor to the end into a local artifact the seat can read whole (nx_fs job <id> full); (4) the gate with the three-windows-plus-one fixture and the stop-early neg-control; (5) the envelope census DI2 gains the class SILENT-CUT-ON-WIRE so every capped reply path in the estate is named, not just the three met today
2026-09-06	DI14	measure	NAS re-measure on the promoted door b45eea2c, same btrfs volume: di14_slot_batch_rows=95 cloned=0 copied=95 clone_rc=-22 (EINVAL: FICLONERANGE requires block alignment; first refusal inc_fd=5 dst_fd=6 off=0 len=41240) ms=7,993 against 803,991 before the per-row fsync was removed, a 100x fall; 53/53 GREEN. The accept rule's time leg is met (one fsynced chunk write cost about 8.5 s in the same hour); the link leg is refused by the kernel by construction for content-defined ranges and is NAMED in the receipt; the rung row was rewritten to say so and the aligned-window clone became DI17.
2026-09-06	DI14	lesson	Two instruments lied in the same direction before the door was touched: the gate parser returned its own -1 for any negative number, and the reuse receipt printed only the last rc, so three hosts read EPERM where the kernel had said -95 and -22. A probe that varies the filesystem while the door stays fixed measures the door; a parser that cannot represent the value it parses returns a sentinel wearing the value's clothes. Fix the instrument, then measure, then touch the subject.
2026-09-06	DI16	land	nx_io_envelope_census PROMOTED 81f05e45 (121,872 B) adds the worklist verb: the baseline IS the worklist, printed grouped by file with the biggest file first and a partition line (rows equal listed), selftest 49/49 with the T30 teeth. The DI16 campaign starts from silent=1,082 (332 fixed + 699 capped loops + 51 accept-loop reads), GREEN with new_silent=0 after --accept, ratchet armed.
2026-09-06	DI16	measure	The worklist verb on the accepted baseline (promoted census a91eb706, NAS run 2026-09-06): rows=1082 files=803 listed=1082 shapes=608 shared_shapes=125 rows_in_shared_shapes=599 singleton_rows=483 partition=RECONCILES. The campaign is sized by causes, not sites: 125 shared reader shapes cover 599 rows and the top of the table is ONE helper family copied by hand (x28 sys_read(fd, buf+n, cap-1-n), x22 sys_read(fd, buf+total, CAP-total), x20 sys_read(fd, base+n, cap-n), x19 sys_read(fd, buf+n, cap-n), x15 var nrd = sys_read(fd, buf, cap), x13 the while nrd loop), i.e. a read-into-a-caller's-cap loop that never says when the cap filled. FIRST CAUSE TO EAT: one shared announcing helper (a read-into-cap that returns the truncation as a named state, sys_read_file where the whole file is wanted) adopted through nx_oo_extract across the copies, which turns dozens of silent sites into announcing ones in one proof cycle. A second class is legitimate by contract and is adjudicated with kind=false rows carrying the record size: fixed-record reads (8, 16, 24 and 32-byte headers, 31 and 63-byte ids) whose length IS the record. The biggest single file is nx_torrent_get.nx with 14 rows.
2026-09-06	DI16	land	First cause shipped: nx_readcap_lib (runtime/nx_readcap_lib.nx, the ONE read-into-a-caller's-cap loop) with states EOF, CAPPED-unprobed (socket-safe), TRUNCATED-more-remains and EXACT (files, decided by a one-byte probe), ERR with the rc, and rc_complete as the one question a consumer asks; nx_readcap_gate PROMOTED 17abb91a (35,672 B, 26/26, neg-controls named, values emitted) and listed on dataio.gates. Adoption is the campaign: the worklist's shared shapes (125 shapes, 599 rows) are converted onto rc_fill or rc_read_file_into (or sys_read_file where the whole file is wanted) file by file via nx_oo_extract, each conversion removing the consumer's own sys_read site so the census counts it CONVERTED and the ratchet tightens. No incumbent existed: nx_capsearch returned the TLS truncation gate, the cap-detect core and the token cutter, none a read-into-cap helper; fsx_read_at in nx_fsops_lib is the announcing WINDOW reader for the nx_fs tool and stays the window primitive.
2026-09-06	DI16	measure	nx_gate_bite nx_readcap_gate runtime/nx_readcap_lib.nx 2 on the NAS: baseline green, one comparison mutant VOID (build lane exit 6, admission refused it, excluded not a survivor), one compiled and was KILLED (the gate went RED), restore verified byte-identical (4,187 B), both twins restored, mutant_live=0, verdict GREEN (the gate BITES). The void mutant is a floor on coverage, not a pass; re-bite when the admission storm clears.
2026-09-06	DI9	land	The door's per-post fsync was the latency of every push, not only of reuse rows: nx_content_put PROMOTED 394ab379 (97,309 B, strict superset) stages chunk posts and appends with sync=0 and prints durable=at-commit on the CP-CHUNK and CP-APPEND receipts; the durability point is commit, which re-hashes every staged chunk against its declared digest and fsyncs the assembled destination, so a torn or empty post-crash chunk is refused by index and re-sent after status (the resumable-upload contract). The META, PLAN and index markers keep their fsync (their loss would orphan a transfer). nx_content_put_gate PROMOTED 545da9a2 (98,727 B, 54/54 locally, a tooth reads the receipt's durability declaration); twins installed. First live push through it: a 5.9 MB fixture from the laptop, per-post receive times 3-150 ms on the wire with occasional multi-second edge stalls and one JF-REISSUE (an edge-lost reply re-posted under its key, replayed not re-executed) -- the wire and the edge window are the cost now, not the array.
2026-09-06	DI9	measure	Client-side witness, pass A (fresh upload of the 5,894,477-byte fixture from the laptop through the promoted no-fsync door to /tmp/nx_content_put_gate/di9_tally.bin): E2E OK chunks_sent=122 of 122 in 1,052 s; the log carries 38 JF-REISSUE lines, i.e. the edge lost the reply of 31 percent of keyed posts under the storm and each was replayed from its recorded outcome, never re-executed. Per-post receive on the wire was 3-150 ms; the 8.6 s per chunk is the job-lane poll granularity plus the edge window, not the array and not the door. The 64 MiB one-byte-insertion measurement (about 1,400 posts) would cost about 3 hours at this rate and stays queued for a calmer edge; pass B (one byte changed, cdc) runs next for the CC-DEDUPE tally.
2026-09-06	DI9	measure	CLIENT-SIDE CC-DEDUPE TALLY WITNESSED FOR A COMPLETED RUN (the owed witness): pass B from the laptop, the same fixture with one byte changed at offset 0, mode=cdc against the pass-A incumbent: CC-HAVE incumbent_bytes=5894477 chunks=122 parsed=122 pages=1; CC-DEDUPE plan_chunks=122 incumbent_chunks=122 reused=121 sent=1 reuse_batches=1 wire_bytes=79025 total=5894477 (reused + sent = plan_chunks); E2E OK bytes=5894477 chunks_sent=1 of 122; elapsed 69 s with one JF-REISSUE. Against pass A's 1,052 s and 7.9 MB for the full send, the dedupe pass moved 1.3 percent of the bytes in 6.6 percent of the time, and the door-side commit verified the destination's sha256 by re-read. The DI9 accept rule at 5.9 MB is met on the client's own tally; the 64 MiB rule stays queued behind the edge window.
2026-09-06	DI9	measure	THE POLL LADDER: the shared follow and re-issue loops in nx_https_post_lib (the ONE place every organ polls a job) waited a flat sleep_ms=3000 before every poll, so a chunk whose artifact was ready in 100 ms still paid 3 s. hp_ladder_first (sleep over 16, floor 50 ms) and hp_ladder_next (double, cap at sleep_ms) keep the wall budget polls x sleep_ms unchanged and reach the flat interval by the fifth wait; nx_https_post_lib_gate PROMOTED 4b35997a (16/16, eight ladder teeth, first promote) and REGISTERED. MEASURED on the same 5,894,477-byte fixture from the same laptop within the hour: pass A flat = 1,052 s with 38 JF-REISSUE; pass A2 laddered = 88 s with 0 JF-REISSUE and E2E OK 122 of 122 -- 12x, and the re-issue storm was the flat wait exceeding the edge window, not the edge losing replies. A 15-chunk client push fell to 32 s (2.1 s per chunk from 8.6). The 64 MiB one-byte-insertion rule is now affordable and runs next.
2026-09-06	DI14	measure	NAS end-to-end gate on the promoted no-fsync door 394ab379 (gate 545da9a2): 54/54 GREEN; di14_slot_batch_rows=95 cloned=0 copied=95 clone_rc=-22 ms=1,516 -- the same 95-row reuse batch that cost 803,991 ms this morning and 7,993 ms after the reuse fsync went now costs 1.5 s (16 ms per row) once no chunk post on the box fsyncs either; the receipt declares durable=at-commit and the interleaved, EC24 and EC26 refusals all still fire.
2026-09-06	DI13	lesson	THE REFEREE'S ALL-DAY DEFER WAS A WEDGED MUTEX, NOT LOAD: nx_swcompare_evidence printed HEAVYIO running=1 width=4 storm_budget=4 slot=-1 verdict=DEFER, i.e. headroom on every axis and no slot. Read from the lease store: all four knowledge/lease/heavyio-slot-N.lock stamps were RELEASED (gens 236, 96, 163, 157) while the next generation gate dirs g237, g97, g164, g158 already existed -- takeovers killed between their mkdir and their stamp rename (the storm's kills), so every later takeover re-derived the same gate, hit EEXIST and reported BUSY forever. nx_lease_wedge_gate had DETECTED this shape on 2026-09-04 and declared the remedy owed; two days later the same four slots were wedged again. REMEDY LANDED in nx_lease_lib (the ONE primitive): the temp stamp is written first under a pid-unique name so a refused write cannot strand a gate, and on EEXIST an orphan gate at least max(ttl, 30 s) old with the stamp still one generation behind is removed and retaken, while a fresh gate stays a lost takeover; nothing unlinks a stamp. nx_lease selftest 11/11 (both 4-racer rounds), nx_lease_wedge_gate 25/25 with the remedy planted both ways, nx_lease PROMOTED 6fc85ac1 and nx_lease_wedge_gate PROMOTED cd777444. HEALED LIVE: four acquires through the promoted primitive each printed LS-ORPHAN-GATE reclaimed for its gate and LS-ACQUIRED, and the referee then took a slot for the first time today. Adopters compiled against the old lib (the regen, the evidence referee, plan_run, crawl_step, artifactdrift, seg_compact, eco_graph_build, shard_compact) keep working on healed stamps and inherit the self-heal on their next rebuild.
2026-09-06	DI13	measure	THE REFEREE RAN (the owed verdict): nx_swcompare_evidence dataio, HEAVYIO running=3 width=4 storm_budget=6 slot=0 ADMIT, verdict=MEASURED-HONEST -- gates_green=12/12 (every row on dataio.gates including the three added today: nx_io_envelope_census_gate 9/9, nx_capcliff_gate 8/8, nx_readcap_gate 26/26, and the door 54/54), present_axes=22 grounded=22 ungrounded=0, absent=2 both named (ie_worklist_zero, cp_stage_window), landed=13, partition and composition reconcile (24 = 9 claimed + 2 gaps + 13 landed), liar-kill all four. The first pass of the day that did not abstain, one minute after the four slots were healed.
2026-09-06	DI13	land	The two heavy-I/O adopters this lane depends on were rebuilt against the remedied lease lib from NAS-equal sources (nx_swcompare_evidence, nx_ioadmit_lib, nx_heavyio_lib, nx_poolgov and nx_lease_lib all hash-identical laptop vs NAS): nx_swcompare_evidence PROMOTED b7e3e0f6 (166,992 B) and nx_compare_regen PROMOTED 50e7dc44 (180,856 B), each with symbol-name-only losses under the laptop lane and each gaining the ioadmit storm witness strings the older binaries predated; twins installed. Both now self-heal an orphaned slot gate instead of deferring on it. The remaining adopters (plan_run, crawl_step, artifactdrift, seg_compact_cli, eco_graph_build, web_shard_compact) still carry the old lib and are the next rebuild list; until then a kill mid-claim in one of them re-wedges a slot that the next new-lib acquirer reclaims after 30 s.
2026-09-06	DI7	lesson	THE OFF-LAN CONTENT-PUT CONTRACT, MEASURED AND CLOSED 2026-09-06: from an off-LAN laptop the LAN vantage (192.168.8.240:8443) is unreachable (the client saw 44 JF-REISSUE then CC-BEGIN post failed), and on the public vantage the FIRST failure was the edge answering the JSON-RPC begin with Content-Encoding gzip because nx_http_client's builder derives Accept-Encoding from every codec the estate compiles (hc_put_caps advertises gzip) while the POST completer returns the reply verbatim with no gzip stage -- a client that cannot decode must not advertise. Fix in BOTH trees: nx_https_post_lib hp_post_json_nofollow sends Accept-Encoding: identity as xhdr, and nx_http_client suppresses hc_put_caps when the caller's xhdr already carries Accept-Encoding (hc_xhdr_has_field is now the ONE case-insensitive field scanner behind hc_xhdr_has_ua and the new hc_xhdr_has_ae). Second failure: the URL must be the /mcp door (a bare host posts to the home page). Third: the edge promotes begin to the job lane, so the client needs readcap=<nx_fs read cap file> to follow JOB-STARTED. Working recipe: nx_content_put_client <local> <dest.new> contentput.cap https://nishifamily.com/mcp readcap=fsread.cap -> E2E OK 720,208 B in 15 chunks. Owed: the POST completer should decode what it advertises (then the identity ask can go).
2026-09-06	DI17	land	COMMIT-CLONE SHIPPED AND WITNESSED ON BTRFS: nx_content_put PROMOTED 14d754d0 (104,345 B, strict superset) keeps a reuse ledger <id>.rl (k off len) and at commit reflinks the block-aligned interior of every offset-preserving run of reused chunks straight from the incumbent (FICLONERANGE src_off == dst_off, len a multiple of st_blksize read from the incumbent's stat, never assumed), copying only the run's two edges; the whole-file re-read still judges the assembly. Receipt: CP-ASSEMBLE from_incumbent= clone_runs= cloned_bytes= incumbent_copied_bytes= chunk_copied_bytes= clone_rc= blk= plus the first refusal's inputs. nx_content_put_gate PROMOTED 6cb29a52 (the DI14 slot fixture now COMMITS over the identical incumbent; 4 teeth + 9 values): laptop 58/58 on DrvFs (blk=512, clone_rc=-95, 609 chunks copied from the incumbent, partition sums); NAS 58/58 on btrfs: clone_runs=1 cloned_bytes=2,588,672 = floor(2,589,160/4096)*4096, incumbent_copied=488, chunk_copied=0, clone_rc=0, blk=4096, 95 of 95 chunks sourced from the incumbent, commit 22.5 s under the storm. The reflink win is real where offsets are preserved; twins installed.
2026-09-06	DI16	measure	THE JUDGE COULD NOT READ TIGHT SPELLING: nx_io_envelope_census PROMOTED 61edfd74 (118,350 B, selftest 56/56 with T31..T31e) walks to the enclosing while from the READ SITE (a same-line `while go==1 { k=sys_read(..); if k<=0 {go=0} }` was invisible from the line start) and matches the eof and bound idioms on a CANONICAL copy of the span (` op ` around every comparison, blanks collapsed, -> << >> verbatim), and a partial walk no longer creates or tightens the baseline. NAS re-scan on the same 2,368-site walk (coverage_complete=1 corpus_complete=1): new_silent=449, left_silent=49, silent_now=1,482, verdict RED (the ratchet refuses the rise by name). The 449 are capped loops spelled without spaces that the old matchers read as UNJUDGED, three sampled and all true: nx_cap_census.nx:73 `while r>0 { r=sys_read(fd,dst,fcap-tot); if tot>=fcap { r=0 } }`, nx_swcompare_crm.nx:36 `while tot < cap { r = sys_read(fd, buf+tot, cap - tot); if r <= 0 { break } }`, nx_orchestrate.nx:29 `if n>=cap-1 { r=0 }`. The 49 are one-line streaming copies the old ruler had listed as capped one-shots (nx_ccheck:31, nx_media_server:207/273, nx_gallery_gateway:161, nx_fs:19/33 among them), acquitted by their exit and journaled kind=left now=looped, so the ledger's own false-positive rate reads 996 permil over 313 adjudicated (312 were the old ruler's loops, 1 a conversion). The rise is accepted into the baseline by --accept (kind=new rows), and the worklist grows from 1,082 to 1,482 rows because the ruler now sees what it was blind to, not because readers got worse.
2026-09-06	DI16	measure	Re-scan on the accepted baseline (promoted census 61edfd74, NAS, walker matches=2368 coverage_complete=1 corpus_complete=1): hits=2368 not_a_site=88 dynamic=125 looped=1799 (streaming 560, capped 1148, capped-announcing 91, UNJUDGED 0 where the old judge left 26) fixed=356 (literal silent 194, named silent 140, announcing 22) silent=1482 partition RECONCILES, baseline PRESENT rows=1482 new_silent=0 left_silent=0, verdict GREEN. The DI16 campaign now starts from 1,482 rows: 1,148 capped loops that never announce plus 334 fixed silent reads, the whole population judged (no UNJUDGED bucket left to hide in).
2026-09-06	DI16	measure	Worklist on the accepted 1,482-row baseline: rows=1482 files=1138 listed=1482 shapes=732 shared_shapes=164 rows_in_shared_shapes=914 singleton_rows=568 partition=RECONCILES. The top shapes are hand-copied read-into-cap helpers, each a cause not a site: x51 `while go == 1 { r = sys_read(fd, buf+n, cap-1-n); ... if n >= cap-1 { go = 0 } }`, x40+x40 the prime-read plus `while r > 0 { ... if n >= cap-1 { r = 0 } ... }` pair, x36 `while tot < cap { r = sys_read(fd, buf+tot, cap-tot); if r <= 0 { break } tot = tot + r }`, x33 the `let base = buf as i64` variant, x32+x22+x15+x11 the `nrd` family. 164 shared shapes cover 914 rows; the incumbent conductor for mapping a duplicate group onto a shared lib is nx_map_delegate (nx_capsearch rank 1, `<listfile> <blockfile> <anchor> <impline>`), so the campaign is a delegation of each top shape onto nx_readcap_lib (rc_fill_file for the read-into-cap body, announcing TRUNCATED-more-remains), one shape per proof cycle, never a hand edit per file.
2026-09-06	DI19	lesson	A SILENT CAP AT THE FUNCTION AND AN HONEST ANNOUNCEMENT AT ITS ONE CONSUMER LOOK IDENTICAL FROM THE LIBRARY SIDE, AND THE DIFFERENCE IS THE WHOLE VERDICT. Found while checking-before-building an arXiv census: em_collect_yms exits on nd>=maxd and returns a bare count, which reads exactly like a silent cap. A first pass was one step from filing that as a defect against nx_search_emerge. The CONTROL that refuted it was reading the CONSUMER rather than the library function: nx_search_emerge main prints 'sampled hits=' beside 'total volume=', so it already announces and already carries the two-counters-are-a-free-audit shape. The lesson is symmetric and both halves matter. First, NEVER indict a library function on its own body when a consumer decides whether the cap is announced. Second, DO NOT then acquit the function, because the next composer inherits the silence and 'no live victim yet' is not 'not a defect'; that is why this is DI19 and not a closed note. This is the DI2 and DI12 rule reaching one step further out, from readers to collectors.
2026-09-10	DI4	measure	2026-09-09 native MCP completion evidence repair: nx_job_put_error_gate promoted with SHA2561105b1de1e4196b0298e14d5fb49475fa302d9456ebff72962523d3525583032 then passed15/15 real filesystem tests in job1789008990. Old5/5 binary detected and excluded before measurement. nx_tools_api_serve built in job1789008999; contentdiff job1789009138 retained1009/1009 live printable runs. toolsapi domain mapping added to dataio; scoped predeploy check1789009273 had0 blockers and7 warnings without override. Deployment1789009286 changed live file; filehash1789009387 verified SHA256a049d5c51c167ed7e56b0dff5440d68fd7c29132a07589f9990157f1c1b4e19e bytes360368. Services1789009350 shows toolsapi UP and native calls respond. Original deploy job claim remains unresolved; generic deploy_status is not target-bound proof. Crash durability, abandoned-claim recovery and full client reconnect remain gaps.
2026-09-10	DI2	measure	2026-09-09 shared native measurement release: nx_sota_status json emits 120 local domains and 3568 declared axes with explicit source and cached-evidence age. Independent four-directory census reconciled all 120; seven corrupted records rejected. Published compare/maturity/measurement.json 50989 bytes SHA25683ca0bceef04a90abc19223cd652fdcf11d257b4fa11f75a8bdcd5287235d7dc via guarded publisher job1789010176. nx_compare_serve promoted job1789010246 SHA256b3874a8606e6c56774f92078abe1c0367af291b5b6a1f536bd1701dbad4f76d0; live nishi_compare measurement equals public snapshot bytes. Index and OpenAPI legacy bytes preserved; traversal refused. Snapshot refresh is not automated. Nine Compare-index domains lack measurement coverage; function/API/MCP/rung bindings, investment estimates and dated matched frontier benchmarks remain unbound. Browser unavailable: visual and interaction delivery review unfinished.
2026-09-10	DI2	measure	2026-09-09 native measurement contract discovery: nx_swcompare_hub now emits /compare/maturity/measurement.json and SotaBoardMeasurement schema without changing OpenAPI3.1.0 or existing API contracts. Native9656byte document validates with independent JSONSchema2020-12 validator against real120domain snapshot; false estate-wide claim rejected. Existing index output98666bytes is byte-identical in live/candidate comparison. Promoted155720B SHA256d0a4a2a41018a5eac910c2f8559b7dd29b1fce9cb1e29bc8dc62291029999f45; _offc hash matched job1789010999. Contentdiff lost legacy shared headings/CSS strings; full emitted HTML diff contains shared stylesheet changes only, browser review unavailable. Guarded OpenAPI publication1789010838 and nishi_compare openapi return exact9656bytes SHA25635d91c33872f1b99c2ffec47277844a1b9098a5671461f872562aec4248b75ef. HTTPS validation found a separate gateway defect: /compare/openapi.json returns200 text/html index14150bytes, not this contract. Do not claim HTTP contract delivery until policy-preserving route correction is exercised. Scoped measurement API remains separate from complete estate maturity.
2026-09-10	DI2	measure	2026-09-09 release: Compare OpenAPI discovery is served as JSON with access-policy projection. Gateway deployment1789011982 is DEPLOYED-GREEN; live269232B SHA256462ac942b2287be3ef46d799813879d592b09b214d2f59bd2a04f40def75d906 matched the staged build. HTTPS /compare/openapi.json returns200 application/json9655bytes, identical to validated native projection; all schemas and routes preserved. Public index200 JSON16424bytes excludes hidden board; hidden-board request404. Tests:29 projection/token fixtures,36 existing access checks,30 tokenizer selftest checks,10 existing JSON-completeness checks. Character stamp refreshed by evidence text mode:77 checks in4 gates,26 grounded claims and36 gaps; JSON mode alone intentionally does not stamp. Measurement snapshot1789011729 published50987B SHA256cbbeeaeacb395049d0b0b0880a805478e30898dda3baee1f595266f9a641360e and HTTPS bytes match; charsim MECH-OK is not SOTA. Research retrieved2026-09-09 informs benchmarks: MCP2026-07-28 and optional Tasks, OpenAPI3.2 reference without contract upgrade, OTel HTTP metrics, SLSA1.2 provenance,2026 ReSTIR graphics papers. Investment schema prototype locally validates measured/forecast separation and rejects9 invalid records; native integration, full inventory joins, comparable frontier runs, renderer integration and visual/interaction review remain unfinished. No browser instance is available; UI delivery remains partially verified.
2026-09-10	DI2	measure	2026-09-09 reused counted-cost comparator nx_cost_oracle: exact admitted metric IDs only, equal costs tie even with zero margin, negative costs/margins refused and ordered nonnegative subtraction avoids signed overflow. Empty samples no longer count as reproducibility evidence. Legacy five function signatures and result IDs retained; counted instructions/toggles/bytes explicitly do not prove lower latency, universal reproducibility or hardware portability. Canonical36/36 test replaces seven narrow tests and is promoted35904B SHA25690b675f4320b18e91db392956524a205fd72f4e1fa8e93accd3b26e021db7f27. Investment reuse audit also found native nx_tokroi report and existing comparerank/plan stores, preventing a duplicate ledger. Actual ROI report has five rows but truncated evidence, floor payback and declared historical assumptions; financial/token savings are not reverified by this read. ROI boundary hardening and native investment projection remain underway; no all-estate or SOTA-complete claim.
2026-09-10	DI2	measure	2026-09-09 investment release: reused nx_tokroi and its retained five-row ledger, preserved all legacy numeric fields/totals, added signed_delta and ceiling break_even_uses, excluded unknown status from aggregates, retained full evidence and declared evidence_verified=false, units_verified=false, history_complete=null. Native25/25 boundary checks plus5/5 existing selftests passed; missing plane emits structured error/nonzero. Promoted166344B SHA256d1f8393a8158fd4affd151e04e596cbca2f5b068c6921cdf29a1bce865ff6bc1 after full18-token audit:15 re-encoded JSON fragments and3 corrected measurement claims, explicit reviewed capability-loss exception; no commands/fields removed. Extended existing contentdiff display from default8 to optional bounded limit,18/18 checks, no verdict weakening. Compare investment alias and OpenAPI schema share published3085B report SHA25673f3b946344c1650e69e431fc8569823f690d9bbd6370ec25f0da8534f789208; HTTPS200 application/json and direct sovereign MCP nishi_compare investment bytes match. OpenAPI retains old paths/schemas and returns14026B authorized projection. Attached nishi transport closed; sovereign ELF API fallback exercised. Boundary escaping mismatch was detected/corrected in unpublished temp data. Domain/rung/function bindings, actual saved-cost verification, first-byte-to-delivery spans and SOTA comparisons remain unfinished; browser list empty, visual/interaction acceptance unresolved.
2026-09-10	DI2	measure	2026-09-10 release: first-byte-to-SOTA measurement investment continues through existing sovereign APIs. nx_sota_status bindings domain preserves raw full/partial rung contracts and independent older rank stamps, null unresolved behavior/source/API/MCP joins; producer170888B SHA2564959166184838839aa5da3d0a576f79b9f31b9f385301e01b333a3f5bd8295c3 promoted1789018343. Native49/49 parser/rank checks and30/30 complete-artifact/invalid-input/board-preservation checks; actual charsim37 and gameengine68 rows fully parsed. Published /compare/charsim/bindings.json63987B and /compare/gameengine/bindings.json222060B, full HTTPS200 bodies byte-identical in44/44 delivery gate1789019042. Live nishi_compare bindings gameengine returns1048B artifact manifest; existing investment3085B unchanged; adapter23/23 public policy/read checks and zero content losses. OpenAPI3.1 remains stable: only bindings route/schema added, whole generated old/new objects identical after removing additions and generation time; reviewed one printable JSON-fragment split before explicit capability-loss exception promoting hub164872B80b6567fa518401293704fc341b4a69f76b27da95e4872463cb362c6c9bebc74. Unicode MCP shared decoder52/52 and actual-caller19/19 gates; live escaped Unicode exact and malformed surrogate returns-32602 before dispatch, live serving hash15ab45ad2bb8d85215fc2d4042f054aa492d9cb8e7eadfdd2d3e211d0f725df7. Deployment1789017242 terminal receipt still absent; watchdog/live hash/behavior pass independently; needs-intervention to reconcile stale claimed job, no duplicate deployment. Today primary research: MCP2026-07-28 versioned Tasks, OpenAPI3.2, OTel HTTP metrics stable/mixed, SLSA1.2 and July2026 ReSTIR papers guide bounded adoption, not claimed estate SOTA. Still unfinished: correlated first-byte-to-complete-delivery spans, full estate evidence joins, verified savings/resource spend, matched rendering frontier and served visual/interaction review. Parallel gates do not prove time-to-market improvement.
2026-09-10	DI2	measure	2026-09-10 release: existing bindings API/MCP now joins all105 retained rungs to exact current matrix symbols, with34 charsim and52 gameengine unique joins,14 unmatched,3 unsupported and2 without contract symbols. Declaration text observations remain separate from syntax, deployed behavior, rank and SOTA;8 gameengine watches retain declared gaps despite present text. Source reader reports full read or unobservable; no unavailable source is called absent. Existing49/49 parser/rank and30/30 new join-rule checks plus30/30 actual staged artifact checks; full independent JSON/matrix/raw-rank and previous-field parity passed. Producer193480B SHA25609ab34359ab0f6ec06838e1df4ac34d27367e0fe5861f75572b2b0b4284bcc1b promoted1789021557 after review of one intentionally split JSON literal. Guarded reports published1789021595/1596: charsim124424B SHA25692d35e52d3ac63b4fa0d52f4b28ce5de9fc825c10e7294aa38907e4eba7ce2bf; gameengine336300B SHA2567442f3a97c672b89b01e451f4101e36801140fe7d2793fe4019ab73445c46d3b. Entire HTTPS200 bodies equal published files;44/44 delivery gate1789021645, actual nishi_compare bindings gameengine1048B manifest names336300B artifact. API/MCP operation and behavior joins, client first-byte timing, independently captured source provenance, actual investment returns and matched SOTA frontier remain unfinished. Timing candidates reuse actlog but are not deployed. Research refreshed2026-09-10; protocol specs and rendering papers are targets, not estate attainment. Served visual/interaction review remains unavailable and unresolved.
2026-09-10	DI2	measure	2026-09-10 retained timing worklog: full daemon build1789022928 and zero printable losses1789023037 reviewed; dedicated loopback gate1789023687 passed51/51 after copied fixture execution was diagnosed as EACCES and replaced with the original byte-verified executable. Gate exercises real sync, positive exit7 result, async/promoted IDs and publication, disconnected write failures; promoted capture explicitly unreaped. Native gates are not client TTFB or throughput benchmarks. Health-checked toolsapi deployment1789023777 and exact live binary/behavior independently verified; terminal job receipt remains NEEDS-INTERVENTION, not a waiting recommendation. Latest primary research checked2026-09-10 guides versioned task lifecycle, distinct HTTP/local timing and matched rendering comparisons. Specifications/papers are comparison targets, not evidence of Nishi completion. Ready: tested native timing evidence; running: live timing daemon; waiting: no justified automatic queue; intervention: missing deployment terminal receipt and unavailable served visual/interaction review. Preserve prior failed tests and unfinished work.
2026-09-10	DI2	measure	2026-09-10 retained worklog: parser48/48 job1789025031, actual staged producer artifact30/30 job1789025307, zero content losses3/3 job1789025308; all105 report rows independently compared with exact matrix, raw rank and prior contracts before promotion. Charsim133708B SHA256c8e2166e0ba6bb747e652678b7ebe3dc1a7a1db0ffde63735f6c2eebadfd6aef; gameengine357433B SHA2560cc879138bbdd96316f59838ea9405c435f40bf47b1961cf83bf97993ab3cd3d. Ready: tested measurement contracts; running: promoted producer and published reports; waiting: no justified automatic queue; needs intervention: prior deployment terminal receipts and full Compare receipt journal. Signal-free native process gate1789025371 passed5/5: detached child matched existing restart substring predicate, then exited normally with no signals; this proves selection risk, not historical deployment cause. Stop and guard need coherent listener ownership before repair; no live restart or claim rewrite performed. Beach loader/browser, independently verified resource returns and full estate coverage remain unfinished.
2026-09-10	DI2	measure	2026-09-10 native restart prerequisites: tools request children now close inherited listener in source; actual source-linked socket gate1789026317 passed19/19, preserves accepted socket, parent second connection and exact268B HTTP response. Candidate daemon382272B SHA256695ea70403064bff4a625efde779a24b2b7ecd6e5576fd5fab71586152a78944 is staged, NOT deployed. Existing OS observation owner adds all encountered inode PID/FD references with unknown/capacity errors; native18/18 gate1789026165. Actual allproc census747PIDs found2 references but662 reads inaccessible(first_error=-13), so result UNKNOWN, not restart authority. Ready: isolated prerequisite evidence; running: prior live daemon; waiting: no automatic deployment claimed; next action: complete listener/service identity and coherent stop/guard repair before rollout. Prior lost deployment receipts and full publication journal remain needs-intervention; no replay or history deletion. Native Beach resident-loader candidate remains local, real assets/WASM growth/renderer and served visual acceptance unfinished.
2026-09-10	DI2	measure	2026-09-10 retained worklog: shared all-listener census validates actual IPv4/IPv6 headers, preserves all matching raw addresses/inodes and refuses truncated input or row capacity. Native29/29 job1789027643, actual two loopback addresses and132281 proc bytes. First gate build rejected reserved keyword match; corrected unpublished gate to matched and retained failure1789027556. Existing portcheck source19770B SHA256506c7de68eb48bc0599b4a04834a428035600442eb4f0c0312308dc387c2f564; staged build1789028271 fully reviewed. Real child CLI gate1789028805 passed29/29, captures independently validate four JSON results and legacy5/5. Management API1789029065 returned COMPLETE771B; scoped MCP observation1789029148 returned COMPLETE771B. Ready: tested observer; running: promoted existing organ; waiting: no automatic queue claimed; next: join observations to stable process identity and repair stop/guard coherently. Prior lost deployment receipts, full Compare journal, unavailable visual review, client first-byte spans, full estate joins and independently verified investment returns remain unfinished. Research checked2026-09-10 remains comparison guidance, not SOTA attainment.
2026-09-10	DI2	measure	2026-09-10 retained worklog: existing nx_toolatency60632B SHA2563fd38b41b8022f22e22d04d6609cd2fc829a0013ab9f9de48c992e35813004c6 promoted1789032682 and actual live hash verified. Native strict parser33/33 job1789031841 on unchanged8165B journal23 observations; actual staged CLI48/48 job1789032165 covers complete output, row/read windows, malformed/overflow/arity, missing input, UTF8/signed minimum and closed stdout exit4, with source/config unchanged. Independent JSON Schema and exact raw-span validation passed all9 captures; representative legacy20/20 job1789032596 preserved622B identical stdout and journal payload apart from valid timestamps. Original build1789031979 log was overwritten by unrelated build; repeat1789032069 exact cache hash/full proper log reviewed. Actual management call1789032728 and MCP both returned5283B WINDOW with four identical rows, checked against independent journal span; cursor63245586 resumed four next rows to63246945 with no skipped leading bytes. Live source initially observed63259957B; each response records its own initial-size observation, never an atomic snapshot. Read-only library16337B and existing owner26198B; no second event store or tool registration. One-day capability scoped only to existing nx_toolatency retained privately. Ready: checked phase reader; running: promoted API/MCP command; needs intervention: first-byte/result-retrieval instruments, explicit artifact/rung/investment joins, full Compare receipt journal and unavailable browser review. No raw operator journal published to Compare, no verified return or general speedup claim. Dated research refreshed2026-09-10 remains a guide for matched comparisons rather than proof of SOTA attainment.
2026-09-10	DI2	measure	2026-09-10 retained worklog: corrected existing knowledge/tool_schemas.conf row948 through exact guarded replacement job1789033713 DONE; resulting468494B SHA256b8ce847de62a5cf0c9b6442878dd10de78f5efa92592107e7dc66526cb965840. Actual MCP tools/list cursor896 returned the complete nx_toolatency item with authored observations grammar and readOnlyHint=false; destructive/idempotent/openWorld flags remain false. Canonical runtime/nx_tools_api.nx rereads metadata per request, so no daemon rebuild or restart was needed. Existing output fields and legacy entrypoint retained. Ready: reviewed metadata; running: fresh discovery response verified; needs intervention: browser visual review and full Compare receipt journal. First-byte/result retrieval and explicit execution/artifact/rung/investment joins remain unfinished. Existing benchmark receipt plane and binding source observations identified for reuse; investment report still declares five rows with evidence_verified=false and units_verified=false. No new store, verified ROI or universal SOTA claim.
2026-09-22	dataio	queue	2026-09-22 RESEARCH LEAD from the operator (UNREAD: cite nothing until each source is fetched through nx_research_fetch, read from the mirrored bytes and pinned in dataio.refs): the zero-copy, schema-driven record layouts the field uses in place of text rows and JSON -- capnproto.org (Varda, no encoding step by memory alignment), google flatbuffers (van Oortmerssen), Apache Arrow (one in-memory columnar layout shared without serialisation), Kleppmann DDIA chapter 4 on the CPU cost of text formats, arXiv 2407.13494v2 (streaming technologies and serialisation protocols), MDPI computers 13 4 89 (Lite2 schemaless zero-copy). Candidate rung once read: a NishiLang typed record layout with zero-copy reads for the seg-store planes and the compare api.json, measured against those formats as OUTSIDE oracles on bytes per record, decode cycles and energy per record; none of them enters the build or serve path (sovereignty law), their numbers and mirrored bytes do
2026-09-22	dataio	queue	2026-09-22 STORE DEFECT OWNED HERE (ecosystem EC70): nx_store_put close rewrites a fixed status column (the third field) instead of tombstoning the key, so on a two-field row it writes the row back unchanged and still reports CLOSED replaced=1 -- the mutation journal of knowledge/store/plan-lang-hygiene- shows old equal to new on four closes. The seg-store already carries a key-level tombstone (ss_get returns 0 for a tombstoned key) that close does not use. Remedy: close tombstones the key or refuses by name, load and sts_load_checked skip and count tombstones, and every reader that keys on a column value (the plan runner's RETIRED rule among them) moves to that state; the gate plants a two-field and a three-field row and proves both retire or refuse, never a success receipt for an unchanged row
2026-09-22	DI20	lesson	A CLIENT THAT NAMES THE WRONG STAGE COSTS THE INVESTIGATION IT EXISTS TO SAVE: three transport failures tonight were one cwd defect. The discriminators were one call from the harness to the door (CG-BEGIN answered with the NAS hash, so the door, the URL and the cap were innocent) and one re-run from the tree root (E2E OK 150690 B in 30 ms). hf_store_load returns 0 with no diagnosis and every consumer inherits the silence; the message fix is landed at both clients' load sites (CG-IO and CC-IO name the path and the cwd, nothing posted) and the loader-level remedy is this rung. The three failed runs were launched from the home directory by this seat, not by any transport.
2026-09-22	DI20	land	DONE-RULE PART 1 LANDED ON BOTH TREES: nx_content_get_client.nx 19331 B (dba7be20) and nx_content_put_client.nx 50595 B (78261397) edited on the NAS under size CAS (five edits, every predicted size exact), flowed back to the laptop through the get door itself, rebuilt on the laptop lane (428021 B 5a6c5816 and 456962 B c736f998), gates 12/12 and 9/9 GREEN. Bite from the home directory: rc=3 CG-IO trust store unreadable at data/mozilla_certdata.txt (resolved against the CURRENT DIRECTORY, launch from the tree root, nothing was posted). Control from the tree root: E2E OK 150690 B with the NAS hash. Parts 2 (the hf_store_locate ladder in the lib) and 3 (the from-home bite as a gate tooth) remain open.
2026-09-23	DI20	land	DONE-RULE PART 2 LANDED ON BOTH TREES: nx_https_fetch_lib.nx 39242 B (ea3b2e22) carries hf_self_dir (readlinkat /proc/self/exe, never argv[0]), hf_store_probe, hf_store_candidate, hf_store_locate (the pure decision; 0 names every candidate joined by semicolons) and the composed hf_store_load (rung 1 silent and byte-for-byte, a later rung announced once on stderr, total failure named); nx_https_fetch_lib_gate.nx 11422 B (538dc6ff) adds L1-L5 over fixture roots and reads 20/20 GREEN on the laptop; NAS build 612584 B 8340b82a src_stable=1, PROMOTED prev=1. Clients rebuilt on the closure (get 431592 B e83ef269, put 460548 B e9de261a) with their refusal lines deferring to the HF-STORE line; gates 12/12 and 9/9. Bites: from the home directory the get client now fetches 150690 B with the NAS hash and announces rung 2; a copy placed far from any store refuses rc=3 naming all three candidates with 0 B on stdout. Part 3 (those two bites as teeth in the client gates) remains open; the three incumbent self-dir copies (nx_sota_why_gate, nx_torrent_daemon, nx_torrent_get, two of them reading argv) are an nx_oo_extract candidate onto hf_self_dir.
2026-09-23	DI20	measure	NAS PROOF: /api/gate_run nx_https_fetch_lib_gate (promoted 8340b82a) passed 20/20 verdict=GREEN with capture_truncated=0; on the NAS the foreign-cwd tooth L5 resolved the store through rung 3 (the serving root's own data/mozilla_certdata.txt) where the laptop resolved through rung 2 (_build/../data), so the ladder is proven on both hosts with the same source and no host-specific expectation. Laptop manifests re-pushed after the ladder sources landed: HASHDIVERGE 21738/21738 identical, nas-ahead 0.
2026-09-23	DI20	land	DONE-RULE PART 3 LANDED ON BOTH TREES AND PROVEN ON BOTH HOSTS: the ladder bites are teeth in both client gates. nx_content_get_client_gate.nx 20280 B (efe438c0) and nx_content_put_client_gate.nx 16378 B (97296d27) each carry cgg_abs/cpg_abs (an absolute subject path, since a relative one fails to exec after the chdir and reads as the refusal under test), a fixture tooth asserting no store on any rung of the far copy, T13/T10 a dryrun forked from a foreign cwd exits 0 and emits its envelope, a fixture tooth asserting the far copy is the subject's bytes and executable, and T14/T11 the far copy refuses exit 3 naming every rung, unlinked after the run. Laptop 16/16 and 13/13 twice each; NAS builds 55416 B 82449b37 and 53152 B cdb66cf7 PROMOTED prev=1, gate_run 16/16 and 13/13 GREEN. LESSON: the first NAS run read 15/16 with the far copy exiting 127 while its bytes-and-mode fixture tooth PASSED, because the NAS mounts /tmp noexec; a fixture that must EXECUTE is placed beside the subject (its filesystem executes by construction), two directories down so no rung reaches a store, never under /tmp. A host may mount /tmp noexec, and an exec failure reads exactly like the refusal under test.
2026-09-23	DI20	land	ONE EXE-DIRECTORY RESOLVER, THREE HAND-ROLLED COPIES RETIRED: pon_self_dir(out, cap) in nx_os_introspect.nx (29373 B bb548965, composes the lib's own pon_readlink over /proc/self/exe, never argv[0]). Consumers on both trees: nx_https_fetch_lib.nx 39097 B 44fcc4fc (hf_self_dir is now a thin alias), nx_sota_why_gate.nx 10426 B d1566bd9 (sg_selfdir alias), nx_torrent_daemon.nx 89293 B 17b4873a and nx_torrent_get.nx 86194 B c0bc0f3c (exe-link primary path; the argv cut kept only as the no-/proc fallback, because a bare launch used to send every sibling-executable and conf lookup to their /tmp fallback). Laptop: fetch lib gate 20/20, get client gate 16/16, put client gate 13/13, sota_why gate 14/14, both torrent organs compile; get client from the home directory still fetches through rung 2. NAS: fetch lib gate 613192 B c03fc0ee and sota_why gate 55480 B 8adbe675 built, PROMOTED prev=1, gate_run 20/20 and 14/14 GREEN; torrent daemon and torrent_get compiled --build-only (compile proof only; the daemon deploy belongs to its lane). nx_crash (a self-contained crash handler with no imports) and the ship behaviour lib (which hashes the exe, a different question) keep their own readers by design. Manifests re-pushed: 21747/21747 identical.

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. Honest position, measured 2026-09-05. The estate already holds the instruments and most of the wire, and it has been running almost none of them. The silent-truncation cap detector existed SOURCE-ONLY since 2026-07-15 and had never been compiled; its first census could not run until this admission shipped it. The recurring ceiling is one number: the literal 4194304 appears 1,430 times in 717 source files (1,415 in code: 607 named constants, 718 bare literals inside a call, 90 other; 15 in comments; partition reconciles; coverage_complete=1 over 23,663 files). The ledger-cliff forecaster reads 4 of 18 rostered append-only ledgers OVER the 4 MiB nominal reader window -- actlog.jrnl at 54.6 MB is thirteen windows deep -- and every consumer of that ledger this census could read is TAIL-anchored by declaration, so those four are size facts and not blindness; two consumers remain unverified and are the worklist. The same day, two organs had their gram tables and journal buffers re-derived from the input (a 16,384-entry table that silently dropped every pair past the cap now sizes itself from a frame census and counts 16,900 exactly). On the wire the estate is at or past the bar where it has built, and absent where it has not: chunked framing is decoded per RFC 9112 [rfc9112]; range pulls resume per RFC 9110 [rfc9110]; the content lane is chunked, sha-receipted and resumable with a commit compare-and-swap that refuses bytes not hashing to the declared digest -- stricter than tus's optional checksum extension [tus]; but chunking is fixed-size (content-defined chunking is ABSENT-PROVEN across every board [fastcdc16] [restic]), verification happens at commit, not per chunk as it arrives [blake3], the public door does not yet speak the IETF resumable-upload draft [httpbis-resumable], and no unsafe MCP write carries an idempotency key [idempotency-key] -- measured in one session: nine writes returned Outcome-Unknown, each adjudicated by re-reading the artifact, and one class of edit cannot be re-issued safely at all. Every truncation the estate performs on purpose ANNOUNCES itself (the read envelope prints OUTPUT-IS-PARTIAL with its cap and a next= cursor), and that announcement is exactly what made this board's own floors visible.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/dataio.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain dataio, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from dataio.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	3
scanned	3
fetched	3
reused	0
failed	0
named	3
candidates	3
mentions	3
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	IETF HTTP (RFC 9110, 9112, 9457, 9530, httpbis and httpapi drafts)	1	1	col0-ietf	named	https://www.rfc-editor.org/rfc/rfc9112.txt
2	tus resumable upload 1.0	1	1	col1-tus	named	https://tus.io/protocols/resumable-upload
3	restic (content-defined chunking)	1	1	col2-restic	named	https://restic.readthedocs.io/en/stable/100_references.html

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 24 capabilities: 22 exclusive to it and 2 shared with other boards. Shared rows on this page: 2 = home here 1 + home elsewhere 1 + ambiguous 0 + undecided 0 + refused 0 (partition 2); undecided = unmapped 0 + unproven 0 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=7175.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
v_commit	`nx_content_put.nx`	sharehub, sovereignty, dataio+, modding	dataio	gates	gates	home here
mg_fetch	`nx_model_get.nx`	gen*, dataio	gen	rung	plan	home elsewhere adopt: `@xrow gen\|mg_fetch\|home by rung (fleet duplicate census)`

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1396280 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[rfc9112] Fielding, Nottingham and Reschke. HTTP/1.1. IETF RFC 9112, June 2022, section 7.1 Chunked Transfer Coding: the coding wraps content to transfer it as a series of length-prefixed chunks and is complete only when a chunk with a chunk-size of zero is received, so a body whose terminating chunk never arrived is INCOMPLETE by definition rather than a shorter body. publisher · read in our library knowledge/fetched/cmp_dataio_rfc9112.txt · pin he4f426bac6206b67fdf9e0da826154f70588db2133a0a86b15cde4ff725d8937 · accessed 2026-09-05 · published-standardGrounds: Chunked transfer framing with a terminating last chunk
[rfc9110] Fielding, Nottingham and Reschke. HTTP Semantics. IETF RFC 9110, June 2022, section 14 Range Requests and section 15.3.7 206 Partial Content: a client resumes from a declared byte offset and the server states the range it satisfied in Content-Range. publisher · read in our library knowledge/fetched/cmp_trafficsafety_rfc9110-retry-after.txt · pin h21c1cdce6ab0e5509b04d84a28000836c7a087cf786efe6f04877ebfff47232a · accessed 2026-09-05 · published-standardGrounds: Range requests and 206 partial content for resumable pulls
[rfc9530] Polli and Pardue. Digest Fields. IETF RFC 9530, February 2024: the Content-Digest and Repr-Digest integrity fields carry a digest of the content or representation so a receiver can verify the bytes it holds are the bytes sent, independent of the transport framing; Want-Content-Digest lets an endpoint ask for one. publisher · read in our library knowledge/fetched/cmp_dataio_rfc9530.txt · pin h544dbb7d9afceafa8c9931d9924ca6cff2b4807274166d7ed2483342ef2cdd6a · accessed 2026-09-05 · published-standardGrounds: Integrity digest on the wire so a short body cannot pass as complete
[rfc9457] Nottingham, Wilde and Dalal. Problem Details for HTTP APIs. IETF RFC 9457, July 2023: a machine-readable error body with type, title, status and detail so a failure names its class and its remedy instead of a bare status code. publisher · read in our library knowledge/fetched/cmp_dataio_rfc9457.txt · pin hf2b3db92fb0bf3489cb3841a0da0c0d88dff40797b64d40b6123085183886c7b · accessed 2026-09-05 · published-standardGrounds: Idempotency key on every unsafe write so an Outcome-Unknown retry is safe by construction
[httpbis-resumable] Kleidl, Mehta and Zhang. Resumable Uploads for HTTP. IETF HTTP Working Group Internet-Draft draft-ietf-httpbis-resumable-upload, fetched at its datatracker home 2026-09-05: a client creates an upload resource, appends with declared offsets, and after an interruption retrieves the offset the server holds so accepted bytes are never sent twice. publisher · read in our library knowledge/fetched/cmp_dataio_httpbis-resumable-upload.html · pin hc221184c3bbe4bf75c3f77590802335c28cefae9f721eebf3698d0da2d37bedf · accessed 2026-09-05 · published-standardGrounds: Resumable upload on the public wire per the IETF draft
[idempotency-key] Jayadevan and Desai. The Idempotency-Key HTTP Header Field. IETF HTTPAPI Working Group Internet-Draft draft-ietf-httpapi-idempotency-key-header, 2026 revision: an idempotency key is a unique value generated by the client which the resource uses to recognize subsequent retries of the same request, making non-idempotent methods such as POST or PATCH fault-tolerant; a missing or reused key is answered with a problem-details body. publisher · read in our library knowledge/fetched/cmp_dataio_idempotency-key.html · pin hfd2ba67202b24fa947d54f87df8c9de2566532761a0951736f6c38327fe40c2b · accessed 2026-09-05 · published-standardGrounds: Idempotency key on every unsafe write so an Outcome-Unknown retry is safe by construction
[fastcdc16] Xia, Zhou, Jiang, Feng, Hua, Hu, Liu and Zhang. FastCDC: a Fast and Efficient Content-Defined Chunking Approach for Data Deduplication. USENIX ATC 2016: a gear-hash content-defined chunker with normalized chunking and cut-point skipping, whose chunk boundaries follow the content so an insertion shifts one boundary instead of re-keying every chunk that follows. publisher · read in our library knowledge/fetched/cmp_dataio_fastcdc16.pdf · pin h2a90f53dd58ccb9f2a19073f1ff8b9e96cd60c74686e08d809f5fafd4d013239 · accessed 2026-09-05 · published-paperGrounds: Content-defined chunking so an insertion does not re-key every following chunk
[tus] Transloadit and the tus contributors. tus resumable upload protocol 1.0.0: HEAD returns the Upload-Offset the server holds, PATCH appends at that offset, Upload-Length declares the total, and the checksum extension verifies each PATCH body. publisher · read in our library knowledge/fetched/cmp_dataio_tus.html · pin h868947ec6573ff745f31649d730616bfcd7d154af0c22ab39f1af4937f3e3a21 · accessed 2026-09-05 · vendor-docGrounds: Chunked, sha-receipted, resumable upload with a commit compare-and-swap
[blake3] O'Connor, Aumasson, Neves and Wilcox-O'Hearn. BLAKE3: one function, fast everywhere. Specification (BLAKE3-team, 2020 onward): a tree-structured hash over 1 KiB chunks whose structure permits parallel hashing and verified streaming, so a receiver can verify each chunk as it arrives rather than only the whole at the end. publisher · read in our library knowledge/fetched/cmp_dataio_blake3.pdf · pin hce179e62f29a6e43ec1ac2fe62b5e063a18632cf936c430d1373bfa0b81fb349 · accessed 2026-09-05 · published-paperGrounds: Verified streaming: each chunk verifiable as it arrives
[restic] The restic authors. restic documentation, References: Design (stable): repository content is split by content-defined chunking into blobs addressed by their SHA-256; files smaller than 512 KiB are not split and blobs are of 512 KiB to 8 MiB, so unchanged regions of a changed file are not stored twice. publisher · read in our library knowledge/fetched/cmp_dataio_restic-design.html · pin h40cc7855bbbdab09699bac73c5d094f7cf519980e3d5a75a7e2172a497e18264 · accessed 2026-09-05 · vendor-docGrounds: Content-defined chunking so an insertion does not re-key every following chunk
[mcp20260728] Model Context Protocol specification revision2026-07-28, retrieved2026-09-09. Protocol version and request capabilities must be negotiated and tested against real clients; native job text alone does not prove current MCP task interoperability. publisher · read in our library knowledge/fetched/cmp_dataio_mcp20260728_20260909.html · pin h71338850f874ec0f9efb36b1b110c1a32cb395215f13fe6737d340b6d625b7af · accessed 2026-09-09 · published-standardGrounds: Idempotency key on every unsafe write so an Outcome-Unknown retry is safe by construction
[mcptasks20260909] MCP Tasks extension draft, retrieved2026-09-09. Durable task handle before response, explicit result retrieval, and cancellation semantics guide the DI4 recovery investment. Draft status retained; no Nishi conformance claim. publisher · read in our library knowledge/fetched/cmp_dataio_mcptasks_20260909.html · pin hb8bb22ac811e6259b12e4909f73f4ae6360ce7b7aaba29b407e2059fbef57324 · accessed 2026-09-09 · draft-standardGrounds: Idempotency key on every unsafe write so an Outcome-Unknown retry is safe by construction
[slsaprov12] SLSA v1.2 provenance, retrieved2026-09-09. Build provenance binds artifacts to source, builder and invocation; use as a design reference for measurement receipts. Provenance alone proves neither SOTA nor visual acceptance. publisher · read in our library knowledge/fetched/cmp_dataio_slsav12_20260909.html · pin h9a176a8193aff28144dbab80584f0e9dd707a7c24f98c436349674a4a0e51e44 · accessed 2026-09-09 · published-standardGrounds: Integrity digest on the wire so a short body cannot pass as complete

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/dataio.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls