Nishi Family › Compare › Nishi OS (NXE lane) versus the small and from-scratch OS field

Nishi Compare · capabilities, evidence and delivery

Nishi OS (NXE lane) versus the small and from-scratch OS field

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

The sovereign UEFI loader, NXE kernel and GPT/FAT32 medium against SliTaz, KolibriOS, SerenityOS and Haiku -- SliTaz is the declared parity target

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. Measured, and the shape is unchanged since the 2026-08-05 register. WHAT WORKS, each witnessed rather than asserted: a GPT image authored byte-by-byte with CRC32 on every structure, verified by our emitter gate, by real TianoCore booting from it and by Linux sfdisk --verify; a 1536-byte PE32+ shim that is the only foreign format in the product path, which reads /KERNEL.NXE off the ESP through real firmware protocols, re-derives its payload sum and HOLDS with its own printed refusal rather than jumping blind (real TianoCore was made to print that refusal); a 5064-byte kernel that paints a desktop, renders arbitrary strings from a sovereign 8x8 font carried as payload data with the line chosen by the machine's own state, drives the 8042 directly after ExitBootServices (tally rose 0 to 640 to 1280 to 2080 pixels with the firmware gone) and walks PCI config space itself, binding devices from a DATA ROW carrying an op-list program that one unchanging interpreter executes -- proven on a real e1000 with the negative control mismatching on real silicon; and an optional assistant slot where the toggle IS the file, proven on real TianoCore with two different weight blobs and one unchanged binary. WHAT DOES NOT: no pointer, no window manager, no file manager, no shell, no network packets, no persistence, no browser on the metal, and no real model behind the assistant slot. AND ONE THING IS WORSE THAN MISSING -- it is broken where a user meets it: written to a physical stick larger than the image, the backup GPT lands mid-device rather than at the last LBA (7,987,200 device sectors versus 135,269 image sectors) and the user-writable data partition does not mount at all. The image is correct; the write path is not.

Where we need to go. Reach parity of KIND with SliTaz -- the operator's declared target, a sub-50MB OS that is immediately usable -- without surrendering a single sovereign EXCEED. Those exceeds are shipping criteria, not decoration: the whole stack built by our own compiler with zero third-party code in the product path, a native executable format that is not ELF or PE, a loader that validates before it executes, never-brick properties machine-checked by the emitter rather than promised in a comment, a bit-exact reproducible image, and an OS update that is a single file copy. The app layer is the climb and none of it is research -- every rung below has a proven substrate underneath it. The 6600-byte figure is honest in both directions: it is small because the app layer is absent, and it must be allowed to grow.

The unit. 1 u = one measured session-leg (organ + gate + a witnessed run). Kernel rungs are metal-class: the accept rule for each names a run on the sovereign UEFI emulator AND a witness on real TianoCore/OVMF, used as an ORACLE ONLY and never in the product path.

Cost to make the medium actually work: 0.5 u. SO0 alone. The smallest rung on the board, and until it lands the stick a person plugs in has a partition that does not mount.

Cost to an interactive desktop: 6 u. adds SO1 pointer, SO2 window manager, SO3 file listing and SO4 a shell -- the four that turn painted pixels into widgets a person can use.

Cost to on the network and persistent: 11 u. adds SO5 the e1000 driver post-ExitBootServices and SO6 a sovereign checksummed filesystem with writes. SO5 gates the browser arc; SO6 lifts the FAT32 4 GiB ceiling off model weights.

Cost to SliTaz parity of kind: 17 u. adds SO7 the existing browser engine on the NXE kernel and SO8 a real quantized model behind the NISHI.AI slot.

Research bar. SliTaz (the declared parity target) is measured on a sub-50MB live OS that is immediately usable: Openbox desktop, homemade graphical tools, Midori and Firefox, 300-plus commands via Busybox, 5000-plus packages via Tazpkg, runs entirely in RAM. Theirs: the operator brief of 2026-08-05 names this as the bar, and it is quoted from SliTaz's own site. Ours: SO1 through SO4 close the desktop half; SO7 closes the browser row. Package management is deliberately NOT a rung -- our update story is a file copy by construction.

Research bar. Haiku and SerenityOS (the full-desktop bar) is measured on complete compositing desktops with their own window managers, file managers and shipped browsers, written from scratch. Theirs: the two rivals whose ambition matches ours and whose app layer does not. Ours: SO2 and SO7 are graded against these, not against SliTaz, because they built theirs rather than assembling it.

Research bar. KolibriOS (the tiny bar) is measured on a few megabytes of disk, an i586 processor and 12 MB of RAM, with a text editor, image viewer, graphic editor, web browser and over 30 games. Theirs: proof that a from-scratch OS can be tiny AND have an app layer -- the answer to any claim that our 6600 bytes and our missing apps are the same fact. Ours: every rung below grows the byte count on purpose; smallness is not the exceed, sovereignty and never-brick are.

Latest recorded release

2026-09-02 · SO0

smallos.matrix row flipped GAP to LIVE: nk0_gpt_relocate is present x3 in nx_efi_fat32_image (the referee had read it LANDED-UNFLIPPED), referee nx_gpt_relocate_gate queued to build (BQ row, SOURCE-ONLY 11496 B until the queue fires). Two further LIVE rows admitted on real symbols the smallos.gates driver rows already execute: dp_emit_image (driver protocol from an op-list spec, exceed) and vh_emit_image (virtio-MMIO handshake from a spec, parity). Referee re-run 2026-09-02: present=6 grounded=6 gates 1/3 GREEN 2 SKIP verdict=MEASURED-HONEST-PARTIAL, where the board read RED failing_conjunct=present (4 axes under the 5-axis liar-kill) and blocked the deploy lane fleet-wide

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

6 of 14 capability source symbols found|2 of them authored stronger-claims|8 open|coverage 428/1000|adoption 1 full / 5 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 6 vs present 6 · named + unnamed + withheld = 8 vs open 8 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 11174 bytes · gates map: PRIMARY · stamped 3d 7h ago · source ../knowledge/status/evstamp_smallos.verdict

Gap class	What it is, and the work it names
NONE	No gap class fires on this board: every published claim is grounded, the declared gates ran and were green, no watch contract is unnamed or already landed, and the stamp is inside its TTL. That is a statement about evidence, not about depth, scale or polish.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence smallos itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: PLAN_MATRIX_BOUND_ONLY. Recorded priorities require current acceptance evidence and resource checks before execution.

Ranking matches the captured plan and matrix only. Latest execution outcome, research freshness, accepted delivery and investment return are unverified.

Recorded priority estimates

Order from nx_compare_rank (nx_dr_ocm: (deficit + cost-of-delay + option + enables) x sponsor x self-sufficiency x momentum / cost). FINISH rows are rungs whose symbol is present but whose organ is short of full adoption: listed before new work by this heuristic. Priority is not measured delivery cost or execution readiness. Stamp: # asof=1790081712 domain=smallos target_version=1.0 rungs=9 done=1 open=8 finish=1 ranker=nx_dr_ocm

#	Stage	Rung	Priority	Derivation
F	FINISH	Boot medium usable on a real USB stick (SO0) nk0_gpt_relocate dossier	REGISTERED-DARK	callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)
#1	1.0	Pointer input (PS/2 mouse and USB HID) (SO1) nk0_mouse_poll dossier	2000	v=20 m=1 c=10
#2	1.0	Window manager (move, resize, focus, z-order) (SO2) nk0_wm_focus dossier	1000	v=20 m=1 c=20
#3	1.0	File listing and a file manager on the metal (SO3) nk0_fs_list dossier	1000	v=10 m=1 c=10
#4	1.0	Terminal and shell on the metal (SO4) nk0_shell_line dossier	400	v=6 m=1 c=15
#5	later	Network driver on the metal (e1000 rings, DMA, packets) (SO5) nk0_e1000_tx dossier	1000	v=30 m=1 c=30
#6	later	Persistent user data on a sovereign checksummed filesystem (SO6) nk0_sfs_write dossier	1000	v=10 m=2 c=20
#7	later	Browser engine on the NXE kernel (SO7) nk0_browser_page dossier	200	v=6 m=1 c=30
#8	later	A real quantized model behind the NISHI.AI slot (SO8) nk0_ai_generate dossier	33	v=1 m=1 c=30

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Boot medium usable on a real USB stick (SO0)	nk0_gpt_relocate	The write path must relocate the backup GPT to the device's last LBA and rewrite the primary header's alternate-LBA and last-usable-LBA fields with recomputed CRC32s, the way sgdisk -e does, for any device larger than the image. ACCEPT: after writing to a device whose sector count differs from the image's, Linux sfdisk --verify reports no errors AND the second partition mounts as an ordinary drive on a machine that is not this one, AND a NEG-CONTROL with one byte of the relocated backup header mutated is REJECTED rather than silently accepted. Byte-identical rebuild of the base image must survive the change.	Organ	0.5 u
Pointer input (PS/2 mouse and USB HID) (SO1)	nk0_mouse_poll	A PS/2 mouse driver on the 8042 alongside the existing keyboard path, then a USB HID boot-protocol path for machines with no PS/2 emulation. ACCEPT: a pointer moves and its buttons register on the sovereign emulator AND on real TianoCore, with the cursor position derived from the device packets rather than a demo animation -- proven by a NEG-CONTROL run with no device attached, in which the cursor must NOT move. Port I/O stays inside the audited decode allow-set.	Organ	1 u
Window manager (move, resize, focus, z-order) (SO2) after SO1	nk0_wm_focus	Real windows over the existing framebuffer: a z-ordered list, hit-testing against the pointer, drag to move, drag an edge to resize, click to focus, and a close box that closes. ACCEPT: three windows are created, the second is raised by a click, moved, resized and closed, and the resulting framebuffer is pixel-compared against an independently derived expected image on both the sovereign emulator and real TianoCore -- with an ANTI-VACUITY tooth that a click landing on the BACKGROUND raises nothing, which a paint-everything implementation cannot pass.	Organ	2 u
File listing and a file manager on the metal (SO3)	nk0_fs_list	Directory enumeration over the already-proven ESP read chain and our own FAT32 reader, surfaced as a navigable list. ACCEPT: the manager lists the real root of the booted volume and its second partition, the entries match what the sovereign FAT32 reader independently extracts from the same image, and opening a file displays its bytes. Read-only by construction -- writes belong to SO6 and must REFUSE here.	Organ	1 u
Terminal and shell on the metal (SO4) after SO3	nk0_shell_line	A line editor and a command dispatcher on the kernel's own text rendering, with a small built-in command set over the file, device and PCI facilities that already exist. ACCEPT: a scripted key sequence typed through the proven 8042 path produces a transcript byte-identical to an independently derived expected transcript, including the error text for an unknown command -- so a shell that accepts everything cannot pass.	Organ	1.5 u
Network driver on the metal (e1000 rings, DMA, packets) (SO5)	nk0_e1000_tx	Transmit and receive descriptor rings, DMA buffers and interrupt or poll handling for the e1000 we already enumerate and VERIFY through our own PCI walk. This is the gate on the entire browser arc and it carries its own never-brick audit, because it is the first thing we let write to device memory. ACCEPT: a frame we constructed is transmitted and observed by a third-party capture on another host, and a frame sent from that host is received and its bytes match -- external oracle in both directions, never a loopback that proves only that our own code agrees with itself.	Organ	3 u
Persistent user data on a sovereign checksummed filesystem (SO6) after SO0	nk0_sfs_write	A second partition carrying our own filesystem with per-block checksums and no 4 GiB file ceiling, and the first sanctioned WRITE path in the whole lane. ACCEPT: a file written on one boot is read back byte-identical on the next with its checksum verified, a deliberately corrupted block is DETECTED and REFUSED rather than returned, and the never-brick audit shows the write path cannot reach the ESP or any firmware region. The read-only posture on the ESP is preserved, not relaxed.	Organ	2 u
Browser engine on the NXE kernel (SO7) after SO2,SO5	nk0_browser_page	Port the browser engine that is already PROMOTED and running on Linux and native Windows onto the NXE kernel over SO5's network path and SO2's windows. ACCEPT: a page fetched over our own network driver renders on the metal and its framebuffer struct-compares against the same page rendered by the same engine on Linux from the same saved bytes -- the engine is the control, so any difference is the port, not the renderer.	Organ	3 u
A real quantized model behind the NISHI.AI slot (SO8) after SO6	nk0_ai_generate	The slot, the provenance record, the validation, the three visible states and the fallback are all DONE and witnessed; what is missing is a real model. Load a 350M-1B class model quantized to integer weights from the user-writable partition and generate text. ACCEPT: the same unchanged binary produces DIFFERENT and individually correct output for two different weight files, the screen NAMES the model it loaded, and every one of the three refusal reasons still falls back to the built-in vectors so an unvalidatable blob NEVER reaches the compute. Integer-only, so the output is bit-exact reproducible.	Organ	3 u

Milestones

Milestone	Rungs	Cumulative
S0 · The stick works on real hardware	SO0	0.5 u
S1 · Interactive desktop (pointer, windows, files, shell)	SO1,SO2,SO3,SO4	6 u
S2 · On the network and persistent	SO5,SO6	11 u
S3 · SliTaz parity of kind (browser and assistant on the metal)	SO7,SO8	17 u

Ladder verdict. NOT DECLARED. This board names no dated best-in-class or frontier target and no rung roles (sotatarget and rungrole rows on its plan); the ranker labels it NO-LADDER until it does, and until then its rungs climb toward a target nobody has written down. Bars read NO-BAR against the current month 2026-10.

Bar freshness, counted
Class	Count	Note
bars	0	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	0	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	0	RECONCILED: the parts sum to the total 0
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 9. Rank input binding: PLAN_MATRIX_BOUND_ONLY. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 2fe3d3a15e14e6443f1da47b8a6178b85c3b63ab21c4af9962dcd5696d5813e5. Target rows 0; role rows 0. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 9 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

SO0 — Boot medium usable on a real USB stick
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nk0_gpt_relocate
Acceptance: The write path must relocate the backup GPT to the device's last LBA and rewrite the primary header's alternate-LBA and last-usable-LBA fields with recomputed CRC32s, the way sgdisk -e does, for any device larger than the image. ACCEPT: after writing to a device whose sector count differs from the image's, Linux sfdisk --verify reports no errors AND the second partition mounts as an ordinary drive on a machine that is not this one, AND a NEG-CONTROL with one byte of the relocated backup header mutated is REJECTED rather than silently accepted. Byte-identical rebuild of the base image must survive the change.
Authored effort: 0.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
SO1 — Pointer input (PS/2 mouse and USB HID)
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nk0_mouse_poll
Acceptance: A PS/2 mouse driver on the 8042 alongside the existing keyboard path, then a USB HID boot-protocol path for machines with no PS/2 emulation. ACCEPT: a pointer moves and its buttons register on the sovereign emulator AND on real TianoCore, with the cursor position derived from the device packets rather than a demo animation -- proven by a NEG-CONTROL run with no device attached, in which the cursor must NOT move. Port I/O stays inside the audited decode allow-set.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
SO2 — Window manager (move, resize, focus, z-order)
Prerequisites: SO1 (acceptance unverified)
Contract: nk0_wm_focus
Acceptance: Real windows over the existing framebuffer: a z-ordered list, hit-testing against the pointer, drag to move, drag an edge to resize, click to focus, and a close box that closes. ACCEPT: three windows are created, the second is raised by a click, moved, resized and closed, and the resulting framebuffer is pixel-compared against an independently derived expected image on both the sovereign emulator and real TianoCore -- with an ANTI-VACUITY tooth that a click landing on the BACKGROUND raises nothing, which a paint-everything implementation cannot pass.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
SO3 — File listing and a file manager on the metal
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nk0_fs_list
Acceptance: Directory enumeration over the already-proven ESP read chain and our own FAT32 reader, surfaced as a navigable list. ACCEPT: the manager lists the real root of the booted volume and its second partition, the entries match what the sovereign FAT32 reader independently extracts from the same image, and opening a file displays its bytes. Read-only by construction -- writes belong to SO6 and must REFUSE here.
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
SO4 — Terminal and shell on the metal
Prerequisites: SO3 (acceptance unverified)
Contract: nk0_shell_line
Acceptance: A line editor and a command dispatcher on the kernel's own text rendering, with a small built-in command set over the file, device and PCI facilities that already exist. ACCEPT: a scripted key sequence typed through the proven 8042 path produces a transcript byte-identical to an independently derived expected transcript, including the error text for an unknown command -- so a shell that accepts everything cannot pass.
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
SO5 — Network driver on the metal (e1000 rings, DMA, packets)
Prerequisites: None declared; this does not establish execution eligibility.
Contract: nk0_e1000_tx
Acceptance: Transmit and receive descriptor rings, DMA buffers and interrupt or poll handling for the e1000 we already enumerate and VERIFY through our own PCI walk. This is the gate on the entire browser arc and it carries its own never-brick audit, because it is the first thing we let write to device memory. ACCEPT: a frame we constructed is transmitted and observed by a third-party capture on another host, and a frame sent from that host is received and its bytes match -- external oracle in both directions, never a loopback that proves only that our own code agrees with itself.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
SO6 — Persistent user data on a sovereign checksummed filesystem
Prerequisites: SO0 (acceptance unverified)
Contract: nk0_sfs_write
Acceptance: A second partition carrying our own filesystem with per-block checksums and no 4 GiB file ceiling, and the first sanctioned WRITE path in the whole lane. ACCEPT: a file written on one boot is read back byte-identical on the next with its checksum verified, a deliberately corrupted block is DETECTED and REFUSED rather than returned, and the never-brick audit shows the write path cannot reach the ESP or any firmware region. The read-only posture on the ESP is preserved, not relaxed.
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
SO7 — Browser engine on the NXE kernel
Prerequisites: SO2 (acceptance unverified), SO5 (acceptance unverified)
Contract: nk0_browser_page
Acceptance: Port the browser engine that is already PROMOTED and running on Linux and native Windows onto the NXE kernel over SO5's network path and SO2's windows. ACCEPT: a page fetched over our own network driver renders on the metal and its framebuffer struct-compares against the same page rendered by the same engine on Linux from the same saved bytes -- the engine is the control, so any difference is the port, not the renderer.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
SO8 — A real quantized model behind the NISHI.AI slot
Prerequisites: SO6 (acceptance unverified)
Contract: nk0_ai_generate
Acceptance: The slot, the provenance record, the validation, the three visible states and the fallback are all DONE and witnessed; what is missing is a real model. Load a 350M-1B class model quantized to integer weights from the user-writable partition and generate text. ACCEPT: the same unchanged binary produces DIFFERENT and individually correct output for two different weight files, the screen NAMES the model it loaded, and every one of the three refusal reasons still falls back to the built-in vectors so an unvalidatable blob NEVER reaches the compute. Integer-only, so the output is bit-exact reproducible.
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence smallos writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

SO0 Boot medium usable on a real USB stick · cell PRESENT · gate NO-GATE-DECLARED

Contract	`nk0_gpt_relocate` · executor Organ · 0.5 u · stands on nothing
Definition of done	The write path must relocate the backup GPT to the device's last LBA and rewrite the primary header's alternate-LBA and last-usable-LBA fields with recomputed CRC32s, the way sgdisk -e does, for any device larger than the image. ACCEPT: after writing to a device whose sector count differs from the image's, Linux sfdisk --verify reports no errors AND the second partition mounts as an ordinary drive on a machine that is not this one, AND a NEG-CONTROL with one byte of the relocated backup header mutated is REJECTED rather than silently accepted. Byte-identical rebuild of the base image must survive the change.
Matrix cell	LIVE: Boot medium usable on a real USB stick (backup GPT relocation) · `runtime/_hdl_build/nx_efi_fat32_image.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_efi_fat32_image`; declare `nx_efi_fat32_image TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-02 land smallos.matrix row flipped GAP to LIVE: nk0_gpt_relocate is present x3 in nx_efi_fat32_image (the referee had read it LANDED-UNFLIPPED), referee nx_gpt_relocate_gate queued to build (BQ row, SOURCE-ONLY 11496 B until the queue fires). Two further LIVE rows admitted on real symbols the smallos.gates driver rows already execute: dp_emit_image (driver protocol from an op-list spec, exceed) and vh_emit_image (virtio-MMIO handshake from a spec, parity). Referee re-run 2026-09-02: present=6 grounded=6 gates 1/3 GREEN 2 SKIP verdict=MEASURED-HONEST-PARTIAL, where the board read RED failing_conjunct=present (4 axes under the 5-axis liar-kill) and blocked the deploy lane fleet-wide 2026-09-02 land nk0_gpt_relocate SHIPPED as the relocate verb of nx_efi_fat32_image: the backup GPT header and entry array are rewritten at the real device's last LBA, the primary's AlternateLBA and LastUsableLBA follow, the protective MBR spans the device, the old mid-disk backup is retired; writes backup first and primary last; refuses a non-GPT device, a foreign disk GUID and a device smaller than the image, each by a named rule with nothing written; a second run reports ALREADY-RELOCATED. Gate nx_gpt_relocate_gate 15 of 15 GREEN on real 96 MiB image-devices, three refusal neg-controls; laptop _offc installed; NAS source landing by anchored CAS edits 2026-09-02 queue the physical witness is still owed: nobody has written the relocated image to a USB stick and watched firmware boot it; the gate proves structure on a file, the stick proves the firmware. nx_efi_fat32_image is REGISTERED on the NAS today (was PROMOTED-UNREGISTERED) so any seat can author and relocate through the job runner once the NAS binary is rebuilt from the landed source 2026-09-02 lesson a GPT relocation that verifies from RAM proves nothing about the device; every tooth here re-reads the bytes from the file after the write, and the CRC recompute must zero the CRC field first exactly as a firmware parser does 2026-09-02 land PHYSICAL WITNESS: the operator's 3.9 GB test stick (Generic Flash Disk, already carrying our GPT image with the backup at LBA 135268) was relocated by the sovereign organ against a sparse file twin of the device (WSL2 refuses to attach removable flash: Wsl/Service/AttachDisk 0x8007000f), the four changed regions (LBA 0, LBA 1, the old backup sector, the last 33 sectors at 7987167..7987199) were written to the physical drive and read back byte-identical, and a second relocate on a twin rebuilt from the DEVICE's own bytes read ALREADY-RELOCATED. Windows re-read the stick as GPT with both partitions intact and the data partition mounted. Firmware boot from the relocated stick is still the operator's witness 2026-09-02 lesson when the sovereign runtime cannot reach a device, keep the judgement in the organ and reduce the shell to a byte mover: the organ decides on a twin of the device's real geometry, the shell copies only the sectors the organ changed, and the organ then re-judges the device's own bytes; the shell never decides what a partition table should say

SO1 Pointer input (PS/2 mouse and USB HID) · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nk0_mouse_poll` · executor Organ · 1 u · stands on nothing
Definition of done	A PS/2 mouse driver on the 8042 alongside the existing keyboard path, then a USB HID boot-protocol path for machines with no PS/2 emulation. ACCEPT: a pointer moves and its buttons register on the sovereign emulator AND on real TianoCore, with the cursor position derived from the device packets rather than a demo animation -- proven by a NEG-CONTROL run with no device attached, in which the cursor must NOT move. Port I/O stays inside the audited decode allow-set.
Matrix cell	GAP: Pointer input (PS/2 mouse and USB HID) · `runtime/_hdl_build/nx_nxe_kernel0.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_nxe_kernel0`; declare `nx_nxe_kernel0 TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

SO2 Window manager (move, resize, focus, z-order) · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nk0_wm_focus` · executor Organ · 2 u · stands on SO1
Definition of done	Real windows over the existing framebuffer: a z-ordered list, hit-testing against the pointer, drag to move, drag an edge to resize, click to focus, and a close box that closes. ACCEPT: three windows are created, the second is raised by a click, moved, resized and closed, and the resulting framebuffer is pixel-compared against an independently derived expected image on both the sovereign emulator and real TianoCore -- with an ANTI-VACUITY tooth that a click landing on the BACKGROUND raises nothing, which a paint-everything implementation cannot pass.
Matrix cell	GAP: Window manager (move, resize, focus, z-order) · `runtime/_hdl_build/nx_nxe_kernel0.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_nxe_kernel0`; declare `nx_nxe_kernel0 TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

SO3 File listing and a file manager on the metal · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nk0_fs_list` · executor Organ · 1 u · stands on nothing
Definition of done	Directory enumeration over the already-proven ESP read chain and our own FAT32 reader, surfaced as a navigable list. ACCEPT: the manager lists the real root of the booted volume and its second partition, the entries match what the sovereign FAT32 reader independently extracts from the same image, and opening a file displays its bytes. Read-only by construction -- writes belong to SO6 and must REFUSE here.
Matrix cell	GAP: File listing and a file manager on the metal · `runtime/_hdl_build/nx_nxe_kernel0.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_nxe_kernel0`; declare `nx_nxe_kernel0 TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

SO4 Terminal and shell on the metal · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nk0_shell_line` · executor Organ · 1.5 u · stands on SO3
Definition of done	A line editor and a command dispatcher on the kernel's own text rendering, with a small built-in command set over the file, device and PCI facilities that already exist. ACCEPT: a scripted key sequence typed through the proven 8042 path produces a transcript byte-identical to an independently derived expected transcript, including the error text for an unknown command -- so a shell that accepts everything cannot pass.
Matrix cell	GAP: Terminal or shell on the metal · `runtime/_hdl_build/nx_nxe_kernel0.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_nxe_kernel0`; declare `nx_nxe_kernel0 TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

SO5 Network driver on the metal (e1000 rings, DMA, packets) · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nk0_e1000_tx` · executor Organ · 3 u · stands on nothing
Definition of done	Transmit and receive descriptor rings, DMA buffers and interrupt or poll handling for the e1000 we already enumerate and VERIFY through our own PCI walk. This is the gate on the entire browser arc and it carries its own never-brick audit, because it is the first thing we let write to device memory. ACCEPT: a frame we constructed is transmitted and observed by a third-party capture on another host, and a frame sent from that host is received and its bytes match -- external oracle in both directions, never a loopback that proves only that our own code agrees with itself.
Matrix cell	GAP: Network driver on the metal (e1000 rings, DMA, packets) · `runtime/_hdl_build/nx_nxe_kernel0.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_nxe_kernel0`; declare `nx_nxe_kernel0 TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

SO6 Persistent user data on a sovereign checksummed filesystem · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nk0_sfs_write` · executor Organ · 2 u · stands on SO0
Definition of done	A second partition carrying our own filesystem with per-block checksums and no 4 GiB file ceiling, and the first sanctioned WRITE path in the whole lane. ACCEPT: a file written on one boot is read back byte-identical on the next with its checksum verified, a deliberately corrupted block is DETECTED and REFUSED rather than returned, and the never-brick audit shows the write path cannot reach the ESP or any firmware region. The read-only posture on the ESP is preserved, not relaxed.
Matrix cell	GAP: Persistent user data (a sovereign checksummed filesystem with writes) · `runtime/_hdl_build/nx_efi_fat32_image.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_efi_fat32_image`; declare `nx_efi_fat32_image TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

SO7 Browser engine on the NXE kernel · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nk0_browser_page` · executor Organ · 3 u · stands on SO2, SO5
Definition of done	Port the browser engine that is already PROMOTED and running on Linux and native Windows onto the NXE kernel over SO5's network path and SO2's windows. ACCEPT: a page fetched over our own network driver renders on the metal and its framebuffer struct-compares against the same page rendered by the same engine on Linux from the same saved bytes -- the engine is the control, so any difference is the port, not the renderer.
Matrix cell	GAP: Web browser on the metal · `runtime/_hdl_build/nx_nxe_kernel0.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_nxe_kernel0`; declare `nx_nxe_kernel0 TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

SO8 A real quantized model behind the NISHI.AI slot · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nk0_ai_generate` · executor Organ · 3 u · stands on SO6
Definition of done	The slot, the provenance record, the validation, the three visible states and the fallback are all DONE and witnessed; what is missing is a real model. Load a 350M-1B class model quantized to integer weights from the user-writable partition and generate text. ACCEPT: the same unchanged binary produces DIFFERENT and individually correct output for two different weight files, the screen NAMES the model it loaded, and every one of the three refusal reasons still falls back to the built-in vectors so an unvalidatable blob NEVER reaches the compute. Integer-only, so the output is bit-exact reproducible.
Matrix cell	GAP: Optional on-device assistant behind the NISHI.AI slot (a real model) · `runtime/_hdl_build/nx_nxe_kernel0.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_nxe_kernel0`; declare `nx_nxe_kernel0 TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

dossiers=9 cells_joined=9 no_matrix_row=0 (sum 9) gates_recorded=0 gates_unrecorded=0 no_gate_declared=9 (sum 9 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 14 feature rows mapped of 14 matrix rows; 0 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/smallos.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 300–1000, distinctiveness 50–400 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 715 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 300–1000 · distinctiveness 50–400 · breadth 200–700 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 2 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 453 permil of the plot

Nishi SliTaz KolibriOS SerenityOS Haiku
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 10 (a fact of the data: two players that close are that close) · data spread 520 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Unconventional	440	347	333	777	0 since 2026-09-23	6	10	2026-09-15
SliTaz	Mainstream	960	143	547	696	0 since 2026-09-23	11	10	2026-09-15
KolibriOS	Mainstream	960	106	500	636	0 since 2026-09-23	11	10	2026-09-15
SerenityOS	Mainstream	960	159	571	727	0 since 2026-09-23	11	10	2026-09-15
Haiku	Aspirational	960	219	619	787	0 since 2026-09-23	11	10	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	14	5
2026-09-16	14	5
2026-09-17	14	5
2026-09-18	14	5
2026-09-19	14	5
2026-09-20	14	5
2026-09-21	14	5
2026-09-22	14	5
2026-09-23	14	5
2026-10-08	14	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 56, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	SliTaz	KolibriOS	SerenityOS	Haiku
LIVE
GPT partition table authored byte-by-byte with CRC32 and a backup header Measured: `wr_gpt_hdr` exists in `runtime/_hdl_build/nx_efi_fat32_image.nx`, verified at emit. Protective MBR, primary header at LBA 1, 128-entry array, backup header and array at the end of the disk, every structure carrying a CRC32 this emitter computes and its own gate recomputes. Verified three ways: our emitter gate, real TianoCore booting from it, and Linux sfdisk --verify reporting no errors. Disk and partition GUIDs are FIXED so byte-identical rebuild survives rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	●	●
Sovereign FAT32 reader (no host OS, no firmware, no third-party driver) Measured: `esp_extract` exists in `runtime/_hdl_build/nx_esp_boot.nx`, verified at emit. Walks the BPB, the FAT chain and the root directory to extract a named file from our own ESP image, with tamper teeth. FAT on the ESP is MANDATED by the UEFI specification, so every rival ships a reader too -- ours is the only one that is also ours rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-UNAUTHORISED` — PARTIAL: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). not adopted: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	●	●
Loader validates the kernel before jumping (never-brick by construction) Source present; authored stronger claim: `nxe_neverbrick_ok` in `runtime/nx_nxe_lib.nx`, verified at emit. EXCEED and alone in this field: the loader re-derives the payload sum and checks the capability and never-brick bits BEFORE mapping anything executable, and a mismatch prints its refusal on the firmware console and HOLDS. Real TianoCore was made to print our literal refusal when handed an ESP with no kernel file, so the refusal path has been seen to execute on somebody else's silicon Adoption: `LIB-WIRED importers=4 nonval=4` — fully adopted (top of its ladder). Pros Source symbol found; stronger capability claim is authored; ahead of SliTaz, KolibriOS, SerenityOS, Haiku; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	○	○	○	○
Boot medium usable on a real USB stick (backup GPT relocation) Measured: `nk0_gpt_relocate` exists in `runtime/_hdl_build/nx_efi_fat32_image.nx`, verified at emit. LANDED 2026-09-02 (was the smallest open rung, SO0): nk0_gpt_relocate <path> relocates the backup GPT header and entry array to the real device's last LBAs and rewrites the primary header to point at them, the sgdisk -e class of repair, idempotent and refusal-named. The defect it drains was measured on the SOTA page: a 135,269-sector image written to a 7,987,200-sector stick left the backup GPT mid-device and the data partition unmountable. Referee nx_gpt_relocate_gate (SO0) is in source and queued to build; it joins smallos.gates the day it runs GREEN through /api/gate_run. Every rival ships a dd-able hybrid image, so the column reads Yes across the board and this row claims parity, not exceed rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked). dossiernot adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked) Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked)	●	●	●	●	●
New device bring-up as a DATA ROW (driver protocol synthesized from an op-list spec, no per-device code) Source present; authored stronger claim: `dp_emit_image` in `runtime/_hdl_build/nx_drv_proto_emit.nx`, verified at emit. One generic emitter walks a SPEC file carrying the register map AND the protocol step-sequence as data (verify, verifyu, write, read, checkbit, setbase, memstore, emit) and authors a complete RISC-V driver image: the same emitter produced the virtio-blk register/ring/irq driver and the virtio-net handshake driver from two different specs. The rivals hand-write every driver in C or assembly; a new device here is a spec row. Executed evidence is the smallos.gates driver-protocol row (4/4 when the sovereign device models are reachable, SKIP not RED when they are not) Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_drv_bind -- a mention, not a run. not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_drv_bind -- a mention, not a run Pros Source symbol found; stronger capability claim is authored; ahead of SliTaz, KolibriOS, SerenityOS, HaikuCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_drv_bind -- a mention, not a run	◉	○	○	○	○
virtio-MMIO transport handshake (magic, version, device-id, feature negotiation, status progression) emitted from a spec Measured: `vh_emit_image` exists in `runtime/_hdl_build/nx_virtio_hs_emit.nx`, verified at emit. The legacy virtio-MMIO handshake (K-R2-001a) as an emitted image: reads base and offsets, device identity, the ACK, DRIVER, FEATURES_OK and DRIVER_OK status bits and the banner from knowledge/specs, every standard register offset corroborated against the published OASIS virtio v1.2 specification by the smallos.gates ORACLE row (18/18 offsets plus the MagicValue the spec mandates, GREEN 3/3 today). SliTaz inherits Linux virtio, SerenityOS and Haiku carry their own virtio drivers, KolibriOS has partial virtio support; parity claimed, the exceed is the row above rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by _k_r2_001c1_gate -- a mention, not a run. not adopted: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by _k_r2_001c1_gate -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of KolibriOSCons not adopted yet: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by _k_r2_001c1_gate -- a mention, not a run	●	●	◐	●	●
GAP
Pointer input (PS/2 mouse and USB HID) DARK — `runtime/_hdl_build/nx_nxe_kernel0.nx` EXISTS but does not declare `nk0_mouse_poll`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. No pointer of any kind: no PS/2 mouse driver, no USB HID. Keyboard only, and PS/2 only, so on machines with no PS/2 emulation even that stops working after ExitBootServices. Nothing painted on the desktop can be clicked, which is why the taskbar and start block are pixels rather than widgets rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching nk0_mouse_poll Pros none measured yetCons behind SliTaz, KolibriOS, SerenityOS (leads), Haiku (leads); open contract; expected source declaration not established	○	●	●	◉	◉
Window manager (move, resize, focus, z-order) DARK — `runtime/_hdl_build/nx_nxe_kernel0.nx` EXISTS but does not declare `nk0_wm_focus`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The single biggest visual-parity gap: we paint ONE static window frame and have no window manager at all. SliTaz ships Openbox; SerenityOS and Haiku ship full compositing desktops of their own design and are the bar rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching nk0_wm_focus Pros none measured yetCons behind SliTaz, KolibriOS, SerenityOS (leads), Haiku (leads); open contract; expected source declaration not established	○	●	●	◉	◉
File listing and a file manager on the metal DARK — `runtime/_hdl_build/nx_nxe_kernel0.nx` EXISTS but does not declare `nk0_fs_list`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The substrate is already proven -- the loader reads a named file off the ESP through real firmware protocols and our own FAT32 reader parses the same image independently -- so listing a directory is a shell rung, not a research rung rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching nk0_fs_list Pros none measured yetCons behind SliTaz, KolibriOS, SerenityOS, Haiku (leads); open contract; expected source declaration not established	○	●	●	●	◉
Terminal or shell on the metal DARK — `runtime/_hdl_build/nx_nxe_kernel0.nx` EXISTS but does not declare `nk0_shell_line`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. No shell, no command line, no process model on the metal. SliTaz is Best here on its own quoted figure: 300-plus standard commands via Busybox out of the box rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching nk0_shell_line Pros none measured yetCons behind SliTaz (leads), KolibriOS, SerenityOS, Haiku; open contract; expected source declaration not established	○	◉	●	●	●
Network driver on the metal (e1000 rings, DMA, packets) DARK — `runtime/_hdl_build/nx_nxe_kernel0.nx` EXISTS but does not declare `nk0_e1000_tx`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. We ENUMERATE and VERIFY a real e1000 post-ExitBootServices through our own PCI config walk, and honestly report unknown devices as UNBOUND -- but we cannot talk to it: no rings, no DMA, no packets. This is the gate on the entire browser arc and it carries its own never-brick audit rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching nk0_e1000_tx Pros none measured yetCons behind SliTaz, KolibriOS, SerenityOS, Haiku; open contract; expected source declaration not established	○	●	●	●	●
Persistent user data (a sovereign checksummed filesystem with writes) DARK — `runtime/_hdl_build/nx_efi_fat32_image.nx` EXISTS but does not declare `nk0_sfs_write`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Nothing persists: the loader passes read-only file modes by construction and the emulator refuses a write-mode open with a named sentinel. That is a deliberate never-brick posture AND a real capability gap. We also have no filesystem of our own, so FAT32's limits become the OS's limits -- a 4 GiB maximum file size is a hard ceiling on model weights, with no journaling and no checksums rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching nk0_sfs_write Pros none measured yetCons behind SliTaz, KolibriOS, SerenityOS, Haiku; open contract; expected source declaration not established	○	●	●	●	●
Web browser on the metal DARK — `runtime/_hdl_build/nx_nxe_kernel0.nx` EXISTS but does not declare `nk0_browser_page`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. We have a REAL sovereign browser engine with CSS cascade, box layout, anti-aliased vector text and forms, promoted and running on Linux and native Windows -- it simply does not run on the NXE kernel. Honest absent on this axis, and the most valuable single rung on the board. Haiku is Best: a full desktop browser shipped in the box rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching nk0_browser_page Pros none measured yetCons behind SliTaz, KolibriOS, SerenityOS, Haiku (leads); open contract; expected source declaration not established	○	●	●	●	◉
Optional on-device assistant behind the NISHI.AI slot (a real model) DARK — `runtime/_hdl_build/nx_nxe_kernel0.nx` EXISTS but does not declare `nk0_ai_generate`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. A lead nobody in this field holds, and the MECHANISM is already done and proven on real firmware with two different weight files and one unchanged binary: the toggle IS the file, the blob carries model name, origin URL and licence inside the checksummed region, all three refusal reasons fall back to built-in vectors, and the screen NAMES the model it loaded. What is missing is a real MODEL -- today the payload is a 32-lane integer dot product, and calling that an assistant would be the lie this register exists to prevent dossierwatching nk0_ai_generate Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	11	rows carrying a Yes, Best or Part in a rival column
cited	0	a reference mark resolves to a pinned mirror
uncited	11	an observation read, badged until a reference lands
rows, summed	11	RECONCILED: the parts sum to the total 11

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-02	SO0	land	smallos.matrix row flipped GAP to LIVE: nk0_gpt_relocate is present x3 in nx_efi_fat32_image (the referee had read it LANDED-UNFLIPPED), referee nx_gpt_relocate_gate queued to build (BQ row, SOURCE-ONLY 11496 B until the queue fires). Two further LIVE rows admitted on real symbols the smallos.gates driver rows already execute: dp_emit_image (driver protocol from an op-list spec, exceed) and vh_emit_image (virtio-MMIO handshake from a spec, parity). Referee re-run 2026-09-02: present=6 grounded=6 gates 1/3 GREEN 2 SKIP verdict=MEASURED-HONEST-PARTIAL, where the board read RED failing_conjunct=present (4 axes under the 5-axis liar-kill) and blocked the deploy lane fleet-wide

Risk register

Risk	Likelihood x impact	Mitigation
A write path reaches firmware or the ESP and bricks a machine	possible x catastrophic	SO6 is the only rung that introduces writes, it is confined to the second partition, the loader's read-only file modes are unchanged, and the emitter's own gate pins the EXACT firmware call set and REFUSES to emit if one more appears. Never-brick is proven by the emitter, not promised in a comment.
A rung is graded on our own emulator only	likely x high	Every accept rule above names an EXTERNAL witness -- real TianoCore/OVMF as an oracle, a third-party packet capture, sfdisk --verify, or the Linux build of our own browser engine as the control. Our emulator is the fast loop, never the verdict.
The app layer grows the byte count and the smallness claim is read as lost	likely x low	Smallness was never the exceed; sovereignty, never-brick and reproducibility are. The register already says the 6600-byte figure is small BECAUSE the app layer is absent -- publish the growth beside the capability rather than defending the number.
A watch contract flips on a stub carrying the right name	possible x high	Each rung's accept rule names an anti-vacuity tooth a trivial implementation cannot pass: a background click that raises nothing, an unknown command that must error, a corrupted block that must be refused, two weight files that must give different answers.

Release history continued

When	Rung	Kind	Entry
2026-09-02	SO0	land	nk0_gpt_relocate SHIPPED as the relocate verb of nx_efi_fat32_image: the backup GPT header and entry array are rewritten at the real device's last LBA, the primary's AlternateLBA and LastUsableLBA follow, the protective MBR spans the device, the old mid-disk backup is retired; writes backup first and primary last; refuses a non-GPT device, a foreign disk GUID and a device smaller than the image, each by a named rule with nothing written; a second run reports ALREADY-RELOCATED. Gate nx_gpt_relocate_gate 15 of 15 GREEN on real 96 MiB image-devices, three refusal neg-controls; laptop _offc installed; NAS source landing by anchored CAS edits
2026-09-02	SO0	queue	the physical witness is still owed: nobody has written the relocated image to a USB stick and watched firmware boot it; the gate proves structure on a file, the stick proves the firmware. nx_efi_fat32_image is REGISTERED on the NAS today (was PROMOTED-UNREGISTERED) so any seat can author and relocate through the job runner once the NAS binary is rebuilt from the landed source
2026-09-02	SO0	lesson	a GPT relocation that verifies from RAM proves nothing about the device; every tooth here re-reads the bytes from the file after the write, and the CRC recompute must zero the CRC field first exactly as a firmware parser does
2026-09-02	SO0	land	PHYSICAL WITNESS: the operator's 3.9 GB test stick (Generic Flash Disk, already carrying our GPT image with the backup at LBA 135268) was relocated by the sovereign organ against a sparse file twin of the device (WSL2 refuses to attach removable flash: Wsl/Service/AttachDisk 0x8007000f), the four changed regions (LBA 0, LBA 1, the old backup sector, the last 33 sectors at 7987167..7987199) were written to the physical drive and read back byte-identical, and a second relocate on a twin rebuilt from the DEVICE's own bytes read ALREADY-RELOCATED. Windows re-read the stick as GPT with both partitions intact and the data partition mounted. Firmware boot from the relocated stick is still the operator's witness
2026-09-02	SO0	lesson	when the sovereign runtime cannot reach a device, keep the judgement in the organ and reduce the shell to a byte mover: the organ decides on a twin of the device's real geometry, the shell copies only the sectors the organ changed, and the organ then re-judges the device's own bytes; the shell never decides what a partition table should say

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

SOTA field — 7 peers, 43 axes, measured bindings

Nishi OS (NXE lane) vs SliTaz - KolibriOS - MenuetOS - SerenityOS - Haiku - Alpine - ReactOS. The parity target is SliTaz: a sub-50MB OS that is immediately usable (desktop, browser, file manager, config tools). We are a BOOT+GUI-SHELL today with a sovereignty and safety core no one else in this field has; the app layer is the climb. Competitor cells quoted from each project's own site (2026-08-05); Nishi cells measured by our own gates the same day.

How the field is scored. A state-of-the-art comparison across the FULL competitor field: quantitative axes carry measured or published numbers (Nishi’s column is measured on this estate, competitor columns are researcher-sourced and cited in the note); grade axes carry Best / Yes / Part / No for every peer. A Nishi grade may be bound to an organ and a symbol and is then re-measured on every publish by the one symbol ruler the capability matrix above uses; an over-claim refuses to publish.

field, strip order:SliTazKolibriOSMenuetOSSerenityOSHaikuAlpineReactOS·BestYesPartNo

Measured bindings. 4 of the Nishi grades on this page are bound to an organ and a symbol and re-measured on every publish by the one symbol ruler; the drift classes are counted below and their sum is re-derived beside the bound total.

Measured bindings, counted
Class	Count	Note
consistent	2	the grade and the symbol agree
stale-under	0	the grade says No while the organ carries the symbol; published with the badge, named by the gate until raised
unbacked	0	a claim over an absent symbol refuses to publish
unresolved	0
unreadable	0
unserved	2	the organ carries the symbol in source while its binary is not on the serving surface: built nowhere, invisible to symbol presence; published with the badge, never refused
partition sum	4	RECONCILED: the parts sum to the total 4

Footprint (quantitative)

Boot medium image size (MB)

SliTaz: "SliTaz GNU/Linux Cooking (55 MB)" (slitaz.org/en/get); Kolibri: "requires only a few megabytes of disk space"; Menuet: "Fits on a single floppy"; Alpine: "a minimal installation to disk requires around 130 MB"; Nishi volume is fixed-size FAT32 -- see the next row for what is actually OS

SliTaz 55 (cooking ISO)KolibriOS a few MBMenuetOS 1.44 (single floppy)SerenityOS n/a not publishedHaiku n/a not publishedAlpine ~130 disk installReactOS n/a not published

66 (GPT: 32.5M ESP + 32.5M data)

Nishi, measured

OS bytes actually executed

Nishi MEASURED: BOOTX64.EFI 1536 B + KERNEL.NXE 5064 B, both read back off the written USB and hash-matched to the build; SliTaz "root filesystem under 100 MB uncompressed"; Alpine "A container requires no more than 8 MB" [alpine-about]. This is the one axis where our number is extraordinary -- and it is small because the app layer is ABSENT, not because we compressed it

SliTaz <100000000 rootfs uncompressedKolibriOS n/a not publishedMenuetOS n/a not publishedSerenityOS n/a not publishedHaiku n/a not publishedAlpine 8000000 min containerReactOS n/a not published

6600 (1536 loader + 5064 kernel)

Nishi, measured

RAM to reach the painted desktop (MB)

Kolibri publishes "12 MB of RAM" (kolibrios.org/en) [kolibrios]; Nishi MEASURED from the image layout: 26 KB loaded image + 16 KiB memory-map buffer + 10 KiB kernel reserve, framebuffer supplied by firmware GOP; SliTaz does not publish a RAM figure on its site -- the 192-256 MB figure is the operator brief, marked community-cited not vendor-stated

SliTaz ~192-256 community-citedKolibriOS 12MenuetOS n/a not publishedSerenityOS n/a not publishedHaiku n/a not publishedAlpine n/a not publishedReactOS n/a not published

~0.03 + firmware framebuffer

Nishi, measured

Third-party code in the product path

Nishi: zero -- own compiler (nx_cc), own executable format (NXE), own emulator, own FAT32 reader; the ONLY foreign format is the PE32+ header UEFI demands, which is the firmware toll every x86 OS pays; Haiku states "numerous open source projects are utilized ... integrated seamlessly" [haiku-about] [serenityos]

SliTaz Linux kernel + Busybox + Openbox + Midori/FirefoxKolibriOS FASM-built own kernel + driversMenuetOS own asm kernelSerenityOS custom core + some portsHaiku kernel own + "numerous open source projects"Alpine Linux kernel + musl + BusyboxReactOS own reimplementation of Windows

Nishi, measured

Packages installable

SliTaz: "5000+ packages available via Tazpkg from the mirror" [slitaz-about]; Nishi has NO package manager and no package format -- filed rung

SliTaz 5000+ via TazpkgKolibriOS n/a app bundlesMenuetOS n/a app bundlesSerenityOS own ports treeHaiku own + HaikuDepotAlpine large apk repositoryReactOS n/a

0 (no package manager)

Nishi, measured

CPU architectures supported

SliTaz: "32-bit and 64-bit (native 64-bit in active development)" + "ARM support - Raspberry Pi edition"; Kolibri "an i586 processor"; Menuet "written completely in 64bit assembly language" with 32-bit variants; Nishi x86-64 UEFI here -- a separate sovereign rv64 lane exists but the two have NOT met (that is the open NishiOS rung) [reactos]

SliTaz 3 (i486, x86_64, ARM)KolibriOS 1 (i586 x86)MenuetOS 2 (32-bit and 64-bit asm)SerenityOS 2 (x86_64, aarch64)Haiku n/a not publishedAlpine multipleReactOS 1 (x86 family)

1 (x86-64 UEFI)

Nishi, measured

Desktop and GUI (SliTaz parity target)

Native-resolution framebuffer graphics

Nishi: UEFI GOP queried by the loader, 1280x800x4 measured 100 percent of 1,024,000 pixels painted, colour-exact on real OVMF (top bar RGB 46,59,78); Menuet "resolutions up to 1920x1080, 16 million colours" [menuetos]; Alpine is server/container-first, desktop is opt-in

YES

Desktop shell painted at boot

Nishi paints a desktop v0 -- background, top bar, accent, taskbar with start block, one window frame with title and close box, NISHI wordmark -- 57 rect fills, verified identically on our emulator and real TianoCore

YES

Window manager (move, resize, focus, multiple windows)

SliTaz ships Openbox; ours paints ONE static window frame and has no window manager at all -- the single biggest visual-parity gap. Filed rung

Mouse or pointer input

Nishi has NO pointer of any kind: no PS/2 mouse driver, no USB HID. Keyboard only. Filed rung

Keyboard input after firmware exit

Nishi drives the 8042 directly post-ExitBootServices (ports 0x60/0x64, reads only); PROVEN on real QEMU 8042: tally rose 0 to 640 to 1280 to 2080 pixels with the firmware gone

YES

Runtime text rendering (draw arbitrary strings)

Nishi DONE 2026-08-05: the kernel renders arbitrary NUL-terminated ASCII from the sovereign 8x8 font carried as payload DATA, at runtime, with the LINE CHOSEN BY THE MACHINE'S OWN STATE -- the assistant verdict is now written in WORDS, not only colour, because a colour block is legible only to someone holding the source. WITNESSED ON REAL TianoCore: 1281 ink pixels, and the banner reads back off the screendump as NISHI OS 0.1 GPT ESP NXE KERNEL AI: OFF. Non-vacuity: one binary, three states, three DIFFERENT transition counts (4227 OFF / 4255 ON / 4303 REFUSED). The whole font ships, not just the characters these lines use. Honest depth gap: 8x8 bitmap, fixed advance, no anti-aliasing, no wrap or shaping -- the estate's nx_ttf_fontlib has those on other surfaces, not yet on the metal

YES

Icons, taskbar, start menu (interactive)

Nishi PAINTS a taskbar and start block but nothing is clickable or focusable -- pixels, not widgets

PART

Graphical configuration tools

SliTaz: "Openbox desktop with homemade SliTaz graphical tools" and a web-based admin panel. Ours: none on metal

Built-in applications (what makes SliTaz immediately usable)

Web browser on the metal

SliTaz "Midori and Firefox web browsers, Lynx in text mode"; Kolibri ships a web browser; Menuet an http client. Nishi has a REAL sovereign browser engine (nx_browser_render: CSS cascade, box layout, AA vector text, forms) proven on Linux and native Windows -- but it does NOT run on the NXE kernel. Honest n on this axis, and the single most valuable rung on the board

File manager

Nishi: none. Note the substrate is now there -- the loader reads a named file off the ESP through real firmware protocols, so listing and reading files is a shell rung, not a research rung

Text editor

Kolibri ships a text editor; Menuet an "IDE Editor/Assembler". Ours: none on metal

Terminal or shell

SliTaz has "300+ standard GNU/Linux commands" via Busybox. Nishi has no shell, no command line, no process model on metal

Games

Kolibri: "over 30 exciting games". Ours: none on metal (the estate has game engines, none on the NXE kernel)

Package manager

SliTaz Tazpkg, Alpine apk. Nishi: none -- but note our update story is different by construction (see the kernel-as-a-file axis below)

Storage and filesystems

Modern partition table (GPT, not MBR)

Nishi AS OF 2026-08-05 (FS-1): the image is GPT -- protective MBR (type 0xEE), primary header at LBA 1, 128-entry array, and a BACKUP header + array at the end of the disk, every structure carrying a CRC32 this emitter computes and its own gate recomputes. MBR was the genuinely dated part of our layout and it was OURS to fix (2 TiB cap, no integrity field). VERIFIED THREE WAYS: our emitter gate (sig + header CRC + array CRC + backup + type GUID + a guard that the partition cannot overlap its own backup), real TianoCore booting from it, and Linux sfdisk --verify reporting No errors detected. Disk and partition GUIDs are FIXED, not random, because a random GUID would destroy byte-identical rebuild -- a measured property we defend

bound to runtime/_hdl_build/nx_efi_fat32_image.nx:wr_gpt_hdr · measured PRESENT (decl) · CONSISTENT

YES

Read files from the boot medium

Nishi NEW TODAY (N1-full): loader walks LoadedImage to DeviceHandle to SimpleFileSystem to OpenVolume to Open to Read and loads /KERNEL.NXE off the ESP; witnessed on real TianoCore, and our OWN FAT32 reader independently parses the same image (5 of 5 tamper teeth)

bound to runtime/_hdl_build/nx_esp_boot.nx:esp_extract · measured PRESENT (decl) · CONSISTENT

YES

Write to the boot medium

Nishi REFUSES writes BY CONSTRUCTION: the loader passes EFI_FILE_MODE_READ only, the emulator refuses a write-mode Open with a named sentinel, and the census gate pins the exact call set. This is a deliberate never-brick posture, but it IS a capability gap versus every rival

Multiple filesystem support

Kolibri: "full support for FAT12/16/32 file systems, read-only access to NTFS, exFAT, ISO9660, and Ext2/3/4". Nishi reads FAT32 only, read-only. FAT on the ESP is MANDATED -- UEFI firmware carries a FAT driver and the spec requires the EFI System Partition to be FAT [uefi-spec], so every UEFI OS ships one; that is a boundary toll, not a choice. The real gap is that we have NO filesystem of our own, so FAT32's limits become the OS's limits -- notably a 4 GiB maximum file size, which is a hard ceiling on model weights, plus no journaling and no checksums (our loader's own sum64 exists to compensate). FS-2 = a second partition with a sovereign checksummed filesystem

Persistent user data across boots

SliTaz: "Persistent storage via USB or mounted partition". Ours: nothing persists -- no writes at all

Runs entirely in RAM (medium removable after boot)

SliTaz: "Runs entirely in RAM: eject the CD, the system keeps running". Nishi PARTIAL and untested: after ExitBootServices the kernel touches no storage, so it plausibly survives removal -- but we have NOT run that experiment, so this is a ~ with a filed test, not a Y

PART

Hardware and drivers

PCI bus enumeration

Nishi walks PCI config space itself post-ExitBootServices (CONFIG_ADDRESS 0xCF8 write-selector only, CONFIG_DATA 0xCFC read-only) with no firmware and no host OS -- witnessed on real hardware: host bridge VERIFIED, e1000 VERIFIED, unknown devices honestly UNBOUND

YES

Device support driven by DATA rows, not new code

Nishi UNIQUE IN THIS FIELD: each registry row carries an op-list PROGRAM (READ/AND/EXPECT/SHR/END) that one unchanging interpreter executes; a new device class is a new ROW. Proven on a real e1000 with a 10-step program including a real BAR check, and the negative control (flip the expectation) MISMATCHes on real silicon. Every rival adds a driver by adding code

BEST

Network driver

Nishi enumerates and VERIFIES an e1000 but cannot talk to it -- no rings, no DMA, no packets. This is the gate on the entire browser arc, and its own never-brick audit

Sound

SliTaz "ALSA sound support"; Kolibri drivers for "popular sound ... cards". Ours: none

USB input devices (HID)

Nishi is PS/2 only post-firmware; a real USB stack is a filed rung. On machines with no PS/2 emulation our post-EBS keyboard will not work -- stated plainly rather than discovered by a user

Sovereignty, safety and update (where Nishi leads)

Whole stack built by its own compiler, zero third-party in the product path

Nishi: the compiler (nx_cc), the executable format, the image writer, the FAT reader, the emulator and the kernel are all ours, bits-up. EVIDENCE (MEASURED 2026-08-13): a return-42 static ELF from this toolchain is 188 bytes, which cannot contain a libc; and the compiler self-hosts under nx_cc_equiv_gate at 10/10 plus a self-host stage before any promotion, so bits-up is verified by rebuilding the compiler with itself. Kolibri/Menuet write their own kernels in FASM (a third-party assembler); Haiku states it uses numerous open source projects; the Linux-based rows inherit an enormous foreign base

BEST

Native executable format (not ELF or PE)

Nishi kernel is NXE (own format, magic + version + payload sum64). EVIDENCE (WITNESSED on real firmware, and this cell cited none until 2026-08-14): the format is not merely declared -- real TianoCore/OVMF was made to print our literal NXE! refusal when handed an ESP with no kernel file, which only happens if the loader is genuinely parsing and validating our own format rather than deferring to a stock one. PE32+ exists in exactly ONE place -- the 1536-byte firmware shim -- and nothing downstream of it is a foreign format

BEST

Loader cryptographically validates the kernel before jumping

Nishi: the loader re-derives the payload sum64 and compares the magic-version qword, and a mismatch prints NXE! on the firmware console and HOLDS -- never a blind jump. WITNESSED on real OVMF: an ESP with no kernel file made real firmware print our literal NXE!. Secure Boot is a different thing (chain of trust to firmware keys) and we do not have it -- filed

bound to runtime/nx_nxe_lib.nx:nxe_neverbrick_ok · measured PRESENT (decl) · UNSERVED — the hand grade claims the capability and the organ carries the symbol in SOURCE, but its binary is not on the serving surface: built nowhere -- this cell over-reports what RUNS and stays flagged until the organ is promoted

BEST

Never-brick guarantees proven mechanically, not promised

Nishi: the emitter's own gate pins the EXACT firmware call set -- 8 read-only calls (LocateProtocol, HandleProtocol x2, OpenVolume, Open+Read for the kernel, Open+Read for the optional assistant file), 1 refusal print, 1 jump -- and REFUSES to emit if one more appears. The census walks the sites the emitter RECORDED, not bytes that look like a call: a byte scan false-flagged a lea whose displacement happened to be 255; port I/O is decode-restricted to an audited allow-set; a write-mode file open is impossible by construction. No rival makes a machine-checked claim of this shape

BEST

Bit-exact reproducible image build

Nishi: rebuilding after a no-op source change produced a byte-identical image sha; the toolchain swap earlier this week left the image sha UNCHANGED. EVIDENCE (MEASURED again 2026-08-14 on a different subject, which is what makes it a property rather than an anecdote): renaming two constants in nx_eqsat.nx changed the source text and the rebuilt binary came back byte-identical at sha 49a74350, 153,520 B. Reproducibility that holds across unrelated organs on unrelated days is the integer-determinism doctrine showing up as an observable, not a build flag. Most distros pursue reproducible builds; ours falls out of integer-only determinism

BEST

Boot chain independently witnessed by a foreign oracle

Nishi runs every rung under real TianoCore/OVMF as an ORACLE ONLY -- never in the product path -- and the pixel census is byte-exact against the sovereign emulator [tianocore-edk2]. Rivals are witnessed by their own user bases, which is a stronger form of the same thing

YES

OS update is a single file copy on the boot medium

Nishi PARTIAL, corrected 2026-08-05 after MEASURING it: the loader READS /KERNEL.NXE off the ESP rather than embedding it, so updating the OS is genuinely a file copy and needs no image rebuild and no writer -- but moving to GPT made Windows treat the partition as a protected EFI System Partition, and a normal user now gets Access Denied on the mounted volume (under the old MBR type-0x0C layout it mounted as an ordinary FAT32 drive). FIXED THE SAME SESSION (FS-2b): the image now carries a SECOND partition with the Microsoft basic-data type GUID, which Windows, Linux and macOS all mount as an ordinary drive -- that is where NISHI.AI goes, so the file a user actually swaps needs no elevation anywhere. PROVEN END-TO-END ON REAL TianoCore FROM THE IMAGE: the loader booted from the ESP, enumerated every filesystem via LocateHandleBuffer, found NISHI.AI on partition 2 and ran the assistant on its weights (status ON, swatch 0xFFFFFFEC). Still Part, honestly, for TWO measured reasons: the KERNEL remains on the protected ESP so updating IT needs elevation on Windows, and on a PHYSICAL stick the data partition does not yet mount at all -- writing a fixed-size image to a larger device leaves the backup GPT mid-device instead of at the device's last LBA (measured: 7987200 device sectors vs 135269 image sectors). The image is correct; the WRITE PATH must relocate the backup GPT and rewrite the primary header, the way sgdisk -e does. Filed, not hidden

PART

Optional on-device AI (the Nishi-only axis)

Integer-only (no float) inference primitives

Nishi: the whole nofloat stack is integer -- deterministic and bit-exact BY CONSTRUCTION. EVIDENCE (MEASURED): the determinism is what makes exact-equality gates expressible at all -- the sibling emulator measures 0 divergences in 500 fuzz vectors against QEMU, and the estate's integer organs assert exact integer equalities rather than tolerance bands. A float stack cannot be tested that way, so the FORM of the tests is itself the evidence. No small-OS rival offers on-device inference at all, so this axis is ours by default and worth exactly what it is: a mechanism, not a product

BEST

AI primitive proven running at boot on the metal

Nishi PARTIAL: the kernel performs 32 signed multiply-accumulates -- the inner loop of every GEMM in our stack -- with no libc, no allocator, no float, and paints the accumulator as a pixel; expected -26 (0xFFFFFFE6) derived by a separate path and confirmed on BOTH the sovereign emulator and real OVMF. That is a proven MECHANISM and nothing about a real model. As of 2026-08-05 the same primitive also runs on weights READ FROM A FILE ON THE BOOT MEDIUM, verified on the sovereign emulator with an independently derived expected value

PART

Model weights loadable as a swappable file

Nishi DONE 2026-08-05 and unique in this field. NISHI.AI is the SLOT, not the model: the blob carries the ORIGINAL model name, its ORIGIN URL and licence INSIDE the checksummed region, so provenance cannot be edited without detection and the user can always choose a different model. The loader searches EVERY volume for it (so it lives on the user-writable data partition, not the protected ESP), the kernel validates magic + lane count + sum64 before anything executes, and THE SCREEN NAMES THE MODEL IT LOADED. PROVEN ON REAL TianoCore with two different files and ONE unchanged binary: gemma-3-1b-it-abliterated-v2 renders 897 ink px and computes 0xFFFFFFE6; TinyLlama-1.1B-Chat renders 753 px and computes 0xFFFFFFEC. Swap the file, the words and the answer both change. Honest scope: the payload is still a 32-lane integer dot product, not a language model

BEST

Optional assistant the user can switch on and off

Nishi PARTIAL and the MECHANISM is done: THE TOGGLE IS THE FILE -- copy /NISHI.AI onto the stick to enable, delete it to disable, and the kernel paints three DISTINCT states (OFF slate, REFUSED red, ON green) so the machine never claims a capability it does not have. All three refusal reasons (bad magic, wrong lane count, bad checksum) fall back to the built-in vectors, so an unvalidatable blob NEVER reaches the compute. What is still missing is a real MODEL: today the payload is a 32-lane integer dot product, not an assistant, and calling it one would be the lie this matrix exists to prevent. Honest ~ rather than Y. Target tier per the operator brief: 350M-1B class (Granite 350M, TinyLlama, MiniCPM, Gemma-3-1b) quantized to integer weights. Original note follows: honest n for everyone. The Nishi design is a toggle in the desktop shell with an explicit OFF default and a visible state, so the machine never runs a model the user did not ask for -- but neither the toggle nor the model exists yet. Target tier per the operator brief: a 350M-1B class model (Granite 350M, TinyLlama, MiniCPM, Gemma-3-1b class) quantized to integer weights

PART

Honest capability reporting to the user

Nishi: an unknown PCI device paints UNBOUND rather than a false bind, a bad kernel file prints NXE! rather than booting something, and the emulator REFUSES an unmodeled port instead of inventing a value. EVIDENCE (WITNESSED on real firmware, cited here from 2026-08-14): the middle case is not hypothetical -- real TianoCore printed our literal NXE! and HELD rather than jumping. Refusal-over-fabrication is only a virtue if the refusal path has been seen to execute, and this one has, on somebody else's silicon. Refusal-over-fabrication is a design rule here, and it is why this matrix has so many n cells

BEST

7 competitors43 axes6 quantitativeNishi best 9 · absent 15bound 4 · stale-under 0 · unbacked 0 · unserved 2

Honest verdict (2026-08-05). Against SliTaz we are not at parity and not close on the app layer: no window manager, no mouse, no browser on the metal, no file manager, no editor, no shell, no package manager, no persistence, no network driver, no sound. What we DO have is the part that is normally hardest to retrofit and easiest to fake: a boot chain that is ours bits-up, a loader that validates the kernel and refuses rather than jumping blind (witnessed printing NXE! on real firmware), a driver model where a new device is a data row and not new code (witnessed on a real e1000), never-brick properties that are machine-checked by the emitter rather than promised in a comment, and as of today an OS whose kernel is a file you can replace with a copy command. The 6600-byte figure is honest in both directions: it is small because the app layer is absent. The climb is ordered and every rung is filed: (1) runtime text rendering in the kernel, (2) mouse plus a real window manager, (3) file listing and a file manager over the proven ESP read chain, (4) the e1000 driver post-EBS and a network stack, (5) our existing browser engine ported onto the NXE kernel, (6) the optional AI assistant, weights as a file on the medium, OFF by default. Nothing on that list is research; every item is engineering with a proven substrate underneath it.

Honest verdict. Ranker-feeder view of the domain the SOTA register at /compare/smallos renders in full against eight columns. The shape of the honest verdict has not changed since 2026-08-05: what we have is the part that is normally hardest to retrofit and easiest to fake -- a boot chain that is ours bits-up, a loader that validates the kernel and refuses rather than jumping blind (witnessed printing its own refusal on real TianoCore), a driver model where a new device is a DATA ROW and not new code, never-brick properties machine-checked by the emitter, and a kernel that is a file you replace with a copy command. What is missing is the app layer, and the SOTA page's own closing paragraph already orders the climb: pointer and a real window manager, file listing over the proven ESP read chain, a shell, the e1000 driver post-ExitBootServices and a network stack, the existing browser engine ported onto the NXE kernel, and the optional assistant with weights as a file and OFF by default. Ahead of all of it sits one small measured defect the page files and nobody has drained: written to a physical stick larger than the image, the backup GPT lands mid-device and the data partition does not mount at all, so the medium a user actually plugs in is broken. That is 0.1.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/smallos.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain smallos, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from smallos.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	4
scanned	4
fetched	4
reused	0
failed	0
named	4
candidates	4
mentions	4
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	SliTaz	1	1	col0-slitaz	named	https://slitaz.org/en/about/
2	KolibriOS	1	1	col1-kolibrios	named	https://kolibrios.org/en/
3	SerenityOS	1	1	col2-serenityos	named	https://serenityos.org/
4	Haiku	1	1	col3-haiku	named	https://www.haiku-os.org/about/

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 14 capabilities: 14 exclusive to it and 0 shared with other boards. Shared rows on this page: 0 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 0 + refused 0 (partition 0); undecided = unmapped 0 + unproven 0 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=6286.

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1395391 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[slitaz-about] SliTaz GNU/Linux project. About SliTaz (slitaz.org/en/about): live CD/USB distribution, runs entirely in RAM, root filesystem under 100 MB uncompressed, Openbox desktop with homemade graphical tools, Midori and Firefox, 5000+ packages via Tazpkg, ARM Raspberry Pi edition. publisher · read in our library knowledge/fetched/cmp_smallos_slitaz.html · pin h26c0da817434df8d01698365970045952f8beff5aa5549695acea4562d1d50f7 · accessed 2026-08-18 · vendor-docGrounds: THE PARITY TARGET column: OS bytes actually executed (under 100 MB rootfs), Packages installable (5000+ via Tazpkg), Web browser on the metal (Midori and Firefox), Runs entirely in RAM, Graphical configuration tools, Persistent user data -- every SliTaz cell in the register quotes this page.
[kolibrios] KolibriOS Project Team. KolibriOS official site (kolibrios.org/en): a few megabytes of disk, an i586 processor and 12 MB of RAM; text editor, image viewer, graphic editor, web browser and over 30 games; FAT12/16/32 with read-only NTFS, exFAT, ISO9660 and Ext2/3/4; kernel and drivers written in FASM. publisher · read in our library knowledge/fetched/cmp_smallos_kolibrios.html · pin h10f4a518f20b34c95569443426cec8caf95e056884c36af0c8a41d4e1332f642 · accessed 2026-08-18 · vendor-docGrounds: The KolibriOS column: RAM to reach the painted desktop (12 MB), Games (over 30), Multiple filesystem support, Text editor and Web browser on the metal, CPU architectures supported (i586) and the FASM note on Third-party code in the product path.
[menuetos] MenuetOS. MenuetOS official site (menuetos.net): pre-emptive OS written completely in 64-bit assembly language, fits on a single floppy, resolutions up to 1920x1080 with 16 million colours, IDE editor and assembler, http client. publisher · read in our library knowledge/fetched/cmp_smallos_menuetos.html · pin h742bb45bf5c7c5bb145f1a16b053b66ce021460f6f33b81d870205a3cef9bbd6 · accessed 2026-08-18 · vendor-docGrounds: The MenuetOS column: Boot medium image size (1.44 single floppy), Native-resolution framebuffer graphics (up to 1920x1080, 16 million colours), CPU architectures supported (32-bit and 64-bit asm), Text editor (IDE Editor/Assembler) and the own-asm-kernel note.
[serenityos] SerenityOS project. SerenityOS official site (serenityos.org): a graphical Unix-like operating system for desktop computers with a custom Unix-like core, links to source, man pages and FAQ. publisher · read in our library knowledge/fetched/cmp_smallos_serenityos.html · pin hb761a0ced4aea53bda5faada986edeee972d29e7677024a04ddc7b0c9dea886d · accessed 2026-08-18 · vendor-docGrounds: The SerenityOS column: the custom core + some ports note on Third-party code in the product path and own ports tree on Packages installable; the desktop, window-manager, browser and file-manager Y cells (a full graphical Unix-like desktop is the project's stated scope). The mirror is the whole homepage (1758 bytes -- the page really is that small).
[haiku-about] Haiku Inc. About Haiku (haiku-os.org/about): open-source operating system specifically targeting personal computing, inspired by BeOS, custom kernel with numerous open source projects utilized and integrated seamlessly. publisher · read in our library knowledge/fetched/cmp_smallos_haiku.html · pin h56d8c96df6f01c266e5be4d4b7097c8d75832055089bba59a10f8d7f84490bea · accessed 2026-08-18 · vendor-docGrounds: The Haiku column: the kernel own + numerous open source projects cell on Third-party code in the product path, own + HaikuDepot on Packages installable, and the desktop and application Y cells.
[alpine-about] Alpine Linux Development Team. About Alpine Linux (alpinelinux.org/about): built around musl libc and busybox; a container requires no more than 8 MB and a minimal installation to disk requires around 130 MB; own package manager apk; OpenRC init. publisher · read in our library knowledge/fetched/cmp_smallos_alpine.html · pin hb2605b348a9ed28614114ce7005112f07345e2622553325ff9c11333b1c09876 · accessed 2026-08-18 · vendor-docGrounds: The Alpine column: Boot medium image size (~130 MB disk install), OS bytes actually executed (8 MB minimum container), Package manager (apk) and the Linux kernel + musl + Busybox cell on Third-party code in the product path -- Alpine is the server/container-first row, desktop opt-in.
[reactos] ReactOS Foundation. ReactOS official site (reactos.org): a free and open-source operating system for x86 that is binary-compatible with Windows programs and drivers, an own reimplementation rather than a Linux distribution. publisher · read in our library knowledge/fetched/cmp_smallos_reactos.html · pin h414e1fc7f568b7f55e5fcac71ee92d451274af7f1fe939143add7daa17f25cd9 · accessed 2026-08-18 · vendor-docGrounds: The ReactOS column: the own reimplementation of Windows cell on Third-party code in the product path, CPU architectures supported (x86 family) and the desktop and application Y cells.
[uefi-spec] UEFI Forum. Unified Extensible Firmware Interface (UEFI) Specification, current release as listed on uefi.org/specifications: boot services and ExitBootServices, Graphics Output Protocol, Simple File System protocol, GUID Partition Table and the FAT-formatted EFI System Partition. publisher · read in our library knowledge/fetched/cmp_smallos_uefispec.html · pin hcad4cb51d8a95c0320426cfb90f3b14b3add8fed7ddb871efbf20543b819aa30 · accessed 2026-08-18 · published-standardGrounds: The Storage and Hardware rows that name the firmware toll: Modern partition table (GPT), Read files from the boot medium (LoadedImage to SimpleFileSystem to Open to Read), Multiple filesystem support (FAT on the ESP is MANDATED by this spec), Native-resolution framebuffer graphics (GOP), Keyboard input after firmware exit (post-ExitBootServices) and the PE32+ header note -- the ONLY foreign format in the product path is the one this specification demands.
[tianocore-edk2] TianoCore. EDK II -- the open-source reference implementation of the UEFI and PI specifications (github.com/tianocore/edk2), whose OVMF package is the firmware image used as the foreign oracle here. publisher · read in our library knowledge/fetched/cmp_smallos_edk2.html · pin h59d7a0377f329210cb7c5fb757211d9d7b938fef8aa5e08d0f3e4c16b2e42de2 · accessed 2026-08-18 · source-readGrounds: The Boot chain independently witnessed by a foreign oracle row and every WITNESSED ON REAL TianoCore/OVMF evidence sentence in the register (NXE! refusal printed by real firmware, 1281 ink pixels, GPT boot, NISHI.AI found on partition 2): OVMF/EDK II is the third-party firmware those claims ran under, used as an ORACLE ONLY and never in the product path.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/smallos.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls