Nishi Family › Compare › Deployment and Live Hosting

Nishi Compare · capabilities, evidence and delivery

Deployment and Live Hosting

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

The sovereign mgmt control plane (upload -> build-on-target -> health-gated promote -> auto-rollback, all simple API calls over own TLS) vs Vercel and Fly.io and Render and Kubernetes with Argo

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. The sovereign control plane is live and self-hosting: health-gated promote with an auto-rollback watchdog (never-brick by default), instant rollback, build-on-target with the sovereign toolchain, one-command ship, sha-pinned atomic content publish, crash-loop-aware supervision, fleet inventory and SSE, the Sovereign Fleet UI, a fail-closed deploy-target registry, an OpenAPI spec, plus domain purchase with a spend wall, registrar DNS, ACME certs and purchase-to-live orchestration. Three exceeds: OPAQUE-PAKE control-plane auth, sovereign end-to-end TLS and routing, and a plane that deploys ITSELF through its own chain. Behind the platforms on: canary weighting, preview environments, blue-green warm slots, a GitOps reconciler, multi-node placement, autoscale, and rotation-managed secrets.

Where we need to go. The deployment ergonomics the platforms sell -- previews per change, weighted canaries, warm-slot cutover, declared-state reconciliation, secrets that rotate -- on owned hardware behind the same never-brick watchdog, and then placement across a second node without a cloud LB.

The unit. 1 u = one measured session-leg (estate calibration: graphics R21 in one leg 2026-08-15). Local evidence: the wiki restart route and the D-state admission witness each landed gated in one leg on 2026-08-17; estimates are relative to those.

Where we are: 7 open rungs. Control-plane fundamentals at or beyond the field; release ergonomics and multi-node behind. Counts measured at emit below this line.

Cost to safer releases: 4 u. DL1 blue-green warm slots, DL2 weighted canary on top of them, DL3 preview instances per staged change -- all ride the existing watchdog.

Cost to declared state: 3 u. DL4 the GitOps-class reconciler over the deploy-target registry, DL5 secrets rotation under it.

Cost to more than one box: 6 u. DL6 placement of a service on a second sovereign node, DL7 scale-to-zero for always-on daemons that idle.

Research bar. Argo Rollouts is measured on weighted canary steps, blue-green, analysis-gated promotion. Theirs: the progressive-delivery reference. Ours: DL1 and DL2 measured on this page.

Research bar. Vercel is measured on preview deployment per change, instant rollback, edge network. Theirs: the DX bar. Ours: DL3; rollback already matched.

Research bar. Flux and Argo CD is measured on reconcile the cluster to declared repo state. Theirs: the GitOps bar. Ours: DL4.

Release feedback and deployment pacing: Required for every release from 2026-09-07. Show a dated summary and retained worklog on the existing product or management surface. Distinguish ready, building, waiting, promoted, served, visually accepted and needs-intervention states. A wait must show its policy reason, observation timestamp and age, pending artifact identity, next bounded recheck or explicit operator action; never invent an ETA from blocked-process counts. UI delivery requires served visual and interaction review. This is a requirement; autonomous queue/resumption and calibrated capacity recommendations are not yet proven.

Latest recorded release

2026-10-04 · DL28

nx_cert install <domain> <chain> <key> [manifest] [ip] [port] (nx_cert_install_lib): refuses an unparseable chain, a chain that does not cover the domain, not yet valid, expired, a key that does not match the leaf, a bad domain, a relative manifest, no row and a duplicate row, each by name; writes both files beside the manifest under content-addressed names with the key at 0600; one atomic row swap with a named backup (atomic_rewrite_owned); a served check of every row afterwards; any failure restores the backup, proven by re-reading the file's sha256. Gate teeth on fixtures only; NEVER run against the production manifest. Imprecision declared: the success branch is not driven end to end (it needs a TLS listener serving the test certificate); bite killed 1 of 5 with 4 survivors in the refusal-name strings no tooth reads

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

23 of 46 capability source symbols found|3 of them authored stronger-claims|23 open|coverage 500/1000|adoption 18 full / 5 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 23 vs present 23 · named + unnamed + withheld = 23 vs open 23 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 24214 bytes · gates map: PRIMARY · stamped 1d 13h ago · source ../knowledge/status/evstamp_deploy.verdict

Gap class	What it is, and the work it names
FLIP-READY	A watch contract symbol is now present in the organ it named: the cell can flip on a pure data edit with no new code. These are the cheapest closures on this board and they belong before any new work.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence deploy itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_OR_INVALID_BINDING. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Retained ranking is not bound to the current plan and matrix: STALE_OR_INVALID_BINDING. Historical data remains retained. Refresh the ranking after resolving the input differences. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Never-brick deploy (DP0)	deploy_status	Stage, promote, async health watchdog, auto-rollback -- LANDED and self-applied	Organ	0 u
Instant rollback (DP1) after DP0	ma_do_rollback	.prev restore via POST /api/rollback -- LANDED (symbol corrected 2026-09-02: `rollback` was a word, ma_do_rollback is the handler)	Organ	0 u
Fail-closed target registry (DP2)	md_upload_target_ok	Every deployable target allowlisted by name -- LANDED	Organ	0 u
Blue-green warm slots (DL1) after DP0	bg_slot_switch	Two installed slots per daemon, the idle one warmed by the health probe before the SNI route flips; gate proves a flip under a synthetic request stream drops zero requests and a failed warm-up never flips	Organ	1.5 u
Weighted canary (DL2) after DL1	dc_weight_shift	Route a declared permil of new connections to the warm slot and advance the weight only while the watchdog stays GREEN; gate proves a RED at 100 permil rolls the weight back to zero and records it	Organ	1.5 u
Preview per change (DL3) after DP0	dp_preview_spawn	A staged .new binary runs on an ephemeral port behind the operator login with its own route, torn down on promote or expiry; gate proves the preview serves the staged bytes while live serves the promoted bytes, byte-verified both	Organ	1 u
Declared-state reconciler (DL4) after DP2	go_reconcile_desired	A signed desired-state file (targets, versions by sha, routes) reconciled against the live plane on a beat through the existing promote and deploy doors; drift is REPORTED with the diff and applied only when the file says apply; gate proves a declared sha converges and a tampered file is refused by signature	Organ	2 u
Secrets rotation (DL5) after DL4	ds_rotate_secret	Secrets referenced by name from the desired state, rotated on a declared schedule with the old value kept readable for the grace window and the rotation recorded; gate proves a daemon keeps serving through a rotation and a revoked secret is refused after the window	Organ	1 u
Second-node placement (DL6) after DL4	rg_place_service	Place a service on a second sovereign host from the same desired state, with the SNI router fronting both; gate proves a request reaches the second node and a node loss routes back within the watchdog window	Organ	4 u
Scale to zero (DL7) after DL1	as_scale_to_zero	An always-on daemon declared idle-capable is stopped after a declared idle window and respawned on first connection by the router; gate proves zero process while idle and a first request served within the declared cold-start bound	Organ	2 u
Reconcile the rollback census with the chain that actually exists (DL8)	dj_count_prev_chain	REWRITTEN 2026-09-01 WITHIN THE HOUR, BECAUSE ITS FIRST PREMISE WAS WRONG AND READING THE SOURCE REFUTED IT. I filed this as build pre-deploy banking, on the strength of deployjrnl.status reading at_risk=1914 of rollback_slots=1938 against floor=1745 with irreplaceable_evictions=2. THE BANKING ALREADY EXISTS: hc_promote_to_expect has carried a DURABLE ROLLBACK CHAIN since 2026-08-21 -- it rotates .prev to .prev2 before overwriting .prev, so TWO generations survive, and when .prev2 is finally dropped it ANNOUNCES the loss with the artifact size rather than losing it silently. Its own comment cites the same two-deploy measurement I re-derived. Verified against this seat's own two docportal deploys today: the original generation is at .prev2, and the manual hash-verified banks taken beside it were belt-and-braces, not the safety net. SO THE REAL QUESTION IS THE INSTRUMENT, NOT THE MECHANISM: at_risk counts targets with no entry in a separate bank directory (bank_files_scanned=88 bank_size_matched=34) while the mechanism that actually protects rollback is the .prev and .prev2 chain, which that count appears not to read. A RED that measures a different subject from the property it names is the estate's own wrong-subject defect, and it is worse than no metric because 1914 of 1938 reads as catastrophe and gets ignored. DONE-RULE: nx_deployjrnl classifies a target by the chain it actually has -- PREV-ONLY, PREV-PLUS-PREV2, or NEITHER -- the partition SUMS to rollback_slots, the floor is re-derived against the corrected subject rather than kept from the old one, and a target with a live .prev2 is NOT counted at risk. Only then is a genuine residual a worklist	Organ	1.5 u
The build queue dedupes by target (DL9)	bq_dedupe_target	CORRECTED 2026-09-02 by a whole-plane measurement: 231 deployq- rows, 231 distinct ids, zero duplicate BQ rows -- the enqueue is ALREADY idempotent by id (nx_store_put re-puts by id), so the claim that a well-behaved caller multiplies the queue was wrong; the 2026-09-01 pileup (procs_running=31) was concurrent SYNC re-issues under separate per-target leases. The half that stands is the done-rule's second clause, re-scoped: a sync build that succeeds CLOSES any queued BQ row for its target, proven by a gate that enqueues one target twice, asserts one row and one fire, and proves a sync success leaves no live queued row behind. The runner-refusal half of the pileup is closed on the loadgov board (LV10 ma_runner_refused, 2026-09-02)	Organ	0.5 u

Milestones

Milestone	Rungs	Cumulative
M1 · Safer releases	DL1,DL2,DL3,DL8,DL9	6.0 u
M2 · Declared state	DL4,DL5	7 u
M3 · More than one box	DL6,DL7	13 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Resumable artifact upload that survives a dropped chunk (DL10)	cc_resume_from_status	MEASURED 2026-09-04: a 410443 byte ship lost chunk 7 of 9 to a transient on a degraded array and discarded the WHOLE transfer, because the client restarts rather than resumes. The server ALREADY exposes the resume source as nx_content_put status id and the client never calls it, so this is a client gap and not a protocol gap. Industry bar is the OCI Distribution Spec chunked blob upload which resumes from the last accepted byte range, and S3 multipart per-part retry. DONE-RULE: nx_content_put_client queries status before sending, sends only the missing indices, and a gate proves it by interrupting a transfer mid-chunk and showing the retry sends STRICTLY FEWER chunks than the first attempt while the committed whole-file sha still matches	Organ	2 u
Abandoned upload staging is reaped on a declared TTL (DL11) after DL10	cp_reap_stale	MEASURED 2026-09-04: knowledge/contentput held 82 entries, roughly 40 of them bare meta files from begins that never received a chunk, the oldest about eleven days back, with no reaper anywhere. A failed put leaves server-side state and announces nothing, so the leak is invisible until someone lists the directory. The INFLOW cause is now fixed (the transport ceiling that made large chunks impossible), so what remains is historical debt plus whatever future transients leave. Industry bar is the S3 lifecycle rule AbortIncompleteMultipartUpload and the OCI upload session timeout. DONE-RULE: the reaper removes only transfers whose meta is older than a TTL READ FROM CONF and which hold no committed chunks, the reaped count is announced, and a neg-control proves an in-flight transfer is NEVER reaped	Organ	1.5 u
The shared HTTPS post path follows an async job pointer so every caller inherits it (DL12)	hp_follow_job	Census 2026-09-04: of 89 organs that post a tools call, 8 follow the JOB-STARTED pointer and 81 do not. That 81 is a CEILING ON EXPOSURE, not a defect count, because a blind caller only breaks when the edge actually promotes its call. Fixing 81 sites by hand is 81 chances to drift; putting the follow inside hp_post_json makes it structural, which is the same reason nx_jobfollow_lib is one shared follower rather than a copy in each content client. The open question is CAPABILITY not code: the follower needs a read cap for the job artifact and most callers hold none. DONE-RULE: hp_post_json follows when a read capability is resolvable and returns the RAW response unchanged when it is not, never a silent zero, proven by a gate exercising both branches plus a neg-control showing an existing capless caller is byte-identical to today	Organ	2 u
Destructive operations are rate-limited against the store's own history and refused above the band (DL13)	ds_destruction_breaker	DONE-RULE PRE-DECLARED 2026-09-04. Counts deletes, withdrawals and retires per unit time against a band derived from history [cf-outage-feb26]; REFUSES above it naming the rule and stamping to an argument-derived path. Bite: a planted burst must be refused; a planted trickle must pass.	Organ	2 u
A target is built twice in one lane and the promote is refused if the artifacts differ (DL14)	ds_build_twice	DONE-RULE PRE-DECLARED 2026-09-04. Two builds, byte compare, refusal names the first differing offset [debian-repro-gate26]. Positive control: a known-deterministic target promotes; negative control: a planted timestamp in the source must be refused.	Organ	2 u
A promote is refused for any artifact whose closure root is unrecorded (DL15) after DL14	ch_promote_refuse	DONE-RULE PRE-DECLARED 2026-09-04. The build record's single committed digest must exist beside the artifact [repro-not-enough26] [kettle26]; a planted artifact with the record deleted must be refused; the same artifact with the record present must promote.	Organ	2 u
The registry verifier refuses a signature under an unauthorised key, by name (DL16)	rs_unauth_key_bite	DONE-RULE PRE-DECLARED 2026-09-04. A signature valid under a key the policy does not authorise is refused with the rule named [cosign-releases]; a signature under an authorised key still verifies. The refusal is the tooth; acceptance alone proves nothing.	Organ	1 u
The rollback action's dependency chain is resolved and refused if it traverses the subject (DL17)	dr_rollback_chain	DONE-RULE PRE-DECLARED 2026-09-04. Chain resolved from proxy_routes.conf and daemons.reg [cp-sovereignty26]; a planted rollback whose path crosses the subject must be refused; one that does not must pass. Run before every deploy on the request path.	Organ	3 u
Every conf reader holds its last-known-good and stamps LKG-HELD on a rejected file (DL18)	hc_lkg_conf	DONE-RULE PRE-DECLARED 2026-09-04. On parse or validation failure the organ continues on the banked conf and stamps LKG-HELD with the rejected hash [azure-ykyn]; a planted corrupt conf must leave serving unchanged and the stamp present.	Organ	2 u

Milestones

Milestone	Rungs	Cumulative
M4 · September 2026 SOTA: release safety, rollback and provenance as the field practises them, admitted as bars, watches and pre-declared contracts	DL13,DL14,DL15,DL16,DL17,DL18	12 u
M5 · Self-service domain lifecycle -- a domain bought at the registrar to a live generated site from behind the login, every step a sovereign MCP verb	DL19,DL20,DL21,DL22,DL23,DL24,DL25	18 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Domain spin-up as a sovereign MCP verb (retires nx_domain_spinup.sh) (DL19)	ds_spinup	DONE-RULE PRE-DECLARED 2026-09-21: nx_domain_spinup <domain> [plane] registered on the MCP surface performs plane, release-managed docroot with the coming-soon template, lifecycle row, SNI cert manifest row, property_registry route and sites.conf vhost, then verifies 200 + cert CN + the tenancy gate, idempotent on re-run; the shell script becomes a thin wrapper or retires. Witness: gospelofwest.com was spun up by the .sh over ssh from a laptop organ, so the seat drove the estate instead of calling it.	Organ	2 u
Release stage, golive and rollback as a sovereign MCP verb (retires nx_domain_release.sh) (DL20) after DL19	dr_golive	DONE-RULE PRE-DECLARED 2026-09-21: nx_domain_release with verbs stage, golive, rollback, status on the MCP surface; golive flips the lifecycle row to production, repoints current, verifies, runs the tenancy gate and auto-rolls-back on RED exactly as the script does today.	Organ	1.5 u
Split-horizon LAN DNS row from the estate (nx_router_ctl dnsadd), never a laptop ssh organ (DL21)	rc_dnsadd	DONE-RULE PRE-DECLARED 2026-09-21: nx_router_ctl dnsadd <domain> <ip> writes the dnsmasq address row on the GL.iNet router and restarts dnsmasq, idempotent, with dnsdel as the reverse gear. Witness: gospelofwest.com needed the laptop-local nx_aw_routerfix over ssh because the estate has no DNS verb.	Organ	1.5 u
Certificate issuance as a sovereign MCP verb on the NAS, credential custody decided first (DL22)	ci_issue	DONE-RULE PRE-DECLARED 2026-09-21: nx_cert_issue <domain> on the MCP surface runs the proven DNS-01 wildcard loop (nx_acme_dns01_issue) on the NAS and installs certs/le_<domain>_* plus the manifest row; the edge hot-reloads. PRECONDITION NAMED, NOT ASSUMED: the Porkbun API credentials live only in the laptop's machine-bound vault today, so the operator decides NAS-side custody before this verb can exist. Witness: the gospelofwest.com cert was issued on the laptop and pushed by nx_aw_send.	Organ	3 u
Self-service door behind the login: add a domain bought at Porkbun (DL23) after DL19,DL22	dp_add_domain	DONE-RULE PRE-DECLARED 2026-09-21 (operator: behind the login set a url i purchased through porkbun): a gated nishifamily.com route behind the opaque login wall, with X-Nishi-Session validated IN the daemon, takes a domain the operator already bought at Porkbun, verifies ownership through the Porkbun API listAll, sets the apex and www A records to the WAN IP, issues the certificate (DL22), spins the domain up (DL19) and shows each step's receipt plus the live coming-soon URL; every step is the same MCP verb a seat would call, so the page is a caller and never a second implementation.	Organ	4 u
Site from a blueprint, self-service: choose or edit a blueprint, emit, stage, preview, go live (DL24) after DL20,DL23	dp_site_from_blueprint	DONE-RULE PRE-DECLARED 2026-09-21: behind the same login the operator picks or edits a .site blueprint for a spun-up domain; the page runs nx_site_build into the next release, offers a preview host, and golive (DL20) is the approval click. The emitter itself carries no client sentence any more (generalised 2026-09-21, byte-identical on andelinwest.site).	Organ	3 u
The whole launch as ONE seeded plan_run plane (DL25) after DL19,DL20,DL21,DL22	dl_launch_plane	DONE-RULE PRE-DECLARED 2026-09-21: nx_plan_run domainlaunch-<domain> walks verify-ownership, DNS, cert, spin-up, emit, stage, golive, verify as steps with receipts, so a crash leaves a ledger on the NAS and a second seat resumes at the failed step; the gospelofwest.com launch of 2026-09-21 is the reference walk.	Organ	2 u

Milestones

Milestone	Rungs	Cumulative
M6 · Certificates the estate manages itself -- watched from the edge's own manifest, renewed inside the CA's window on the estate's clock, installed with verification and rollback, no laptop and no seat in the loop (operator 2026-10-03: i want the nishi estate proactively managing all of this in a sota manner)	DL26,DL27,DL28,DL29,DL30,DL31	8.5 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Every certificate the edge serves is watched from its own manifest: a state per domain, a stamp, a daily beat (DL26)	nc_scan	LANDED 2026-10-03: nx_cert status (organ nx_cert, lib nx_cert_lib, gate nx_cert_gate 22 of 22) reads certs/sni_certs.manifest, judges each chain file on seconds, prints a summing partition, writes knowledge/status/cert_status.stamp in the gauge grammar and exits 0 GREEN, 1 RED, 3 UNOBSERVABLE; clock row certstatus daily; gauge row on deploy.gauge. File view only: the served leaf is DL27	Organ	0 u
The status verb judges the certificate each name actually serves, from the estate and from one outside vantage (DL27) after DL26	nc_probe_served	DONE-RULE PRE-DECLARED 2026-10-03: one TLS handshake per manifest row with that SNI (composing the probe the renewer already uses), the served notAfter compared with the file's; a stale served copy, a wrong certificate and an unreachable name each get their own state; one outside vantage row so a split-horizon answer cannot acquit the public one. Witness: on 2026-10-03 the page verifier read UNOBSERVABLE tls-handshake for the expired name and raised nothing	Organ	1.5 u
Install as a verb: validated pair, content-addressed files, key mode 0600, manifest row swap under a lock with a backup, served-leaf verify, automatic rollback (DL28) after DL26,DL27	nc_install	DONE-RULE PRE-DECLARED 2026-10-03: nx_cert install <domain> <chain> <key> refuses a chain that does not parse, does not cover the domain, is not yet valid, or whose key does not match the leaf; writes both files under content-addressed names with the key at 0600; swaps the one manifest row atomically with a named backup; verifies the served leaf (DL27) for that domain and every other row; restores the backup on any failure. Witness: the 2026-09-27 and 2026-10-03 installs were hand edits of the manifest	Organ	2 u
Renewal on the estate's own clock: the CA's renewal window (ARI) first, one third of lifetime remaining as the fallback, one name per pass, a blind beat alarms (DL29) after DL22,DL28	nc_renew	DONE-RULE PRE-DECLARED 2026-10-03: a clock row asks each certificate's renewal window [rfc9773-ari] and renews inside it; with no answer it renews when one third of the lifetime remains, the timing the CA itself expects as default lifetimes fall from 90 to 64 to 45 days [le-feed-2026-09] under the 47-day ceiling due March 2029 [cabf-sc081v3]; issue (DL22), install (DL28) and verify are the same verbs a seat would call; the beat stamps every pass including a refusal, and the gauge reads BLIND when the stamp is stale	Organ	3 u
Short-lifetime drill: the whole renew loop proven on a 160-hour certificate before the 45-day default arrives (DL30) after DL29	nc_shortlived_drill	DONE-RULE PRE-DECLARED 2026-10-03: one non-production name runs on the CA's shortlived profile [le-feed-2026-09] and is renewed by DL29 for 30 consecutive days with zero manual steps and zero served-expired seconds, measured by DL27	Organ	1.5 u
Private keys are owner-only: every key 0600, the status verb reports the mode and never calls a wider key OK (DL31) after DL26	nc_key_mode	DONE-RULE PRE-DECLARED 2026-10-03: nx_cert status stats each row's key file and reports KEY-EXPOSED for any mode wider than 0600; install (DL28) writes 0600. Witness measured 2026-10-03 over the ssh lane: le_andelinwest_ecdsa_key.bin and le_nishifamily_ecdsa_key.bin are mode 755	Organ	0.5 u

Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read FRESH against the current month 2026-10.

Bar freshness, counted
Class	Count	Note
bars	1	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	1	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	1	RECONCILED: the parts sum to the total 1
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 34. Rank input binding: STALE_OR_INVALID_BINDING. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 0a3cc9e3542da4f859adc6e87f812914d86732b609d9c3e1b347990eac097fe7. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 34 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

DP0 — Never-brick deploy
Prerequisites: None declared; this does not establish execution eligibility.
Contract: deploy_status
Acceptance: Stage, promote, async health watchdog, auto-rollback -- LANDED and self-applied
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DP1 — Instant rollback
Prerequisites: DP0 (acceptance unverified)
Contract: ma_do_rollback
Acceptance: .prev restore via POST /api/rollback -- LANDED (symbol corrected 2026-09-02: `rollback` was a word, ma_do_rollback is the handler)
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DP2 — Fail-closed target registry
Prerequisites: None declared; this does not establish execution eligibility.
Contract: md_upload_target_ok
Acceptance: Every deployable target allowlisted by name -- LANDED
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL1 — Blue-green warm slots
Prerequisites: DP0 (acceptance unverified)
Contract: bg_slot_switch
Acceptance: Two installed slots per daemon, the idle one warmed by the health probe before the SNI route flips; gate proves a flip under a synthetic request stream drops zero requests and a failed warm-up never flips
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL2 — Weighted canary
Prerequisites: DL1 (acceptance unverified)
Contract: dc_weight_shift
Acceptance: Route a declared permil of new connections to the warm slot and advance the weight only while the watchdog stays GREEN; gate proves a RED at 100 permil rolls the weight back to zero and records it
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL3 — Preview per change
Prerequisites: DP0 (acceptance unverified)
Contract: dp_preview_spawn
Acceptance: A staged .new binary runs on an ephemeral port behind the operator login with its own route, torn down on promote or expiry; gate proves the preview serves the staged bytes while live serves the promoted bytes, byte-verified both
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL4 — Declared-state reconciler
Prerequisites: DP2 (acceptance unverified)
Contract: go_reconcile_desired
Acceptance: A signed desired-state file (targets, versions by sha, routes) reconciled against the live plane on a beat through the existing promote and deploy doors; drift is REPORTED with the diff and applied only when the file says apply; gate proves a declared sha converges and a tampered file is refused by signature
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL5 — Secrets rotation
Prerequisites: DL4 (acceptance unverified)
Contract: ds_rotate_secret
Acceptance: Secrets referenced by name from the desired state, rotated on a declared schedule with the old value kept readable for the grace window and the rotation recorded; gate proves a daemon keeps serving through a rotation and a revoked secret is refused after the window
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL6 — Second-node placement
Prerequisites: DL4 (acceptance unverified)
Contract: rg_place_service
Acceptance: Place a service on a second sovereign host from the same desired state, with the SNI router fronting both; gate proves a request reaches the second node and a node loss routes back within the watchdog window
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL7 — Scale to zero
Prerequisites: DL1 (acceptance unverified)
Contract: as_scale_to_zero
Acceptance: An always-on daemon declared idle-capable is stopped after a declared idle window and respawned on first connection by the router; gate proves zero process while idle and a first request served within the declared cold-start bound
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL8 — Reconcile the rollback census with the chain that actually exists
Prerequisites: None declared; this does not establish execution eligibility.
Contract: dj_count_prev_chain
Acceptance: REWRITTEN 2026-09-01 WITHIN THE HOUR, BECAUSE ITS FIRST PREMISE WAS WRONG AND READING THE SOURCE REFUTED IT. I filed this as build pre-deploy banking, on the strength of deployjrnl.status reading at_risk=1914 of rollback_slots=1938 against floor=1745 with irreplaceable_evictions=2. THE BANKING ALREADY EXISTS: hc_promote_to_expect has carried a DURABLE ROLLBACK CHAIN since 2026-08-21 -- it rotates .prev to .prev2 before overwriting .prev, so TWO generations survive, and when .prev2 is finally dropped it ANNOUNCES the loss with the artifact size rather than losing it silently. Its own comment cites the same two-deploy measurement I re-derived. Verified against this seat's own two docportal deploys today: the original generation is at .prev2, and the manual hash-verified banks taken beside it were belt-and-braces, not the safety net. SO THE REAL QUESTION IS THE INSTRUMENT, NOT THE MECHANISM: at_risk counts targets with no entry in a separate bank directory (bank_files_scanned=88 bank_size_matched=34) while the mechanism that actually protects rollback is the .prev and .prev2 chain, which that count appears not to read. A RED that measures a different subject from the property it names is the estate's own wrong-subject defect, and it is worse than no metric because 1914 of 1938 reads as catastrophe and gets ignored. DONE-RULE: nx_deployjrnl classifies a target by the chain it actually has -- PREV-ONLY, PREV-PLUS-PREV2, or NEITHER -- the partition SUMS to rollback_slots, the floor is re-derived against the corrected subject rather than kept from the old one, and a target with a live .prev2 is NOT counted at risk. Only then is a genuine residual a worklist
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL9 — The build queue dedupes by target
Prerequisites: None declared; this does not establish execution eligibility.
Contract: bq_dedupe_target
Acceptance: CORRECTED 2026-09-02 by a whole-plane measurement: 231 deployq- rows, 231 distinct ids, zero duplicate BQ rows -- the enqueue is ALREADY idempotent by id (nx_store_put re-puts by id), so the claim that a well-behaved caller multiplies the queue was wrong; the 2026-09-01 pileup (procs_running=31) was concurrent SYNC re-issues under separate per-target leases. The half that stands is the done-rule's second clause, re-scoped: a sync build that succeeds CLOSES any queued BQ row for its target, proven by a gate that enqueues one target twice, asserts one row and one fire, and proves a sync success leaves no live queued row behind. The runner-refusal half of the pileup is closed on the loadgov board (LV10 ma_runner_refused, 2026-09-02)
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL10 — Resumable artifact upload that survives a dropped chunk
Prerequisites: None declared; this does not establish execution eligibility.
Contract: cc_resume_from_status
Acceptance: MEASURED 2026-09-04: a 410443 byte ship lost chunk 7 of 9 to a transient on a degraded array and discarded the WHOLE transfer, because the client restarts rather than resumes. The server ALREADY exposes the resume source as nx_content_put status id and the client never calls it, so this is a client gap and not a protocol gap. Industry bar is the OCI Distribution Spec chunked blob upload which resumes from the last accepted byte range, and S3 multipart per-part retry. DONE-RULE: nx_content_put_client queries status before sending, sends only the missing indices, and a gate proves it by interrupting a transfer mid-chunk and showing the retry sends STRICTLY FEWER chunks than the first attempt while the committed whole-file sha still matches
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL11 — Abandoned upload staging is reaped on a declared TTL
Prerequisites: DL10 (acceptance unverified)
Contract: cp_reap_stale
Acceptance: MEASURED 2026-09-04: knowledge/contentput held 82 entries, roughly 40 of them bare meta files from begins that never received a chunk, the oldest about eleven days back, with no reaper anywhere. A failed put leaves server-side state and announces nothing, so the leak is invisible until someone lists the directory. The INFLOW cause is now fixed (the transport ceiling that made large chunks impossible), so what remains is historical debt plus whatever future transients leave. Industry bar is the S3 lifecycle rule AbortIncompleteMultipartUpload and the OCI upload session timeout. DONE-RULE: the reaper removes only transfers whose meta is older than a TTL READ FROM CONF and which hold no committed chunks, the reaped count is announced, and a neg-control proves an in-flight transfer is NEVER reaped
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL12 — The shared HTTPS post path follows an async job pointer so every caller inherits it
Prerequisites: None declared; this does not establish execution eligibility.
Contract: hp_follow_job
Acceptance: Census 2026-09-04: of 89 organs that post a tools call, 8 follow the JOB-STARTED pointer and 81 do not. That 81 is a CEILING ON EXPOSURE, not a defect count, because a blind caller only breaks when the edge actually promotes its call. Fixing 81 sites by hand is 81 chances to drift; putting the follow inside hp_post_json makes it structural, which is the same reason nx_jobfollow_lib is one shared follower rather than a copy in each content client. The open question is CAPABILITY not code: the follower needs a read cap for the job artifact and most callers hold none. DONE-RULE: hp_post_json follows when a read capability is resolvable and returns the RAW response unchanged when it is not, never a silent zero, proven by a gate exercising both branches plus a neg-control showing an existing capless caller is byte-identical to today
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL13 — Destructive operations are rate-limited against the store's own history and refused above the band
Prerequisites: None declared; this does not establish execution eligibility.
Contract: ds_destruction_breaker
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Counts deletes, withdrawals and retires per unit time against a band derived from history [@cf-outage-feb26]; REFUSES above it naming the rule and stamping to an argument-derived path. Bite: a planted burst must be refused; a planted trickle must pass.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL14 — A target is built twice in one lane and the promote is refused if the artifacts differ
Prerequisites: None declared; this does not establish execution eligibility.
Contract: ds_build_twice
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Two builds, byte compare, refusal names the first differing offset [@debian-repro-gate26]. Positive control: a known-deterministic target promotes; negative control: a planted timestamp in the source must be refused.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL15 — A promote is refused for any artifact whose closure root is unrecorded
Prerequisites: DL14 (acceptance unverified)
Contract: ch_promote_refuse
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. The build record's single committed digest must exist beside the artifact [@repro-not-enough26] [@kettle26]; a planted artifact with the record deleted must be refused; the same artifact with the record present must promote.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL16 — The registry verifier refuses a signature under an unauthorised key, by name
Prerequisites: None declared; this does not establish execution eligibility.
Contract: rs_unauth_key_bite
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. A signature valid under a key the policy does not authorise is refused with the rule named [@cosign-releases]; a signature under an authorised key still verifies. The refusal is the tooth; acceptance alone proves nothing.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL17 — The rollback action's dependency chain is resolved and refused if it traverses the subject
Prerequisites: None declared; this does not establish execution eligibility.
Contract: dr_rollback_chain
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. Chain resolved from proxy_routes.conf and daemons.reg [@cp-sovereignty26]; a planted rollback whose path crosses the subject must be refused; one that does not must pass. Run before every deploy on the request path.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL18 — Every conf reader holds its last-known-good and stamps LKG-HELD on a rejected file
Prerequisites: None declared; this does not establish execution eligibility.
Contract: hc_lkg_conf
Acceptance: DONE-RULE PRE-DECLARED 2026-09-04. On parse or validation failure the organ continues on the banked conf and stamps LKG-HELD with the rejected hash [@azure-ykyn]; a planted corrupt conf must leave serving unchanged and the stamp present.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL19 — Domain spin-up as a sovereign MCP verb (retires nx_domain_spinup.sh)
Prerequisites: None declared; this does not establish execution eligibility.
Contract: ds_spinup
Acceptance: DONE-RULE PRE-DECLARED 2026-09-21: nx_domain_spinup <domain> [plane] registered on the MCP surface performs plane, release-managed docroot with the coming-soon template, lifecycle row, SNI cert manifest row, property_registry route and sites.conf vhost, then verifies 200 + cert CN + the tenancy gate, idempotent on re-run; the shell script becomes a thin wrapper or retires. Witness: gospelofwest.com was spun up by the .sh over ssh from a laptop organ, so the seat drove the estate instead of calling it.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL20 — Release stage, golive and rollback as a sovereign MCP verb (retires nx_domain_release.sh)
Prerequisites: DL19 (acceptance unverified)
Contract: dr_golive
Acceptance: DONE-RULE PRE-DECLARED 2026-09-21: nx_domain_release with verbs stage, golive, rollback, status on the MCP surface; golive flips the lifecycle row to production, repoints current, verifies, runs the tenancy gate and auto-rolls-back on RED exactly as the script does today.
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL21 — Split-horizon LAN DNS row from the estate (nx_router_ctl dnsadd), never a laptop ssh organ
Prerequisites: None declared; this does not establish execution eligibility.
Contract: rc_dnsadd
Acceptance: DONE-RULE PRE-DECLARED 2026-09-21: nx_router_ctl dnsadd <domain> <ip> writes the dnsmasq address row on the GL.iNet router and restarts dnsmasq, idempotent, with dnsdel as the reverse gear. Witness: gospelofwest.com needed the laptop-local nx_aw_routerfix over ssh because the estate has no DNS verb.
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL22 — Certificate issuance as a sovereign MCP verb on the NAS, credential custody decided first
Prerequisites: None declared; this does not establish execution eligibility.
Contract: ci_issue
Acceptance: DONE-RULE PRE-DECLARED 2026-09-21: nx_cert_issue <domain> on the MCP surface runs the proven DNS-01 wildcard loop (nx_acme_dns01_issue) on the NAS and installs certs/le_<domain>_* plus the manifest row; the edge hot-reloads. PRECONDITION NAMED, NOT ASSUMED: the Porkbun API credentials live only in the laptop's machine-bound vault today, so the operator decides NAS-side custody before this verb can exist. Witness: the gospelofwest.com cert was issued on the laptop and pushed by nx_aw_send.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL23 — Self-service door behind the login: add a domain bought at Porkbun
Prerequisites: DL19 (acceptance unverified), DL22 (acceptance unverified)
Contract: dp_add_domain
Acceptance: DONE-RULE PRE-DECLARED 2026-09-21 (operator: behind the login set a url i purchased through porkbun): a gated nishifamily.com route behind the opaque login wall, with X-Nishi-Session validated IN the daemon, takes a domain the operator already bought at Porkbun, verifies ownership through the Porkbun API listAll, sets the apex and www A records to the WAN IP, issues the certificate (DL22), spins the domain up (DL19) and shows each step's receipt plus the live coming-soon URL; every step is the same MCP verb a seat would call, so the page is a caller and never a second implementation.
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL24 — Site from a blueprint, self-service: choose or edit a blueprint, emit, stage, preview, go live
Prerequisites: DL20 (acceptance unverified), DL23 (acceptance unverified)
Contract: dp_site_from_blueprint
Acceptance: DONE-RULE PRE-DECLARED 2026-09-21: behind the same login the operator picks or edits a .site blueprint for a spun-up domain; the page runs nx_site_build into the next release, offers a preview host, and golive (DL20) is the approval click. The emitter itself carries no client sentence any more (generalised 2026-09-21, byte-identical on andelinwest.site).
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL25 — The whole launch as ONE seeded plan_run plane
Prerequisites: DL19 (acceptance unverified), DL20 (acceptance unverified), DL21 (acceptance unverified), DL22 (acceptance unverified)
Contract: dl_launch_plane
Acceptance: DONE-RULE PRE-DECLARED 2026-09-21: nx_plan_run domainlaunch-<domain> walks verify-ownership, DNS, cert, spin-up, emit, stage, golive, verify as steps with receipts, so a crash leaves a ledger on the NAS and a second seat resumes at the failed step; the gospelofwest.com launch of 2026-09-21 is the reference walk.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL26 — Every certificate the edge serves is watched from its own manifest: a state per domain, a stamp, a daily beat
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nc_scan
Acceptance: LANDED 2026-10-03: nx_cert status (organ nx_cert, lib nx_cert_lib, gate nx_cert_gate 22 of 22) reads certs/sni_certs.manifest, judges each chain file on seconds, prints a summing partition, writes knowledge/status/cert_status.stamp in the gauge grammar and exits 0 GREEN, 1 RED, 3 UNOBSERVABLE; clock row certstatus daily; gauge row on deploy.gauge. File view only: the served leaf is DL27
Authored effort: 0. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL27 — The status verb judges the certificate each name actually serves, from the estate and from one outside vantage
Prerequisites: DL26 (acceptance unverified)
Contract: nc_probe_served
Acceptance: DONE-RULE PRE-DECLARED 2026-10-03: one TLS handshake per manifest row with that SNI (composing the probe the renewer already uses), the served notAfter compared with the file's; a stale served copy, a wrong certificate and an unreachable name each get their own state; one outside vantage row so a split-horizon answer cannot acquit the public one. Witness: on 2026-10-03 the page verifier read UNOBSERVABLE tls-handshake for the expired name and raised nothing
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL28 — Install as a verb: validated pair, content-addressed files, key mode 0600, manifest row swap under a lock with a backup, served-leaf verify, automatic rollback
Prerequisites: DL26 (acceptance unverified), DL27 (acceptance unverified)
Contract: nc_install
Acceptance: DONE-RULE PRE-DECLARED 2026-10-03: nx_cert install <domain> <chain> <key> refuses a chain that does not parse, does not cover the domain, is not yet valid, or whose key does not match the leaf; writes both files under content-addressed names with the key at 0600; swaps the one manifest row atomically with a named backup; verifies the served leaf (DL27) for that domain and every other row; restores the backup on any failure. Witness: the 2026-09-27 and 2026-10-03 installs were hand edits of the manifest
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL29 — Renewal on the estate's own clock: the CA's renewal window (ARI) first, one third of lifetime remaining as the fallback, one name per pass, a blind beat alarms
Prerequisites: DL22 (acceptance unverified), DL28 (acceptance unverified)
Contract: nc_renew
Acceptance: DONE-RULE PRE-DECLARED 2026-10-03: a clock row asks each certificate's renewal window [@rfc9773-ari] and renews inside it; with no answer it renews when one third of the lifetime remains, the timing the CA itself expects as default lifetimes fall from 90 to 64 to 45 days [@le-feed-2026-09] under the 47-day ceiling due March 2029 [@cabf-sc081v3]; issue (DL22), install (DL28) and verify are the same verbs a seat would call; the beat stamps every pass including a refusal, and the gauge reads BLIND when the stamp is stale
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL30 — Short-lifetime drill: the whole renew loop proven on a 160-hour certificate before the 45-day default arrives
Prerequisites: DL29 (acceptance unverified)
Contract: nc_shortlived_drill
Acceptance: DONE-RULE PRE-DECLARED 2026-10-03: one non-production name runs on the CA's shortlived profile [@le-feed-2026-09] and is renewed by DL29 for 30 consecutive days with zero manual steps and zero served-expired seconds, measured by DL27
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
DL31 — Private keys are owner-only: every key 0600, the status verb reports the mode and never calls a wider key OK
Prerequisites: DL26 (acceptance unverified)
Contract: nc_key_mode
Acceptance: DONE-RULE PRE-DECLARED 2026-10-03: nx_cert status stats each row's key file and reports KEY-EXPOSED for any mode wider than 0600; install (DL28) writes 0600. Witness measured 2026-10-03 over the ssh lane: le_andelinwest_ecdsa_key.bin and le_nishifamily_ecdsa_key.bin are mode 755
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence deploy writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

DP0 Never-brick deploy · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`deploy_status` · executor Organ · 0 u · stands on nothing
Definition of done	Stage, promote, async health watchdog, auto-rollback -- LANDED and self-applied
Matrix cell	NO-MATRIX-ROW — no matrix row carries `deploy_status`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-02 measure nx_deploy_ready evidence-honesty BLOCK: 18 RED compare domains at session start (nx_sota_status), so every /api/deploy needed an AUDITED confirm_gate_override. Instrument: nx_swcompare_evidence per domain, verdict line in knowledge/status/evstamp_<dom>.verdict. 2026-09-02 land deploy.matrix: 6 substring symbols repointed to top-level funcs (ma_do_deploy_status x2, cmd_buildrun, ma_do_promote_content, ma_emit_dashboard, ma_openapi) -- deploy RED to MEASURED-HONEST. Same class closed on surveys 5 rows, stem 1, swarm 1, videocodec 2, team 2, warden 2, projectmgmt 10; surveys stem team warden re-measured MEASURED-HONEST. 2026-09-02 land nx_opaque_rfc_kat migrated onto nx_gate_verdict: three named RFC 9807 teeth (C.1.5, C.1.6, production round trip), exit carries the verdict. It printed no canonical passed N/M line so the referee read it VACUOUS pass=0/0. Build queued as BQ-nx_opaque_rfc_kat under a saturated box; promote owed, then re-run the deploy referee. 2026-09-02 land nx_opaque_rfc_kat PROMOTED 172,282 B sha 5079e416 (allow_capability_loss=yes: the two lost runs are its own retired GREEN/FAILED literals, superseded by the canonical gv_verdict line); /api/gate_run passed 3/3 verdict=GREEN; deploy referee re-run MEASURED-HONEST with vacuous=0. The OPAQUE exceed row is now backed by an executed, readable proof instead of a pass=0/0. 2026-09-02 lesson A SUBSTRING GROUNDS A CLAIM ONLY UNTIL THE RULER GETS STRICTER: 31 board rows across 9 domains named routes, CSS classes and comment words as their symbol; the one-symbol ruler (sd_present) made every one UNGROUNDED and the deploy gate blocked on it fleet-wide. A symbol is a top-level func or an _ABSENT_ contract, never a word that happens to appear in the file. 2026-09-02 queue Still RED: automation (nx_sclass_dispatch_gate convicted its subject on a builder ADMISSION refusal; source now gv_need SKIPs on rc=4, build queued), swarm (nx_swarm_tend_gate old-generation binary hangs in the referee; rebuild queued), smallos (fewer than 5 measured axes: a content gap), doctor mangagen koikatsu autodev (re-measure pending).

DP1 Instant rollback · cell PRESENT · gate UNRECORDED

Contract	`ma_do_rollback` · executor Organ · 0 u · stands on DP0
Definition of done	.prev restore via POST /api/rollback -- LANDED (symbol corrected 2026-09-02: `rollback` was a word, ma_do_rollback is the handler)
Matrix cell	Instant rollback to the previous generation · `runtime/_hdl_build/nx_mgmt_api.nx` · PRESENT decl
Gate	`nx_mgmt_api_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_mgmt_gaterun_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-02 land symbol corrected from the bare word rollback to ma_do_rollback and a matrix row added, so the ranker can price the rung it had been reporting UNMAPPED 2026-09-03 land the BEHIND drain now has a governed driver: nx_ship_fleet (SHIPPED 8c5ada31, registered; gate nx_ship_fleet_gate 19/19) forks nx_organ_ship per target at an AIMD-governed width (polite budget ceiling, halve on a build-admission refusal, pause on serve-first), so every promote still passes prove + adoptgate. Today's census (nx_artifactdrift): 233 BEHIND (186 gates), 41 AHEAD (never promote). Worklist knowledge/status/fleet_targets_gates_0902.txt (186 gates); plan-mode run at load 19.6 read rg_budget=0 admit=REFUSE width=0 (forked nothing, correctly); clock row fleet_drain_gates at 86400 s runs the drain whenever the box has headroom. The non-gate BEHIND rows (47) stay a hand-adjudicated list: nx_organ_ship rebuilds and the adoptgate refuses any loss, but a daemon in that set must go through the health-checked deploy, never the fleet 2026-09-08 land Scoped page-publisher retry repair: nx_site_publish promoted1788842921 hash01baf9e5e98319d1a6b569708dcd4364f37da4c1a829b95503787be272b5abe0. Isolated11/11 gate2699. Live749670B Beach retry2930 UNCHANGED writes=0; previous746862B page hash remained0b5c424f94440bcd2e3cc3f80950d7e164691b14c9dbe449ae050da96b67cb29 at2976. Preserves last different .prev on identical retry. Not multi-artifact rollback or concurrent transaction guarantee; those remain open. Build-to-serve and visual receipt automation remain gaps. 2026-09-08 measure Artifact-reference candidate in existing nx_game_page_emit rebind: native local10/10 gate and actual749913B Beach page reproduced byte-exact in0.066s from SHA-pinned page/WASM references. Not promoted: concurrent new-output creation race still requires hardening; NAS builds refused admission with no queue. Reference https://bazel.build/remote/caching supports action metadata/content-addressed outputs; no parity benchmark or SOTA claim. Public publisher retry repair remains delivered. 2026-09-08 measure Artifact-reference concurrency hardened in candidate: native exclusive scratch plus Linux RENAME_NOREPLACE,12/12 gate on WSL Linux/tmp with competing-writer test. Windows/mnt/c rejects errno-22 and no overwrite fallback. Actual749913B Beach rebind SHAverified after fix. Host source synchronized but unpromoted: fresh ioconfirm4235 measured9 over12s; build4256 refused at age2s, so current pressure refusal not solely stale data. No threshold changes or SOTA claim. 2026-09-08 measure Guarded publisher candidate adds artifact and live SHA pins, target ownership, idempotent retry and scoped reverse. Local native20/20 and actual764950-byte Beach isolated publish/readback pass. Host artifact124207B matches local gate hash783092f4b170f686bf06d1e8a5d2195dde0a9c976fd1fcee5e8a5ac4ae623e5d; host gate attempts2270 and2526 timed out during writes, so NOT promoted. Host publisher build2480 completed with no-cache diagnostic after fresh admission; staged130648B hash87b9f4f4f1f11b31fc9c5ba7b3339d3ca8e504ca210d82f7c7af398fd94d2052. Earlier gate build1788 stored its correct binary then timed out after300000ms. Source audit: post-store cache pruning reads every payload to count bytes; metadata-only candidate compiles and passes isolated cold/warm build with64MiB logical cache payload and executable result42. Actual host latency cause and cache candidate adoption remain unverified. September2026 hot-update and delivery requirements B26-HOT/STREAM/DELIVERY/REVIEW are in sovereign-human-world-contract-20260907.md. No public Beach graphics or deployment SOTA claim.

DP2 Fail-closed target registry · cell PRESENT · gate NO-GATE-DECLARED

Contract	`md_upload_target_ok` · executor Organ · 0 u · stands on nothing
Definition of done	Every deployable target allowlisted by name -- LANDED
Matrix cell	Fail-closed deploy-target registry · `runtime/_hdl_build/nx_mgmt_data.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_mgmt_data`; declare `nx_mgmt_data TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DL1 Blue-green warm slots · cell WATCHING · gate NO-GATE-DECLARED

Contract	`bg_slot_switch` · executor Organ · 1.5 u · stands on DP0
Definition of done	Two installed slots per daemon, the idle one warmed by the health probe before the SNI route flips; gate proves a flip under a synthetic request stream drops zero requests and a failed warm-up never flips
Matrix cell	Blue-green dual-slot instant switch · `runtime/nx_deploy_bluegreen.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deploy_bluegreen`; declare `nx_deploy_bluegreen TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DL2 Weighted canary · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dc_weight_shift` · executor Organ · 1.5 u · stands on DL1
Definition of done	Route a declared permil of new connections to the warm slot and advance the weight only while the watchdog stays GREEN; gate proves a RED at 100 permil rolls the weight back to zero and records it
Matrix cell	Canary and progressive traffic shifting · `runtime/nx_deploy_canary.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deploy_canary`; declare `nx_deploy_canary TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DL3 Preview per change · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dp_preview_spawn` · executor Organ · 1 u · stands on DP0
Definition of done	A staged .new binary runs on an ephemeral port behind the operator login with its own route, torn down on promote or expiry; gate proves the preview serves the staged bytes while live serves the promoted bytes, byte-verified both
Matrix cell	Preview environments per change · `runtime/nx_deploy_preview.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deploy_preview`; declare `nx_deploy_preview TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DL4 Declared-state reconciler · cell WATCHING · gate NO-GATE-DECLARED

Contract	`go_reconcile_desired` · executor Organ · 2 u · stands on DP2
Definition of done	A signed desired-state file (targets, versions by sha, routes) reconciled against the live plane on a beat through the existing promote and deploy doors; drift is REPORTED with the diff and applied only when the file says apply; gate proves a declared sha converges and a tampered file is refused by signature
Matrix cell	GitOps declared-state reconciler · `runtime/nx_deploy_gitops.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deploy_gitops`; declare `nx_deploy_gitops TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DL5 Secrets rotation · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ds_rotate_secret` · executor Organ · 1 u · stands on DL4
Definition of done	Secrets referenced by name from the desired state, rotated on a declared schedule with the old value kept readable for the grace window and the rotation recorded; gate proves a daemon keeps serving through a rotation and a revoked secret is refused after the window
Matrix cell	Secrets manager with rotation · `runtime/nx_deploy_secrets.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deploy_secrets`; declare `nx_deploy_secrets TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DL6 Second-node placement · cell WATCHING · gate NO-GATE-DECLARED

Contract	`rg_place_service` · executor Organ · 4 u · stands on DL4
Definition of done	Place a service on a second sovereign host from the same desired state, with the SNI router fronting both; gate proves a request reaches the second node and a node loss routes back within the watchdog window
Matrix cell	Multi-node and multi-region placement · `runtime/nx_deploy_region.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deploy_region`; declare `nx_deploy_region TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DL7 Scale to zero · cell WATCHING · gate NO-GATE-DECLARED

Contract	`as_scale_to_zero` · executor Organ · 2 u · stands on DL1
Definition of done	An always-on daemon declared idle-capable is stopped after a declared idle window and respawned on first connection by the router; gate proves zero process while idle and a first request served within the declared cold-start bound
Matrix cell	Autoscale including scale-to-zero · `runtime/nx_deploy_scale.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deploy_scale`; declare `nx_deploy_scale TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DL8 Reconcile the rollback census with the chain that actually exists · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dj_count_prev_chain` · executor Organ · 1.5 u · stands on nothing
Definition of done	REWRITTEN 2026-09-01 WITHIN THE HOUR, BECAUSE ITS FIRST PREMISE WAS WRONG AND READING THE SOURCE REFUTED IT. I filed this as build pre-deploy banking, on the strength of deployjrnl.status reading at_risk=1914 of rollback_slots=1938 against floor=1745 with irreplaceable_evictions=2. THE BANKING ALREADY EXISTS: hc_promote_to_expect has carried a DURABLE ROLLBACK CHAIN since 2026-08-21 -- it rotates .prev to .prev2 before overwriting .prev, so TWO generations survive, and when .prev2 is finally dropped it ANNOUNCES the loss with the artifact size rather than losing it silently. Its own comment cites the same two-deploy measurement I re-derived. Verified against this seat's own two docportal deploys today: the original generation is at .prev2, and the manual hash-verified banks taken beside it were belt-and-braces, not the safety net. SO THE REAL QUESTION IS THE INSTRUMENT, NOT THE MECHANISM: at_risk counts targets with no entry in a separate bank directory (bank_files_scanned=88 bank_size_matched=34) while the mechanism that actually protects rollback is the .prev and .prev2 chain, which that count appears not to read. A RED that measures a different subject from the property it names is the estate's own wrong-subject defect, and it is worse than no metric because 1914 of 1938 reads as catastrophe and gets ignored. DONE-RULE: nx_deployjrnl classifies a target by the chain it actually has -- PREV-ONLY, PREV-PLUS-PREV2, or NEITHER -- the partition SUMS to rollback_slots, the floor is re-derived against the corrected subject rather than kept from the old one, and a target with a live .prev2 is NOT counted at risk. Only then is a genuine residual a worklist
Matrix cell	Rollback census classifies each target by the chain it actually has (PREV-ONLY, PREV-PLUS-PREV2, NEITHER) with a partition that sums · `runtime/nx_deployjrnl.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deployjrnl`; declare `nx_deployjrnl TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land matrix watch row admitted for dj_count_prev_chain (the chain-classifying census the rung's own text specifies), so DL8 stops reading UNMAPPED and the ranker prices it against the platforms' revision-history bar

DL9 The build queue dedupes by target · cell LANDED · gate NO-GATE-DECLARED

Contract	`bq_dedupe_target` · executor Organ · 0.5 u · stands on nothing
Definition of done	CORRECTED 2026-09-02 by a whole-plane measurement: 231 deployq- rows, 231 distinct ids, zero duplicate BQ rows -- the enqueue is ALREADY idempotent by id (nx_store_put re-puts by id), so the claim that a well-behaved caller multiplies the queue was wrong; the 2026-09-01 pileup (procs_running=31) was concurrent SYNC re-issues under separate per-target leases. The half that stands is the done-rule's second clause, re-scoped: a sync build that succeeds CLOSES any queued BQ row for its target, proven by a gate that enqueues one target twice, asserts one row and one fire, and proves a sync success leaves no live queued row behind. The runner-refusal half of the pileup is closed on the loadgov board (LV10 ma_runner_refused, 2026-09-02)
Matrix cell	Superseded builds are deduped, not queued twice · `runtime/_hdl_build/nx_buildq.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_buildq`; declare `nx_buildq TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land bq_dedupe_target SHIPPED in nx_buildq: the row finder is a pure function of the plane dump (exact id, BQ-t1 never matches BQ-t10), a second add of one target now says ALREADY-QUEUED and replaces by id, and a new verb `close <target> [rc]` marks a queued row closed IN PLACE with the reason so the poller can never rebuild a source another door already built; fired, closed and absent rows are named, never invented (NOT-QUEUED, NO-ROW, exit 0). Gate nx_buildq_gate 13 of 13 GREEN against the real nx_store_put on fixture planes; laptop _offc installed; NAS sources landing 2026-09-02 queue the second clause of the done-rule, the SYNC build door closing the row itself, is a one-line fork of nx_buildq close after the BUILT receipt in nx_mgmt_api ma_do_build; the source edit is next and its deploy waits on build admission (the box has refused every build today, load 22 to 34 against a 16 ceiling) 2026-09-07 land Scoped compare publication released: canonical nx_compare_regen accepts one existing --domain, preserving full mode by default. SHAed268c61a7fa4e6fe1dc0943634acfc81bd3eee929a3d557169d679e71396dd0 promoted job1788804763. Parser49/49; selected team isolation verified by unchanged unrelated hashes; canonical ecosystem5150 and sovereignty5265 published with zero failures. Domain scope receipts state aggregates not refreshed. This is scoped execution, not automatic dependency invalidation or deferred-request recovery. 2026-09-07 land Release feedback generator deployed: existing dated plan worklogs now produce a Latest recorded release summary and retained Release history and work log link on generated domain pages with plans. Native tests31/31 include actual deploy.plan, chronological selection, escaped text and invalid/future records. Matrix71d7039766b887e7d00440a7fa5c2538654c2734b6861ee1175081a8638ef9c7 promoted6767; actual publisher _offc copy restaged6870 and independently matched6879. UI visual acceptance pending; hub/radar/planless pages are outside this renderer. Each page updates on its next scoped publication.

DL10 Resumable artifact upload that survives a dropped chunk · cell LANDED · gate NO-GATE-DECLARED

Contract	`cc_resume_from_status` · executor Organ · 2 u · stands on nothing
Definition of done	MEASURED 2026-09-04: a 410443 byte ship lost chunk 7 of 9 to a transient on a degraded array and discarded the WHOLE transfer, because the client restarts rather than resumes. The server ALREADY exposes the resume source as nx_content_put status id and the client never calls it, so this is a client gap and not a protocol gap. Industry bar is the OCI Distribution Spec chunked blob upload which resumes from the last accepted byte range, and S3 multipart per-part retry. DONE-RULE: nx_content_put_client queries status before sending, sends only the missing indices, and a gate proves it by interrupting a transfer mid-chunk and showing the retry sends STRICTLY FEWER chunks than the first attempt while the committed whole-file sha still matches
Matrix cell	Resumable artifact upload that survives a dropped chunk instead of restarting the transfer · `runtime/nx_content_put_client.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_content_put_client`; declare `nx_content_put_client TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-04 measure 410443 byte ship lost chunk 7 of 9 and discarded the transfer; server exposes status id as a resume source that the client does not call 2026-09-04 land the IN-FLIGHT half shipped and SALVAGED A REAL TRANSFER on its first production occurrence: `CC-CHUNK retry index 1 attempt 1 of 3` then `E2E OK 9 of 9` on a 411177 byte ship. A chunk is addressed by index so a re-send is idempotent, and retrying one index costs ONE request where the old restart cost nine -- an amplifier in reverse on a degraded array. CROSS-PROCESS RESUME REMAINS OPEN and the code says so in place, so nobody reads this as closing the rung 2026-09-04 lesson the first live run of the retry EXPOSED A DEFECT THE RETRY ITSELF INTRODUCED: the receiver answers CP-CHUNK DUPLICATE-IDENTICAL for a byte-identical re-send (nx_content_put.nx:510) and the client accepted only CP-CHUNK OK, so a SUCCESS read as a refusal and aborted a live transfer -- briefly making the retry worse than no retry. Both spellings are now read from the server source, not guessed. SUCCESS HAVING TWO SPELLINGS IS THE SAME ONE-VOCABULARY DEFECT AS A MARKER LIST KEYED ON ONE PRODUCER 2026-09-04 land CROSS-PROCESS RESUME SHIPPED AND PROVEN ACROSS A REAL PROCESS KILL. A 200000-byte 5-chunk ship was interrupted mid-transfer; the re-run printed CP-RESUME id=1788545834533796 chunk_raw=48402 nchunks=5 still_missing=4 already_received=1 and finished E2E OK chunks_sent=4 of=5 skipped_already_received=1, with the sidecar removed on the confirmed commit. Nothing was invented client-side: chunk_raw, nchunks and the MISSING INDEX LIST all come from the server's own `status <id>`, whose header says chunk_raw travels in status ON PURPOSE because a resuming client cannot derive it 2026-09-04 measure the design guard is the DIGEST, not the size. The sidecar records the transfer id beside the LOCAL file's sha256, and a mismatch abandons it and begins fresh -- resuming a changed file would splice two generations into one artifact, byte-valid and semantically nonsense, and a size check would not catch a same-size rewrite. A resume that marks ZERO missing chunks REFUSES the skip path rather than committing whatever the server happens to hold 2026-09-04 measure CONTROL FIRST, and it is what makes the change safe to ship: with no sidecar the path is byte-for-byte what has been shipping all day -- fresh begin, every index marked missing, no CP-RESUME line, gate 8/8 GREEN. The sidecar is written BEFORE the first chunk, because a crash between begin and chunk 0 is precisely the case this feature exists for 2026-09-04 measure NEG-CONTROL PASSES DECISIVELY: with a sidecar present but the local file rewritten R->Z at the same 200000 bytes, the run printed CP-BEGIN id=1788546007675909 (a FRESH begin, not CP-RESUME) and chunks_sent=5 of=5 with no skip line. A same-size rewrite is exactly what a size check would have waved through, which is why the guard is the digest 2026-09-04 lesson my post-hoc check of the neg-control was AMBIGUOUS and I nearly read it as a failure: after the run the sidecar sha and the file sha MATCHED, because a correct fresh begin REWRITES the sidecar for the new content. The state after the event could not distinguish did-not-resume from resumed-and-updated -- only the run's own CP-BEGIN line could. READ THE EVENT, NOT THE RESIDUE, WHEN THE ACTION UNDER TEST REWRITES THE THING YOU ARE INSPECTING 2026-09-04 land CONTRACT NOW SATISFIED BY THE CODE, NOT BY EDITING THE ROW. The resume logic first shipped INLINE in main, so the published contract _ABSENT_:cc_resume_from_status named a symbol that did not exist -- the cell would have read WATCHING while the capability was live, which is exactly the mechanically-green-editorially-false mismatch the prose axis of nx_board_contract_gate exists to catch. Extracted to func cc_resume_from_status(store_i, url, spath, shahex, capraw, caplen, resp, respcap, rcraw, rclen, miss, out) returning 1 on adoption with out[] carrying id/chunk_raw/nchunks/still_missing. The _ABSENT_ spelling STAYS in the data by design; the emitter measures the symbol on every publish and flips the cell itself 2026-09-04 measure the refactor was re-proven, not assumed: post-extraction interrupt-and-resume gave CP-RESUME still_missing=2 already_received=3 then E2E OK chunks_sent=2 of=5 skipped_already_received=3, and the client gate stayed 8/8 GREEN. A REFACTOR IS A HYPOTHESIS AND MUST PASS THE EXPERIMENT IT DEMANDS

DL11 Abandoned upload staging is reaped on a declared TTL · cell WATCHING · gate UNRECORDED

Contract	`cp_reap_stale` · executor Organ · 1.5 u · stands on DL10
Definition of done	MEASURED 2026-09-04: knowledge/contentput held 82 entries, roughly 40 of them bare meta files from begins that never received a chunk, the oldest about eleven days back, with no reaper anywhere. A failed put leaves server-side state and announces nothing, so the leak is invisible until someone lists the directory. The INFLOW cause is now fixed (the transport ceiling that made large chunks impossible), so what remains is historical debt plus whatever future transients leave. Industry bar is the S3 lifecycle rule AbortIncompleteMultipartUpload and the OCI upload session timeout. DONE-RULE: the reaper removes only transfers whose meta is older than a TTL READ FROM CONF and which hold no committed chunks, the reaped count is announced, and a neg-control proves an in-flight transfer is NEVER reaped
Matrix cell	Abandoned upload staging is reaped on a declared TTL instead of accumulating forever · `runtime/nx_content_put.nx` · WATCHING decl
Gate	`nx_cdc_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-04 measure knowledge/contentput 82 entries, about 40 bare meta files from chunkless begins, oldest about eleven days, no reaper 2026-09-04 land nx_contentput_reap SHIPPED, promoted, registered and INVOKED. Production census metas=55 has_chunks=9 too_young=41 reapable=5 unknown_stat=0, partition RECONCILES; applied, reaped=5, re-census 50/reapable=0 and a second apply reaps nothing. TTL is read from conf with its PROVENANCE PRINTED on every run (CONF/ARGV/DEFAULT-derived) because this bound gates a delete. Dry-run is the default; --apply must be spelled out 2026-09-04 measure the ~40 bare metas counted on 2026-09-04 were mostly from THAT DAY -- my own failed ships before the transport fix -- so at a 7-day TTL only 5 were genuinely stale. The conservative default is doing exactly what it is for, and quoting the 40 as the reapable population would have been a same-day artefact mistaken for historical debt 2026-09-04 lesson MY FIRST NEG-CONTROL PROVED LESS THAN I CLAIMED. I ran --apply at ttl=0 to show a chunked transfer survives age, but the arg parser only accepts ttl>0, so it silently fell back to the 7-day default and the fixture NEVER REACHED THE CONDITION -- the transfer was protected by youth, not by the chunk test. Re-run at ttl=1 with too_young=0 asserted FIRST: 2222 reaped, 3333.meta and 3333.c0 survived, so the chunk test alone is what protects it. ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING THE OUTCOME 2026-09-04 retract THIS RUNG'S PREMISE WAS WRONG AND SO WAS MY ORGAN. nx_content_put ALREADY HAS A REAPER -- v_reap/cp_reap, in the producer itself, with a BETTER bound than mine: a per-transfer deadline derived from nchunks x worst_call_ms x resume_allowance, where mine was a flat TTL. It also already abstains on an untrustworthy age. My nx_spendgate check searched the registered TOOL corpus and found nothing, because the capability lives as a VERB INSIDE THE PRODUCER, where no tool-name search can see it -- the exact check-before-build failure this estate keeps paying for, committed by me while writing rules about it 2026-09-04 measure and the coverage argument for keeping mine does not survive either: knowledge/contentput/index.txt carries 278 rows against 50 directory metas, so the index is a SUPERSET and the incumbent sees everything a directory walk does. Mine is a pure duplicate with a worse bound 2026-09-04 measure THE REAL DEFECT, RESTATED: the reaper is not missing, it is BUILT AND UNWIRED -- no caller for cp_reap anywhere in runtime/ or the confs. That is a wiring gap, not a capability gap, and it is why 5 transfers sat stale for eleven days beside a working reaper 2026-09-04 lesson A CAPABILITY SEARCH OVER TOOL NAMES CANNOT SEE A VERB INSIDE AN ORGAN. nx_spendgate and nx_capsearch rank REGISTERED TOOLS; a sub-command of a shipped organ is invisible to both. Before building anything that acts on another organ's data, READ THAT ORGAN'S USAGE LINE -- the words `abort` and `reap` were in nx_content_put's own usage string the whole time 2026-09-04 land CLOSED, and not the way the rung was written. The incumbent nx_content_put reap is now WIRED via cron.reg (17 4 * * *, output to logs/contentput_reap.cron.log because a cron row that discards its output makes its own failure unobservable). My duplicate is retracted in place: nx_contentput_reap is promoted as a read-only CENSUS whose --apply REFUSES with exit 2 and names the incumbent, proven live on the NAS and bite-proven locally (a 9-day-old fixture meta that the previous binary WOULD have deleted survives). One deletion ruler in the estate, one observer beside it. 5 stale transfers already drained, 55 to 50, reapable 5 to 0, partition reconciling at every step 2026-09-04 lesson appending to cron.reg was safe ONLY because a sibling had already fixed nx_cron_reconcile: CR_REGCAP 16384 against a 24356-byte file used to drop the tail silently, so a row appended at the END would have been INERT while looking declared. That fix says in its own header that both caps are GONE, NOT RAISED, and both files are read whole via sys_read_file. CHECK THAT THE READER OF A REGISTRY READS ALL OF IT BEFORE APPENDING TO THE END OF IT

DL12 The shared HTTPS post path follows an async job pointer so every caller inherits it · cell LANDED · gate NO-GATE-DECLARED

Contract	`hp_follow_job` · executor Organ · 2 u · stands on nothing
Definition of done	Census 2026-09-04: of 89 organs that post a tools call, 8 follow the JOB-STARTED pointer and 81 do not. That 81 is a CEILING ON EXPOSURE, not a defect count, because a blind caller only breaks when the edge actually promotes its call. Fixing 81 sites by hand is 81 chances to drift; putting the follow inside hp_post_json makes it structural, which is the same reason nx_jobfollow_lib is one shared follower rather than a copy in each content client. The open question is CAPABILITY not code: the follower needs a read cap for the job artifact and most callers hold none. DONE-RULE: hp_post_json follows when a read capability is resolvable and returns the RAW response unchanged when it is not, never a silent zero, proven by a gate exercising both branches plus a neg-control showing an existing capless caller is byte-identical to today
Matrix cell	The shared HTTPS post path follows an async job pointer so every caller inherits it · `runtime/nx_https_post_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_https_post_lib`; declare `nx_https_post_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-04 measure 89 organs post a tools call, 8 follow the job pointer, 81 do not; ceiling on exposure not a defect count 2026-09-04 retract the 89-posters-81-blind census that motivated this rung was WRONG and is retracted by its author the same hour: it counted files containing the string tools/call, sweeping in 18 tool_register emitters, 17 gates asserting on envelope text and 8 SERVER-side organs that PARSE tools/call rather than send it. Discriminating experiment: classify by POST PATH instead of by string. Result over the same 90 files -- 4 post via hp_post_json, 2 roll their own record loop, 84 do not post at all, partition sums to 90. The rung therefore has NO fleet-wide leverage; it is a correctness fix for four organs 2026-09-04 land the follow now exists ONCE as hp_follow_job in nx_https_post_lib with the pure parse split into the leaf nx_jobfollow_parse to break the import cycle, and jf_post_follow delegates rather than carrying a second poll loop (measured: 1 poll loop in the post lib, 0 in the follower lib). hp_post_json is DELIBERATELY unchanged so no existing caller blocks; activation is one conventional cap file that does not yet exist, so today every caller is byte-identical 2026-09-04 lesson LABEL A POPULATION BY THE BEHAVIOUR YOU MEAN, NEVER BY THE STRING YOU GREPPED FOR -- the tell was that the census counted the SERVER as a blind client, and a membership error survives every later check because the count still reconciles 2026-09-04 measure promote refused class=CAPLOSS capability_loss_permil=69 live_tokens_absent=8 of 115 on a 425-byte shrink. ADJUDICATED BEFORE OVERRIDING, not after: nx_contentdiff named all 8 and every one is a JF- diagnostic string deliberately moved into nx_https_post_lib and renamed HP-, and the ruler independently reported symmetry=BIDIRECTIONAL with gained_by_candidate=5 -- a rename, not a loss. allow_capability_loss was then passed WITH the enumeration in hand; a future reader inheriting the flag without this row would be inheriting a habit 2026-09-04 retract a SECOND false blocker of my own retracted: I reported nx_board_contract_gate as un-promotable because local was 45414 and the NAS 63277. Those are a SOURCE size and an ELF size -- a subject mismatch, the same class as every homonym defect on this board. Source-to-source they are BYTE-IDENTICAL (45414, sha e805ed9f). It is now built, promoted and GREEN on the NAS: 105 domains, 3070 rows, 1157 contracts, partition summing exactly, ratchet at baseline 11, and the two axes added this morning firing on real data (prose_stale_source_claims=3, prose_stale_binary_claims=1) 2026-09-04 lesson A GATE THAT CANNOT FIT INSIDE ITS OWN CALLER IS INDISTINGUISHABLE FROM A FAILING GATE. Its first NAS run returned exit_code=141 verdict=RED with capture_truncated=1 -- SIGPIPE, killed mid-write, while every tooth SHOWN had passed. Cause was my own naming worklists plus the pre-existing per-contract loops, unbounded against a 1157-contract corpus and a 16384-byte capture. Capping only my two changed nothing, which is what proved the volume was elsewhere. Fully capped: 16384-truncated to 5384-complete, exit 0, GREEN. The cap ANNOUNCES itself as a prefix of its own count, because a silent cap would trade a loud wrong answer for a quiet one

DL13 Destructive operations are rate-limited against the store's own history and refused above the band · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ds_destruction_breaker` · executor Organ · 2 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Counts deletes, withdrawals and retires per unit time against a band derived from history [cf-outage-feb26]; REFUSES above it naming the rule and stamping to an argument-derived path. Bite: a planted burst must be refused; a planted trickle must pass.
Matrix cell	Rate-of-destruction circuit breaker · `runtime/_hdl_build/nx_deploy_stage.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deploy_stage`; declare `nx_deploy_stage TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-04 land September 2026 SOTA for release safety, rollback, reproducibility and attestation admitted as DATA: 14 refs pinned (deploy.refs 6763 to 12184 B, payload f3652f28ea271336), a MEASUREMENT AND ITERATION TOOLING section of 13 rows carrying 13 watch contracts (deploy.matrix 14311 to 23326 B, 7ab129262074336d), rungs DL13-DL18 under M4 ver 3.0 (deploy.plan 27463 to 29938 B, 99094170eeed8579); every append settled by the size ladder and proven single by row-unique count; NAS buildroot tree only 2026-09-04 measure referee nx_compare_refs_gate 24/24 GREEN fleet-wide after the append (job 1788557920): files=103 pins=1369 matched=1369 missing=0 marks=3491 unresolved=0 uncited_keys=0; every one of the 14 keys is cited inline, checked by the composer before the write 2026-09-04 lesson the sweep's verifier agent for this domain died to a usage limit, so every source was verified by sovereign FETCH instead (18 of 18 status 200, hashed, two 41563-byte arxiv pages proven distinct by hash not size) and every claim carries the sweep's own confidence grade in its note; a fetched and hashed page proves the source exists and says what the note quotes, it does not grade the claim's standing, so the MEDIUM rows (SHADOW, control-plane sovereignty) say MEDIUM on the page 2026-09-04 queue all six rungs are pre-declared contracts with a positive AND a negative control; none is built. By the board's own columns the leverage order is DL17 rollback dependency-chain refusal (exceed; the estate already named it from its own route table), then DL14 build-twice ratchet (cheap here: single-PT_LOAD ELFs, nothing to normalise), then DL15, DL18, DL16, DL13. The AWS negative finding is a freshness bar, not a build item: crg_index_drift on the refs gate is where it lands 2026-09-04 retract the published cite and matrix note for cf-outage-feb26 said automated rollback fired on nothing; the postmortem, read verbatim by the adversarial verifier (workflow wf_d98197e2-d2e), says the health-mediated snapshot rollout is not in production and an engineer stopped the runaway sub-task at 18:46 UTC. Cite and note corrected in place; the exceed stands because the remediation names a circuit breaker in prose; the DL13 done-rule is unchanged, it never carried the claim 2026-09-04 measure adversarial re-verification of all 18 published systems rows (workflow wf_d98197e2-d2e, 4 agents, 0 errors): CONFIRMED 15, REFUTED 3 (167 permil), UNDATED 0, UNCITABLE 0; every refutation was a paraphrased mechanism or an attribution, never a date, an id or a mirror 2026-09-04 lesson a sovereign FETCH proved 18 of 18 sources exist and say what the notes quote; it graded nothing about the paraphrased mechanism, and the re-run verifier refuted 3 of 18 on exactly that axis. A fetched and hashed page is presence evidence; the claim needs its own referee, and a verifier that dies to a usage limit must be re-run, never replaced by a pin

DL14 A target is built twice in one lane and the promote is refused if the artifacts differ · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ds_build_twice` · executor Organ · 2 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Two builds, byte compare, refusal names the first differing offset [debian-repro-gate26]. Positive control: a known-deterministic target promotes; negative control: a planted timestamp in the source must be refused.
Matrix cell	Build-determinism ratchet on the promote path · `runtime/_hdl_build/nx_deploy_stage.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_deploy_stage`; declare `nx_deploy_stage TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-04 queue cross-domain rank (workflow wf_d98197e2-d2e) orders this board differently from the queue row above and both are recorded: Tier 1 is DL14 build-twice plus DL15 closure-record refusal together (SMALL, nx_closurehash and first_diff_off exist), then DL16 the unauthorised-key bite, then DL13 the destruction breaker; DL17 rollback-chain refusal and DL18 last-known-good move to Tier 2 behind them because each needs new graph or per-daemon state; hc_reexec_fd and dr_zero_drop_swap are Tier 2 on a spare port; shadow26 state handoff is Tier 3

DL15 A promote is refused for any artifact whose closure root is unrecorded · cell WATCHING · gate UNRECORDED

Contract	`ch_promote_refuse` · executor Organ · 2 u · stands on DL14
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. The build record's single committed digest must exist beside the artifact [repro-not-enough26] [kettle26]; a planted artifact with the record deleted must be refused; the same artifact with the record present must promote.
Matrix cell	Closure manifest beside every artifact, and a promote that refuses without it · `runtime/nx_closurehash.nx` · WATCHING decl
Gate	`nx_comparetree_release_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	no log row names this rung yet

DL16 The registry verifier refuses a signature under an unauthorised key, by name · cell WATCHING · gate NO-GATE-DECLARED

Contract	`rs_unauth_key_bite` · executor Organ · 1 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. A signature valid under a key the policy does not authorise is refused with the rule named [cosign-releases]; a signature under an authorised key still verifies. The refusal is the tooth; acceptance alone proves nothing.
Matrix cell	Verifier bite: an unauthorised key must be refused by name · `runtime/_hdl_build/nx_reg_sign.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_reg_sign`; declare `nx_reg_sign TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

DL17 The rollback action's dependency chain is resolved and refused if it traverses the subject · cell WATCHING · gate UNRECORDED

Contract	`dr_rollback_chain` · executor Organ · 3 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. Chain resolved from proxy_routes.conf and daemons.reg [cp-sovereignty26]; a planted rollback whose path crosses the subject must be refused; one that does not must pass. Run before every deploy on the request path.
Matrix cell	Dependency-chain refusal for the rollback action · `runtime/_hdl_build/nx_deploy_ready.nx` · WATCHING decl
Gate	`nx_deploy_ready_scope_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-04 retract the published cite and note for cp-sovereignty26 attributed a static-stability definition (recover without the subject) and a first formalisation to arXiv 2604.14242; the paper defines management sovereignty as governing, operating, evidencing and recovering regardless of infrastructure dependencies. Cite and note corrected; DL17 and its exceed rest on the estate's own route-table measurement, which the row always named

DL18 Every conf reader holds its last-known-good and stamps LKG-HELD on a rejected file · cell WATCHING · gate UNRECORDED

Contract	`hc_lkg_conf` · executor Organ · 2 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-04. On parse or validation failure the organ continues on the banked conf and stamps LKG-HELD with the rejected hash [azure-ykyn]; a planted corrupt conf must leave serving unchanged and the stamp present.
Matrix cell	Last-known-good conf loader · `runtime/_hdl_build/nx_hostctl.nx` · WATCHING decl
Gate	`nx_hostctl_keepbackoff_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_hostctl_buildrun_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped) `nx_exactkill_gate` · UNRECORDED — no recorded verdict for this gate (it is declared for the organ but the evidence referee's last run did not record it: it is not on this board's gates map, or the referee has not run since the per-gate record shipped)
Work log	2026-09-04 retract the published cite for azure-qnbq placed a last-known-good repair item in PIR QNBQ-5W8; a verbatim search of that PIR finds no LKG text. The LKG evidence is PIR YKYN-BWZ (2025-10-29), where the LKG itself was contaminated and hand-edited: mirrored (67897 B, pin f002168e), admitted as ref azure-ykyn; the qnbq cite now says what that PIR says (runtime validation pipelines), the note cites both, DL18 cites azure-ykyn

DL19 Domain spin-up as a sovereign MCP verb (retires nx_domain_spinup.sh) · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`ds_spinup` · executor Organ · 2 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-21: nx_domain_spinup <domain> [plane] registered on the MCP surface performs plane, release-managed docroot with the coming-soon template, lifecycle row, SNI cert manifest row, property_registry route and sites.conf vhost, then verifies 200 + cert CN + the tenancy gate, idempotent on re-run; the shell script becomes a thin wrapper or retires. Witness: gospelofwest.com was spun up by the .sh over ssh from a laptop organ, so the seat drove the estate instead of calling it.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `ds_spinup`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-21 measure gospelofwest.com launched 2026-09-21: LE wildcard cert issued on the laptop (DNS-01, TXT propagation hit the 360 s ceiling, authz VALID), pushed by nx_aw_send (3408 B chain, 32 B key), nx_domain_spinup.sh rc=0 over nx_aw_nasfix, http 200 cert CN=gospelofwest.com tenancy gate GREEN, router address row via nx_aw_routerfix, www alias rows, page_verify GREEN from the DNS vantage. Every step ran from the seat's laptop organs or a shell script, which is the reason M5 exists. 2026-09-22 queue 2026-09-22 RELEASE-SIDE CONTRACT from ecosystem EC68 and EC69 (operator standing directions): every release verb on this board (DL19 spin-up, DL20 release, DL21 golive, DL22 router row, DL23 NAS-side cert, DL24 self-service door, DL25 one plan_run plane) is invoked only through the owning role's seeded plan plane, never by a seat's hand; the RACI store carries ROLLOUT-waves-one-version (R architect+referee, A pm, C adversary+operator, I all-crew); a release stage is reported as ready, running, waiting or needs-intervention with evidence age and the pending artifact identity; estate-wide rollout proceeds by blast-radius waves planned from the drift census with the previous process kept alive as the rollback and a wave whose undo path traverses its subject refused (nx_undopath_gate). First wave named: gospelofwest.com alpha (v6) then beta then production through the owner's plane, with receipts on this board. The lifecycle rule (ecosystem EC71) applies to every release artifact: a previous release is SUPERSEDED with its successor named and leaves the serving surface, archived with its mining receipt, never left beside the live one as a parallel site

DL20 Release stage, golive and rollback as a sovereign MCP verb (retires nx_domain_release.sh) · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`dr_golive` · executor Organ · 1.5 u · stands on DL19
Definition of done	DONE-RULE PRE-DECLARED 2026-09-21: nx_domain_release with verbs stage, golive, rollback, status on the MCP surface; golive flips the lifecycle row to production, repoints current, verifies, runs the tenancy gate and auto-rolls-back on RED exactly as the script does today.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `dr_golive`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-21 lesson A candidate previewed through a symlink under the LIVE release is a production exposure, not a stage (operator, 2026-09-21: not the alpha/beta/production methodology): a site version is emitted to releases/vN (not served), reviewed on the alpha plane at nishifamily.com/alpha/SITE/, stabilised on /beta/SITE/ with a browser check, and reaches production only by golive on the operator's eye; the DL20 release verb owes stage-to-alpha and alpha-to-beta as MCP verbs (today a symlink over the nasfix lane) 2026-09-22 land 2026-09-22 the alpha release of gospelofwest.com now runs as the publisher's plane plan-site-release-gospelofwest- (12 rows: emit gospelofwest_v8.site to releases/v8, ui_audit file, nine registry-gated nx_site_publish rows into sites/nishifamily/alpha/gospelofwest, page_verify) executed by nx_plan_run with receipts in planrun-site-release-gospelofwest-; owner = publisher (RACI site-release AR, ux supervisor operator C, pm warden I; crew row publisher site-release nx_plan_run; orchestration binding site-release to nx_plan_run); the v6 alpha had been copied over the shell lane and its nine paths were unregistered until nx_pub_plane adopt nishifamily 2026-09-22 measure 2026-09-22 first owned run: 12 of 12 steps rc 0; alpha index 26031 bytes (v6 24192), theme pages 25191 bytes (v6 23382), three mv- keyframe presets plus the page view-transition, itemscope 2, ui_audit hygiene 12 of 12 with the craft and agent blocks, page_verify GREEN a11y 0; registry adopt added 768 (725 draft pages, 43 assets, 0 debris) with 88921 already registered 2026-09-22 queue owed: the release verb proper, one organ that walks releases/vN into alpha, beta or production through the publish gateway so the plane holds one row per stage instead of one row per file (per-file rows rot when the emitter adds a file); beta and golive as separate planes whose golive step reads the accept plane; the same plane shape for andelinwest and every client site; EC68 rr_release_owner resolves the owner and refuses an ownerless target

DL21 Split-horizon LAN DNS row from the estate (nx_router_ctl dnsadd), never a laptop ssh organ · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`rc_dnsadd` · executor Organ · 1.5 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-21: nx_router_ctl dnsadd <domain> <ip> writes the dnsmasq address row on the GL.iNet router and restarts dnsmasq, idempotent, with dnsdel as the reverse gear. Witness: gospelofwest.com needed the laptop-local nx_aw_routerfix over ssh because the estate has no DNS verb.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `rc_dnsadd`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

DL22 Certificate issuance as a sovereign MCP verb on the NAS, credential custody decided first · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`ci_issue` · executor Organ · 3 u · stands on nothing
Definition of done	DONE-RULE PRE-DECLARED 2026-09-21: nx_cert_issue <domain> on the MCP surface runs the proven DNS-01 wildcard loop (nx_acme_dns01_issue) on the NAS and installs certs/le_<domain>_* plus the manifest row; the edge hot-reloads. PRECONDITION NAMED, NOT ASSUMED: the Porkbun API credentials live only in the laptop's machine-bound vault today, so the operator decides NAS-side custody before this verb can exist. Witness: the gospelofwest.com cert was issued on the laptop and pushed by nx_aw_send.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `ci_issue`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-27 measure 2026-09-27 04:26 UTC the nishifamily.com apex plus wildcard certificate (Let's Encrypt, issued Jun 29) expired on schedule, a REPEAT of 2026-06-28: every site behind the front door and every MCP wire call failed SEC_E_CERT_EXPIRED, ssh :22 was closed from the LAN, and the ssh-bound aw organs (nasfix, hostctl status) could not reach the NAS; the autorenew sweep rides the team-pulse conductor, which the July record already names as not beating; a seat issued a replacement on the laptop with the estate's own ritual (nx_secret_cli get porkbun, nx_sov_build_run nx_acme_dns01_issue nishifamily.com, exit 0, 3408 B chain, valid to Dec 26) and stopped at the issuer's own line "human drives deploy"; the operator deployed a certificate issued 05:09 UTC and the front door verified 200 at 15:00 UTC 2026-09-27 queue the lapse is a MECHANISM defect, not a missed task: (1) the renewal beat needs its own heartbeat stamp and an ALARM on staleness, independent of the conductor (an abstaining beat is invisible: the estate's own axis-blind law); (2) a pre-expiry alarm at 30, 14 and 7 days read from the served certificate itself (openssl dates are the witness, never a stamp); (3) the DL22 NAS-side issue verb with Porkbun credential custody decided by the operator, so renewal does not depend on one laptop being awake; (4) the aw lane needs a non-ssh path for hostctl verbs (certswap, restart) so a seat can complete a deploy when :22 is closed 2026-10-03 measure 2026-10-03: andelinwest.com served a certificate that expired 2026-09-30 22:59 UTC (leaf read by an outside TLS client: notBefore 07-02, notAfter 09-30), three days after the 09-27 nishifamily lapse whose renewal left it untouched: the fourth lapse in about a hundred days. Found only because a real browser refused an alpha page (ERR_CERT_DATE_INVALID); the estate's page verifier read UNOBSERVABLE tls-handshake and raised nothing; the autorenew organ is BUILT and STAGED and was never promoted, and nx_cert_monitor was source-only since June 2026-10-03 land andelinwest.com renewed: issued on the laptop with the estate ritual (nx_secret_cli get porkbun, nx_sov_build_run nx_acme_dns01_issue andelinwest.com, authz VALID twice, exit 0), chain 3409 B sha256 dc970aae6f38d1483c9fced4490823ea2dd4b1d0e9ea1d8af5d8d931659a3a43, valid 2026-10-03 21:26 to 2027-01-01 21:26 UTC, names apex plus wildcard; staged by nx_aw_send under content-addressed names; the operator approved the install in session; manifest row swapped under a size CAS with backup certs/sni_certs.manifest.before-20261003-dc970aae6f38; served leaf verified by an outside TLS client for andelinwest.com (new) and for nishifamily.com and gospelofwest.com (unchanged), and by a real browser loading https://andelinwest.com/alpha/docs/. Laptop copies of the key and the credential scratch file shredded 2026-10-03 queue operator decision still open and now blocking DL29: NAS-side custody of the DNS provider credential. Without it renewal stays a laptop ritual. Recommendation: a credential scoped to DNS records for the estate's zones, held in the NAS vault and readable only by the issue verb 2026-10-03 measure OPERATOR DECISION 2026-10-03 (asked in session, answer: NAS vault, issue verb only): the DNS provider credential moves into the NAS vault, readable only by the certificate issue verb, so renewal runs on the estate's clock with no laptop awake. This closes the custody precondition DL22 has carried since 2026-09-21 and unblocks DL29. The move itself is not done: it needs the vault row, the scoped reader and a gate that proves no other organ can read it

DL23 Self-service door behind the login: add a domain bought at Porkbun · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`dp_add_domain` · executor Organ · 4 u · stands on DL19, DL22
Definition of done	DONE-RULE PRE-DECLARED 2026-09-21 (operator: behind the login set a url i purchased through porkbun): a gated nishifamily.com route behind the opaque login wall, with X-Nishi-Session validated IN the daemon, takes a domain the operator already bought at Porkbun, verifies ownership through the Porkbun API listAll, sets the apex and www A records to the WAN IP, issues the certificate (DL22), spins the domain up (DL19) and shows each step's receipt plus the live coming-soon URL; every step is the same MCP verb a seat would call, so the page is a caller and never a second implementation.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `dp_add_domain`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

DL24 Site from a blueprint, self-service: choose or edit a blueprint, emit, stage, preview, go live · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`dp_site_from_blueprint` · executor Organ · 3 u · stands on DL20, DL23
Definition of done	DONE-RULE PRE-DECLARED 2026-09-21: behind the same login the operator picks or edits a .site blueprint for a spun-up domain; the page runs nx_site_build into the next release, offers a preview host, and golive (DL20) is the approval click. The emitter itself carries no client sentence any more (generalised 2026-09-21, byte-identical on andelinwest.site).
Matrix cell	NO-MATRIX-ROW — no matrix row carries `dp_site_from_blueprint`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-09-21 land nx_site_build generalised: keys pages, hero2, heronote, section_cards, section_steps, section_trust, section_cta, pagehero2, pagenote, section_related, pagecta with the former literals as defaults and the search form optional; andelinwest.site emits byte-identical (7 of 7 files) with the new build; promoted 46ca13ec with 5 lost runs, all the /practice path literal now derived from the pages key. 2026-09-21 queue nx_site_build_gate is BUILT+STAGED d0edcdf2 on the NAS but /api/promote refused D001 (rolls its own verdict): migrate it (nx_gate_dry_apply then nx_gate_migrate verify) and promote, then /api/gate_run answers instead of NOT-FOUND exit 127. The generalised emitter is proven on the laptop (andelinwest.site byte-identical) and unproven by the NAS gate until then. Second queue item: the edge 301s every /<pages>/<slug>.html link to its extensionless form, so the emitter should emit extensionless hrefs and sitemap urls (one key or one default, byte-identical on the incumbent again). 2026-09-21 land the showcase tier now emits EXTENSIONLESS, RELOCATABLE hrefs (./ and ../ prefixes by page depth, the face at a relative fonts/ path) and copies the display face with its OFL LICENSE into RELEASE/fonts (nx_site_build promoted 2ff7ba05), so ONE release serves at the production root, under nishifamily.com/alpha/SITE/ and under /beta/SITE/; the extensionless-href queue item is closed for the showcase tier (the kit and editorial tiers still emit .html, byte-identical on the incumbent), the gate migration item stays open

DL25 The whole launch as ONE seeded plan_run plane · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`dl_launch_plane` · executor Organ · 2 u · stands on DL19, DL20, DL21, DL22
Definition of done	DONE-RULE PRE-DECLARED 2026-09-21: nx_plan_run domainlaunch-<domain> walks verify-ownership, DNS, cert, spin-up, emit, stage, golive, verify as steps with receipts, so a crash leaves a ledger on the NAS and a second seat resumes at the failed step; the gospelofwest.com launch of 2026-09-21 is the reference walk.
Matrix cell	NO-MATRIX-ROW — no matrix row carries `dl_launch_plane`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

DL26 Every certificate the edge serves is watched from its own manifest: a state per domain, a stamp, a daily beat · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nc_scan` · executor Organ · 0 u · stands on nothing
Definition of done	LANDED 2026-10-03: nx_cert status (organ nx_cert, lib nx_cert_lib, gate nx_cert_gate 22 of 22) reads certs/sni_certs.manifest, judges each chain file on seconds, prints a summing partition, writes knowledge/status/cert_status.stamp in the gauge grammar and exits 0 GREEN, 1 RED, 3 UNOBSERVABLE; clock row certstatus daily; gauge row on deploy.gauge. File view only: the served leaf is DL27
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nc_scan`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-10-03 land nx_cert shipped 950b69a1 (gate nx_cert_gate 524db34e, 22 of 22, built first try), registered on the MCP surface, cap in ~/.nishi/cert1003.cap, clock row certstatus 86400 committed at revision 270. First live run: rows=4 ok=3 warn=1 partition SUMS, b2b.loans 9 days left (not_after_epoch 1791928133), verdict RED -- the next silent lapse, seen ten days early 2026-10-03 lesson a whole-day expiry rule calls a certificate that lapsed 23 hours ago a warning (the gate prints the old monitor's verdict for that case: 1, WARN); expiry is decided on seconds. And the watch list is the manifest the edge loads, never a second list: the 09-27 renewal fixed the one name somebody was looking at and the other name on the same edge lapsed three days later 2026-10-03 land b2b.loans renewed and installed the same evening the status verb first read it at 9 days left: issued on the laptop (authz VALID twice, exit 0), chain 3392 B sha256 17a4f3d06690113758adceb4fe5bdd9845db669aac82d6ced6bc13eae3783a54, valid 2026-10-03 21:43 to 2027-01-01 21:43 UTC, apex plus wildcard; operator approved the install in session; manifest row swapped under a size CAS with backup certs/sni_certs.manifest.before-20261003-17a4f3d06690; served leaf verified by an outside TLS client for all four names; nx_cert status then read rows=4 ok=4 partition SUMS verdict GREEN, nearest expiry gospelofwest.com 2026-12-20. Laptop key copy shredded 2026-10-04 measure the daily beat was declared but could not have run: nx_clockjob get certstatus read schedule_state=WAITING_AUTHORITY authority_reason=EXPECTED_EXECUTABLE_MISSING, because the clock now runs a row only when it is bound to the exact executable. Bound 2026-10-03 with nx_clockjob bind (revision 276, expected sha256 e938bc6c..., command /volume1/homes/elderwesto/nishihost/nx_cert.elf status): both planes now read ELIGIBLE, BOUND_CONTRACT, next due 1791163754. execution_proven is still 0: the first fire has not happened, so the beat is scheduled, not yet witnessed. A re-ship of nx_cert changes its hash and needs a re-bind 2026-10-04 lesson a put on the clock plane returned DESIRED_COMMITTED and the row appeared live with a next due time, yet it was not authorised to execute; the receipt of the declaration said nothing about that. Read nx_clockjob get after every put and look for schedule_state=ELIGIBLE, then for execution_proven after the first interval 2026-10-04 measure clock row certstatus read at about 1791079735: both planes revision 276, ELIGIBLE, BOUND_CONTRACT, expected sha256 e938bc6c; LIVE next_due=1791163754 (about 84000 s, 23.3 h ahead) and execution_proven=0, so the first daily fire has NOT happened yet: the beat is scheduled, not witnessed. Re-shipping nx_cert for DL27 moves the hash, so the row must be re-bound before that first fire or it will wait for authority instead of running

DL27 The status verb judges the certificate each name actually serves, from the estate and from one outside vantage · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nc_probe_served` · executor Organ · 1.5 u · stands on DL26
Definition of done	DONE-RULE PRE-DECLARED 2026-10-03: one TLS handshake per manifest row with that SNI (composing the probe the renewer already uses), the served notAfter compared with the file's; a stale served copy, a wrong certificate and an unreachable name each get their own state; one outside vantage row so a split-horizon answer cannot acquit the public one. Witness: on 2026-10-03 the page verifier read UNOBSERVABLE tls-handshake for the expired name and raised nothing
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nc_probe_served`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-10-04 land served-leaf probe landed in the incumbent lib and verb, no parallel organ: nx_cert_lib gains nc_tls13_leaf, nc_der_len, nc_served_classify, nc_probe_served, nc_served_scan, nc_conf_port and nc_stamp_served, composing nx_connect_bounded, nx_tls13_client_session_run and the validation context's cert_out capture (no handshake code of its own). nx_cert served [manifest] [ip] [port] defaults to loopback and the port of the deploy_targets.conf sites row; status runs the same axis on its own lines and a third stamp line and never moves the expiry verdict. Four counted states MATCH / MISMATCH / UNREACHABLE / UNREADABLE with a summing partition; served exit 0 every row MATCH, 1 any MISMATCH, 3 otherwise (unreachable is never a pass). Shipped through nx_organ_ship: nx_cert c321e61f (450904 B, was e938bc6c 54888 B; the growth is the TLS client and the hf_store_load trust-store ladder) with 2 lost runs approved by allow_loss_v1 c3b447ad (the one-verb usage line and the old scope text, both superseded) and a reviewed behaviour change (review 294cf311, observation e699cf8a); gate nx_cert_gate aaf478ee 55 of 55 (24 new teeth incl. one-byte and different-certificate MISMATCH neg-controls and loopback port 0 UNREACHABLE end to end). Clock row certstatus re-bound to c321e61f at revision 280, both planes ELIGIBLE BOUND_CONTRACT, next_due 1791163754, execution_proven still 0. Sources: nx_cert_lib.nx 31071 B, nx_cert.nx 11455 B, nx_cert_gate.nx 20207 B 2026-10-04 measure live from the promoted binary c321e61f at 1791082141, vantage 127.0.0.1:8443 (the edge terminator on loopback; port read from the deploy_targets.conf sites row): nishifamily.com MATCH leaf 930 B, andelinwest.com MATCH 932 B, b2b.loans MATCH 915 B, gospelofwest.com MATCH 931 B, every handshake connected=1 validated=1; CERT-SERVED-SUMMARY rows=4 match=4 mismatch=0 unreachable=0 unreadable=0 partition=SUMS, served verdict GREEN; status verdict GREEN with expiry 4 OK and keys 4 OWNER-ONLY. The production stamp now carries line 3 served_observed=1 served_rows=4 served_match=4 served_mismatch=0 served_unreachable=0 served_unreadable=0 edge_port=8443, line 1 (ts gauge axes_known axes_total) unchanged. Scope: this proves what the loopback listener presents, not what a public client is routed to; the outside-vantage half of the done-rule is still open 2026-10-04 lesson the first live run read all four rows UNREADABLE with connected=1 validated=1: the parser began at the Certificate body, but the capture handed to cert_out carries the 4-byte handshake header (type 11 and a 24-bit length), as nx_tls13_client_validate_certificate_test Test C shows by feeding the same function a 0x0B-headed message. The gate had read 54 of 54 GREEN because its fixture was assembled in the same wrong shape, so it measured agreement with the bug. Fixed in nc_tls13_leaf; the fixture now uses the wire form and a body-only message is a neg-control. A known-answer fixture must come from the producer's contract, never from the parser under test. The same body-first parse sits in nx_edge_probe (ep_count_chain, ep_autopsy) over the same capture; not run here, so unverified there 2026-10-04 land served-leaf probe in nx_cert (cb85425a, gate nx_cert_gate b8818225 112/112): per manifest row one TLS handshake with that SNI at the estate vantage 127.0.0.1:8443, served notAfter against the file's, mismatches split STALE, WRONG-CERT and other with both dates printed and the sub-counts summing; a public vantage over 1.1.1.1 and 8.8.8.8; stamp lines 3 and 4. The daily status verdict is still the expiry verdict, so the certstatus beat stays GREEN; the separate served verb needs both vantages. certstatus re-bound revision 285 to cb85425a in the same minute as the promote 2026-10-04 measure live: estate vantage 4 of 4 MATCH (nishifamily.com, andelinwest.com, b2b.loans, gospelofwest.com); public vantage UNOBSERVABLE from the NAS because 1.1.1.1 and 8.8.8.8 on port 53 answer 192.168.8.240 for every name (the LAN router intercepts DNS), public_unresolved=4, never counted as a pass 2026-10-04 queue a public lookup over a channel the router cannot rewrite (DNS over HTTPS) or a vantage off the LAN, so the public row can read MATCH; a test TLS listener for the DL28 success branch; teeth on ni_ename's refusal names

DL28 Install as a verb: validated pair, content-addressed files, key mode 0600, manifest row swap under a lock with a backup, served-leaf verify, automatic rollback · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nc_install` · executor Organ · 2 u · stands on DL26, DL27
Definition of done	DONE-RULE PRE-DECLARED 2026-10-03: nx_cert install <domain> <chain> <key> refuses a chain that does not parse, does not cover the domain, is not yet valid, or whose key does not match the leaf; writes both files under content-addressed names with the key at 0600; swaps the one manifest row atomically with a named backup; verifies the served leaf (DL27) for that domain and every other row; restores the backup on any failure. Witness: the 2026-09-27 and 2026-10-03 installs were hand edits of the manifest
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nc_install`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-10-03 measure OPERATOR DECISION 2026-10-03 (asked in session, answer: yes, standing approval): until the install verb exists a seat may install a RENEWED certificate for a domain already in the edge manifest with the backed-up, verified row swap without asking each time. Conditions that travel with it: a backup of the manifest first, the served certificate verified for every domain afterwards, the old row restored on any failure, and a land row on this board for each install. It does not cover a new domain, a key-mode change, or any other edit of the edge 2026-10-04 queue nx_cert install <domain> <chain> <key> now has its verify step ready: after the row swap it calls nc_served_scan for the installed domain and every other row and restores the backup on anything but MATCH. Still needed before it can ship: (a) validate the pair before touching anything: the chain parses, covers the domain (wildcard included), notBefore <= now, and the leaf public key matches the key file (compose nx_x509_validate and the SAN and validity readers, refuse by name); (b) write chain and key under content-addressed names with the key at 0600 through an atomic mode-setting writer (the nx_offc_install pattern, never a raw copy, which lands 0644); (c) swap the one manifest row atomically under a lock with a named backup; (d) wait for the edge's hot reload before the served verify, with the reload cadence read from the edge, not typed; (e) a gate over a fixture manifest and a stand-in listener, with a refused-pair neg-control and a forced-MISMATCH rollback tooth. Still open on DL27 itself: the outside-vantage row and an UNREACHABLE or MISMATCH alarm on the deploy.gauge row 2026-10-04 land nx_cert install <domain> <chain> <key> [manifest] [ip] [port] (nx_cert_install_lib): refuses an unparseable chain, a chain that does not cover the domain, not yet valid, expired, a key that does not match the leaf, a bad domain, a relative manifest, no row and a duplicate row, each by name; writes both files beside the manifest under content-addressed names with the key at 0600; one atomic row swap with a named backup (atomic_rewrite_owned); a served check of every row afterwards; any failure restores the backup, proven by re-reading the file's sha256. Gate teeth on fixtures only; NEVER run against the production manifest. Imprecision declared: the success branch is not driven end to end (it needs a TLS listener serving the test certificate); bite killed 1 of 5 with 4 survivors in the refusal-name strings no tooth reads

DL29 Renewal on the estate's own clock: the CA's renewal window (ARI) first, one third of lifetime remaining as the fallback, one name per pass, a blind beat alarms · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nc_renew` · executor Organ · 3 u · stands on DL22, DL28
Definition of done	DONE-RULE PRE-DECLARED 2026-10-03: a clock row asks each certificate's renewal window [rfc9773-ari] and renews inside it; with no answer it renews when one third of the lifetime remains, the timing the CA itself expects as default lifetimes fall from 90 to 64 to 45 days [le-feed-2026-09] under the 47-day ceiling due March 2029 [cabf-sc081v3]; issue (DL22), install (DL28) and verify are the same verbs a seat would call; the beat stamps every pass including a refusal, and the gauge reads BLIND when the stamp is stale
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nc_renew`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

DL30 Short-lifetime drill: the whole renew loop proven on a 160-hour certificate before the 45-day default arrives · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nc_shortlived_drill` · executor Organ · 1.5 u · stands on DL29
Definition of done	DONE-RULE PRE-DECLARED 2026-10-03: one non-production name runs on the CA's shortlived profile [le-feed-2026-09] and is renewed by DL29 for 30 consecutive days with zero manual steps and zero served-expired seconds, measured by DL27
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nc_shortlived_drill`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	no log row names this rung yet

DL31 Private keys are owner-only: every key 0600, the status verb reports the mode and never calls a wider key OK · cell NO-MATRIX-ROW · gate NO-MATRIX-ROW

Contract	`nc_key_mode` · executor Organ · 0.5 u · stands on DL26
Definition of done	DONE-RULE PRE-DECLARED 2026-10-03: nx_cert status stats each row's key file and reports KEY-EXPOSED for any mode wider than 0600; install (DL28) writes 0600. Witness measured 2026-10-03 over the ssh lane: le_andelinwest_ecdsa_key.bin and le_nishifamily_ecdsa_key.bin are mode 755
Matrix cell	NO-MATRIX-ROW — no matrix row carries `nc_key_mode`; the ranker reads this rung as unmapped and no cell can flip for it. Add the row and the join completes on the next publish.
Gate	the gate join needs a matrix row: no organ is named for this rung
Work log	2026-10-04 measure key modes measured over the ssh lane 2026-10-03: sites.elf and sni_router.elf run as elderwesto, the owner of every key file; le_gospelofwest.com_ecdsa_key.bin and le_ecdsa_key.bin are already 600 and gospelofwest.com serves, a positive control that owner-only works with the live edge; five key files are 755 (le_andelinwest_ecdsa_key.bin, le_andelinwest_ecdsa_key_dc970aae6f38.bin, le_b2b.loans_ecdsa_key.bin, le_b2b.loans_ecdsa_key_17a4f3d06690.bin, le_nishifamily_ecdsa_key.bin) because the ssh receive verb installs 755. Tightening them is one chmod each and is NOT covered by the standing install approval: waiting on the operator's go. The status verb does not report the mode yet 2026-10-04 land the status verb reports key modes on their own axis: nx_cert e938bc6c (gate nx_cert_gate c0f2d161, 31 of 31, nine new teeth with fixture key files at 600 and 644, a missing key and a row with no key field). Live run 2026-10-03: nishifamily.com, andelinwest.com and b2b.loans keys EXPOSED mode 755, gospelofwest.com OWNER-ONLY mode 600, partition SUMS; the same modes the ssh read showed, so two independent readings agree. The axis is separate by design: it does not move the expiry result, so three exposed keys do not turn the certificate check permanently red. Still open on this rung: the chmod itself (operator's go) and install writing 600 (DL28) 2026-10-04 land the key files under certs/ are owner-only: per the session record the seven private key files were set to mode 600 on 2026-10-03 (row 1791077030 had measured five at 755 and two already at 600) and four outside TLS handshakes succeeded afterwards. Re-measured by the status verb (nx_cert e938bc6c, run at 1791079735): all four keys the manifest names read OWNER-ONLY mode=600 (le_nishifamily_ecdsa_key.bin, le_andelinwest_ecdsa_key_dc970aae6f38.bin, le_b2b.loans_ecdsa_key_17a4f3d06690.bin, le_gospelofwest.com_ecdsa_key.bin). The three key files no manifest row names (le_andelinwest_ecdsa_key.bin, le_b2b.loans_ecdsa_key.bin, le_ecdsa_key.bin) are outside this organ's reach and were not re-measured by it. Still open on this rung: install writing 600 (DL28) 2026-10-04 measure nx_cert status at 1791079735 (binary e938bc6c): CERT-KEYS rows=4 owner_only=4 exposed=0 unreadable=0 none=0 partition=SUMS; expiry axis CERT-SUMMARY rows=4 ok=4 warn=0 expired=0 unreadable=0 malformed=0 partition=SUMS needs_action=0, nearest expiry gospelofwest.com 6709944 s (77 days, not_after_epoch 1797789672); stamp wrote 159 of 159; verdict GREEN. The same organ read three keys EXPOSED mode 755 in row 1791077300; it now reads zero, so the axis moved 3 to 0 with the chmod

dossiers=34 cells_joined=20 no_matrix_row=14 (sum 34) gates_recorded=0 gates_unrecorded=5 no_gate_declared=15 (sum 20 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 46 feature rows mapped of 46 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/deploy.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 500–1000, distinctiveness 0–350 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 0 (a fact of the data: two players that close are that close) · data spread 641 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 500–1000 · distinctiveness 0–350 · breadth 300–600 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 285 permil of the plot

Nishi Vercel Fly.io Render Kubernetes+Argo
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 5 (a fact of the data: two players that close are that close) · data spread 511 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Unconventional	629	210	355	710	0 since 2026-10-04	23	12	2026-09-15
Vercel	Aspirational	907	180	478	709	0 since 2026-10-04	31	12	2026-09-15
Fly.io	Mainstream	913	115	434	645	0 since 2026-10-04	31	12	2026-09-15
Render	Mainstream	880	74	384	609	0 since 2026-10-04	29	12	2026-09-15
Kubernetes+Argo	Aspirational	953	297	565	702	0 since 2026-10-04	37	12	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	46	5
2026-09-16	46	5
2026-09-17	46	5
2026-09-18	46	5
2026-09-19	46	5
2026-09-20	46	5
2026-09-21	46	5
2026-09-22	46	5
2026-09-23	46	5
2026-10-03	46	5
2026-10-04	46	5
2026-10-08	46	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 184, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	Vercel	Fly.io	Render	Kubernetes+Argo
Health-gated promote with auto-rollback watchdog Measured: `ma_do_deploy_status` exists in `runtime/_hdl_build/nx_mgmt_api.nx`, verified at emit. Argo Rollouts is the reference [argo-rollouts]; Fly and Render health-check releases [render-deploys]; Nishi /api/deploy stages .new then promotes then an async watchdog verifies health and ROLLS BACK by construction -- never-brick is the default not an option [nomad-update-20260907] Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Kubernetes+Argo (leads)	●	●	●	●	◉
Superseded builds are deduped, not queued twice Measured: `bq_dedupe_target` exists in `runtime/_hdl_build/nx_buildq.nx`, verified at emit. CORRECTED 2026-09-02 BY MEASUREMENT, and the first version's premise was wrong: the whole deployq- plane holds 231 rows with 231 DISTINCT ids and ZERO duplicate BQ-<target> rows, because nx_store_put re-puts BY ID -- a second enqueue of one target REPLACES the first, it does not double it. The 2026-09-01 pileup (procs_running=31 on 8 threads) was concurrent SYNC re-issues each compiling under its own per-target lease, not queue rows firing together. What the contract still owes, stated rather than hidden: a sync build that succeeds does not CLOSE a queued row for the same target, so the poller's later fire is a build-cache hit whose cost is UNMEASURED; and the 2026-09-02 fix that routes a RUNNER admission refusal into the queue (ma_runner_refused, on the loadgov board) makes the BQ row the single place a pending build is recorded. Done when a gate enqueues one target twice, asserts one row and one fire, and proves a sync success leaves no live queued row behind. Every rival collapses superseded builds -- Vercel cancels them and Argo serialises by sync wave rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:actlog` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Vercel (leads), Kubernetes+Argo (leads)	●	◉	●	●	◉
Rollback coverage MEASURED across every target, not asserted per deploy DARK — `runtime/_hdl_build/nx_hostctl.nx` EXISTS but does not declare `hc_bank_before_swap`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. ADDED 2026-09-01 because this board asserts rollback while the estate's own census says it is at risk on 988 permil of targets, and NO column carried that. MEASURED from knowledge/status/deployjrnl.status ts=1788293038 method=stat-plus-sha256-over-live-and-prev: rollback_slots=1938 at_risk=1914 no_rollback=0 against a declared floor=1745, so the ratchet reads RED, and irreplaceable_evictions=2 says two rollback targets are ALREADY unrecoverable. Partition reconciles: cls_sum=1938 of_current=1938. The mechanism is the estate's own standing law -- the slot holds THE PREVIOUS DEPLOY, not the last known good, so the SECOND deploy of a session evicts the pre-change binary, and an older-generation artifact cannot be rebuilt. Every rival keeps immutable prior releases: Vercel aliases any prior deployment instantly. THE FIX IS NOT A CAMPAIGN OVER 1914 FILES -- that backlog has an inflow. It is hc_deploy_one banking the pre-change artifact to a durable path, verified by hash, BEFORE it swaps rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them watching hc_bank_before_swap Pros none measured yetCons behind Vercel (leads), Fly.io, Render, Kubernetes+Argo (leads); open contract; expected source declaration not established	○	◉	●	●	◉
Build on the target from source Measured: `cmd_buildrun` exists in `runtime/_hdl_build/nx_hostctl.nx`, verified at emit. Vercel build pipeline is Best-in-class; K8s delegates builds to CI; Nishi POST /api/build compiles with the sovereign toolchain ON the NAS -- no external CI rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `PRODUCER-ALIAS` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Kubernetes+Argo; fully adopted on the estate ladderCons behind Vercel (leads)	●	◉	●	●	◐
One-command source to live Measured: `SHIPPED` exists in `runtime/nx_ship.nx`, verified at emit. vercel deploy set the DX bar; Nishi nx_ship packs the tree then uploads over sovereign TLS then builds on target in ONE command rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:fork:nx_ws_hygiene_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Kubernetes+Argo; fully adopted on the estate ladderCons behind Vercel (leads)	●	◉	●	●	◐
Staged content publish (sha-pinned, atomic) Measured: `ma_do_promote_content` exists in `runtime/_hdl_build/nx_mgmt_api.nx`, verified at emit. Everyone stages then swaps; Nishi /api/promote_content and /api/compare/publish re-hash the stage and install atomically with .prev backing [netlify-atomic-20260907] Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Service supervision with crash-loop backoff Measured: `crash-loop` exists in `runtime/_hdl_build/nx_hostctl.nx`, verified at emit. K8s liveness probes are Best; Nishi hostctl supervise runs live (PID + SERVING probe, HUNG-aware, backoff) and respawns from the promoted binary rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `PRODUCER-ALIAS` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Kubernetes+Argo (leads)	●	●	●	●	◉
Live fleet inventory API Measured: `/api/services` exists in `runtime/_hdl_build/nx_mgmt_api.nx`, verified at emit. kubectl get is the reference [k8s-deployment]; Nishi GET /api/services serves the multi-service inventory Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Kubernetes+Argo (leads)	●	●	●	●	◉
Deploy and ops event stream Measured: `event-stream` exists in `runtime/_hdl_build/nx_mgmt_api.nx`, verified at emit. K8s watch API Best; Nishi GET /api/events serves SSE to EventSource clients rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Kubernetes+Argo (leads)	●	●	●	●	◉
Ops dashboard UI Measured: `ma_emit_dashboard` exists in `runtime/_hdl_build/nx_mgmt_api.nx`, verified at emit. Vercel dashboard is Best; Nishi Sovereign Fleet at /health is LIVE behind the operator login with per-service cards and allowlisted actions rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Kubernetes+Argo; fully adopted on the estate ladderCons behind Vercel (leads)	●	◉	●	●	◐
Fail-closed deploy-target registry Measured: `md_upload_target_ok` exists in `runtime/_hdl_build/nx_mgmt_data.nx`, verified at emit. K8s RBAC-scoped resources are the reference; Nishi allowlists every uploadable and deployable target BY NAME -- unknown targets are refused rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=16 nonval=10` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Kubernetes+Argo (leads)	●	●	●	●	◉
Machine-readable control-plane spec Measured: `ma_openapi` exists in `runtime/_hdl_build/nx_mgmt_api.nx`, verified at emit. K8s OpenAPI is the reference; Nishi GET /api/openapi.json describes the whole plane for auto-driving agents rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Kubernetes+Argo (leads)	●	●	●	●	◉
EXCEED control-plane auth is OPAQUE PAKE Source present; authored stronger claim: `OPAQUE` in `runtime/nx_opaque_login.nx`, verified at emit. Incumbents authenticate deploys with bearer tokens and OIDC; the Nishi plane authenticates with OPAQUE-3DH -- the password never crosses the wire and the server stores no password-equivalent [rfc9807-opaque]; sessions are Ed25519-minted and TTL-bound Adoption: `RUN-BY:daemon` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Vercel, Fly.io, Render, Kubernetes+Argo; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
EXCEED sovereign end-to-end hosting Source present; authored stronger claim: `sni_backend` in `runtime/nx_sni_route.nx`, verified at emit. The live site terminates its own TLS 1.3 [rfc8446-tls13] and routes SNI without a third-party terminator -- no nginx no cloud LB no CDN vendor; every byte from ClientHello to response is auditable sovereign source on owned hardware Adoption: `LIB-WIRED importers=3 nonval=1` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Vercel, Fly.io, Render, Kubernetes+Argo; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
EXCEED the control plane deploys ITSELF Source present; authored stronger claim: `ma_do_deploy_status` in `runtime/_hdl_build/nx_mgmt_api.nx`, verified at emit. Proven live: the mgmt API was upgraded THROUGH its own upload-deploy-watchdog chain (DEPLOYED-GREEN) -- self-hosting deployment with never-brick protection; platform vendors upgrade their planes outside your view Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of Vercel, Fly.io, Render, Kubernetes+Argo; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Canary and progressive traffic shifting Open — watching `runtime/nx_deploy_canary.nx` : `dc_weight_shift`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Argo Rollouts weighted steps are the reference [argo-rollouts]; Nishi promotes whole-service -- percentage shifting is a named gap [cf-worker-affinity-20260907] dossierwatching dc_weight_shift Pros none measured yetCons behind Vercel, Fly.io, Render, Kubernetes+Argo (leads); open contract; expected source declaration not established	○	●	●	●	◉
Preview environments per change Open — watching `runtime/nx_deploy_preview.nx` : `dp_preview_spawn`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Vercel preview-per-PR defined the category; Nishi has no ephemeral preview instances yet rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching dp_preview_spawn Pros none measured yetCons behind Vercel (leads), Fly.io, Render, Kubernetes+Argo; open contract; expected source declaration not established	○	◉	●	●	◐
Blue-green dual-slot instant switch Open — watching `runtime/nx_deploy_bluegreen.nx` : `bg_slot_switch`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Nishi has .prev restore but not two warm slots with instant cutover [aws-codedeploy-platforms-20260907] dossierwatching bg_slot_switch Pros none measured yetCons behind Vercel, Fly.io, Render, Kubernetes+Argo; open contract; expected source declaration not established	○	●	●	●	●
GitOps declared-state reconciler Open — watching `runtime/nx_deploy_gitops.nx` : `go_reconcile_desired`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Argo/Flux reconcile the cluster to a declared repo state; the Nishi registry is imperative API calls today rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching go_reconcile_desired Pros none measured yetCons behind Vercel, Fly.io, Render, Kubernetes+Argo (leads); open contract; expected source declaration not established	○	◐	◐	◐	◉
Multi-node and multi-region placement Open — watching `runtime/nx_deploy_region.nx` : `rg_place_service`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Fly regions and Vercel edge network lead [flyio-config]; Nishi runs one sovereign host plus workstation dossierwatching rg_place_service Pros none measured yetCons behind Vercel (leads), Fly.io (leads), Render, Kubernetes+Argo (leads); open contract; expected source declaration not established	○	◉	◉	●	◉
Autoscale including scale-to-zero Open — watching `runtime/nx_deploy_scale.nx` : `as_scale_to_zero`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Serverless platforms scale to zero; Nishi services are always-on supervised processes rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching as_scale_to_zero Pros none measured yetCons behind Vercel (leads), Fly.io (leads), Render, Kubernetes+Argo; open contract; expected source declaration not established	○	◉	◉	●	●
Secrets manager with rotation Open — watching `runtime/nx_deploy_secrets.nx` : `ds_rotate_secret`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. K8s secrets plus external-secrets is the reference; Nishi has key files and a vault doctrine but no rotation-managed deploy secrets plane rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching ds_rotate_secret Pros none measured yetCons behind Vercel, Fly.io, Render, Kubernetes+Argo (leads); open contract; expected source declaration not established	○	●	●	●	◉
Domain purchase API with spend wall + dry-run-first Measured: `pbd_register_wall` exists in `runtime/nx_porkbun_domain.nx`, verified at emit. LIVE-PROVEN to the server pre-flight (Porkbun dryRun, 0 charge) [porkbun-api]: refusal ladder = spec-verified endpoint, creds, literal confirm-spend, quote<=cap; Vercel sells domains via API too -- ours adds the client-side spend wall (their docs not banked, so no exceed claimed) Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separate; ahead of Fly.io, Render, Kubernetes+ArgoCons not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	●	○	○	○
DNS records API on the live registrar (A/TXT) Measured: `nx_porkbun_set_a` exists in `runtime/nx_acme_porkbun.nx`, verified at emit. Live-KAT proven against andelinwest.com over sovereign TLS; platforms manage DNS on their own edges; K8s external-dns is Part rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Render, Kubernetes+ArgoCons not adopted yet: source exists, never compiled: /api/build it	●	●	●	◐	◐
TLS certificate acquisition (bundle retrieve + ACME DNS-01) Measured: `acme_account_key` exists in `runtime/nx_acme_issue.nx`, verified at emit. LIVE: 10509-byte LE bundle retrieved (0600, key never printed) for andelinwest.com; platforms auto-provision on their edge -- ours lands certs on the sovereign edge [rfc8555-acme] Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Kubernetes+ArgoCons not adopted yet: source exists, never compiled: /api/build it	●	●	●	●	◐
Purchase-to-live orchestration (ordered, once-only spend) Measured: `gl_advance` exists in `runtime/_hdl_build/nx_domain_golive.nx`, verified at emit. Gated 8/8: dryrun-then-confirm spend, double-purchase impossible by construction, operator-gated edge step; Vercel buy+auto-cert is the incumbent flow without explicit spend caps rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `SOURCE-ONLY` — PARTIAL: source exists, never compiled: /api/build it. not adopted: source exists, never compiled: /api/build it Pros Implementing source symbol found; runtime acceptance separate; ahead of Fly.io, Render, Kubernetes+ArgoCons not adopted yet: source exists, never compiled: /api/build it	●	●	○	○	○
Instant rollback to the previous generation Measured: `ma_do_rollback` exists in `runtime/_hdl_build/nx_mgmt_api.nx`, verified at emit. POST /api/rollback restores .prev under the same watchdog; Vercel instant rollback is the DX bar [vercel-instant-rollback], Fly and Render roll back a release, Argo keeps a revision history [argo-rollouts]; ranker row for DP1, which had no matrix row until 2026-09-02 Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Kubernetes+Argo (leads)	●	●	●	●	◉
Rollback census classifies each target by the chain it actually has (PREV-ONLY, PREV-PLUS-PREV2, NEITHER) with a partition that sums DARK — `runtime/nx_deployjrnl.nx` EXISTS but does not declare `dj_count_prev_chain`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The current at_risk count reads a bank directory the mechanism does not use (1914 of 1938 at risk against a live .prev/.prev2 chain); no platform publishes how many generations survive a deploy, Kubernetes revisionHistoryLimit is the nearest (Part); ranker row for DL8 rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching dj_count_prev_chain Pros none measured yetCons behind Kubernetes+Argo; open contract; expected source declaration not established	○	○	○	○	◐
Request bodies larger than one TLS record are fragmented by the transport instead of refused Measured: `nx_tls13_frag_len` exists in `runtime/nx_tls13_record.nx`, verified at emit. SHIPPED 2026-09-04; gate nx_tls13_frag_gate 18 of 18, bite-proven aimed at nx_tls13_frag_len (valid_mutants 1, killed 1), load-bearing tooth is the partition sum. RFC 8446 section 5.1 [rfc8446-tls13] bounds a record at 2 to the 14 bytes of plaintext and every mainstream TLS stack fragments a larger write automatically, so this is a GAP WE HAD CLOSED and explicitly NOT an exceed. Before the fix nx_https_req_complete emitted ONE record, so callers wore the ceiling as hand-picked body constants; measured, a 6100 byte payload produced an 8369 byte body and was refused while 5900 passed, and the sovereign shipper could not send the 48402 byte chunks its own server offered. Adoption: `LIB-WIRED importers=54 nonval=36` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
A client that receives an async job pointer instead of a receipt follows it to the real result Measured: `jf_post_follow` exists in `runtime/nx_jobfollow_lib.nx`, verified at emit. SHIPPED 2026-09-04 as ONE shared follower composed by both content clients, so the five call sites cannot disagree. MEASURED the edge answers a tools call with JOB-STARTED id and the receipt lands in the job artifact; a client scanning an unanchored id read the JOB id as the ORGAN id and reported a receipt that never existed, which is why the sovereign put client had never completed a transfer. A first census claiming 89 posters and 81 blind was RETRACTED the same day: it counted files containing the string tools/call, which includes registrars, gates and the SERVER organs that parse it. Re-measured by post path, 4 organs post via hp_post_json, 2 roll their own record loop and 84 do not post at all, partition summing to 90. Industry bar is Google AIP-151 long-running operations where the client polls the returned operation name. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=2 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Resumable artifact upload that survives a dropped chunk instead of restarting the transfer Measured: `cc_resume_from_status` exists in `runtime/nx_content_put_client.nx`, verified at emit. MEASURED 2026-09-04 a 410443 byte ship lost chunk 7 of 9 to a transient on a degraded array and discarded the entire transfer, because the client restarts rather than resumes; the server ALREADY exposes the resume source as nx_content_put status id and the client never calls it. Industry bar is the OCI Distribution Spec chunked blob upload whose PATCH sequence resumes from the last accepted byte range [oci-dist], inherited by Fly.io and by any Kubernetes registry-based flow; S3 multipart upload is the same shape with per-part retry. Vercel and Render upload whole and restart on failure. Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_content_put_client_gate -- a mention, not a run. dossiernot adopted: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_content_put_client_gate -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of Vercel, RenderCons not adopted yet: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_content_put_client_gate -- a mention, not a run	●	○	●	○	●
Abandoned upload staging is reaped on a declared TTL instead of accumulating forever DARK — `runtime/nx_content_put.nx` EXISTS but does not declare `cp_reap_stale`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. MEASURED 2026-09-04 knowledge/contentput held 82 entries of which roughly 40 were bare meta files from begins that never received a chunk, the oldest about eleven days back, with no reaper anywhere; a failed put leaves server-side state and announces nothing, so the leak is invisible until someone lists the directory. Industry bar is the S3 lifecycle rule AbortIncompleteMultipartUpload which expires unfinished multipart uploads after a declared number of days, and the OCI spec upload session timeout. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching cp_reap_stale Pros none measured yetCons behind Fly.io, Kubernetes+Argo; open contract; expected source declaration not established	○	○	●	○	●
The shared HTTPS post path follows an async job pointer so every caller inherits it Measured: `hp_follow_job` exists in `runtime/nx_https_post_lib.nx`, verified at emit. RETRACTED AND RE-MEASURED 2026-09-04 by its own author within the hour: the 89-and-81 figure counted FILES CONTAINING THE STRING tools/call, which is a membership error -- it swept in 18 tool_register emitters, 17 gates asserting on envelope text, and 8 SERVER-SIDE organs that PARSE tools/call rather than send it, and calling a server a blind client is what exposed the mistake. Re-measured BY POST PATH over the same corpus: 90 files carry the string, 4 post via hp_post_json, 2 roll their own record loop, 84 do not post at all, and the partition sums to 90. There is therefore NO shared chokepoint here: hp_follow_job reaches FOUR organs, not 81. The leverage this row originally claimed does not exist, and saying so is the point: the follow is still worth having as ONE implementation, but it is a correctness fix for four organs rather than a fleet-wide one. The open question is capability rather than code, because the follower needs a read capability to fetch the job artifact and most callers hold none. Industry bar is Google AIP-151 long-running operations, where the operation name is returned and polled by the generated client for every method rather than by each caller by hand. rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=8 nonval=4` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Self-re-exec with the listener banked in the environment DARK — `runtime/_hdl_build/nx_hostctl.nx` EXISTS but does not declare `hc_reexec_fd`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH hc_reexec_fd. Cloudflare's production answer to process replacement, open-sourced 2026-02-13, is fork plus exec with the listener fd handed down and the child signalling readiness before the parent drains [ecdysis26]. Done when the supervisor banks the listener fd number, forks, execs the new binary, waits for the child's readiness pipe, and only then closes and drains -- bite-proven by killing the child mid-init and asserting the parent NEVER stopped accepting. Kubernetes rolling replacement is the Best column by construction; the PaaS rivals do it behind a proxy (Part). watching hc_reexec_fd Pros none measured yetCons behind Vercel, Fly.io, Render, Kubernetes+Argo (leads); open contract; expected source declaration not established	○	◐	◐	◐	◉
Zero refusals and zero truncated responses across a swap DARK — `runtime/_hdl_build/nx_deploy_ready.nx` EXISTS but does not declare `dr_zero_drop_swap`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH dr_zero_drop_swap. The seamless-reload incumbent is unchanged and re-committed to 2031 with HAProxy 3.4.0 LTS on 2026-06-03 [haproxy34]. Nothing new to build; the buildable unit is the PROOF this estate lacks: nx_hotlisten_gate proves only the necessary condition of two binders, never zero drops. Done when a gate opens N connections, triggers a replacement, and asserts zero refusals and zero truncated responses across the swap. [cloudrun-revisions-20260907] watching dr_zero_drop_swap Pros none measured yetCons behind Vercel, Fly.io, Render, Kubernetes+Argo (leads); open contract; expected source declaration not established	○	◐	◐	◐	◉
ExchangeFence
state handoff proven by a nonce sequence DARK — `runtime/_hdl_build/nx_hostctl.nx` EXISTS but does not declare `hc_exchange_fence`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH hc_exchange_fence. The 2026 frontier is STATE handoff, not socket handoff: coordinated handoff eliminates downtime for stateful services [shadow26], confidence MEDIUM on the percentages, HIGH on the mechanism. Done when the successor is brought to a serving state while the incumbent still serves, the incumbent is fenced and drained to zero against a named deadline, identity swaps, and zero messages lost is asserted by a caller-supplied NONCE sequence rather than by a count -- this estate has already measured that counts hide a leak. watching hc_exchange_fence Pros none measured yetCons behind Kubernetes+Argo; open contract; expected source declaration not established	○	○	○	○	◐
Rate-of-destruction circuit breaker DARK — `runtime/_hdl_build/nx_deploy_stage.nx` EXISTS but does not declare `ds_destruction_breaker`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH ds_destruction_breaker. In a six-hour 2026 outage a runaway sub-task deleted BYOIP prefixes and their dependent objects until an engineer found and stopped it, and the postmortem says the health-mediated snapshot rollout that would have caught it is not in production [cf-outage-feb26] (corrected 2026-09-04: an earlier note said automated rollback fired; none existed). Done when an organ counts destructive operations per unit time against a band derived from the store's own history, REFUSES above the band naming the rule, and stamps the refusal to a path derived from its own arguments -- paired with nx_retire_path so reversible retire is the only destructive verb in the path. Exceed claimed: no rival ships a destruction-rate breaker as a mechanism; the postmortem asks for one in prose. dossierwatching ds_destruction_breaker Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Last-known-good conf loader DARK — `runtime/_hdl_build/nx_hostctl.nx` EXISTS but does not declare `hc_lkg_conf`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH hc_lkg_conf. Microsoft's two October 2025 Front Door PIRs carry both halves of this row: QNBQ-5W8 commits to runtime validation pipelines against a replica of the data plane [azure-qnbq], and YKYN-BWZ shows a last-known-good configuration that had itself been contaminated and had to be edited by hand before redeploy [azure-ykyn], the stronger evidence for banking only a conf that parsed clean AND served (corrected 2026-09-04: an earlier note placed the LKG item in the wrong PIR). Done when every organ that reads a conf keeps the last one that PARSED CLEAN and served at least one request, continues on it after a parse or validation failure, and stamps LKG-HELD with the rejected file's hash -- so an unknown mode value fails CLOSED to the previous known state, which is the fix for the pr_mode-defaults-to-open class this estate already found. dossierwatching hc_lkg_conf Pros none measured yetCons behind Vercel, Fly.io, Render, Kubernetes+Argo; open contract; expected source declaration not established	○	●	●	●	◐
Citation-freshness beat with a DRIFTED state DARK — `runtime/nx_compare_refs_gate.nx` EXISTS but does not declare `crg_index_drift`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH crg_index_drift. NEGATIVE FINDING: AWS has published no Post-Event Summary for any 2026 event; its index, enumerated in full, stops at 2025-10-19 [aws-pes-index]. The refs gate already pins every mirror by hash; the missing axis is WHETHER THE SOURCE HAS MOVED ON. Done when every cited source records its accessed date, the source INDEX is re-probed on a cadence, and DRIFTED is emitted when the index's newest entry has not advanced past the cited one within a declared horizon. Exceed claimed narrowly: a board that knows when its own citations have gone quiet. watching crg_index_drift Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Build-determinism ratchet on the promote path DARK — `runtime/_hdl_build/nx_deploy_stage.nx` EXISTS but does not declare `ds_build_twice`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH ds_build_twice. Debian made reproducibility a GATE in May 2026: unreproducible packages are blocked from migrating to testing [debian-repro-gate26]. Done when the target is built TWICE in the same lane and the promote is refused if the artifacts differ, with the differing offset named. Cheap here specifically because the sovereign toolchain emits single-PT_LOAD program-header-only ELFs with no .symtab and no timestamp section to normalise. Exceed claimed narrowly: a promote that refuses a non-deterministic build, where the rivals measure reproducibility without gating on it. dossierwatching ds_build_twice Pros none measured yetCons behind Kubernetes+Argo (leads); open contract; expected source declaration not established	○	○	○	○	◉
Closure manifest beside every artifact, and a promote that refuses without it DARK — `runtime/nx_closurehash.nx` EXISTS but does not declare `ch_promote_refuse`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH ch_promote_refuse. Reproducibility is not enough: provenance attestations do NOT constitute a rebuild [repro-not-enough26], and attested builds bind the provenance digest into a hardware measurement so verification is one step [kettle26]. nx_closurehash exists and /api/build already prints closure_sha256; the buildable unit is the REFUSAL: done when a promote is refused for any artifact whose closure root is unrecorded, and one canonical build record -- source root hash, toolchain hash, conf hashes, output hash -- is hashed to a single committed digest beside the artifact. dossierwatching ch_promote_refuse Pros none measured yetCons behind Kubernetes+Argo; open contract; expected source declaration not established	○	○	○	○	◐
Source-track claim that refuses an unguarded write DARK — `runtime/nx_closurehash.nx` EXISTS but does not declare `ch_source_track`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH ch_source_track. SLSA v1.2 added a SOURCE track: the framework now covers who authored and reviewed the code, not only how it was built [slsa12]. Done when, for a given artifact, the organ emits the edit history of every file in its closure with the identity that made each change and the CAS token that guarded it, and REFUSES to emit a claim for any file whose write landed without an expect= token -- the refusal is the value, because it makes we-do-not-know-who-wrote-this a named state. watching ch_source_track Pros none measured yetCons behind Kubernetes+Argo; open contract; expected source declaration not established	○	○	○	○	◐
Verifier bite
an unauthorised key must be refused by name DARK — `runtime/_hdl_build/nx_reg_sign.nx` EXISTS but does not declare `rs_unauth_key_bite`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH rs_unauth_key_bite. cosign 3.1.3 fixed a verifier advisory on 2026-08-06; the verifier is attack surface and the transparency log a rotating external dependency [cosign-releases]. Done when a gate plants a signature valid under a key the policy does NOT authorise and asserts nx_reg_sign REFUSES it naming the rule -- the one tooth almost nobody writes, because every existing test asks did-it-accept-a-good-signature, which a verifier that accepts everything also passes. dossierwatching rs_unauth_key_bite Pros none measured yetCons behind Vercel, Fly.io, Render, Kubernetes+Argo; open contract; expected source declaration not established	○	◐	◐	◐	◐
RATS-shaped evidence record with an UNOBSERVABLE verdict DARK — `runtime/_hdl_build/nx_neverbrick_genesis.nx` EXISTS but does not declare `nb_rats_record`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH nb_rats_record. The transport for attestation is UNSETTLED: the individual attested-TLS draft was withdrawn on 2026-07-23 [ietf-seat]. Done when an organ produces evidence, reference values, appraisal policy and attestation result as four separately named artifacts whose verdict can be UNOBSERVABLE, bound to no channel -- so the verifier's third state, I could not appraise, survives whichever transport the field settles on. watching nb_rats_record Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Dependency-chain refusal for the rollback action DARK — `runtime/_hdl_build/nx_deploy_ready.nx` EXISTS but does not declare `dr_rollback_chain`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH dr_rollback_chain. An April 2026 paper frames control-plane sovereignty as the ability to govern, operate, evidence and recover services regardless of underlying infrastructure dependencies [cp-sovereignty26]; that is a federation-level framing, and the static-stability reading here, recover without traversing the subject, is the estate's own (corrected 2026-09-04: an earlier note attributed the definition to the paper and called it a first formalisation). This estate already named the same gate as an exceed candidate from its own route table: /api and /api/tools both traverse the one front door, so the process whose restart is the incident is on the path to the call that undoes it. Done when the gate resolves the transitive call chain of the rollback action -- daemon, port, conf, path -- and REFUSES if any element is the subject being rolled back, run before every deploy on the request path. Exceed claimed: a TESTED static-stability property, which the field writes essays about and no rival gates. dossierwatching dr_rollback_chain Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
Reverse-dependency index over the artifact closure DARK — `runtime/nx_closurehash.nx` EXISTS but does not declare `ch_reverse_index`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. WATCH ch_reverse_index. From 2026-09-11 the EU Cyber Resilience Act makes exploited-vulnerability reporting a legal obligation on a 24-hour, 72-hour and 14-day clock [eu-cra-reporting]. Done when, given a source file or symbol, the organ returns every promoted artifact whose closure contains it with its promote date, in minutes -- nx_closurehash and nx_importcensus exist; the missing organ is the INVERSE index, and if the answer takes longer than minutes the 24-hour clock is not meetable. watching ch_reverse_index Pros none measured yetCons behind Kubernetes+Argo; open contract; expected source declaration not established	○	○	○	○	●

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	39	rows carrying a Yes, Best or Part in a rival column
cited	20	a reference mark resolves to a pinned mirror
uncited	19	an observation read, badged until a reference lands
rows, summed	39	RECONCILED: the parts sum to the total 39

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Risk register

Risk	Likelihood x impact	Mitigation
Two warm slots double the memory footprint on a box that is already swapping	likely x medium	DL1 warms on demand and the admission gate refuses a warm-up under the memory floor.
A reconciler with apply authority is the most dangerous daemon on the box	possible x high	DL4 applies only through the never-brick doors it already has, never by file copy; report-only is the default mode.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-02	DP0	measure	nx_deploy_ready evidence-honesty BLOCK: 18 RED compare domains at session start (nx_sota_status), so every /api/deploy needed an AUDITED confirm_gate_override. Instrument: nx_swcompare_evidence per domain, verdict line in knowledge/status/evstamp_<dom>.verdict.
2026-09-02	DP0	land	deploy.matrix: 6 substring symbols repointed to top-level funcs (ma_do_deploy_status x2, cmd_buildrun, ma_do_promote_content, ma_emit_dashboard, ma_openapi) -- deploy RED to MEASURED-HONEST. Same class closed on surveys 5 rows, stem 1, swarm 1, videocodec 2, team 2, warden 2, projectmgmt 10; surveys stem team warden re-measured MEASURED-HONEST.
2026-09-02	DP0	land	nx_opaque_rfc_kat migrated onto nx_gate_verdict: three named RFC 9807 teeth (C.1.5, C.1.6, production round trip), exit carries the verdict. It printed no canonical passed N/M line so the referee read it VACUOUS pass=0/0. Build queued as BQ-nx_opaque_rfc_kat under a saturated box; promote owed, then re-run the deploy referee.
2026-09-02	DP0	land	nx_opaque_rfc_kat PROMOTED 172,282 B sha 5079e416 (allow_capability_loss=yes: the two lost runs are its own retired GREEN/FAILED literals, superseded by the canonical gv_verdict line); /api/gate_run passed 3/3 verdict=GREEN; deploy referee re-run MEASURED-HONEST with vacuous=0. The OPAQUE exceed row is now backed by an executed, readable proof instead of a pass=0/0.
2026-09-02	DP0	lesson	A SUBSTRING GROUNDS A CLAIM ONLY UNTIL THE RULER GETS STRICTER: 31 board rows across 9 domains named routes, CSS classes and comment words as their symbol; the one-symbol ruler (sd_present) made every one UNGROUNDED and the deploy gate blocked on it fleet-wide. A symbol is a top-level func or an _ABSENT_ contract, never a word that happens to appear in the file.
2026-09-02	DP0	queue	Still RED: automation (nx_sclass_dispatch_gate convicted its subject on a builder ADMISSION refusal; source now gv_need SKIPs on rc=4, build queued), swarm (nx_swarm_tend_gate old-generation binary hangs in the referee; rebuild queued), smallos (fewer than 5 measured axes: a content gap), doctor mangagen koikatsu autodev (re-measure pending).
2026-09-02	DL9	land	bq_dedupe_target SHIPPED in nx_buildq: the row finder is a pure function of the plane dump (exact id, BQ-t1 never matches BQ-t10), a second add of one target now says ALREADY-QUEUED and replaces by id, and a new verb `close <target> [rc]` marks a queued row closed IN PLACE with the reason so the poller can never rebuild a source another door already built; fired, closed and absent rows are named, never invented (NOT-QUEUED, NO-ROW, exit 0). Gate nx_buildq_gate 13 of 13 GREEN against the real nx_store_put on fixture planes; laptop _offc installed; NAS sources landing
2026-09-02	DL9	queue	the second clause of the done-rule, the SYNC build door closing the row itself, is a one-line fork of nx_buildq close after the BUILT receipt in nx_mgmt_api ma_do_build; the source edit is next and its deploy waits on build admission (the box has refused every build today, load 22 to 34 against a 16 ceiling)
2026-09-02	DP1	land	symbol corrected from the bare word rollback to ma_do_rollback and a matrix row added, so the ranker can price the rung it had been reporting UNMAPPED
2026-09-02	DL8	land	matrix watch row admitted for dj_count_prev_chain (the chain-classifying census the rung's own text specifies), so DL8 stops reading UNMAPPED and the ranker prices it against the platforms' revision-history bar
2026-09-03	DP1	land	the BEHIND drain now has a governed driver: nx_ship_fleet (SHIPPED 8c5ada31, registered; gate nx_ship_fleet_gate 19/19) forks nx_organ_ship per target at an AIMD-governed width (polite budget ceiling, halve on a build-admission refusal, pause on serve-first), so every promote still passes prove + adoptgate. Today's census (nx_artifactdrift): 233 BEHIND (186 gates), 41 AHEAD (never promote). Worklist knowledge/status/fleet_targets_gates_0902.txt (186 gates); plan-mode run at load 19.6 read rg_budget=0 admit=REFUSE width=0 (forked nothing, correctly); clock row fleet_drain_gates at 86400 s runs the drain whenever the box has headroom. The non-gate BEHIND rows (47) stay a hand-adjudicated list: nx_organ_ship rebuilds and the adoptgate refuses any loss, but a daemon in that set must go through the health-checked deploy, never the fleet
2026-09-04	DL10	measure	410443 byte ship lost chunk 7 of 9 and discarded the transfer; server exposes status id as a resume source that the client does not call
2026-09-04	DL11	measure	knowledge/contentput 82 entries, about 40 bare meta files from chunkless begins, oldest about eleven days, no reaper
2026-09-04	DL12	measure	89 organs post a tools call, 8 follow the job pointer, 81 do not; ceiling on exposure not a defect count
2026-09-04	DL12	retract	the 89-posters-81-blind census that motivated this rung was WRONG and is retracted by its author the same hour: it counted files containing the string tools/call, sweeping in 18 tool_register emitters, 17 gates asserting on envelope text and 8 SERVER-side organs that PARSE tools/call rather than send it. Discriminating experiment: classify by POST PATH instead of by string. Result over the same 90 files -- 4 post via hp_post_json, 2 roll their own record loop, 84 do not post at all, partition sums to 90. The rung therefore has NO fleet-wide leverage; it is a correctness fix for four organs
2026-09-04	DL12	land	the follow now exists ONCE as hp_follow_job in nx_https_post_lib with the pure parse split into the leaf nx_jobfollow_parse to break the import cycle, and jf_post_follow delegates rather than carrying a second poll loop (measured: 1 poll loop in the post lib, 0 in the follower lib). hp_post_json is DELIBERATELY unchanged so no existing caller blocks; activation is one conventional cap file that does not yet exist, so today every caller is byte-identical
2026-09-04	DL12	lesson	LABEL A POPULATION BY THE BEHAVIOUR YOU MEAN, NEVER BY THE STRING YOU GREPPED FOR -- the tell was that the census counted the SERVER as a blind client, and a membership error survives every later check because the count still reconciles
2026-09-04	DL10	land	the IN-FLIGHT half shipped and SALVAGED A REAL TRANSFER on its first production occurrence: `CC-CHUNK retry index 1 attempt 1 of 3` then `E2E OK 9 of 9` on a 411177 byte ship. A chunk is addressed by index so a re-send is idempotent, and retrying one index costs ONE request where the old restart cost nine -- an amplifier in reverse on a degraded array. CROSS-PROCESS RESUME REMAINS OPEN and the code says so in place, so nobody reads this as closing the rung
2026-09-04	DL10	lesson	the first live run of the retry EXPOSED A DEFECT THE RETRY ITSELF INTRODUCED: the receiver answers CP-CHUNK DUPLICATE-IDENTICAL for a byte-identical re-send (nx_content_put.nx:510) and the client accepted only CP-CHUNK OK, so a SUCCESS read as a refusal and aborted a live transfer -- briefly making the retry worse than no retry. Both spellings are now read from the server source, not guessed. SUCCESS HAVING TWO SPELLINGS IS THE SAME ONE-VOCABULARY DEFECT AS A MARKER LIST KEYED ON ONE PRODUCER
2026-09-04	DL12	measure	promote refused class=CAPLOSS capability_loss_permil=69 live_tokens_absent=8 of 115 on a 425-byte shrink. ADJUDICATED BEFORE OVERRIDING, not after: nx_contentdiff named all 8 and every one is a JF- diagnostic string deliberately moved into nx_https_post_lib and renamed HP-, and the ruler independently reported symmetry=BIDIRECTIONAL with gained_by_candidate=5 -- a rename, not a loss. allow_capability_loss was then passed WITH the enumeration in hand; a future reader inheriting the flag without this row would be inheriting a habit
2026-09-04	DL12	retract	a SECOND false blocker of my own retracted: I reported nx_board_contract_gate as un-promotable because local was 45414 and the NAS 63277. Those are a SOURCE size and an ELF size -- a subject mismatch, the same class as every homonym defect on this board. Source-to-source they are BYTE-IDENTICAL (45414, sha e805ed9f). It is now built, promoted and GREEN on the NAS: 105 domains, 3070 rows, 1157 contracts, partition summing exactly, ratchet at baseline 11, and the two axes added this morning firing on real data (prose_stale_source_claims=3, prose_stale_binary_claims=1)
2026-09-04	DL12	lesson	A GATE THAT CANNOT FIT INSIDE ITS OWN CALLER IS INDISTINGUISHABLE FROM A FAILING GATE. Its first NAS run returned exit_code=141 verdict=RED with capture_truncated=1 -- SIGPIPE, killed mid-write, while every tooth SHOWN had passed. Cause was my own naming worklists plus the pre-existing per-contract loops, unbounded against a 1157-contract corpus and a 16384-byte capture. Capping only my two changed nothing, which is what proved the volume was elsewhere. Fully capped: 16384-truncated to 5384-complete, exit 0, GREEN. The cap ANNOUNCES itself as a prefix of its own count, because a silent cap would trade a loud wrong answer for a quiet one
2026-09-04	DL11	land	nx_contentput_reap SHIPPED, promoted, registered and INVOKED. Production census metas=55 has_chunks=9 too_young=41 reapable=5 unknown_stat=0, partition RECONCILES; applied, reaped=5, re-census 50/reapable=0 and a second apply reaps nothing. TTL is read from conf with its PROVENANCE PRINTED on every run (CONF/ARGV/DEFAULT-derived) because this bound gates a delete. Dry-run is the default; --apply must be spelled out
2026-09-04	DL11	measure	the ~40 bare metas counted on 2026-09-04 were mostly from THAT DAY -- my own failed ships before the transport fix -- so at a 7-day TTL only 5 were genuinely stale. The conservative default is doing exactly what it is for, and quoting the 40 as the reapable population would have been a same-day artefact mistaken for historical debt
2026-09-04	DL11	lesson	MY FIRST NEG-CONTROL PROVED LESS THAN I CLAIMED. I ran --apply at ttl=0 to show a chunked transfer survives age, but the arg parser only accepts ttl>0, so it silently fell back to the 7-day default and the fixture NEVER REACHED THE CONDITION -- the transfer was protected by youth, not by the chunk test. Re-run at ttl=1 with too_young=0 asserted FIRST: 2222 reaped, 3333.meta and 3333.c0 survived, so the chunk test alone is what protects it. ASSERT THE FIXTURE REACHED THE CONDITION BEFORE ASSERTING THE OUTCOME
2026-09-04	DL11	retract	THIS RUNG'S PREMISE WAS WRONG AND SO WAS MY ORGAN. nx_content_put ALREADY HAS A REAPER -- v_reap/cp_reap, in the producer itself, with a BETTER bound than mine: a per-transfer deadline derived from nchunks x worst_call_ms x resume_allowance, where mine was a flat TTL. It also already abstains on an untrustworthy age. My nx_spendgate check searched the registered TOOL corpus and found nothing, because the capability lives as a VERB INSIDE THE PRODUCER, where no tool-name search can see it -- the exact check-before-build failure this estate keeps paying for, committed by me while writing rules about it
2026-09-04	DL11	measure	and the coverage argument for keeping mine does not survive either: knowledge/contentput/index.txt carries 278 rows against 50 directory metas, so the index is a SUPERSET and the incumbent sees everything a directory walk does. Mine is a pure duplicate with a worse bound
2026-09-04	DL11	measure	THE REAL DEFECT, RESTATED: the reaper is not missing, it is BUILT AND UNWIRED -- no caller for cp_reap anywhere in runtime/ or the confs. That is a wiring gap, not a capability gap, and it is why 5 transfers sat stale for eleven days beside a working reaper
2026-09-04	DL11	lesson	A CAPABILITY SEARCH OVER TOOL NAMES CANNOT SEE A VERB INSIDE AN ORGAN. nx_spendgate and nx_capsearch rank REGISTERED TOOLS; a sub-command of a shipped organ is invisible to both. Before building anything that acts on another organ's data, READ THAT ORGAN'S USAGE LINE -- the words `abort` and `reap` were in nx_content_put's own usage string the whole time
2026-09-04	DL11	land	CLOSED, and not the way the rung was written. The incumbent nx_content_put reap is now WIRED via cron.reg (17 4 * * *, output to logs/contentput_reap.cron.log because a cron row that discards its output makes its own failure unobservable). My duplicate is retracted in place: nx_contentput_reap is promoted as a read-only CENSUS whose --apply REFUSES with exit 2 and names the incumbent, proven live on the NAS and bite-proven locally (a 9-day-old fixture meta that the previous binary WOULD have deleted survives). One deletion ruler in the estate, one observer beside it. 5 stale transfers already drained, 55 to 50, reapable 5 to 0, partition reconciling at every step
2026-09-04	DL11	lesson	appending to cron.reg was safe ONLY because a sibling had already fixed nx_cron_reconcile: CR_REGCAP 16384 against a 24356-byte file used to drop the tail silently, so a row appended at the END would have been INERT while looking declared. That fix says in its own header that both caps are GONE, NOT RAISED, and both files are read whole via sys_read_file. CHECK THAT THE READER OF A REGISTRY READS ALL OF IT BEFORE APPENDING TO THE END OF IT
2026-09-04	DL10	land	CROSS-PROCESS RESUME SHIPPED AND PROVEN ACROSS A REAL PROCESS KILL. A 200000-byte 5-chunk ship was interrupted mid-transfer; the re-run printed CP-RESUME id=1788545834533796 chunk_raw=48402 nchunks=5 still_missing=4 already_received=1 and finished E2E OK chunks_sent=4 of=5 skipped_already_received=1, with the sidecar removed on the confirmed commit. Nothing was invented client-side: chunk_raw, nchunks and the MISSING INDEX LIST all come from the server's own `status <id>`, whose header says chunk_raw travels in status ON PURPOSE because a resuming client cannot derive it
2026-09-04	DL10	measure	the design guard is the DIGEST, not the size. The sidecar records the transfer id beside the LOCAL file's sha256, and a mismatch abandons it and begins fresh -- resuming a changed file would splice two generations into one artifact, byte-valid and semantically nonsense, and a size check would not catch a same-size rewrite. A resume that marks ZERO missing chunks REFUSES the skip path rather than committing whatever the server happens to hold
2026-09-04	DL10	measure	CONTROL FIRST, and it is what makes the change safe to ship: with no sidecar the path is byte-for-byte what has been shipping all day -- fresh begin, every index marked missing, no CP-RESUME line, gate 8/8 GREEN. The sidecar is written BEFORE the first chunk, because a crash between begin and chunk 0 is precisely the case this feature exists for
2026-09-04	DL10	measure	NEG-CONTROL PASSES DECISIVELY: with a sidecar present but the local file rewritten R->Z at the same 200000 bytes, the run printed CP-BEGIN id=1788546007675909 (a FRESH begin, not CP-RESUME) and chunks_sent=5 of=5 with no skip line. A same-size rewrite is exactly what a size check would have waved through, which is why the guard is the digest
2026-09-04	DL10	lesson	my post-hoc check of the neg-control was AMBIGUOUS and I nearly read it as a failure: after the run the sidecar sha and the file sha MATCHED, because a correct fresh begin REWRITES the sidecar for the new content. The state after the event could not distinguish did-not-resume from resumed-and-updated -- only the run's own CP-BEGIN line could. READ THE EVENT, NOT THE RESIDUE, WHEN THE ACTION UNDER TEST REWRITES THE THING YOU ARE INSPECTING
2026-09-04	DL10	land	CONTRACT NOW SATISFIED BY THE CODE, NOT BY EDITING THE ROW. The resume logic first shipped INLINE in main, so the published contract _ABSENT_:cc_resume_from_status named a symbol that did not exist -- the cell would have read WATCHING while the capability was live, which is exactly the mechanically-green-editorially-false mismatch the prose axis of nx_board_contract_gate exists to catch. Extracted to func cc_resume_from_status(store_i, url, spath, shahex, capraw, caplen, resp, respcap, rcraw, rclen, miss, out) returning 1 on adoption with out[] carrying id/chunk_raw/nchunks/still_missing. The _ABSENT_ spelling STAYS in the data by design; the emitter measures the symbol on every publish and flips the cell itself
2026-09-04	DL10	measure	the refactor was re-proven, not assumed: post-extraction interrupt-and-resume gave CP-RESUME still_missing=2 already_received=3 then E2E OK chunks_sent=2 of=5 skipped_already_received=3, and the client gate stayed 8/8 GREEN. A REFACTOR IS A HYPOTHESIS AND MUST PASS THE EXPERIMENT IT DEMANDS
2026-09-21	DL19	measure	gospelofwest.com launched 2026-09-21: LE wildcard cert issued on the laptop (DNS-01, TXT propagation hit the 360 s ceiling, authz VALID), pushed by nx_aw_send (3408 B chain, 32 B key), nx_domain_spinup.sh rc=0 over nx_aw_nasfix, http 200 cert CN=gospelofwest.com tenancy gate GREEN, router address row via nx_aw_routerfix, www alias rows, page_verify GREEN from the DNS vantage. Every step ran from the seat's laptop organs or a shell script, which is the reason M5 exists.
2026-09-21	DL24	land	nx_site_build generalised: keys pages, hero2, heronote, section_cards, section_steps, section_trust, section_cta, pagehero2, pagenote, section_related, pagecta with the former literals as defaults and the search form optional; andelinwest.site emits byte-identical (7 of 7 files) with the new build; promoted 46ca13ec with 5 lost runs, all the /practice path literal now derived from the pages key.
2026-09-04	DL13	land	September 2026 SOTA for release safety, rollback, reproducibility and attestation admitted as DATA: 14 refs pinned (deploy.refs 6763 to 12184 B, payload f3652f28ea271336), a MEASUREMENT AND ITERATION TOOLING section of 13 rows carrying 13 watch contracts (deploy.matrix 14311 to 23326 B, 7ab129262074336d), rungs DL13-DL18 under M4 ver 3.0 (deploy.plan 27463 to 29938 B, 99094170eeed8579); every append settled by the size ladder and proven single by row-unique count; NAS buildroot tree only
2026-09-04	DL13	measure	referee nx_compare_refs_gate 24/24 GREEN fleet-wide after the append (job 1788557920): files=103 pins=1369 matched=1369 missing=0 marks=3491 unresolved=0 uncited_keys=0; every one of the 14 keys is cited inline, checked by the composer before the write
2026-09-04	DL13	lesson	the sweep's verifier agent for this domain died to a usage limit, so every source was verified by sovereign FETCH instead (18 of 18 status 200, hashed, two 41563-byte arxiv pages proven distinct by hash not size) and every claim carries the sweep's own confidence grade in its note; a fetched and hashed page proves the source exists and says what the note quotes, it does not grade the claim's standing, so the MEDIUM rows (SHADOW, control-plane sovereignty) say MEDIUM on the page
2026-09-04	DL13	queue	all six rungs are pre-declared contracts with a positive AND a negative control; none is built. By the board's own columns the leverage order is DL17 rollback dependency-chain refusal (exceed; the estate already named it from its own route table), then DL14 build-twice ratchet (cheap here: single-PT_LOAD ELFs, nothing to normalise), then DL15, DL18, DL16, DL13. The AWS negative finding is a freshness bar, not a build item: crg_index_drift on the refs gate is where it lands
2026-09-04	DL13	retract	the published cite and matrix note for cf-outage-feb26 said automated rollback fired on nothing; the postmortem, read verbatim by the adversarial verifier (workflow wf_d98197e2-d2e), says the health-mediated snapshot rollout is not in production and an engineer stopped the runaway sub-task at 18:46 UTC. Cite and note corrected in place; the exceed stands because the remediation names a circuit breaker in prose; the DL13 done-rule is unchanged, it never carried the claim
2026-09-04	DL18	retract	the published cite for azure-qnbq placed a last-known-good repair item in PIR QNBQ-5W8; a verbatim search of that PIR finds no LKG text. The LKG evidence is PIR YKYN-BWZ (2025-10-29), where the LKG itself was contaminated and hand-edited: mirrored (67897 B, pin f002168e), admitted as ref azure-ykyn; the qnbq cite now says what that PIR says (runtime validation pipelines), the note cites both, DL18 cites azure-ykyn
2026-09-04	DL17	retract	the published cite and note for cp-sovereignty26 attributed a static-stability definition (recover without the subject) and a first formalisation to arXiv 2604.14242; the paper defines management sovereignty as governing, operating, evidencing and recovering regardless of infrastructure dependencies. Cite and note corrected; DL17 and its exceed rest on the estate's own route-table measurement, which the row always named
2026-09-04	DL13	measure	adversarial re-verification of all 18 published systems rows (workflow wf_d98197e2-d2e, 4 agents, 0 errors): CONFIRMED 15, REFUTED 3 (167 permil), UNDATED 0, UNCITABLE 0; every refutation was a paraphrased mechanism or an attribution, never a date, an id or a mirror
2026-09-04	DL13	lesson	a sovereign FETCH proved 18 of 18 sources exist and say what the notes quote; it graded nothing about the paraphrased mechanism, and the re-run verifier refuted 3 of 18 on exactly that axis. A fetched and hashed page is presence evidence; the claim needs its own referee, and a verifier that dies to a usage limit must be re-run, never replaced by a pin
2026-09-04	DL14	queue	cross-domain rank (workflow wf_d98197e2-d2e) orders this board differently from the queue row above and both are recorded: Tier 1 is DL14 build-twice plus DL15 closure-record refusal together (SMALL, nx_closurehash and first_diff_off exist), then DL16 the unauthorised-key bite, then DL13 the destruction breaker; DL17 rollback-chain refusal and DL18 last-known-good move to Tier 2 behind them because each needs new graph or per-daemon state; hc_reexec_fd and dr_zero_drop_swap are Tier 2 on a spare port; shadow26 state handoff is Tier 3
2026-09-07	DL9	land	Scoped compare publication released: canonical nx_compare_regen accepts one existing --domain, preserving full mode by default. SHAed268c61a7fa4e6fe1dc0943634acfc81bd3eee929a3d557169d679e71396dd0 promoted job1788804763. Parser49/49; selected team isolation verified by unchanged unrelated hashes; canonical ecosystem5150 and sovereignty5265 published with zero failures. Domain scope receipts state aggregates not refreshed. This is scoped execution, not automatic dependency invalidation or deferred-request recovery.
2026-09-07	DL9	land	Release feedback generator deployed: existing dated plan worklogs now produce a Latest recorded release summary and retained Release history and work log link on generated domain pages with plans. Native tests31/31 include actual deploy.plan, chronological selection, escaped text and invalid/future records. Matrix71d7039766b887e7d00440a7fa5c2538654c2734b6861ee1175081a8638ef9c7 promoted6767; actual publisher _offc copy restaged6870 and independently matched6879. UI visual acceptance pending; hub/radar/planless pages are outside this renderer. Each page updates on its next scoped publication.
2026-09-07	UI-RESPONSIVE	land	Shared Compare layout released: executive sections use a responsive grid with bounded prose; the capability matrix has a named keyboard-focusable horizontal scroll region; body and executive text respect root font sizing; small metadata text uses the existing stronger-contrast color; capability-card queries target their child elements. Native build and complete 178,042-byte staged render passed 14 content/structure checks, preserving scripts, row counts, IDs, themes and release links. A first 30-second capture timed out; a later bounded retry completed in about 4 seconds including API round trip. Mobile/tablet/desktop visual and interaction review remains pending; competitor breadth, the other deployment tables and adoption by other website emitters are not completed by this release.
2026-09-07	UI-LADDER	land	Shared ladder projection added to the existing page and API: inspect all declared rungs and direct prerequisites, with exact plan and matrix identities and explicit stale-rank diagnostics. Native parser34/34 and captured HTML/API parity74/74 passed; canonical render differs only in the expected evidence-age counter. Renderer509008 bytes SHAaf21badb14bd6e39d17358d9e44d413a55a6ce2e8cb0d936a279abb5ae9b2761 promoted1788823120 and publisher restaged1788823173. No execution readiness, ownership or completion is inferred from authored declarations. Visual and interaction acceptance remains pending; transitive path navigation, structured risk ownership and benchmark-driven SOTA qualification remain open.
2026-09-07	UI-LADDER	land	Ranking labels aligned with the evidence contract: stale output is a recorded priority estimate, not a Do this next instruction; the ranking shows its source-binding state, and the authored roadmap is no longer labelled a measured critical path. Existing ranks, contracts and worklog are retained. Final native page199522 bytes passed eight focused label/completeness checks after parser34/34 and HTML/API parity74/74. Four replaced printable strings are the reviewed intentional wording changes; the content ruler remains RED for those replacements, not silently waived as GREEN. Renderer509440 bytes SHA47b115649a12e5c5e758c8067eaacf36dcc1da1149b535617414e35de9c08a52 promoted1788823658. Visual acceptance, structured authority and benchmark qualification remain pending.
2026-09-08	UI-LADDER	land	Shared Compare production layout: Overview, Production map, Capability comparisons, and Delivery and evidence now group the existing detail; nested heading levels follow the section hierarchy. Missing-plan rendering keeps usable capability/evidence sections without empty roadmap navigation. Five deployment reference entries expand the documented field without adding benchmark scores. Canonical renderer518272 bytes SHA1cb7e7b59eb02f4135224f56e599af56d8a550379ae166e369579b3c1c740095. Actual HTML/API capture checks and missing-plan native cases passed. Release accounting: publication and served verification are separate from build success; visual acceptance, performance/resource/total-cost baselines and SOTA qualification remain unmeasured. No Beach or hair capability is delivered by this renderer change. Promoted1788832885 and publisher restaged1788832926. All31 printable losses were reviewed as intentional heading, navigation and CSS replacements; the content ruler remains RED, with a specific reviewed replacement exception. Public page publication and served verification must be checked separately.
2026-09-08	DP1	land	Scoped page-publisher retry repair: nx_site_publish promoted1788842921 hash01baf9e5e98319d1a6b569708dcd4364f37da4c1a829b95503787be272b5abe0. Isolated11/11 gate2699. Live749670B Beach retry2930 UNCHANGED writes=0; previous746862B page hash remained0b5c424f94440bcd2e3cc3f80950d7e164691b14c9dbe449ae050da96b67cb29 at2976. Preserves last different .prev on identical retry. Not multi-artifact rollback or concurrent transaction guarantee; those remain open. Build-to-serve and visual receipt automation remain gaps.
2026-09-08	DP1	measure	Artifact-reference candidate in existing nx_game_page_emit rebind: native local10/10 gate and actual749913B Beach page reproduced byte-exact in0.066s from SHA-pinned page/WASM references. Not promoted: concurrent new-output creation race still requires hardening; NAS builds refused admission with no queue. Reference https://bazel.build/remote/caching supports action metadata/content-addressed outputs; no parity benchmark or SOTA claim. Public publisher retry repair remains delivered.
2026-09-08	DP1	measure	Artifact-reference concurrency hardened in candidate: native exclusive scratch plus Linux RENAME_NOREPLACE,12/12 gate on WSL Linux/tmp with competing-writer test. Windows/mnt/c rejects errno-22 and no overwrite fallback. Actual749913B Beach rebind SHAverified after fix. Host source synchronized but unpromoted: fresh ioconfirm4235 measured9 over12s; build4256 refused at age2s, so current pressure refusal not solely stale data. No threshold changes or SOTA claim.
2026-09-08	DP1	measure	Guarded publisher candidate adds artifact and live SHA pins, target ownership, idempotent retry and scoped reverse. Local native20/20 and actual764950-byte Beach isolated publish/readback pass. Host artifact124207B matches local gate hash783092f4b170f686bf06d1e8a5d2195dde0a9c976fd1fcee5e8a5ac4ae623e5d; host gate attempts2270 and2526 timed out during writes, so NOT promoted. Host publisher build2480 completed with no-cache diagnostic after fresh admission; staged130648B hash87b9f4f4f1f11b31fc9c5ba7b3339d3ca8e504ca210d82f7c7af398fd94d2052. Earlier gate build1788 stored its correct binary then timed out after300000ms. Source audit: post-store cache pruning reads every payload to count bytes; metadata-only candidate compiles and passes isolated cold/warm build with64MiB logical cache payload and executable result42. Actual host latency cause and cache candidate adoption remain unverified. September2026 hot-update and delivery requirements B26-HOT/STREAM/DELIVERY/REVIEW are in sovereign-human-world-contract-20260907.md. No public Beach graphics or deployment SOTA claim.
2026-09-21	DL24	queue	nx_site_build_gate is BUILT+STAGED d0edcdf2 on the NAS but /api/promote refused D001 (rolls its own verdict): migrate it (nx_gate_dry_apply then nx_gate_migrate verify) and promote, then /api/gate_run answers instead of NOT-FOUND exit 127. The generalised emitter is proven on the laptop (andelinwest.site byte-identical) and unproven by the NAS gate until then. Second queue item: the edge 301s every /<pages>/<slug>.html link to its extensionless form, so the emitter should emit extensionless hrefs and sitemap urls (one key or one default, byte-identical on the incumbent again).
2026-09-21	DL24	land	the showcase tier now emits EXTENSIONLESS, RELOCATABLE hrefs (./ and ../ prefixes by page depth, the face at a relative fonts/ path) and copies the display face with its OFL LICENSE into RELEASE/fonts (nx_site_build promoted 2ff7ba05), so ONE release serves at the production root, under nishifamily.com/alpha/SITE/ and under /beta/SITE/; the extensionless-href queue item is closed for the showcase tier (the kit and editorial tiers still emit .html, byte-identical on the incumbent), the gate migration item stays open
2026-09-21	DL20	lesson	A candidate previewed through a symlink under the LIVE release is a production exposure, not a stage (operator, 2026-09-21: not the alpha/beta/production methodology): a site version is emitted to releases/vN (not served), reviewed on the alpha plane at nishifamily.com/alpha/SITE/, stabilised on /beta/SITE/ with a browser check, and reaches production only by golive on the operator's eye; the DL20 release verb owes stage-to-alpha and alpha-to-beta as MCP verbs (today a symlink over the nasfix lane)
2026-09-22	DL20	land	2026-09-22 the alpha release of gospelofwest.com now runs as the publisher's plane plan-site-release-gospelofwest- (12 rows: emit gospelofwest_v8.site to releases/v8, ui_audit file, nine registry-gated nx_site_publish rows into sites/nishifamily/alpha/gospelofwest, page_verify) executed by nx_plan_run with receipts in planrun-site-release-gospelofwest-; owner = publisher (RACI site-release AR, ux supervisor operator C, pm warden I; crew row publisher site-release nx_plan_run; orchestration binding site-release to nx_plan_run); the v6 alpha had been copied over the shell lane and its nine paths were unregistered until nx_pub_plane adopt nishifamily
2026-09-22	DL20	measure	2026-09-22 first owned run: 12 of 12 steps rc 0; alpha index 26031 bytes (v6 24192), theme pages 25191 bytes (v6 23382), three mv- keyframe presets plus the page view-transition, itemscope 2, ui_audit hygiene 12 of 12 with the craft and agent blocks, page_verify GREEN a11y 0; registry adopt added 768 (725 draft pages, 43 assets, 0 debris) with 88921 already registered
2026-09-22	DL20	queue	owed: the release verb proper, one organ that walks releases/vN into alpha, beta or production through the publish gateway so the plane holds one row per stage instead of one row per file (per-file rows rot when the emitter adds a file); beta and golive as separate planes whose golive step reads the accept plane; the same plane shape for andelinwest and every client site; EC68 rr_release_owner resolves the owner and refuses an ownerless target
2026-09-22	DL19	queue	2026-09-22 RELEASE-SIDE CONTRACT from ecosystem EC68 and EC69 (operator standing directions): every release verb on this board (DL19 spin-up, DL20 release, DL21 golive, DL22 router row, DL23 NAS-side cert, DL24 self-service door, DL25 one plan_run plane) is invoked only through the owning role's seeded plan plane, never by a seat's hand; the RACI store carries ROLLOUT-waves-one-version (R architect+referee, A pm, C adversary+operator, I all-crew); a release stage is reported as ready, running, waiting or needs-intervention with evidence age and the pending artifact identity; estate-wide rollout proceeds by blast-radius waves planned from the drift census with the previous process kept alive as the rollback and a wave whose undo path traverses its subject refused (nx_undopath_gate). First wave named: gospelofwest.com alpha (v6) then beta then production through the owner's plane, with receipts on this board. The lifecycle rule (ecosystem EC71) applies to every release artifact: a previous release is SUPERSEDED with its successor named and leaves the serving surface, archived with its mining receipt, never left beside the live one as a parallel site
2026-09-27	DL22	measure	2026-09-27 04:26 UTC the nishifamily.com apex plus wildcard certificate (Let's Encrypt, issued Jun 29) expired on schedule, a REPEAT of 2026-06-28: every site behind the front door and every MCP wire call failed SEC_E_CERT_EXPIRED, ssh :22 was closed from the LAN, and the ssh-bound aw organs (nasfix, hostctl status) could not reach the NAS; the autorenew sweep rides the team-pulse conductor, which the July record already names as not beating; a seat issued a replacement on the laptop with the estate's own ritual (nx_secret_cli get porkbun, nx_sov_build_run nx_acme_dns01_issue nishifamily.com, exit 0, 3408 B chain, valid to Dec 26) and stopped at the issuer's own line "human drives deploy"; the operator deployed a certificate issued 05:09 UTC and the front door verified 200 at 15:00 UTC
2026-09-27	DL22	queue	the lapse is a MECHANISM defect, not a missed task: (1) the renewal beat needs its own heartbeat stamp and an ALARM on staleness, independent of the conductor (an abstaining beat is invisible: the estate's own axis-blind law); (2) a pre-expiry alarm at 30, 14 and 7 days read from the served certificate itself (openssl dates are the witness, never a stamp); (3) the DL22 NAS-side issue verb with Porkbun credential custody decided by the operator, so renewal does not depend on one laptop being awake; (4) the aw lane needs a non-ssh path for hostctl verbs (certswap, restart) so a seat can complete a deploy when :22 is closed
2026-10-03	DL22	measure	2026-10-03: andelinwest.com served a certificate that expired 2026-09-30 22:59 UTC (leaf read by an outside TLS client: notBefore 07-02, notAfter 09-30), three days after the 09-27 nishifamily lapse whose renewal left it untouched: the fourth lapse in about a hundred days. Found only because a real browser refused an alpha page (ERR_CERT_DATE_INVALID); the estate's page verifier read UNOBSERVABLE tls-handshake and raised nothing; the autorenew organ is BUILT and STAGED and was never promoted, and nx_cert_monitor was source-only since June
2026-10-03	DL22	land	andelinwest.com renewed: issued on the laptop with the estate ritual (nx_secret_cli get porkbun, nx_sov_build_run nx_acme_dns01_issue andelinwest.com, authz VALID twice, exit 0), chain 3409 B sha256 dc970aae6f38d1483c9fced4490823ea2dd4b1d0e9ea1d8af5d8d931659a3a43, valid 2026-10-03 21:26 to 2027-01-01 21:26 UTC, names apex plus wildcard; staged by nx_aw_send under content-addressed names; the operator approved the install in session; manifest row swapped under a size CAS with backup certs/sni_certs.manifest.before-20261003-dc970aae6f38; served leaf verified by an outside TLS client for andelinwest.com (new) and for nishifamily.com and gospelofwest.com (unchanged), and by a real browser loading https://andelinwest.com/alpha/docs/. Laptop copies of the key and the credential scratch file shredded
2026-10-03	DL26	land	nx_cert shipped 950b69a1 (gate nx_cert_gate 524db34e, 22 of 22, built first try), registered on the MCP surface, cap in ~/.nishi/cert1003.cap, clock row certstatus 86400 committed at revision 270. First live run: rows=4 ok=3 warn=1 partition SUMS, b2b.loans 9 days left (not_after_epoch 1791928133), verdict RED -- the next silent lapse, seen ten days early
2026-10-03	DL26	lesson	a whole-day expiry rule calls a certificate that lapsed 23 hours ago a warning (the gate prints the old monitor's verdict for that case: 1, WARN); expiry is decided on seconds. And the watch list is the manifest the edge loads, never a second list: the 09-27 renewal fixed the one name somebody was looking at and the other name on the same edge lapsed three days later
2026-10-03	DL22	queue	operator decision still open and now blocking DL29: NAS-side custody of the DNS provider credential. Without it renewal stays a laptop ritual. Recommendation: a credential scoped to DNS records for the estate's zones, held in the NAS vault and readable only by the issue verb
2026-10-03	DL26	land	b2b.loans renewed and installed the same evening the status verb first read it at 9 days left: issued on the laptop (authz VALID twice, exit 0), chain 3392 B sha256 17a4f3d06690113758adceb4fe5bdd9845db669aac82d6ced6bc13eae3783a54, valid 2026-10-03 21:43 to 2027-01-01 21:43 UTC, apex plus wildcard; operator approved the install in session; manifest row swapped under a size CAS with backup certs/sni_certs.manifest.before-20261003-17a4f3d06690; served leaf verified by an outside TLS client for all four names; nx_cert status then read rows=4 ok=4 partition SUMS verdict GREEN, nearest expiry gospelofwest.com 2026-12-20. Laptop key copy shredded
2026-10-03	DL28	measure	OPERATOR DECISION 2026-10-03 (asked in session, answer: yes, standing approval): until the install verb exists a seat may install a RENEWED certificate for a domain already in the edge manifest with the backed-up, verified row swap without asking each time. Conditions that travel with it: a backup of the manifest first, the served certificate verified for every domain afterwards, the old row restored on any failure, and a land row on this board for each install. It does not cover a new domain, a key-mode change, or any other edit of the edge
2026-10-03	DL22	measure	OPERATOR DECISION 2026-10-03 (asked in session, answer: NAS vault, issue verb only): the DNS provider credential moves into the NAS vault, readable only by the certificate issue verb, so renewal runs on the estate's clock with no laptop awake. This closes the custody precondition DL22 has carried since 2026-09-21 and unblocks DL29. The move itself is not done: it needs the vault row, the scoped reader and a gate that proves no other organ can read it
2026-10-04	DL31	measure	key modes measured over the ssh lane 2026-10-03: sites.elf and sni_router.elf run as elderwesto, the owner of every key file; le_gospelofwest.com_ecdsa_key.bin and le_ecdsa_key.bin are already 600 and gospelofwest.com serves, a positive control that owner-only works with the live edge; five key files are 755 (le_andelinwest_ecdsa_key.bin, le_andelinwest_ecdsa_key_dc970aae6f38.bin, le_b2b.loans_ecdsa_key.bin, le_b2b.loans_ecdsa_key_17a4f3d06690.bin, le_nishifamily_ecdsa_key.bin) because the ssh receive verb installs 755. Tightening them is one chmod each and is NOT covered by the standing install approval: waiting on the operator's go. The status verb does not report the mode yet
2026-10-04	DL31	land	the status verb reports key modes on their own axis: nx_cert e938bc6c (gate nx_cert_gate c0f2d161, 31 of 31, nine new teeth with fixture key files at 600 and 644, a missing key and a row with no key field). Live run 2026-10-03: nishifamily.com, andelinwest.com and b2b.loans keys EXPOSED mode 755, gospelofwest.com OWNER-ONLY mode 600, partition SUMS; the same modes the ssh read showed, so two independent readings agree. The axis is separate by design: it does not move the expiry result, so three exposed keys do not turn the certificate check permanently red. Still open on this rung: the chmod itself (operator's go) and install writing 600 (DL28)
2026-10-04	DL26	measure	the daily beat was declared but could not have run: nx_clockjob get certstatus read schedule_state=WAITING_AUTHORITY authority_reason=EXPECTED_EXECUTABLE_MISSING, because the clock now runs a row only when it is bound to the exact executable. Bound 2026-10-03 with nx_clockjob bind (revision 276, expected sha256 e938bc6c..., command /volume1/homes/elderwesto/nishihost/nx_cert.elf status): both planes now read ELIGIBLE, BOUND_CONTRACT, next due 1791163754. execution_proven is still 0: the first fire has not happened, so the beat is scheduled, not yet witnessed. A re-ship of nx_cert changes its hash and needs a re-bind
2026-10-04	DL26	lesson	a put on the clock plane returned DESIRED_COMMITTED and the row appeared live with a next due time, yet it was not authorised to execute; the receipt of the declaration said nothing about that. Read nx_clockjob get after every put and look for schedule_state=ELIGIBLE, then for execution_proven after the first interval
2026-10-04	DL31	land	the key files under certs/ are owner-only: per the session record the seven private key files were set to mode 600 on 2026-10-03 (row 1791077030 had measured five at 755 and two already at 600) and four outside TLS handshakes succeeded afterwards. Re-measured by the status verb (nx_cert e938bc6c, run at 1791079735): all four keys the manifest names read OWNER-ONLY mode=600 (le_nishifamily_ecdsa_key.bin, le_andelinwest_ecdsa_key_dc970aae6f38.bin, le_b2b.loans_ecdsa_key_17a4f3d06690.bin, le_gospelofwest.com_ecdsa_key.bin). The three key files no manifest row names (le_andelinwest_ecdsa_key.bin, le_b2b.loans_ecdsa_key.bin, le_ecdsa_key.bin) are outside this organ's reach and were not re-measured by it. Still open on this rung: install writing 600 (DL28)
2026-10-04	DL31	measure	nx_cert status at 1791079735 (binary e938bc6c): CERT-KEYS rows=4 owner_only=4 exposed=0 unreadable=0 none=0 partition=SUMS; expiry axis CERT-SUMMARY rows=4 ok=4 warn=0 expired=0 unreadable=0 malformed=0 partition=SUMS needs_action=0, nearest expiry gospelofwest.com 6709944 s (77 days, not_after_epoch 1797789672); stamp wrote 159 of 159; verdict GREEN. The same organ read three keys EXPOSED mode 755 in row 1791077300; it now reads zero, so the axis moved 3 to 0 with the chmod
2026-10-04	DL26	measure	clock row certstatus read at about 1791079735: both planes revision 276, ELIGIBLE, BOUND_CONTRACT, expected sha256 e938bc6c; LIVE next_due=1791163754 (about 84000 s, 23.3 h ahead) and execution_proven=0, so the first daily fire has NOT happened yet: the beat is scheduled, not witnessed. Re-shipping nx_cert for DL27 moves the hash, so the row must be re-bound before that first fire or it will wait for authority instead of running
2026-10-04	DL27	land	served-leaf probe landed in the incumbent lib and verb, no parallel organ: nx_cert_lib gains nc_tls13_leaf, nc_der_len, nc_served_classify, nc_probe_served, nc_served_scan, nc_conf_port and nc_stamp_served, composing nx_connect_bounded, nx_tls13_client_session_run and the validation context's cert_out capture (no handshake code of its own). nx_cert served [manifest] [ip] [port] defaults to loopback and the port of the deploy_targets.conf sites row; status runs the same axis on its own lines and a third stamp line and never moves the expiry verdict. Four counted states MATCH / MISMATCH / UNREACHABLE / UNREADABLE with a summing partition; served exit 0 every row MATCH, 1 any MISMATCH, 3 otherwise (unreachable is never a pass). Shipped through nx_organ_ship: nx_cert c321e61f (450904 B, was e938bc6c 54888 B; the growth is the TLS client and the hf_store_load trust-store ladder) with 2 lost runs approved by allow_loss_v1 c3b447ad (the one-verb usage line and the old scope text, both superseded) and a reviewed behaviour change (review 294cf311, observation e699cf8a); gate nx_cert_gate aaf478ee 55 of 55 (24 new teeth incl. one-byte and different-certificate MISMATCH neg-controls and loopback port 0 UNREACHABLE end to end). Clock row certstatus re-bound to c321e61f at revision 280, both planes ELIGIBLE BOUND_CONTRACT, next_due 1791163754, execution_proven still 0. Sources: nx_cert_lib.nx 31071 B, nx_cert.nx 11455 B, nx_cert_gate.nx 20207 B
2026-10-04	DL27	measure	live from the promoted binary c321e61f at 1791082141, vantage 127.0.0.1:8443 (the edge terminator on loopback; port read from the deploy_targets.conf sites row): nishifamily.com MATCH leaf 930 B, andelinwest.com MATCH 932 B, b2b.loans MATCH 915 B, gospelofwest.com MATCH 931 B, every handshake connected=1 validated=1; CERT-SERVED-SUMMARY rows=4 match=4 mismatch=0 unreachable=0 unreadable=0 partition=SUMS, served verdict GREEN; status verdict GREEN with expiry 4 OK and keys 4 OWNER-ONLY. The production stamp now carries line 3 served_observed=1 served_rows=4 served_match=4 served_mismatch=0 served_unreachable=0 served_unreadable=0 edge_port=8443, line 1 (ts gauge axes_known axes_total) unchanged. Scope: this proves what the loopback listener presents, not what a public client is routed to; the outside-vantage half of the done-rule is still open
2026-10-04	DL27	lesson	the first live run read all four rows UNREADABLE with connected=1 validated=1: the parser began at the Certificate body, but the capture handed to cert_out carries the 4-byte handshake header (type 11 and a 24-bit length), as nx_tls13_client_validate_certificate_test Test C shows by feeding the same function a 0x0B-headed message. The gate had read 54 of 54 GREEN because its fixture was assembled in the same wrong shape, so it measured agreement with the bug. Fixed in nc_tls13_leaf; the fixture now uses the wire form and a body-only message is a neg-control. A known-answer fixture must come from the producer's contract, never from the parser under test. The same body-first parse sits in nx_edge_probe (ep_count_chain, ep_autopsy) over the same capture; not run here, so unverified there
2026-10-04	DL28	queue	nx_cert install <domain> <chain> <key> now has its verify step ready: after the row swap it calls nc_served_scan for the installed domain and every other row and restores the backup on anything but MATCH. Still needed before it can ship: (a) validate the pair before touching anything: the chain parses, covers the domain (wildcard included), notBefore <= now, and the leaf public key matches the key file (compose nx_x509_validate and the SAN and validity readers, refuse by name); (b) write chain and key under content-addressed names with the key at 0600 through an atomic mode-setting writer (the nx_offc_install pattern, never a raw copy, which lands 0644); (c) swap the one manifest row atomically under a lock with a named backup; (d) wait for the edge's hot reload before the served verify, with the reload cadence read from the edge, not typed; (e) a gate over a fixture manifest and a stand-in listener, with a refused-pair neg-control and a forced-MISMATCH rollback tooth. Still open on DL27 itself: the outside-vantage row and an UNREACHABLE or MISMATCH alarm on the deploy.gauge row
2026-10-04	DL27	land	served-leaf probe in nx_cert (cb85425a, gate nx_cert_gate b8818225 112/112): per manifest row one TLS handshake with that SNI at the estate vantage 127.0.0.1:8443, served notAfter against the file's, mismatches split STALE, WRONG-CERT and other with both dates printed and the sub-counts summing; a public vantage over 1.1.1.1 and 8.8.8.8; stamp lines 3 and 4. The daily status verdict is still the expiry verdict, so the certstatus beat stays GREEN; the separate served verb needs both vantages. certstatus re-bound revision 285 to cb85425a in the same minute as the promote
2026-10-04	DL27	measure	live: estate vantage 4 of 4 MATCH (nishifamily.com, andelinwest.com, b2b.loans, gospelofwest.com); public vantage UNOBSERVABLE from the NAS because 1.1.1.1 and 8.8.8.8 on port 53 answer 192.168.8.240 for every name (the LAN router intercepts DNS), public_unresolved=4, never counted as a pass
2026-10-04	DL28	land	nx_cert install <domain> <chain> <key> [manifest] [ip] [port] (nx_cert_install_lib): refuses an unparseable chain, a chain that does not cover the domain, not yet valid, expired, a key that does not match the leaf, a bad domain, a relative manifest, no row and a duplicate row, each by name; writes both files beside the manifest under content-addressed names with the key at 0600; one atomic row swap with a named backup (atomic_rewrite_owned); a served check of every row afterwards; any failure restores the backup, proven by re-reading the file's sha256. Gate teeth on fixtures only; NEVER run against the production manifest. Imprecision declared: the success branch is not driven end to end (it needs a TLS listener serving the test certificate); bite killed 1 of 5 with 4 survivors in the refusal-name strings no tooth reads
2026-10-04	DL27	queue	a public lookup over a channel the router cannot rewrite (DNS over HTTPS) or a vantage off the LAN, so the public row can read MATCH; a test TLS listener for the DL28 success branch; teeth on ni_ename's refusal names

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/deploy.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain deploy, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from deploy.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	4
scanned	4
fetched	4
reused	0
failed	0
named	4
candidates	4
mentions	4
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	Vercel	1	1	col0-vercel	named	https://vercel.com/docs/instant-rollback
2	Fly.io	1	1	col1-fly	named	https://fly.io/docs/reference/configuration/
3	Render	1	1	col2-render	named	https://render.com/docs/deploys
4	Kubernetes+Argo	1	1	col3-kubernetes	named	https://argo-rollouts.readthedocs.io/en/stable/

Gauges — a heartbeat, never a bare number

Each row names a gauge stamp written by its measuring beat. This page re-judges the stamp on every publish with the same ruler the beat uses (nx_gauge_lib): FRESH shows the value; STALE withholds it (older than two beats); BLIND withholds it (an axis abstained); ABSENT means nothing has measured. A stale gauge never reads as zero.

gauge	state	reading	note
Certificates needing action (inside the 21-day window, expired, or unreadable) among every domain the edge serves	FRESH	FRESH gauge=0 axes=1/1 age_s=65517	DL26: written by nx_cert status on the certstatus clock row from certs/sni_certs.manifest, so a domain added to the edge is watched without a second list. axis = the manifest was read: an unreadable manifest stamps axes_known=0 and reads BLIND, never zero. This is the file view; the served-leaf probe is DL27. First live run 2026-10-03 read gauge=1 (b2b.loans, 9 days left).

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 45 capabilities: 34 exclusive to it and 11 shared with other boards. Shared rows on this page: 11 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 11 + refused 0 (partition 11); undecided = unmapped 0 + unproven 11 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=6356.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
OPAQUE	`nx_opaque_login.nx`	authz, deploy	—	none	unproven	undecided
sni_backend	`nx_sni_route.nx`	authz, deploy, trafficsafety	—	none	unproven	undecided
event-stream	`nx_mgmt_api.nx`	automation, deploy, containers	—	none	unproven	undecided
ma_do_promote_content	`nx_mgmt_api.nx`	cms, deploy	—	none	unproven	undecided
ma_do_deploy_status	`nx_mgmt_api.nx`	deploy, supervisor	—	none	unproven	undecided
cmd_buildrun	`nx_hostctl.nx`	deploy, swarm	—	none	unproven	undecided
SHIPPED	`nx_ship.nx`	deploy, containers	—	none	unproven	undecided
crash-loop	`nx_hostctl.nx`	deploy, containers	—	none	unproven	undecided
/api/services	`nx_mgmt_api.nx`	deploy, containers	—	none	unproven	undecided
ma_emit_dashboard	`nx_mgmt_api.nx`	deploy, containers	—	none	unproven	undecided
pbd_register_wall	`nx_porkbun_domain.nx`	deploy, warden	—	none	unproven	undecided

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395461 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence
directive	`nx_site_build_gate`	deploy	plan-queue	rung=DL24

rows shown 1|this board's directives 1|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[vercel-instant-rollback] Vercel Inc. Performing an Instant Rollback on a Deployment (vercel.com/docs/instant-rollback): point production domains back at any previously aliased immutable deployment, instantly, from dashboard or CLI. publisher · read in our library knowledge/fetched/cmp_deploy_vercel-rollback.html · pin h9f831075f1290e10a25f584d26d0cb540d2918a90407bf5db0a0c2e71bf2d8c4 · accessed 2026-08-18 · vendor-docGrounds: The Instant manual rollback row where Vercel is Best (instant alias flip to any prior immutable deployment) -- the bar POST /api/rollback restoring the .prev binary is graded against -- and the Vercel column on Preview environments per change and Ops dashboard UI.
[flyio-config] Fly.io. App Configuration (fly.toml) reference (fly.io/docs/reference/configuration): services, http_checks and tcp checks, deploy strategy (rolling, immediate, canary, bluegreen) and regions. publisher · read in our library knowledge/fetched/cmp_deploy_flyio-config.html · pin he572699e7dd7d2995498953f7e53220694379da131a2a131f3317be1d77b674a · accessed 2026-08-18 · vendor-docGrounds: The Fly.io column: Health-gated promote with auto-rollback watchdog (Fly health-checks releases), Canary and progressive traffic shifting, Blue-green dual-slot instant switch and Multi-node and multi-region placement (Fly regions lead) -- the fly.toml checks and deploy-strategy keys are the documented mechanism behind those cells.
[render-deploys] Render. Deploys (render.com/docs/deploys): git-triggered builds, zero-downtime deploys gated on the service's health check path, deploy hooks and manual rollback to a previous deploy. publisher · read in our library knowledge/fetched/cmp_deploy_render-deploys.html · pin heef78665ed2695dc39603c2c2b784ad4b965b5bea20e5fcda2df37fcbd63ef9e · accessed 2026-08-18 · vendor-docGrounds: The Render column: Health-gated promote with auto-rollback watchdog (Render health-checks releases), Instant manual rollback and Build on the target from source -- the documented deploy lifecycle the Nishi upload-build-promote-watchdog chain is compared with.
[argo-rollouts] Argo Project. Argo Rollouts -- Kubernetes progressive delivery controller (argo-rollouts.readthedocs.io): blue-green and canary strategies, weighted traffic steps, analysis-driven automated rollback. publisher · read in our library knowledge/fetched/cmp_deploy_argo-rollouts.html · pin ha13ade59af2152720464f62827c8a867ef7f009201eda8216fc78be275407617 · accessed 2026-08-18 · vendor-docGrounds: The Kubernetes+Argo column: Health-gated promote with auto-rollback watchdog (Argo Rollouts is the reference), Canary and progressive traffic shifting (weighted steps are the reference for the _ABSENT_ nx_deploy_canary gap) and Blue-green dual-slot instant switch.
[k8s-deployment] The Kubernetes Authors. Deployments (kubernetes.io/docs/concepts/workloads/controllers/deployment): declarative rolling updates, revision history and kubectl rollout undo. publisher · read in our library knowledge/fetched/cmp_deploy_k8s-deployment.html · pin h2fc7e20d2384f405f3f6c9a651f4ba8f0542b0ed8925e7f47e47bcb9f92f9775 · accessed 2026-08-18 · vendor-docGrounds: The Kubernetes half of the Kubernetes+Argo column: Instant manual rollback (rollout undo), Staged content publish, Live fleet inventory API (kubectl get is the reference) and the GitOps declared-state reconciler row's declared-state model that Argo/Flux reconcile toward.
[rfc9807-opaque] Bourdrez, Krawczyk, Lewi, Wood. RFC 9807: The OPAQUE Augmented Password-Authenticated Key Exchange (aPAKE) Protocol. IETF, July 2025. publisher · read in our library knowledge/fetched/cmp_deploy_rfc9807.html · pin h0e1ee56460c024fff7057d3743eb73aa4382a4fc274eb484597d6d43b41274cb · accessed 2026-08-18 · published-standardGrounds: The EXCEED control-plane auth is OPAQUE PAKE row: the password never crosses the wire and the server stores no password-equivalent are properties of this protocol (OPAQUE-3DH), which nx_opaque_login implements -- versus bearer tokens and OIDC on the incumbents.
[rfc8446-tls13] Rescorla, E. RFC 8446: The Transport Layer Security (TLS) Protocol Version 1.3. IETF, August 2018. publisher · read in our library knowledge/fetched/cmp_deploy_rfc8446.html · pin h370ed8c0e6da22c8b8f4ad0230b6c12e6ec8ae807eca034220070828f25684fb · accessed 2026-08-18 · published-standardGrounds: The EXCEED sovereign end-to-end hosting row: the live site terminates its own TLS 1.3 (nx_sni_route, no nginx, no cloud LB, no CDN) -- the protocol it implements is this RFC, so every byte from ClientHello to response is checkable against a public standard, and the One-command source to live row's upload over sovereign TLS rides the same stack.
[rfc8555-acme] Barnes, Hoffman-Andrews, McCarney, Kasten. RFC 8555: Automatic Certificate Management Environment (ACME). IETF, March 2019. publisher · read in our library knowledge/fetched/cmp_deploy_rfc8555.html · pin he6ca1ca3e44cbb54cf6dc126f23d9f2abc5837119800af49bfa5e2c546d79393 · accessed 2026-08-18 · published-standardGrounds: The TLS certificate acquisition (bundle retrieve + ACME DNS-01) row: the DNS-01 challenge nx_acme_issue completes for andelinwest.com (10509-byte Let's Encrypt bundle) is defined here -- platforms auto-provision on their edge, ours lands certs on the sovereign edge through the same protocol.
[porkbun-api] Porkbun LLC. Porkbun API v3 documentation (porkbun.com/api/json/v3/documentation): REST/JSON API to register and manage domains, DNS records, DNSSEC and SSL bundle retrieval, with an OpenAPI spec and sandbox. publisher · read in our library knowledge/fetched/cmp_deploy_porkbun-api.html · pin h8dae6acbd654dbc32e631c23715266204354a526c7092df91f68b2f3b1cd7122 · accessed 2026-08-18 · vendor-docGrounds: The Domain purchase API with spend wall + dry-run-first, DNS records API on the live registrar (A/TXT) and Purchase-to-live orchestration rows: the registrar endpoints (dryRun pre-flight, DNS record edit, SSL bundle retrieve) that nx_porkbun_domain, nx_acme_porkbun and nx_domain_golive drive live over sovereign TLS.
[oci-dist] OCI Distribution Specification -- Resumable Push and Chunked Upload (Content-Range PATCH sequence resuming from the last accepted byte) publisher · read in our library knowledge/fetched/cmp_deploy_oci-dist.md · pin h424901daf1487a0921b3dcb09c1541b2c7dc6109c7782507e3f197a9a40d5d22 · accessed 2026-09-04 · published-standardGrounds: Resumable artifact upload that survives a dropped chunk instead of restarting the transfer
[ecdysis26] Cloudflare blog, 2026-02-13: ecdysis -- graceful restarts in Rust by fork, exec and listener-fd handoff, open-sourced Apache-2.0. publisher · read in our library knowledge/fetched/cmp_deploy_blogecdysisrustgrace.html · pin h92836da76b0a4a84cb9a067eb6207367a9f159b8226bde4f4c912017eeb4f13c · accessed 2026-09-04 · vendor-docGrounds: Self-re-exec with the listener banked in the environment
[haproxy34] haproxy.org branch table: HAProxy 3.4.0 LTS released 2026-06-03, supported to 2031-Q2; seamless reload unchanged. publisher · read in our library knowledge/fetched/cmp_deploy_haproxywwwhaproxyorg.html · pin h8fedbf001ce4de084c367c15fbaa995837ad40d8d837fe63fa9be8bc64eae506 · accessed 2026-09-04 · vendor-docGrounds: Zero refusals and zero truncated responses across a swap
[shadow26] Dinh-Tuan, H. SHADOW: eliminating downtime for stateful services by coordinated state handoff. arXiv 2603.25484, v3 2026-06-01. publisher · read in our library knowledge/fetched/cmp_deploy_arxiv260325484.html · pin h26f70055d086edb570a6e493a02094c455914f112a237589ec1653b65dba4c82 · accessed 2026-09-04 · published-paperGrounds: ExchangeFence: state handoff proven by a nonce sequence
[cf-outage-feb26] Cloudflare postmortem, published 2026-02-21, for the 2026-02-20 incident (6 h 7 min): a runaway sub-task deleted BYOIP prefixes and their dependent objects from 17:48 UTC until an engineer found and stopped it at 18:46; no automated rollback existed to fire, and the remediation names a circuit breaker for changes happening too fast or too broadly. CORRECTED 2026-09-04 (an earlier cite said automated rollback fired). publisher · read in our library knowledge/fetched/cmp_deploy_blogcloudflareoutage.html · pin h2d55f9e5131adeeef430c727017b59d633ede074517eb349c7c021990cda863e · accessed 2026-09-04 · vendor-docGrounds: Rate-of-destruction circuit breaker
[azure-qnbq] Azure status history PIR QNBQ-5W8 (2025-10-09, Front Door access issues): repair item to build runtime configuration validation pipelines against a replica of the real-time data plane, estimated March 2026. CORRECTED 2026-09-04: the last-known-good item is NOT in this PIR, see azure-ykyn. publisher · read in our library knowledge/fetched/cmp_deploy_azuretrackingidqnbq5w.html · pin h9a837f9d11672c8bb2e13e84d234a52f65c2902c0e59051c3e9285b3fa7b7656 · accessed 2026-09-04 · vendor-docGrounds: Last-known-good conf loader
[aws-pes-index] AWS Post-Event Summaries index, enumerated in full 2026-09-04: newest entry 2025-10-19, no 2026 event published. publisher · read in our library knowledge/fetched/cmp_deploy_awspes.html · pin h0bd011a2cd83436530525cdf633087fa76efbaaf3fc5e8c873dd30868a948cac · accessed 2026-09-04 · mirrored-indexGrounds: Citation-freshness beat with a DRIFTED state
[debian-repro-gate26] debian-devel-announce, May 2026: unreproducible packages blocked from migrating to testing -- reproducibility as a gate, not a metric. publisher · read in our library knowledge/fetched/cmp_deploy_listsmsg00001html.html · pin h2d116d37b0ba5f990482e715e6281c913837380e65768cadbb0b105515bc5dbf · accessed 2026-09-04 · vendor-docGrounds: Build-determinism ratchet on the promote path
[repro-not-enough26] Reproducibility is not enough: provenance attestations do not constitute a rebuild. arXiv 2608.18180, 2026-08-18. publisher · read in our library knowledge/fetched/cmp_deploy_arxiv260818180.html · pin hc7f22f3a25c00ef92c545c859e4076ee132ae56e4e13ea4530eb1575850b1773 · accessed 2026-09-04 · published-paperGrounds: Closure manifest beside every artifact, and a promote that refuses without it
[kettle26] Asad, Arko. Kettle: attested builds put the provenance digest in a TEE attestation report. arXiv 2605.08363, 2026-05-08. publisher · read in our library knowledge/fetched/cmp_deploy_arxiv260508363.html · pin h767bb109a2bef8f7271a04a92b5f8e52b5020356a25304b9b2bb4e8f10a98ce7 · accessed 2026-09-04 · published-paperGrounds: Closure manifest beside every artifact, and a promote that refuses without it
[slsa12] SLSA specification v1.2, What is new: the Source track covers code authorship and review, not just build. publisher · read in our library knowledge/fetched/cmp_deploy_slsawhatsnew.html · pin ha2e8bee7130d1b8b6b221ea87787589d3cf9cf6d4455b97f4eb966e7f9891ac6 · accessed 2026-09-04 · published-standardGrounds: Source-track claim that refuses an unguarded write
[cosign-releases] sigstore/cosign releases: v3.1.3 (2026-08-06) fixing a verifier advisory; the verifier is attack surface. publisher · read in our library knowledge/fetched/cmp_deploy_githubreleases.html · pin h891147f838a7820b0816e2ac5475675aeeb1003af9b77fe9d08fcabc5c192c32 · accessed 2026-09-04 · source-readGrounds: Verifier bite: an unauthorised key must be refused by name
[ietf-seat] IETF SEAT working group documents: the individual attested-TLS draft withdrawn 2026-07-23; the attestation transport is unsettled. publisher · read in our library knowledge/fetched/cmp_deploy_datatrackerdocuments.html · pin h36967c2d5c81af93f88179a6e2f8fae30a8bfa2a3957cca8fefe5bd1d3aa9f54 · accessed 2026-09-04 · published-standardGrounds: RATS-shaped evidence record with an UNOBSERVABLE verdict
[cp-sovereignty26] Stark, Wilkie. Sovereign 2.0: control-plane sovereignty for cloud systems under disruption. Management sovereignty defined as the ability to govern, operate, evidence and recover services regardless of underlying infrastructure dependencies. arXiv 2604.14242, 2026-04-15. CORRECTED 2026-09-04: an earlier cite attributed a static-stability definition to it. publisher · read in our library knowledge/fetched/cmp_deploy_arxiv260414242.html · pin he4f70949a9e855a1d4de65e5fb64585ba2a2005bc4b86da818ea1f8365d3a38e · accessed 2026-09-04 · published-paperGrounds: Dependency-chain refusal for the rollback action
[eu-cra-reporting] European Commission: Cyber Resilience Act reporting obligations from 2026-09-11 -- 24h, 72h and 14-day deadlines for exploited vulnerabilities. publisher · read in our library knowledge/fetched/cmp_deploy_digital-strategycrareporting.html · pin haa103788ba18ccaf6bdc964c88e04ba956cfda539693b2f732b100c65d5393a7 · accessed 2026-09-04 · published-standardGrounds: Reverse-dependency index over the artifact closure
[azure-ykyn] Azure status history PIR YKYN-BWZ (2025-10-29, Front Door connectivity issues across multiple regions): the last-known-good configuration had itself been updated with the conflicting metadata, so engineers declined to revert to it or to earlier LKGs and edited the latest LKG by hand before redeploying it fleet-wide. publisher · read in our library knowledge/fetched/cmp_deploy_azureykynbwz.html · pin hf002168e9a4f7f03859912d22e8bd77cad2f6caa025a6d63e3186b5d6140dc9d · accessed 2026-09-04 · vendor-docGrounds: Last-known-good conf loader
[cf-worker-affinity-20260907] Cloudflare Workers version affinity: a stable request key assigns traffic consistently during a gradual deployment; the documentation illustrates avoiding mixed-version HTML and asset requests. publisher · accessed 2026-09-07 · vendor-docGrounds: Canary and progressive traffic shifting: extend acceptance to coherent client and asset revisions. Additional edge-runtime reference, not a measured Nishi result or new matrix score.
[netlify-atomic-20260907] Netlify deploy overview: new deploys compare changed files and become public after their upload completes. Skew protection is documented separately with framework and CLI support limits. publisher · accessed 2026-09-07 · vendor-docGrounds: Staged content publish (sha-pinned, atomic): distinguish whole-release asset consistency from a single-file atomic rename. Static-site deployment reference; benchmark execution and content pin outstanding.
[aws-codedeploy-platforms-20260907] AWS CodeDeploy primary components: EC2/on-premises health constraints differ from Lambda and ECS traffic configurations; the latter support canary, linear and all-at-once shifts. publisher · accessed 2026-09-07 · vendor-docGrounds: Canary and progressive traffic shifting and Blue-green dual-slot instant switch: qualify behavior per compute platform instead of assigning one unqualified product-wide score. Cloud rollout reference, not measured performance.
[nomad-update-20260907] HashiCorp Nomad update block: rolling and canary strategy, health evaluation, healthy/progress deadlines and optional reversion to the last stable job. max_parallel is scoped per task group; groups update in parallel. publisher · accessed 2026-09-07 · vendor-docGrounds: Health-gated promote with auto-rollback watchdog: include scheduling scope, failed health transitions and stable-job selection in acceptance. Self-managed scheduler reference; no equivalence to Nishi measured.
[cloudrun-revisions-20260907] Google Cloud Run rollout documentation: revision traffic migration is not instantaneous, in-flight requests continue, and an existing traffic-split pattern persists into subsequent deployments. publisher · accessed 2026-09-07 · vendor-docGrounds: Canary and progressive traffic shifting and Zero refusals and zero truncated responses across a swap: test transition semantics and persistent split state. Managed revision-runtime reference, not a latency benchmark.
[rfc9773-ari] IETF RFC 9773, ACME Renewal Information (ARI) Extension, Standards Track, 2025: the CA publishes a suggestedWindow in which each certificate should be renewed publisher · read in our library knowledge/fetched/rf_3315d144.raw · pin h3d6ef345fe6b026b6bf0656f3d510a99d74a763e3ad498d6d82456f770373af9 · accessed 2026-10-03 · published-standardGrounds: Renewal on the estate's own clock: the CA's renewal window (ARI) first, one third of lifetime remaining as the fallback, one name per pass, a blind beat alarms
[cabf-sc081v3] CA/Browser Forum Ballot SC-081v3: schedule reducing public TLS certificate maximum validity from 398 days to 47 days and validation data reuse to 10 days, March 2026 to March 2029 publisher · read in our library knowledge/fetched/rf_538e8f54.raw · pin hbd91a9320a96ca61d0798abb6922ae0f674861157658ba19909b022604f5c6d0 · accessed 2026-10-03 · published-standardGrounds: Renewal on the estate's own clock: the CA's renewal window (ARI) first, one third of lifetime remaining as the fallback, one name per pass, a blind beat alarms
[le-feed-2026-09] Let's Encrypt news feed, read 2026-10-03, newest entry 2026-09-17: default lifetime moving 90 to 64 to 45 days with renewal expected near day 30 of 45 (2026-02-24, 2025-12-02); short-lived certificates of 160 hours generally available under the shortlived profile publisher · read in our library knowledge/fetched/rf_8785dfa5.raw · pin h51477b43a08fbe7e1b651458f7dfc81bbecc0e318d75a1b3d07145aca16b2b4b · accessed 2026-10-03 · vendor-docGrounds: Renewal on the estate's own clock: the CA's renewal window (ARI) first, one third of lifetime remaining as the fallback, one name per pass, a blind beat alarms

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/deploy.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls