Nishi Family › Compare › Unified Document Portal: Documents as Pages in the Sovereign Browser and NishiOS

Nishi Compare · capabilities, evidence and delivery

Unified Document Portal: Documents as Pages in the Sovereign Browser and NishiOS

Compare capabilities and delivery evidence. Source discovery, qualification, deployment and accepted outcomes are separate; an open contract names work still to verify.

Nishi vs Google Drive, Microsoft 365 for the web, Adobe Acrobat web and Nextcloud Hub -- every document a zero-script page the Nishi browser and NishiOS open natively, with the portal's actions as plain forms, so there is one surface instead of a file browser plus a web browser

Overview

The purpose, declared position and evidence coverage of this domain. Source presence and completed acceptance are different measures.

Where we are. Measured 2026-09-03 against buildroot, not recalled. The estate already opens documents as pages in FOUR places that do not share a page: the browser omnitool (knowledge/doc_viewers.conf routes docx, pptx, xlsx, pdf, md and csv to focused renderers and nx_browser paints the result inline when it navigates to a document URL, proven live on a .docx over the sovereign TLS stack), NishiOS (nx_nishios_docview boots and opens a Markdown document in the NISHI DOCS window with the same renderer linked in, 12 of 12), the office (import, edit, version, diff, sign, share over the H P T B I document model, live on nishifamily.com/office and admin.andelinwest.com/office) and the per-domain vault (admin.andelinwest.com, private uploads isolated from public search). What was NOT there is the unified page: one page shape for every kind, over the office's own model, with a fail-closed policy, text escaped by construction and the portal's actions as plain forms. Landed today as rung UD1: nx_unidoc_lib, the nx_unidoc CLI (the same html interface the registry dispatches) and nx_unidoc_gate with 28 teeth -- hostile text renders as text, the CSP is present, a web page is refused by name, the same bytes render the same page, forms appear only with a portal base, csv keeps a quoted comma, and a genuine Microsoft Word document renders through the promoted docx spec verb. Compiled clean on the laptop toolchain first try (49993 B and 66554 B); sources landed byte-identical in both trees (sha 9af39ebb, f20a64c2, 46f7bcb9); the NAS ship is recorded in the log rows below.

Where we need to go. Version 0.1 is one page for every document kind, gated, promoted and registered as the renderer for the kinds no renderer served (txt, odt), so the browser omnitool and the portal show the same page. Version 1.0 is the portal: one URL per vault document composing the page with its original, versions, annotations, signature and share, served by the portal daemon, and the Nishi browser submitting those forms natively, so a client on the firm's portal never leaves the page to act on it. Version 2.0 is the unified surface on the sovereign platform: NishiOS opens the portal index as its document window (the file browser retired), the shared model grows lists, quotes and code blocks, PDF pages are laid out rather than reflowed, and the browser, the reader and NishiOS paint through one render core so the NAS census can grade what the daily driver paints.

The unit. 1 u = one measured session-leg. Calibration: UD1 (lib, cli, gate with 28 teeth, local compile, both trees, this board) took one leg on 2026-09-03; the legalpractice L3 board took one leg the same day.

Where we are: UD1 landed; 7 open rungs. Every renderer is present and gate-proven, the browser and NishiOS open documents natively, the office and the vault are live, and the unified page exists as an organ with its gate. What is open is the wiring: the registry rows, the portal route, the browser's form submission, the model's list block, PDF layout, the OS index and one render core.

Cost to the unified page as the served renderer (0.1): 1.5 u. UD1 landed; UD2 registers txt and odt to the unified page and re-runs the browser document gate against it.

Cost to the portal (1.0): 8 u. UD3 the daemon route, UD4 the browser's form submission, UD5 the list block and editor, cumulative 9.5 u.

Cost to the unified sovereign surface (2.0): 10 u more. UD6 PDF layout (the long pole), UD7 the NishiOS index, UD8 co-editing shared with legalpractice LP14, UD9 one render core shared with the browser board's BR29.

Research bar. Google Drive viewer is measured on the file kinds a cloud drive previews inline and its one-page-per-file model [@google-drive-view]. Theirs: UNPINNED -- a SaaS product with no release registry; declared, not pinned; the mirrored help page carries its pin and access date in unidoc.refs. Ours: the OPEN and PORTAL columns.

Research bar. Microsoft 365 for the web is measured on office documents viewed and edited in the browser [@m365-web]. Theirs: UNPINNED -- SaaS; mirrored product page pinned in unidoc.refs. Ours: the OPEN, EDIT and co-editing columns.

Research bar. Adobe Acrobat web is measured on PDF viewed, annotated and signed in the browser [@acrobat-web]. Theirs: UNPINNED and UNMIRRORED -- adobe.com refused the sovereign TLS client twice on 2026-09-03, so the column is index-level and says so in every cell. Ours: the PDF row and the PDF annotation and signing cells.

Research bar. Nextcloud Hub (self-hosted) is measured on the self-hosted files platform with viewer, versions, comments and share [@nextcloud-server]. Theirs: UNPINNED -- the repository's releases feed is pinnable through api.github.com and is owed to knowledge/barcheck.conf before any version is quoted. Ours: the self-hosted column.

Research bar. PDF.js is measured on open in-browser PDF page rendering [@pdfjs]. Theirs: the bar for the pf_page_layout watch (UD6). Ours: the PDF row.

Research bar. Content Security Policy Level 3 and the HTML sandbox is measured on what a document page may load and run [@csp3] [@whatwg-sandbox]. Theirs: default-src none, form-action self, base-uri none on every emitted page; the field sandboxes a frame. Ours: the SECURE rows.

Latest recorded release

2026-10-08 · UD8

2026-10-07 three rows on this board that graded an e-sign or legal capability whose exceed is claimed on /compare/legalpractice became @xrow references to it (nx_ann_add the annotation overlay, nx_env_send envelope routing, nx_legal_regime the never-void instrument gate), chosen by the fleet duplicate census (nx_rivalcensus dupes, ecosystem EC89); each reference keeps the document-portal reading (Acrobat Sign Best on routing, Google Docs Part by the 2026-10-07 census) in its note; landed on a predicted size ladder 31957 to 32089 in three steps, every receipt byte-exact; no unidoc rung carries any of the three symbols, so the ranker stays at unmapped=0. This board is in turn the home for dad_handle and the on-premise property row that legalpractice now references

Release history and work log

Release entries describe recorded changes; they do not establish that every capability passed evaluation.

44 of 64 capability source symbols found|8 of them authored stronger-claims|20 open|coverage 687/1000|adoption 24 full / 20 partial

Evidence profile — what the gaps on this board actually are

Measured by nx_swcompare_evidence, read back by nx_evprofile_lib. Every figure is a count with its denominator — there is deliberately no score, no grade and no percentage anywhere in this band, because a stored scalar is a field a seat can edit and a counted partition is not.

proven able to fail counts the gates that have a RECORDED RED — nx_gate_bite mutated the gate subject, rebuilt it, watched the gate go red, and that record is inside the shared TTL. never bitten is its complement over the same denominator: those gates ran and were green, and nothing has ever shown them able to detect anything, so their green is a statement about this run and not about the gate. green at 0/0 is a separate and much weaker observation — the gate printed GREEN on a zero denominator, so its own tooth counter says it examined nothing. A gate can be green, non-zero, and still never bitten; that is the common case and it is now visible instead of implied.

partition: grounded + unsupported = 30 vs present 30 · named + unnamed + withheld = 6 vs open 6 · both reconcile

liar-kill conj=GPQN · all four conjuncts held

graded document: BUILDROOT tree, 13718 bytes · gates map: PRIMARY · stamped 35d 4h ago · STALE against the shared TTL of 604800s — this is evidence about a build nobody can vouch for now · source ../knowledge/status/evstamp_unidoc.verdict

Gap class	What it is, and the work it names
STALE	This profile is older than the shared TTL, or its clock ran backwards. It is reported as unusable rather than as fresh, because being wrong in the direction of refusing is the safe direction.

This band reports the referee counts. The per-axis worklist rows — which axis is unsupported, which watch is ready to flip, which gap is unnamed — are printed by nx_swcompare_evidence unidoc itself and are not carried on the stamp, so this page names the classes and the producer names the rows. That split is stated rather than hidden: a count without a worklist is not actionable, and this band is honest about which half of that it is.

Production map

Follow the dependencies, declared acceptance criteria and recorded priorities. Inspect source binding before treating a rank as executable work.

Ranking source binding: STALE_OR_INVALID_BINDING. Recorded priorities require current acceptance evidence and resource checks before execution.

Recorded ranking withheld

Retained ranking is not bound to the current plan and matrix: STALE_OR_INVALID_BINDING. Historical data remains retained. Refresh the ranking after resolving the input differences. Latest execution outcome is unverified.

Declared roadmap — contract, acceptance, executor, effort

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The unified document page as an organ with its gate (UD1)	ud_render_path	nx_unidoc_lib folds docx, odt, pdf, md, csv and txt to the office document model through the promoted spec verbs and emits one zero-script page with a fail-closed CSP, escaped text and the portal's forms only with a base; nx_unidoc exposes the registry renderer interface; nx_unidoc_gate proves the escape fires and stays silent, the CSP is present, a web page is refused by name, determinism, csv quoting, and a genuine Word document through the promoted organ -- LANDED 2026-09-03	Organ	1 u
The unified page registered as the renderer for the kinds nothing served (UD2) after UD1	dv_lookup	knowledge/doc_viewers.conf gains txt and odt rows pointing at _offc/nx_unidoc.elf and the browser document gate is re-run against them; gate: nx_doc_view routes a .txt and a .odt to the unified page and the browser paints it inline	Deploy	0.5 u
One URL per vault document served by the portal daemon (UD3) after UD1	dad_unidoc	nx_docportal_admin_daemon serves GET /doc/<cid> through ud_render_path with the portal base so the original, versions, annotate and sign forms post back to the daemon, and POST /doc/<cid>/annotate and /sign compose nx_ann_add and of_sign_version; gate: a cross-tenant cid is 404, a no-consent sign is refused, the page carries no script	Organ	3 u
The Nishi browser submits the document page's forms natively (UD4)	br_form_submit	nx_browser serialises a form's fields on submit and POSTs them over its own HTTP stack, then paints the response; gate: the browser document gate gains a form leg that posts a note to the fixture server and reads it back	Organ	2 u
List, quote and code blocks in the shared document model (UD5) after UD1	ud_list_block	The model gains L (list item), Q (quote) and C (code) lines, the unified page renders them, the office editor round-trips them and the Markdown folder emits them; gate: a Markdown list renders as a list element and the office save keeps the L lines	Organ	1.5 u
PDF page layout painted, not only reflowed (UD6) after UD1	pf_page_layout	Positioned text runs with their fonts and embedded images painted per page through the sovereign renderer; gate: a two-column PDF keeps its columns and a figure is present, measured by nx_struct_diff against a PDF.js capture	Organ	4 u
NishiOS opens the portal index as its document window (UD7) after UD3	nd_portal_index	nx_nishios_docview lists the vault's documents in the NISHI DOCS window and opens one on selection through the linked unified page; gate: the boot image lists two documents and opens the selected one	Organ	2 u
Co-editing wired into the office (UD8) after UD3	of_coedit	Shared contract with legalpractice LP14: nx_office_serve imports nx_coedit and two browsers converge on one version; gate: the coedit live gate runs against the office route	Organ	1 u
One render core for the browser, the reader and NishiOS (UD9) after UD4	br_one_core	Shared contract with the browser board's BR29: the promoted Linux browser paints through the shared render core so the NAS census grades the same pixels the daily driver paints; gate: the same document page renders bit-identical through nx_browser and nx_browser_render	Organ	3 u

Milestones

Milestone	Rungs	Cumulative
U0 · The unified page as the served renderer	UD1,UD2	1.5 u
U1 · The portal: one URL, plain forms, the browser submits them	UD3,UD4,UD5	9.5 u
U2 · The unified sovereign surface	UD6,UD7,UD8,UD9	19.5 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The document page states what the law requires of this instrument (UD10) after UD3,legalpractice:LP30,legalpractice:LP31	ud_law_panel	ud_page renders, for a document with an instrument class and a signer place, a requirements panel built from the law engine's answer (the element set of legalpractice LP30, or the several-places set of LP32 when more than one state is involved): each element, whether the record satisfies it, the law id, the section and the pin of the row that demands it, and the day the row was read; the sign form is emitted only when that answer permits a ceremony for that place and class, otherwise the panel names what is missing or states that this instrument is signed on paper before witnesses; gate: a Utah trust page offers the electronic ceremony with its sections named, a deed page offers none, an unclassified document shows the strictest panel, and the page still carries no script	Organ	1.5 u

Milestones

Milestone	Rungs	Cumulative
U3 · The page states the law	UD10	21 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The native document container: canonical content-addressed records under the UXF document profile (UD11) after UD1	uxd_open	nx_uxf_doc_lib holds a document as a manifest and blocks, each a canonical NXR1 record under the envelope's document profile, the document's identity the manifest's CID; a container (the manifest, every distinct block once in first-reference order, then attachments that name the document and are not part of its identity) is verified on open with named refusals; unknown keys are preserved and a key that begins with a bang is must-understand and refused when unknown; a version names its parents by CID; the office spec lines are the first import and export projection; nx_uxf_doc is the tool (verify, from-spec, import, to-spec, docx, set); gate nx_uxf_doc_gate: a changed byte is refused and names the reference it broke, a truncated, foreign, orphaned or misattached container is refused by name, an unknown field survives an edit, the spec round trip is byte-identical -- LANDED 2026-10-03, awaiting acceptance	Organ	2 u
Concurrent versions merge to one identity (UD12) after UD11	uxd_merge	Two versions that name a common ancestor merge deterministically: a block changed on one side is taken, a block changed on both converges at character level with the history kept beside the materialised text and replayed only for the concurrent span, and the result names both parents; gate: two edits to different blocks merge to the same identity in either order, two edits to one block converge to one text on both sides, and a merge with an unrelated document is refused	Organ	3 u
A version is signed and its publication is provable (UD13) after UD11	uxd_sign	A signature attachment over the manifest CID carrying a classical and a post-quantum signature composed from the estate's hybrid signer, and a publication record that makes the version's existence at a time independently auditable, so the evolution of the document is the notarised object and not a snapshot of it; gate: a signed version verifies, a changed byte anywhere fails verification and names the block, a signature moved to another version is refused, and either signature failing alone is reported by name	Organ	2 u
Structure-carrying export and import: Word, ODF 1.4 and tagged PDF for print (UD14) after UD11,legalpractice:LP15	uxd_export	Headings, tables and marks survive into a Word package and an ODF 1.4 package and back, print goes through the sovereign PDF writer as an archival tagged PDF, and every target declares a loss ledger naming what it cannot carry; gate: a round trip through each target returns the same identity or names every lost key, an outside reader opens each export, and the loss ledger of a target that drops nothing is empty	Organ	3 u
The unified page and the office open and save the native container (UD15) after UD11	ud_kind_nxd	The unified page gains the native kind (a doc_viewers.conf row and a fold through the container's own projection), the office saves each version as a container whose manifest names its parent, and the portal serves the container beside the original bytes; gate: the browser paints a container as the same zero-script page, an office save reopens with the same identity, and a tampered container is refused on the page by name	Organ	1.5 u
Inline marks, lists, fields and legal semantics as typed block keys (UD16) after UD11	uxd_marks	Ranges anchored inside a block's text for emphasis, defined terms and cross-references, list and quote blocks, typed merge fields, signature blocks, and the instrument class and jurisdiction on the manifest, every one an optional key an older reader preserves; gate: a marked range survives an edit elsewhere in the block, a defined term used and never defined is named, and a reader that does not know a key round-trips it unchanged	Organ	3 u

Milestones

Milestone	Rungs	Cumulative
U4 · A native document format measured against the incumbents	UD11,UD12,UD13,UD14,UD15,UD16	35.5 u

Ladder to SOTA

Two dated targets, and every rung's role toward them. Best in class is the proven, deployed leader today; the frontier is the research edge as of its month. Each target is dated by a sotabar row and judged against the current month by the bar-age ruler (FRESH, ATTESTED with the fallback month named, or refused). Each rung is substrate (what the target's own methods consume), an arm (a sovereign arm that triangulates without competing for the number), a contender (its done-rule is a number against the target) or superseded (kept as capability, retired as a claim), and carries the rungs it stands on.

best-in-class (T-BIC-DOC), dated by SB-DOCFORMAT = 2026-09 ATTESTED. A document that keeps its history with it, loads as plain state, merges concurrent edits without a server, and is interchanged and signed through the current open standards (ODF 1.4, PDF 2.0 with PDF/UA-2, long-term signature profiles) ref egwalker-eurosys25

frontier (T-FRONT-DOC), dated by SB-DOCFORMAT = 2026-09 ATTESTED. A document whose evolution is the verifiable object: content-addressed changes linked by causal dependencies, converging deterministically, with independently auditable evidence of when each version was published, signed for the long term with post-quantum signatures, and no server or chain in the trust path of reading it ref arxiv-collab-editing

Rung	Role	Toward	Stands on	Why
UD1	substrate	T-BIC-DOC	-	the unified page is the surface every document, native or foreign, is shown through
UD2	substrate	T-BIC-DOC	UD1	the registry rows are how a kind reaches the page
UD3	substrate	T-BIC-DOC	UD1	one URL per document is where a version, its history and its signature are presented
UD4	arm	T-BIC-DOC	-	native form submission makes the page interactive without a script
UD5	substrate	T-BIC-DOC	UD1	list, quote and code blocks are structure the interchange standards expect a document to carry
UD6	arm	T-BIC-DOC	UD1	painted page layout is the print path the tagged PDF export stands beside
UD7	arm	T-BIC-DOC	UD3	the operating system's document window is a second native surface over the same model
UD8	contender	T-BIC-DOC	UD3	co-editing wired into the office is the best-in-class behaviour itself: concurrent edits that converge
UD9	substrate	T-BIC-DOC	UD4	one render core is what makes a document look the same on every native surface
UD10	arm	T-BIC-DOC	UD3,legalpractice:LP30 OPEN,legalpractice:LP31 OPEN	the law panel states what the document needs and triangulates the format's legal semantics without competing for the number
UD11	substrate	T-FRONT-DOC	UD1	canonical content-addressed records are what the frontier's methods consume: nothing is notarised or merged by identity until a document has one
UD12	contender	T-BIC-DOC	UD11	its done-rule is the best-in-class behaviour: deterministic merge with history kept beside plain state
UD13	contender	T-FRONT-DOC	UD11	its done-rule is the frontier target: a signed, publicly provable evolution with post-quantum signatures
UD14	arm	T-BIC-DOC	UD11,legalpractice:LP15 UNRESOLVED(organ-unreadable)	interchange through the open standards is how the format is used outside the estate
UD15	substrate	T-BIC-DOC	UD11	the page and the office reading and writing the container is what makes it the working format rather than an export
UD16	arm	T-FRONT-DOC	UD11	typed semantics inside a content-addressed block are what make a legal document's meaning, not only its bytes, verifiable

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Document page layer: sheet geometry, typography and print sheet from a data file (UD17) after UD1	ud_doc_layer	nx_unidoc_lib reads knowledge/doc_page.conf (rows key, css value, kind, grounds) on every render and draws every document as a sheet on a desk: each safe row becomes the stylesheet variable --doc-<key>, the print page box and the shipped font faces are written from the same rows, and no dimension lives in code. The sheet is US Letter written as size 8.5in 11in with a 1in letter margin as the paged-media standard's own examples write it [css-page-3], the margin Word gives every page by default [ms-word-margins], at a leading that is one of the four line spacings Google Docs offers [gdocs-spacing]; every row the file marks unmeasured is derived from measured published document pages by nx_ui_audit or keeps its literal with the absence of evidence named; gate: the page carries the variables read from the file, a changed row changes the page without a rebuild, an unsafe or malformed row is refused by name and never half-drawn, the print box keeps the sheet size, and the page still carries no script	Organ	1 u

Rung	Role	Toward	Stands on	Why
UD17	substrate	T-BIC-DOC	UD1	the sheet every document kind is drawn and printed on, at the page size, margin and line spacing the incumbent editors give a document by default, is what the page shows a native or foreign document through

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
The event-graph text merge engine: concurrent edits converge for any delivery order (UD18)	uxm_merge	nx_uxf_merge_lib keeps a document as plain text beside an event graph: every insert and delete carries its id (agent, sequence) and the version it was made at (its parent events); a local edit applies directly, and a remote event whose parents equal the current version applies directly too; otherwise the library walks back from the current version and the new event to the last single common event, replays only the events after it into a temporary sequence-CRDT state (a prepare state and an effect state per record, retreat and advance between branches, the FugueMax integration order with the agent id as the tie-break) over a placeholder for the common text, emits the new event's effect on the text and discards the state; an event delivered before its parents waits and applies when they arrive; gate nx_uxf_merge_gate: two and three replicas converge under every delivery permutation of a fixed event set, concurrent inserts at one position resolve to one hand-derived order everywhere and two concurrently typed runs never interleave, a delete of concurrently inserted text and a concurrent delete of one character both resolve, re-delivery is idempotent and a reused id with other content is refused by name, the incremental merge equals a full replay from the root, a linear history never replays, a branch after a long shared prefix replays only the branch, and named negative controls show that applying raw positions diverges and that whole-document last-writer-wins loses text on the same fixture	Organ	2 u
A sync relay carries events between the clients of one document (UD19) after UD18	uxs_relay	A relay daemon over the sovereign HTTP stack keeps each document's event log append-only, accepts events from clients and answers each client with the events it lacks given the version it names, so every client merges through uxm_merge and the relay never transforms anything; it extends the incumbent relay lane in nx_coedit serve (cd_live_sync, which relays RGA op lines) instead of standing beside it, and nx_coedit is retired onto it through the lifecycle once its gates re-run; every request is bracketed by sys_arena_mark and sys_arena_reset; gate: three clients converge through the relay, a client that reconnects naming an old version receives exactly the events it lacks, a duplicate post is idempotent, an event posted to another document is refused by name, and steady-state address-space growth over a run of requests is zero pages	Organ	3 u
Presence and remote cursors (UD20) after UD18,UD19	uxm_cursor_transform	A cursor or selection is a position at a named version and is carried to the current text by the same replay that carries an insert, so it stays beside the same character after concurrent edits on any replica; presence frames (agent, display name, colour index, cursor) travel through the relay, are never events and never change the document identity, and expire after an idle interval derived from the relay heartbeat cadence; gate: a cursor placed after a character stays after it when a concurrent insert lands before it elsewhere, a selection whose text is deleted collapses to the deletion point, a frame older than the derived interval is dropped, and the identity is unchanged by any number of presence frames	Organ	1.5 u
Comments and suggested edits anchored to the text (UD21) after UD16,UD18	uxm_suggest	A comment is a range anchored to character ids (the marks of UD16) that survives edits inside and around it and is reported orphaned, never silently dropped, only when all of its text is deleted; a suggested edit is a branch of events in the same graph that accept merges and reject discards, each decision itself an event naming who decided; gate: a comment range survives a concurrent insert inside it and a delete beside it, an orphaned comment is listed, accepting a suggestion yields the same text as having typed it, rejecting leaves the text byte-identical to the main line, and two concurrent suggestions over one range are both kept as alternatives	Organ	3 u
Per-document permissions: owner, editor, commenter, viewer (UD22) after UD19	uxs_acl_check	Roles are data on the document (an access record whose changes are themselves events), the relay checks every incoming event against the role of its authenticated agent (the estate session header, never a cookie) and refuses by name: a viewer reads only, a commenter adds comment events only, an editor adds text events, an owner changes roles; a revoked editor's later events are refused while the events accepted before the revocation stay in the history; gate: each role's allowed and refused event kinds with the refusal naming the rule that fired, a revocation that removes no history, and a positive control that an editor's event is accepted	Organ	2 u
Offline edits that merge on reconnect (UD23) after UD18,UD19	uxm_since	A client keeps its unsent events with the document (a native container attachment or a side log); on reconnect the client and the relay exchange versions, each sends what the other lacks (uxm_since answers the events after a version), and the merge replays only the concurrent span of the two branches; gate: two replicas that each edit offline for a run of events reconnect and converge to the text an always-online replica reaches from the same events, the replay zone covers the two branches and not the shared history, no event is lost or duplicated, and unsent events survive a restart of the client	Organ	2 u

Milestones

Milestone	Rungs	Cumulative
U5 · Several people edit one document at once	UD18,UD19,UD20,UD21,UD22,UD23	49 u

Rung	Role	Toward	Stands on	Why
UD18	contender	T-BIC-DOC	-	its done-rule is the best-in-class merge behaviour itself, the peer-reviewed event-graph method that keeps history beside plain text, measured by convergence under every delivery order
UD19	substrate	T-BIC-DOC	UD18	the relay is how events reach every client of one document; it carries and never transforms
UD20	arm	T-BIC-DOC	UD18,UD19	presence and cursors make concurrent editing usable without competing for the merge number
UD21	arm	T-BIC-DOC	UD16,UD18	comments and suggestions are the review layer the incumbent editors give a shared document, built on the same event graph
UD22	substrate	T-BIC-DOC	UD19	permissions are what make a shared legal document safe to open to a client
UD23	contender	T-BIC-DOC	UD18,UD19	merging long offline branches without a server is the target's own statement and the method's measured strength

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Document outline: auto-numbered clauses, a navigation pane and live cross-references (UD24) after UD17	dst_find_clause	nx_doc_structure_lib derives the outline from the document's own headings: every heading gets a stable anchor and a clause number, the page carries a navigation pane beside the sheet on wide screens and a collapsed Contents block on phones (zero script, a details element), and a written reference such as Article 4 or Section 2.1 becomes a link to its heading; gate: anchors unique and deterministic, numbering matches the heading order, a reference to a missing clause is reported by name and never linked, the pane is hidden in print, and the page still carries no script	Organ	1 u
Defined terms: every definition detected and every use linked back (UD25) after UD24	dst_defs_collect	nx_doc_structure_lib finds each definition written in the drafting convention (the "Term") or "Term" means, gives it an anchor, links every later use of the exact term to its definition, and reports terms used before definition, defined but never used, and defined twice; gate: known-answer counts on a fixture will, a capitalised word that is not a defined term is never linked, a term inside another word is never linked, hostile text in a term is escaped, and the report names every finding	Organ	1 u

Rung	Role	Toward	Stands on	Why
UD24	substrate	T-BIC-DOC	UD17	structure every exceed feature on a legal document hangs from (outline, numbering, references); all three rivals have a navigation pane, none links typed clause references in a legal instrument
UD25	contender	T-BIC-DOC	UD24	defined-term linking and the misuse report are what a legal reader needs and none of the three general editors does natively

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Discrete pages laid out by the estate from real font metrics (UD26) after UD17	dpag_plan	nx_doc_paginate_lib parses knowledge/doc_page.conf into milli-points, measures every word with the shipped face's hmtx advances through nx_ttf_fontlib, breaks paragraphs by Knuth-Plass total fit with greedy first-fit kept as the oracle, stacks lines into the text box with collapsing gaps, keep-with-next, widow and orphan control and unsplit table rows, and emits one zero-script sheet per page with a Page N of M footer; gate: hand-computed widths from the Times metrics, every line re-measured inside its measure, Knuth-Plass never dearer than greedy and equal to a brute-force enumeration, a hand page count, keep-with-next and widow and orphan control each bite, rows never split, the dry byte count equals the written bytes, and a width-ignorant fixed-pitch breaker overflows where Knuth-Plass fits	Organ	2 u

Rung	Role	Toward	Stands on	Why
UD26	substrate	T-BIC-DOC	UD17	discrete pages are how Word and Google Docs show a document by default; page numbers, print fidelity and the page references of the outline (UD24) stand on this plan

best-in-class (T-BIC-LEGALDOC), dated by SB-LEGALDOC = 2026-09 ATTESTED. What the three incumbent editors give a legal draft in October 2026, from their own pages: real-time co-authoring with presence (Word, Google Docs; LibreOffice Writer opens a document for one writer at a time), suggestions and tracked changes with accept and reject (all three), compare and combine of two versions by characters (Word, LibreOffice), version history (Google Docs, LibreOffice), an outline or table of contents (all three), cross-references and field-driven conditional text (Word, LibreOffice), tagged PDF with PDF/UA (LibreOffice) or structure tags (Word), e-signature with an audit trail page (Google Docs) or certificate signatures (Word, LibreOffice), offline work (Google Docs), and AI drafting whose edits are previewed before they apply (Word, Google Docs) ref ms-track-changes

frontier (T-FRONT-LEGALDOC), dated by SB-LEGALDOC = 2026-09 ATTESTED. AI and human edits to a legal instrument that cannot silently corrupt it: every edit is checked against an explicit graph of the instrument's clauses, defined terms and references before it lands, versions are compared by clause and term identity instead of by characters, and each change is judged by its legal failure mode with one decisive defect setting the verdict ref arxiv-doc-editing

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Clause-aware legal redline between two versions (UD27) after UD11,UD24,UD25	drl_redline	nx_doc_redline_lib compares two versions of a native document by clause identity (the anchors and numbers of UD24) and defined-term identity (UD25) instead of by characters: a moved clause is one move, a renumbering alone is no substantive change, a defined-term rename is one change that names every use site, an edit inside a clause is a character redline confined to that clause, and the zero-script redline page names both version identities; Word and LibreOffice compare and combine by characters [ms-compare] [lo-compare]; gate: a fixture will and its revision yield exactly the hand-derived change list (one move, one rename with its use count, one inserted clause, zero changes from renumbering), the same pair always yields the same list, a version whose bytes do not verify is refused by name, and a negative control shows a character diff of the same pair reporting the renumbering as a change on every clause it touched	Organ	2.5 u
AI edits held to the document's structure before they can be accepted (UD28) after UD21,UD24,UD25	dgd_check	nx_doc_aiguard_lib takes an AI-proposed edit as a suggestion (the branch events of UD21) with a declared target span and checks it against the document's structure graph (the clauses and references of UD24, the defined terms of UD25) before it can be accepted: every changed byte lies inside the declared span, no defined term, reference target, party name, amount or date outside the span changes, and a reference the edit breaks is named; a failing suggestion is refused by name and never applied; Word and Google Docs make AI edits reviewable but their pages describe no check of what an edit touched [ms-copilot-word] [gws-gemini-apr26], and frontier models silently corrupt long documents under delegation [arxiv-doc-editing]; gate: planted model outputs that rename a defined term outside the span, delete a clause a reference points to, and change an amount outside the span are each refused naming what was touched, an in-scope edit is accepted and its diff equals its declared span, and a negative control shows that applying the same outputs unchecked changes the term and reference report	Organ	2 u
Reproducible document assembly with the law behind each clause (UD29) after UD11,UD16,UD10	das_assemble	nx_doc_assemble_lib assembles an instrument from a native template whose blocks carry typed fields and conditions (the field keys of UD16): a validated answer set selects clauses deterministically, each conditional clause names its condition and, where the law engine demands it, the law row behind it (the answer UD10 composes), and the assembled document carries the template identity and the answer set as an attachment so it re-assembles to the same identity; Word fields and LibreOffice conditional text select text, and their pages describe neither keeping the answers nor naming why a clause is there [ms-fieldcodes] [lo-condtext]; gate: one answer set assembles to the same identity twice, changing one answer changes exactly the clauses whose conditions read it, a missing or mistyped required answer is refused by name, and every statutory clause names its law row	Organ	3 u
An audit trail bound to the document that a third party verifies offline (UD30) after UD11,UD19,UD22	dau_chain	nx_doc_audit_lib records every view, edit, comment, suggestion decision, signature and export of a document as an append-only event naming the actor, the version identity and the hash of the event before it, and exports an audit report that verifies from the report alone with no server; Google Docs appends an audit trail page to a completed signature request and Microsoft Purview keeps an administrator log retained 180 days by default [gdocs-esign] [ms-purview-audit]; gate: a fixture history verifies, a deleted, reordered or altered event is refused naming its position, an event naming a version that does not exist is refused, the exported report re-verifies with no server, and every relay request that touches the document leaves exactly one event	Organ	2 u
Clause index across the vault with stale-clause recall (UD31) after UD11,UD24	dci_query	nx_doc_clause_index_lib indexes every clause block of every vault document by its content identity and a normalised text fingerprint, answers which documents carry a given clause and at which version, and when a template clause is superseded lists every document still carrying the old one; Copilot and Workspace Intelligence search a tenant's files by prompt, not by clause identity [ms-copilot-privacy] [gws-gemini-apr26], LibreOffice AutoText stores reusable text for insertion [lo-autotext], and none of the three pages describes finding every document that uses a clause; gate: a fixture vault of documents sharing clauses returns exactly the documents and versions for each clause, a superseded template clause lists exactly the stale documents, a private document never appears in another tenant's answer, and an index rebuilt from scratch equals the incremental one	Organ	2 u

Milestones

Milestone	Rungs	Cumulative
U6 · Exceed the incumbent editors on legal documents	UD27,UD28,UD29,UD30,UD31	60.5 u

Rung	Role	Toward	Stands on	Why
UD27	contender	T-BIC-LEGALDOC	UD11,UD24,UD25	its done-rule is a redline the incumbents' character compare cannot produce: moves, renumbering and term renames read as what they are
UD28	contender	T-FRONT-LEGALDOC	UD21,UD24,UD25	its done-rule is the frontier target itself: no AI edit lands until the structure graph shows it touched only its declared span
UD29	contender	T-BIC-LEGALDOC	UD11,UD16,UD10	assembly that re-derives the same instrument from its answers and names the law behind each clause beats field-driven conditional text on a legal document
UD30	contender	T-BIC-LEGALDOC	UD11,UD19,UD22	an offline-verifiable trail of every action on the document beats a signature audit page and an administrator log bounded by licence
UD31	arm	T-BIC-LEGALDOC	UD11,UD24	clause-identity search across the vault triangulates the format's content addressing on real practice work without competing for the editing number

Milestones

Milestone	Rungs	Cumulative
U7 · The document reads like a legal instrument: estate-laid pages, an outline, clause and defined-term links	UD24,UD25,UD26	64.5 u

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Words in this document: the legal words a document uses, marked at first use and explained beside it (UD32) after UD33,UD27	udw_marks	nx_unidoc_words_lib marks the first use of each word the Nishi Lexicon explains (the IRS estate terms, the federal courts' glossary in its general sense, and the dictionary senses that WordNet's own domain_topic relation files under law, chosen by knowledge/lexicon/view.conf with a calibrated least share of law senses) in the sheets and the phone copy, and lists every one in reading order in a panel with its sources' definitions, similar words and credits, the document's own definitions and references taking precedence; a reading interface that contextualizes ambiguous contract language with definitions while always foregrounding the original binding text made Terms of Service significantly easier to read and navigate in a within-subjects study (N=20) [termsight-2026]; gate: nx_unidoc_words_gate -- a sense outside the view never explains a word, a word whose law senses fall short of the share is not marked, a use inside a longer explained use is not marked while the later standalone use is, both renderings carry the marks, the panel escapes and credits, and without a view or an explained word the page is the viewer's byte for byte	Organ	2 u
The Nishi Lexicon: dictionary, thesaurus and legal glossaries as one estate store with an MCP tool (UD33) after UD11	lx_lookup	nx_lexicon_lib keeps sorted stores of one row schema (term, part of speech, sense, domain, definition, synonyms, antonyms, example, source) searched by binary search, finds base forms through WordNet's irregular forms and morphy rules of detachment in their part of speech, scans a text for the terms a store holds (longest first, inflected uses included), and opens the sources a conf declares with every unreadable or unsorted source counted; nx_lexicon_lmf_lib ingests a WN-LMF wordnet with synonyms, antonyms, examples and each sense's domain from its domain_topic relation; nx_lexicon serves define, legal, synonyms, antonyms, lemma, scan, sources and the ingests on the MCP surface with a credit line per source; gate: nx_lexicon_gate -- fixture known answers for the store, the lookup and its negative controls, both ingests with every unresolved reference counted, the scan and the sources, and real-data teeth pinned to the ingested stores	Organ	3 u
Plain-language measures for a legal draft, reported per clause (UD34) after UD33	plg_measure	nx_plainlang_lib measures each clause of a draft: sentence length, passive constructions, shall where an obligation reads must, and legalese that a sourced data table pairs with a plain alternative (the federal plain-language guidelines, read and pinned first), reporting numbers per clause and no verdict until a threshold is calibrated on real drafts; gate: fixture clauses with hand-counted answers, plain text reading zero, and every suggestion naming its source row	Organ	2 u
Focus and paper modes for a document page, zero script (UD35) after UD17	ud_paper_css	a focus control that dims every clause except the one targeted or in focus (CSS :has and :target), and a paper mode for e-ink and slow-refresh screens chosen by the media query update: slow and by a reader toggle (black on white, no motion, heavier strokes), every value from knowledge/doc_page.conf; gate: the emitted CSS references every paper token it defines, the page carries no script, and update: slow selects the same declarations as the toggle	Organ	1 u
A Nishi text face for documents (UD36)	_ABSENT_:nfont_text_set	the sovereign-font ladder (nx_font_ttf_emit carries .notdef, space, H, I and T today) grown to the Latin text set a will and a trust use, re-parsed and checksummed like the R2 emitter, and compared for legibility against a published legibility study read and pinned first; gate: every glyph of the set present, metrics and checksums verified by re-parse, and the measured legibility comparison against the incumbent face	Organ	5 u

Rung	Role	Toward	Stands on	Why
UD32	contender	T-BIC-LEGALDOC	UD33,UD27	a panel that explains the legal words of the document in reading order from named sources, beside the binding text, is the reader-side exceed candidate; the incumbents' own dictionary and thesaurus pages are owed a census before the matrix row is graded
UD33	substrate	T-BIC-LEGALDOC	UD11	the store, lookup, word forms and scan every reading aid consumes
UD34	contender	T-BIC-LEGALDOC	UD33	clause-level plain-language measures from sourced rules beside a draft
UD35	arm	T-BIC-LEGALDOC	UD17	reading comfort on paper-like screens triangulates legibility without competing for the editing number
UD36	substrate	T-BIC-LEGALDOC	-	the face every page and export draws its text with

Rung	Closes with	Definition of done (pre-declared)	Executor	Est.
Word-processor editing in the browser, emitted by the estate (UD37) after UD1,UD17	ude_page	nx_unidoc edit emits an editing page for any document the unified page reads (nx_unidoc_edit_lib, on the viewer's own paper and tokens, settings from knowledge/doc_editor.conf): the estate's own client (web_assets/nishi_editor.js, loaded by a content-versioned URL under script-src self, no third-party code) edits headings, paragraphs, bold, italic, underline, bulleted and numbered lists and tables, keeps undo and redo, find and replace, paste from Word and Google Docs reduced to the document's own marks, the shortcuts those editors use and an outline, writes the page back to the office spec with inline marks as R lines, and keeps a draft in the reader's browser behind a restore banner; every viewer page links to its editor (edit=); gate: nx_unidoc_edit_gate renders the spec's marks, lists and tables to hand-written HTML, refuses unknown lines and bad runs by name, carries one self-only script and no inline handler, pins the content version, and keeps the find bar and banner hidden on load; journeys: nx_cdp_capture journey editor-will (33 steps), editor-trust and editor-poa (12 steps each) pass on a phone and a desktop door	Organ	2 u
The browser editor saves to the firm: versions, compare and a Word download (UD38) after UD37,UD15,UD22	_ABSENT_:ude_save	the editing page posts its spec to the office as a new native container version naming its parent (UD15), lists the versions, opens the clause-aware redline between any two (UD27) and downloads the current version as Word (UD14); gate: a save reopens with the new identity and names its parent, a save whose parent is no longer current is refused by name and offered the merge, a viewer-role session cannot save, and the download opens in an outside reader	Organ	2 u

Rung	Role	Toward	Stands on	Why
UD37	contender	T-BIC-LEGALDOC	UD1,UD17	editing in the browser with the shortcuts and paste a Word or Google Docs user expects, written back to the firm's own format, is what the editing number is measured against
UD38	contender	T-BIC-LEGALDOC	UD37,UD15,UD22	a save that names its parent version and refuses a stale write is what lets browser edits become the firm's record

Ladder verdict. LADDERED. Targets, rung roles and bars are counted in the tables below, each partition re-derived beside its total. Bars read FRESH against the current month 2026-10.

Ladder verdict, counted (17 rows, more than the 12-row disclosure bar)

Ladder verdict, counted
Class	Count	Note
targets	4	sotatarget rows on the plan
best in class	2	targets whose class is best-in-class, by code
frontier	2	targets whose class is frontier, by code
undated	0	targets naming no bar that exists
bad class	0	targets whose class is neither word
duplicate	0	target ids an earlier row already carries
rungs	38	rung rows on the plan
placed	38	rungs carrying a rungrole row
unplaced	0	rungs with no role toward any target
bad role	0	rungrole rows naming a role the ladder does not know
bad target	0	rungrole rows naming a target no sotatarget row declares
rungs, summed	38	RECONCILED: the parts sum to the total 38
substrate	14	what the target's own methods consume
arm	10	a sovereign arm that triangulates without competing for the number
contender	14	its done-rule is a number against the target
superseded	0	kept as capability, retired as a claim
placed, summed	38	RECONCILED: the parts sum to the total 38

Bar freshness, counted
Class	Count	Note
bars	2	sotabar rows on the plan
fresh	0	the bar month is the current month
attested	2	an older bar with a this-month barscan reporting no newer entry
stale	0	a this-month scan saw a newer month the bar ignores
unattested	0	nobody looked this month
malformed	0	a sotabar row missing a field
duplicate	0	bar ids an earlier row already carries
bars, summed	2	RECONCILED: the parts sum to the total 2
current month	2026-10	the month every bar is judged against

Treatment verdict. NOT DECLARED. No rung on this board declares its three-step treatment (a treat row naming the MCP row, the API route, the primitive it composes, the workflow that composes it and the agent beat that runs it); the ranker labels every rung TREATMENT-UNDECLARED until it does.

Inspect a rung and its prerequisites

Declared nodes 38. Rank input binding: STALE_OR_INVALID_BINDING. Dependency order is authored. Implementation, acceptance evidence, authority and resource readiness are unverified. No action is recommended or dispatched here.

Plan SHA-256 845b9da3d7da93612c06d3eeaa9b11138ea4f73819c46dbe2e4bdd86f353adf4. Target rows 4; role rows 38. Existing risks and release worklog retain their own scope; no node completion is inferred.

Runtime observation coverage: 0 of 38 rungs have current, identity-bound execution observations. Observation may report RED. Accepted completion remains unknown; source presence, qualification and deployment do not establish it.

Use Enter or Space on a rung to inspect its contract. Prerequisite links locate another rung in this list; open its summary to inspect it. Estimates are authored effort, not forecasts.

UD1 — The unified document page as an organ with its gate
Prerequisites: None declared; this does not establish execution eligibility.
Contract: ud_render_path
Acceptance: nx_unidoc_lib folds docx, odt, pdf, md, csv and txt to the office document model through the promoted spec verbs and emits one zero-script page with a fail-closed CSP, escaped text and the portal's forms only with a base; nx_unidoc exposes the registry renderer interface; nx_unidoc_gate proves the escape fires and stays silent, the CSP is present, a web page is refused by name, determinism, csv quoting, and a genuine Word document through the promoted organ -- LANDED 2026-09-03
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD2 — The unified page registered as the renderer for the kinds nothing served
Prerequisites: UD1 (acceptance unverified)
Contract: dv_lookup
Acceptance: knowledge/doc_viewers.conf gains txt and odt rows pointing at _offc/nx_unidoc.elf and the browser document gate is re-run against them; gate: nx_doc_view routes a .txt and a .odt to the unified page and the browser paints it inline
Authored effort: 0.5. Executor kind: Deploy. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD3 — One URL per vault document served by the portal daemon
Prerequisites: UD1 (acceptance unverified)
Contract: dad_unidoc
Acceptance: nx_docportal_admin_daemon serves GET /doc/<cid> through ud_render_path with the portal base so the original, versions, annotate and sign forms post back to the daemon, and POST /doc/<cid>/annotate and /sign compose nx_ann_add and of_sign_version; gate: a cross-tenant cid is 404, a no-consent sign is refused, the page carries no script
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD4 — The Nishi browser submits the document page's forms natively
Prerequisites: None declared; this does not establish execution eligibility.
Contract: br_form_submit
Acceptance: nx_browser serialises a form's fields on submit and POSTs them over its own HTTP stack, then paints the response; gate: the browser document gate gains a form leg that posts a note to the fixture server and reads it back
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD5 — List, quote and code blocks in the shared document model
Prerequisites: UD1 (acceptance unverified)
Contract: ud_list_block
Acceptance: The model gains L (list item), Q (quote) and C (code) lines, the unified page renders them, the office editor round-trips them and the Markdown folder emits them; gate: a Markdown list renders as a list element and the office save keeps the L lines
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD6 — PDF page layout painted, not only reflowed
Prerequisites: UD1 (acceptance unverified)
Contract: pf_page_layout
Acceptance: Positioned text runs with their fonts and embedded images painted per page through the sovereign renderer; gate: a two-column PDF keeps its columns and a figure is present, measured by nx_struct_diff against a PDF.js capture
Authored effort: 4. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD7 — NishiOS opens the portal index as its document window
Prerequisites: UD3 (acceptance unverified)
Contract: nd_portal_index
Acceptance: nx_nishios_docview lists the vault's documents in the NISHI DOCS window and opens one on selection through the linked unified page; gate: the boot image lists two documents and opens the selected one
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD8 — Co-editing wired into the office
Prerequisites: UD3 (acceptance unverified)
Contract: of_coedit
Acceptance: Shared contract with legalpractice LP14: nx_office_serve imports nx_coedit and two browsers converge on one version; gate: the coedit live gate runs against the office route
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD9 — One render core for the browser, the reader and NishiOS
Prerequisites: UD4 (acceptance unverified)
Contract: br_one_core
Acceptance: Shared contract with the browser board's BR29: the promoted Linux browser paints through the shared render core so the NAS census grades the same pixels the daily driver paints; gate: the same document page renders bit-identical through nx_browser and nx_browser_render
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD10 — The document page states what the law requires of this instrument
Prerequisites: UD3 (acceptance unverified)
Contract: ud_law_panel
Acceptance: ud_page renders, for a document with an instrument class and a signer place, a requirements panel built from the law engine's answer (the element set of legalpractice LP30, or the several-places set of LP32 when more than one state is involved): each element, whether the record satisfies it, the law id, the section and the pin of the row that demands it, and the day the row was read; the sign form is emitted only when that answer permits a ceremony for that place and class, otherwise the panel names what is missing or states that this instrument is signed on paper before witnesses; gate: a Utah trust page offers the electronic ceremony with its sections named, a deed page offers none, an unclassified document shows the strictest panel, and the page still carries no script
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD11 — The native document container: canonical content-addressed records under the UXF document profile
Prerequisites: UD1 (acceptance unverified)
Contract: uxd_open
Acceptance: nx_uxf_doc_lib holds a document as a manifest and blocks, each a canonical NXR1 record under the envelope's document profile, the document's identity the manifest's CID; a container (the manifest, every distinct block once in first-reference order, then attachments that name the document and are not part of its identity) is verified on open with named refusals; unknown keys are preserved and a key that begins with a bang is must-understand and refused when unknown; a version names its parents by CID; the office spec lines are the first import and export projection; nx_uxf_doc is the tool (verify, from-spec, import, to-spec, docx, set); gate nx_uxf_doc_gate: a changed byte is refused and names the reference it broke, a truncated, foreign, orphaned or misattached container is refused by name, an unknown field survives an edit, the spec round trip is byte-identical -- LANDED 2026-10-03, awaiting acceptance
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD12 — Concurrent versions merge to one identity
Prerequisites: UD11 (acceptance unverified)
Contract: uxd_merge
Acceptance: Two versions that name a common ancestor merge deterministically: a block changed on one side is taken, a block changed on both converges at character level with the history kept beside the materialised text and replayed only for the concurrent span, and the result names both parents; gate: two edits to different blocks merge to the same identity in either order, two edits to one block converge to one text on both sides, and a merge with an unrelated document is refused
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD13 — A version is signed and its publication is provable
Prerequisites: UD11 (acceptance unverified)
Contract: uxd_sign
Acceptance: A signature attachment over the manifest CID carrying a classical and a post-quantum signature composed from the estate's hybrid signer, and a publication record that makes the version's existence at a time independently auditable, so the evolution of the document is the notarised object and not a snapshot of it; gate: a signed version verifies, a changed byte anywhere fails verification and names the block, a signature moved to another version is refused, and either signature failing alone is reported by name
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD14 — Structure-carrying export and import: Word, ODF 1.4 and tagged PDF for print
Prerequisites: UD11 (acceptance unverified)
Contract: uxd_export
Acceptance: Headings, tables and marks survive into a Word package and an ODF 1.4 package and back, print goes through the sovereign PDF writer as an archival tagged PDF, and every target declares a loss ledger naming what it cannot carry; gate: a round trip through each target returns the same identity or names every lost key, an outside reader opens each export, and the loss ledger of a target that drops nothing is empty
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD15 — The unified page and the office open and save the native container
Prerequisites: UD11 (acceptance unverified)
Contract: ud_kind_nxd
Acceptance: The unified page gains the native kind (a doc_viewers.conf row and a fold through the container's own projection), the office saves each version as a container whose manifest names its parent, and the portal serves the container beside the original bytes; gate: the browser paints a container as the same zero-script page, an office save reopens with the same identity, and a tampered container is refused on the page by name
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD16 — Inline marks, lists, fields and legal semantics as typed block keys
Prerequisites: UD11 (acceptance unverified)
Contract: uxd_marks
Acceptance: Ranges anchored inside a block's text for emphasis, defined terms and cross-references, list and quote blocks, typed merge fields, signature blocks, and the instrument class and jurisdiction on the manifest, every one an optional key an older reader preserves; gate: a marked range survives an edit elsewhere in the block, a defined term used and never defined is named, and a reader that does not know a key round-trips it unchanged
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD17 — Document page layer: sheet geometry, typography and print sheet from a data file
Prerequisites: UD1 (acceptance unverified)
Contract: ud_doc_layer
Acceptance: nx_unidoc_lib reads knowledge/doc_page.conf (rows key, css value, kind, grounds) on every render and draws every document as a sheet on a desk: each safe row becomes the stylesheet variable --doc-<key>, the print page box and the shipped font faces are written from the same rows, and no dimension lives in code. The sheet is US Letter written as size 8.5in 11in with a 1in letter margin as the paged-media standard's own examples write it [@css-page-3], the margin Word gives every page by default [@ms-word-margins], at a leading that is one of the four line spacings Google Docs offers [@gdocs-spacing]; every row the file marks unmeasured is derived from measured published document pages by nx_ui_audit or keeps its literal with the absence of evidence named; gate: the page carries the variables read from the file, a changed row changes the page without a rebuild, an unsafe or malformed row is refused by name and never half-drawn, the print box keeps the sheet size, and the page still carries no script
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD18 — The event-graph text merge engine: concurrent edits converge for any delivery order
Prerequisites: None declared; this does not establish execution eligibility.
Contract: uxm_merge
Acceptance: nx_uxf_merge_lib keeps a document as plain text beside an event graph: every insert and delete carries its id (agent, sequence) and the version it was made at (its parent events); a local edit applies directly, and a remote event whose parents equal the current version applies directly too; otherwise the library walks back from the current version and the new event to the last single common event, replays only the events after it into a temporary sequence-CRDT state (a prepare state and an effect state per record, retreat and advance between branches, the FugueMax integration order with the agent id as the tie-break) over a placeholder for the common text, emits the new event's effect on the text and discards the state; an event delivered before its parents waits and applies when they arrive; gate nx_uxf_merge_gate: two and three replicas converge under every delivery permutation of a fixed event set, concurrent inserts at one position resolve to one hand-derived order everywhere and two concurrently typed runs never interleave, a delete of concurrently inserted text and a concurrent delete of one character both resolve, re-delivery is idempotent and a reused id with other content is refused by name, the incremental merge equals a full replay from the root, a linear history never replays, a branch after a long shared prefix replays only the branch, and named negative controls show that applying raw positions diverges and that whole-document last-writer-wins loses text on the same fixture
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD19 — A sync relay carries events between the clients of one document
Prerequisites: UD18 (acceptance unverified)
Contract: uxs_relay
Acceptance: A relay daemon over the sovereign HTTP stack keeps each document's event log append-only, accepts events from clients and answers each client with the events it lacks given the version it names, so every client merges through uxm_merge and the relay never transforms anything; it extends the incumbent relay lane in nx_coedit serve (cd_live_sync, which relays RGA op lines) instead of standing beside it, and nx_coedit is retired onto it through the lifecycle once its gates re-run; every request is bracketed by sys_arena_mark and sys_arena_reset; gate: three clients converge through the relay, a client that reconnects naming an old version receives exactly the events it lacks, a duplicate post is idempotent, an event posted to another document is refused by name, and steady-state address-space growth over a run of requests is zero pages
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD20 — Presence and remote cursors
Prerequisites: UD18 (acceptance unverified), UD19 (acceptance unverified)
Contract: uxm_cursor_transform
Acceptance: A cursor or selection is a position at a named version and is carried to the current text by the same replay that carries an insert, so it stays beside the same character after concurrent edits on any replica; presence frames (agent, display name, colour index, cursor) travel through the relay, are never events and never change the document identity, and expire after an idle interval derived from the relay heartbeat cadence; gate: a cursor placed after a character stays after it when a concurrent insert lands before it elsewhere, a selection whose text is deleted collapses to the deletion point, a frame older than the derived interval is dropped, and the identity is unchanged by any number of presence frames
Authored effort: 1.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD21 — Comments and suggested edits anchored to the text
Prerequisites: UD16 (acceptance unverified), UD18 (acceptance unverified)
Contract: uxm_suggest
Acceptance: A comment is a range anchored to character ids (the marks of UD16) that survives edits inside and around it and is reported orphaned, never silently dropped, only when all of its text is deleted; a suggested edit is a branch of events in the same graph that accept merges and reject discards, each decision itself an event naming who decided; gate: a comment range survives a concurrent insert inside it and a delete beside it, an orphaned comment is listed, accepting a suggestion yields the same text as having typed it, rejecting leaves the text byte-identical to the main line, and two concurrent suggestions over one range are both kept as alternatives
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD22 — Per-document permissions: owner, editor, commenter, viewer
Prerequisites: UD19 (acceptance unverified)
Contract: uxs_acl_check
Acceptance: Roles are data on the document (an access record whose changes are themselves events), the relay checks every incoming event against the role of its authenticated agent (the estate session header, never a cookie) and refuses by name: a viewer reads only, a commenter adds comment events only, an editor adds text events, an owner changes roles; a revoked editor's later events are refused while the events accepted before the revocation stay in the history; gate: each role's allowed and refused event kinds with the refusal naming the rule that fired, a revocation that removes no history, and a positive control that an editor's event is accepted
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD23 — Offline edits that merge on reconnect
Prerequisites: UD18 (acceptance unverified), UD19 (acceptance unverified)
Contract: uxm_since
Acceptance: A client keeps its unsent events with the document (a native container attachment or a side log); on reconnect the client and the relay exchange versions, each sends what the other lacks (uxm_since answers the events after a version), and the merge replays only the concurrent span of the two branches; gate: two replicas that each edit offline for a run of events reconnect and converge to the text an always-online replica reaches from the same events, the replay zone covers the two branches and not the shared history, no event is lost or duplicated, and unsent events survive a restart of the client
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD24 — Document outline: auto-numbered clauses, a navigation pane and live cross-references
Prerequisites: UD17 (acceptance unverified)
Contract: dst_find_clause
Acceptance: nx_doc_structure_lib derives the outline from the document's own headings: every heading gets a stable anchor and a clause number, the page carries a navigation pane beside the sheet on wide screens and a collapsed Contents block on phones (zero script, a details element), and a written reference such as Article 4 or Section 2.1 becomes a link to its heading; gate: anchors unique and deterministic, numbering matches the heading order, a reference to a missing clause is reported by name and never linked, the pane is hidden in print, and the page still carries no script
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD25 — Defined terms: every definition detected and every use linked back
Prerequisites: UD24 (acceptance unverified)
Contract: dst_defs_collect
Acceptance: nx_doc_structure_lib finds each definition written in the drafting convention (the "Term") or "Term" means, gives it an anchor, links every later use of the exact term to its definition, and reports terms used before definition, defined but never used, and defined twice; gate: known-answer counts on a fixture will, a capitalised word that is not a defined term is never linked, a term inside another word is never linked, hostile text in a term is escaped, and the report names every finding
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD26 — Discrete pages laid out by the estate from real font metrics
Prerequisites: UD17 (acceptance unverified)
Contract: dpag_plan
Acceptance: nx_doc_paginate_lib parses knowledge/doc_page.conf into milli-points, measures every word with the shipped face's hmtx advances through nx_ttf_fontlib, breaks paragraphs by Knuth-Plass total fit with greedy first-fit kept as the oracle, stacks lines into the text box with collapsing gaps, keep-with-next, widow and orphan control and unsplit table rows, and emits one zero-script sheet per page with a Page N of M footer; gate: hand-computed widths from the Times metrics, every line re-measured inside its measure, Knuth-Plass never dearer than greedy and equal to a brute-force enumeration, a hand page count, keep-with-next and widow and orphan control each bite, rows never split, the dry byte count equals the written bytes, and a width-ignorant fixed-pitch breaker overflows where Knuth-Plass fits
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD27 — Clause-aware legal redline between two versions
Prerequisites: UD11 (acceptance unverified), UD24 (acceptance unverified), UD25 (acceptance unverified)
Contract: drl_redline
Acceptance: nx_doc_redline_lib compares two versions of a native document by clause identity (the anchors and numbers of UD24) and defined-term identity (UD25) instead of by characters: a moved clause is one move, a renumbering alone is no substantive change, a defined-term rename is one change that names every use site, an edit inside a clause is a character redline confined to that clause, and the zero-script redline page names both version identities; Word and LibreOffice compare and combine by characters [@ms-compare] [@lo-compare]; gate: a fixture will and its revision yield exactly the hand-derived change list (one move, one rename with its use count, one inserted clause, zero changes from renumbering), the same pair always yields the same list, a version whose bytes do not verify is refused by name, and a negative control shows a character diff of the same pair reporting the renumbering as a change on every clause it touched
Authored effort: 2.5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD28 — AI edits held to the document's structure before they can be accepted
Prerequisites: UD21 (acceptance unverified), UD24 (acceptance unverified), UD25 (acceptance unverified)
Contract: dgd_check
Acceptance: nx_doc_aiguard_lib takes an AI-proposed edit as a suggestion (the branch events of UD21) with a declared target span and checks it against the document's structure graph (the clauses and references of UD24, the defined terms of UD25) before it can be accepted: every changed byte lies inside the declared span, no defined term, reference target, party name, amount or date outside the span changes, and a reference the edit breaks is named; a failing suggestion is refused by name and never applied; Word and Google Docs make AI edits reviewable but their pages describe no check of what an edit touched [@ms-copilot-word] [@gws-gemini-apr26], and frontier models silently corrupt long documents under delegation [@arxiv-doc-editing]; gate: planted model outputs that rename a defined term outside the span, delete a clause a reference points to, and change an amount outside the span are each refused naming what was touched, an in-scope edit is accepted and its diff equals its declared span, and a negative control shows that applying the same outputs unchecked changes the term and reference report
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD29 — Reproducible document assembly with the law behind each clause
Prerequisites: UD11 (acceptance unverified), UD16 (acceptance unverified), UD10 (acceptance unverified)
Contract: das_assemble
Acceptance: nx_doc_assemble_lib assembles an instrument from a native template whose blocks carry typed fields and conditions (the field keys of UD16): a validated answer set selects clauses deterministically, each conditional clause names its condition and, where the law engine demands it, the law row behind it (the answer UD10 composes), and the assembled document carries the template identity and the answer set as an attachment so it re-assembles to the same identity; Word fields and LibreOffice conditional text select text, and their pages describe neither keeping the answers nor naming why a clause is there [@ms-fieldcodes] [@lo-condtext]; gate: one answer set assembles to the same identity twice, changing one answer changes exactly the clauses whose conditions read it, a missing or mistyped required answer is refused by name, and every statutory clause names its law row
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD30 — An audit trail bound to the document that a third party verifies offline
Prerequisites: UD11 (acceptance unverified), UD19 (acceptance unverified), UD22 (acceptance unverified)
Contract: dau_chain
Acceptance: nx_doc_audit_lib records every view, edit, comment, suggestion decision, signature and export of a document as an append-only event naming the actor, the version identity and the hash of the event before it, and exports an audit report that verifies from the report alone with no server; Google Docs appends an audit trail page to a completed signature request and Microsoft Purview keeps an administrator log retained 180 days by default [@gdocs-esign] [@ms-purview-audit]; gate: a fixture history verifies, a deleted, reordered or altered event is refused naming its position, an event naming a version that does not exist is refused, the exported report re-verifies with no server, and every relay request that touches the document leaves exactly one event
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD31 — Clause index across the vault with stale-clause recall
Prerequisites: UD11 (acceptance unverified), UD24 (acceptance unverified)
Contract: dci_query
Acceptance: nx_doc_clause_index_lib indexes every clause block of every vault document by its content identity and a normalised text fingerprint, answers which documents carry a given clause and at which version, and when a template clause is superseded lists every document still carrying the old one; Copilot and Workspace Intelligence search a tenant's files by prompt, not by clause identity [@ms-copilot-privacy] [@gws-gemini-apr26], LibreOffice AutoText stores reusable text for insertion [@lo-autotext], and none of the three pages describes finding every document that uses a clause; gate: a fixture vault of documents sharing clauses returns exactly the documents and versions for each clause, a superseded template clause lists exactly the stale documents, a private document never appears in another tenant's answer, and an index rebuilt from scratch equals the incremental one
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD32 — Words in this document: the legal words a document uses, marked at first use and explained beside it
Prerequisites: UD33 (acceptance unverified), UD27 (acceptance unverified)
Contract: udw_marks
Acceptance: nx_unidoc_words_lib marks the first use of each word the Nishi Lexicon explains (the IRS estate terms, the federal courts' glossary in its general sense, and the dictionary senses that WordNet's own domain_topic relation files under law, chosen by knowledge/lexicon/view.conf with a calibrated least share of law senses) in the sheets and the phone copy, and lists every one in reading order in a panel with its sources' definitions, similar words and credits, the document's own definitions and references taking precedence; a reading interface that contextualizes ambiguous contract language with definitions while always foregrounding the original binding text made Terms of Service significantly easier to read and navigate in a within-subjects study (N=20) [@termsight-2026]; gate: nx_unidoc_words_gate -- a sense outside the view never explains a word, a word whose law senses fall short of the share is not marked, a use inside a longer explained use is not marked while the later standalone use is, both renderings carry the marks, the panel escapes and credits, and without a view or an explained word the page is the viewer's byte for byte
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD33 — The Nishi Lexicon: dictionary, thesaurus and legal glossaries as one estate store with an MCP tool
Prerequisites: UD11 (acceptance unverified)
Contract: lx_lookup
Acceptance: nx_lexicon_lib keeps sorted stores of one row schema (term, part of speech, sense, domain, definition, synonyms, antonyms, example, source) searched by binary search, finds base forms through WordNet's irregular forms and morphy rules of detachment in their part of speech, scans a text for the terms a store holds (longest first, inflected uses included), and opens the sources a conf declares with every unreadable or unsorted source counted; nx_lexicon_lmf_lib ingests a WN-LMF wordnet with synonyms, antonyms, examples and each sense's domain from its domain_topic relation; nx_lexicon serves define, legal, synonyms, antonyms, lemma, scan, sources and the ingests on the MCP surface with a credit line per source; gate: nx_lexicon_gate -- fixture known answers for the store, the lookup and its negative controls, both ingests with every unresolved reference counted, the scan and the sources, and real-data teeth pinned to the ingested stores
Authored effort: 3. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD34 — Plain-language measures for a legal draft, reported per clause
Prerequisites: UD33 (acceptance unverified)
Contract: plg_measure
Acceptance: nx_plainlang_lib measures each clause of a draft: sentence length, passive constructions, shall where an obligation reads must, and legalese that a sourced data table pairs with a plain alternative (the federal plain-language guidelines, read and pinned first), reporting numbers per clause and no verdict until a threshold is calibrated on real drafts; gate: fixture clauses with hand-counted answers, plain text reading zero, and every suggestion naming its source row
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD35 — Focus and paper modes for a document page, zero script
Prerequisites: UD17 (acceptance unverified)
Contract: ud_paper_css
Acceptance: a focus control that dims every clause except the one targeted or in focus (CSS :has and :target), and a paper mode for e-ink and slow-refresh screens chosen by the media query update: slow and by a reader toggle (black on white, no motion, heavier strokes), every value from knowledge/doc_page.conf; gate: the emitted CSS references every paper token it defines, the page carries no script, and update: slow selects the same declarations as the toggle
Authored effort: 1. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD36 — A Nishi text face for documents
Prerequisites: None declared; this does not establish execution eligibility.
Contract: _ABSENT_:nfont_text_set
Acceptance: the sovereign-font ladder (nx_font_ttf_emit carries .notdef, space, H, I and T today) grown to the Latin text set a will and a trust use, re-parsed and checksummed like the R2 emitter, and compared for legibility against a published legibility study read and pinned first; gate: every glyph of the set present, metrics and checksums verified by re-parse, and the measured legibility comparison against the incumbent face
Authored effort: 5. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD37 — Word-processor editing in the browser, emitted by the estate
Prerequisites: UD1 (acceptance unverified), UD17 (acceptance unverified)
Contract: ude_page
Acceptance: nx_unidoc edit emits an editing page for any document the unified page reads (nx_unidoc_edit_lib, on the viewer's own paper and tokens, settings from knowledge/doc_editor.conf): the estate's own client (web_assets/nishi_editor.js, loaded by a content-versioned URL under script-src self, no third-party code) edits headings, paragraphs, bold, italic, underline, bulleted and numbered lists and tables, keeps undo and redo, find and replace, paste from Word and Google Docs reduced to the document's own marks, the shortcuts those editors use and an outline, writes the page back to the office spec with inline marks as R lines, and keeps a draft in the reader's browser behind a restore banner; every viewer page links to its editor (edit=); gate: nx_unidoc_edit_gate renders the spec's marks, lists and tables to hand-written HTML, refuses unknown lines and bad runs by name, carries one self-only script and no inline handler, pins the content version, and keeps the find bar and banner hidden on load; journeys: nx_cdp_capture journey editor-will (33 steps), editor-trust and editor-poa (12 steps each) pass on a phone and a desktop door
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.
UD38 — The browser editor saves to the firm: versions, compare and a Word download
Prerequisites: UD37 (acceptance unverified), UD15 (acceptance unverified), UD22 (acceptance unverified)
Contract: _ABSENT_:ude_save
Acceptance: the editing page posts its spec to the office as a new native container version naming its parent (UD15), lists the versions, opens the clause-aware redline between any two (UD27) and downloads the current version as Word (UD14); gate: a save reopens with the new identity and names its parent, a save whose parent is no longer current is refused by name and offered the merge, a viewer-role session cannot save, and the download opens in an outside reader
Authored effort: 2. Executor kind: Organ. Responsible, accountable and verifier not established. Inspect retained worklog.
Runtime observation: UNKNOWN; outcome UNKNOWN; observed epoch -1. Declared owner: . Receipt , SHA-256 . Identity-bound observation is not accepted completion. Qualification and deployment remain unverified by this projection.

Learning and practice paths

No structured learning path is declared for this plan. Existing research, roadmap and worklog remain available above.

Rung dossiers — every record that bears on a rung, in one place

Joined by symbol, never typed. Each dossier is assembled on every publish from the rows this board already carries: the plan's rung row, the matrix row that carries its contract symbol (its status re-measured by the one symbol ruler), the gate the organ declares and the verdict the evidence referee recorded on its last run, the reference marks in the rung text, the design rows that name the rung and the work log filed against it. The capability matrix links each cell to its dossier and each dossier links back to its cell and forward to the rungs it stands on; a dependency naming no rung on this plan is written as UNRESOLVED rather than linked. Absences are named: NO-MATRIX-ROW, NO-GATE-DECLARED, UNRECORDED.

Gate verdicts: UNSTAMPED — no per-gate verdict artifact is published for this domain yet (nx_swcompare_evidence unidoc writes it beside its stamp); every gate below reads UNRECORDED until it runs.

Gate declarations: knowledge/organ_gate.conf read from this working directory (1 rows) and from the estate root (196 rows); rows in both counted once: 0; declarations read: 197. Every declaration in either copy counts, so a stub beside the publisher can never hide the root.

UD1 The unified document page as an organ with its gate · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ud_render_path` · executor Organ · 1 u · stands on nothing
Definition of done	nx_unidoc_lib folds docx, odt, pdf, md, csv and txt to the office document model through the promoted spec verbs and emits one zero-script page with a fail-closed CSP, escaped text and the portal's forms only with a base; nx_unidoc exposes the registry renderer interface; nx_unidoc_gate proves the escape fires and stays silent, the CSP is present, a web page is refused by name, determinism, csv quoting, and a genuine Word document through the promoted organ -- LANDED 2026-09-03
Matrix cell	UNIFY: One page for every kind -- the office's own document model (H, P, T, B, I blocks) rendered as a zero-script page with a fail-closed policy and the portal's actions as plain forms · `runtime/nx_unidoc_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unidoc_lib`; declare `nx_unidoc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 land 2026-09-03: nx_unidoc_lib.nx (28893 B, sha 9af39ebb), nx_unidoc.nx (2722 B, sha f20a64c2) and nx_unidoc_gate.nx (11584 B, sha 46f7bcb9) written on the laptop, compiled by the local sovereign toolchain first try (nx_unidoc 49993 B, nx_unidoc_gate 66554 B), gate 28 of 28 teeth pass locally with the Word-fixture precondition SKIP (the fixture lives on the NAS), sources pushed to buildroot/runtime over the wire lane and nx_filehash read the same three digests on both trees; nx_organ_ship nx_unidoc launched through nx_job_run 2026-09-03 lesson gv_bite takes fired_on_bad and fired_on_good, not passed_bad and passed_good: the first draft passed the good-input PASS as fired_on_good and the tooth read FALSE-POSITIVE; read the base class before composing it 2026-09-03 measure nx_catalog 2026-09-03 over the viewer fleet: nx_doc_view, nx_doc_view_gate, nx_pdf_gate, nx_md, nx_csv, nx_pptx, nx_docx PROMOTED-UNREGISTERED; nx_xlsx registered-unauthorised; nx_browser REGISTERED-DARK; nx_browser_doc_gate, nx_nishios_docview, nx_docx_gate, nx_css_vars_engine_gate BUILT-UNPROMOTED; nx_browser_render and nx_md_lib are libs -- the renderers ship and run, the gates around them are not all promoted, which is the .gates map's honest starting point 2026-09-03 land SHIPPED on the NAS 2026-09-03 through nx_organ_ship: nx_unidoc_gate built and run 30 of 30 GREEN against the promoted docx organ and the genuine Word fixture, promoted sha 230bc7c0 and registered; nx_unidoc promoted sha 50f18daf, adopt-gate APPROVED (content GREEN, behave IDENTICAL, evidence WEAK because the probe compared a usage line on a first promote), _offc twin byte-identical to the build, registered; the first ship receipt read prove=NO-GATE-FOUND because the gate had not been built yet, the second read prove=GREEN after the gate lane shipped; smoke over the served binary: a text document with a planted script tag rendered as a 3496-byte page, script=0 csp=1 2026-09-03 measure nx_swcompare_evidence unidoc 2026-09-03: MEASURED-HONEST, present 30 grounded 30 ungrounded 0, absent 6 all named, gates_green 1 of 1, partitions reconcile (30 plus 6 equals 36); nx_domain_admit unidoc: ADMIT with C3 gates file present, C4 never-bitten until the bite below records, C5 second method class ABSENT (the shared evidence debt of every board), C2 unpinned declared in the matrix header 2026-09-03 measure nx_gate_bite nx_unidoc_gate runtime/nx_unidoc_lib.nx 2 on 2026-09-03: baseline GREEN, comparison mutant at offset 4179 COMPILED and the gate went RED, KILLED; source restored byte-identical (28920 B) and both deployed twins restored; valid_mutants=1 killed=1 not_reached=0 verdict=GREEN -- the gate bites, so the green above is not a green that never had a red 2026-09-03 land PUBLISHED 2026-09-03 by nishi_compare_regen (job 1788443801): /compare/unidoc api.json 22240 B and index.html 95370 B (first publish), hub api.json 89908 to 91020 B; nx_page_verify https://nishifamily.com/compare/unidoc status 200, a11y-lite 0 issues, VERDICT=GREEN; the regen itself read RED for 8 other domains (performersearch, foodscience, water, livingdocs, lang, smallos, devguardrails, gpu: stray pipes and present-under-5 liar-kills, none on this board) and named the matrix generator fork STALE (buildroot/_offc 322744 B vs promoted 357136 B), so this first page was emitted by the older generator copy; nx_restage nx_swcompare_matrix launched the same minute and the next beat republishes with the fresh copy 2026-09-03 measure nx_restage nx_swcompare_matrix on 2026-09-03 returned RESTAGED buildroot/_offc/nx_swcompare_matrix.elf 323342 B from the current source, while the PROMOTED serving-root copy is 357136 B: a fresh build of today's source is 33794 B SMALLER than what was promoted, so the fork and the promoted artifact still differ and the next regen will again name the fork -- a size delta is a question, not a verdict (toolchain shrink versus a served binary ahead of its source); it belongs to the compare-emitter lane and is named here, not chased from this board 2026-09-03 measure SECOND METHOD CLASS ESTABLISHED (C5 ABSENT to UNSIGNED-CANDIDATE, carrier knowledge/status/evclass_unidoc.conf, rows=1, verifier REACHABLE). The first class is our own gate; the second is an OUTSIDE engine that can disagree, exactly the pattern lang uses with V8. Google Chrome over the DevTools protocol was handed two pages generated from ONE 88-byte hostile text document whose payload sets a global: the nx_unidoc page reported pwned=undefined scripts=0 literal_visible=true (the payload neither ran nor became an element and is readable as text) and the SAME witness on the same bytes written unescaped reported pwned=number scripts=1 literal_visible=false. The control is the load-bearing half: a witness that cannot disagree is decoration. UNSIGNED BY DESIGN -- attestation needs an operator-registered durable key, so this is evidence that is not yet proof and the gate says so; fabricating a signature would defeat the instrument that makes PROVEN mean anything. 2026-09-03 lesson A 503 ON A WRITE IS DECIDED ONLY BY THE ARTIFACT, AND THE READ PATH LAGS THE WRITE PATH: a 503'd edit read as unchanged on TWO spaced size reads and had in fact LANDED -- the duplicate retry was refused by the expect= guard, which is the only reason it did not double-apply. Chain every edit on one file by the byte count the previous edit REPORTED, never by a fresh read, and never fire concurrent edits at one file. Six of today's 503s had landed. 2026-10-07 measure rival census (nx_rivalcensus, ecosystem EC88) pass 1 over 34 mirrored pages: 136 cells, 56 exact, 27 presence (Yes proposed where the seat graded Best), 47 disagree, 6 unadjudicated, 430 permil exact; pass 2 with the two-word phrase table: 131 keyed cells, 59 exact, 27 presence, 45 disagree, 0 unadjudicated, 450 permil exact and 656 with presence, ratchet HOLDS, 45 lesson rows in unidoc.census_lessons; three cells re-graded on this month's evidence (Markdown in Docs and eSignature in Docs read Yes from the October Workspace page, Nextcloud Text reads Part for signature requests) 2026-10-07 lesson a bare word is a homonym on a vendor page: convert, preview, approve, compare, version, search, train and at the same time each matched a menu, a rollout note, a price page or a file list, so every census phrase is at least two words the page uses for THIS capability; support.google.com answer pages render their body from script so the sovereign reader sees only the shell, and the Google column is graded from blog and product pages; a Part the seat gave where the page is silent is a No by evidence with the missing page named in the queue 2026-10-07 queue the 45 remaining census disagreements are each a cell to adjudicate with a witness (the organ names the page and the snippet) or a phrase to refine; the Nextcloud Office app page, the Docs dictionary page, Word's readability statistics page and Word's Focus mode page are not mirrored, so those cells read No by evidence until they are; render the census grade row on the page beside the position map (EC88 done-rule); a rendering reader for script-built support pages or a server-rendered source for each such page 2026-10-08 land 2026-10-07 two Word-extraction rows moved HOME to this board from /compare/legalpractice (ecosystem EC89, a document capability is graded on the document board): docx_read_text (own OPC/ZIP reader, w:t runs) and docx_read_spec (paragraph-faithful extraction, the spec verb the import consumes), both runtime/_hdl_build/nx_docx.nx, graded 1

UD2 The unified page registered as the renderer for the kinds nothing served · cell PRESENT · gate NO-GATE-DECLARED

Contract	`dv_lookup` · executor Deploy · 0.5 u · stands on UD1
Definition of done	knowledge/doc_viewers.conf gains txt and odt rows pointing at _offc/nx_unidoc.elf and the browser document gate is re-run against them; gate: nx_doc_view routes a .txt and a .odt to the unified page and the browser paints it inline
Matrix cell	OPEN: Registry-dispatched renderers -- adding a format is one data row and one focused organ, the dispatcher never changes · `runtime/_hdl_build/nx_doc_view.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_doc_view`; declare `nx_doc_view TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 queue Next in order: UD2 registry rows for txt and odt, then the .gates map after the ship receipt, then UD3 the portal route (the daemon change), then UD4 the browser form leg; UD6 PDF layout is the long pole and the byte-up lane's 2026-09-03 land knowledge/doc_viewers.conf (626 to 751 B) gained txt and odt rows routed to _offc/nx_unidoc.elf, the two kinds no renderer served, so the browser omnitool now opens a .txt or a .odt URL as the unified page; the docx, md, csv, xlsx, pptx and pdf rows are untouched until the browser document gate is re-run against the unified page 2026-09-03 land BLOCKERS CLEARED 2026-09-03, both were DATA defects that stopped a whole page publishing: lang.matrix carried a data row ABOVE its @cols header so the generator parsed it before the schema existed (9 fields against a 5-field default) -- the row was moved below @cols and the file returned to EXACTLY its original 77130 bytes, which is the proof the row was restored byte-for-byte rather than rewritten; gpu.matrix row 47 carried two stray pipes inside a note (a door 2026-09-03 land nx_browser_doc_gate REPAIRED AND SHIPPED 7 of 7 GREEN (sha ba3f74cf, promoted + _offc twin + registered). It was INOPERATIVE, not failing: it asked for its browser at /tmp/nx_browser.sov.elf and the sovereign builder writes <cwd>/_build/<t>.sov.elf, so its FIRST tooth could never pass and the six below it were unreachable -- 1 of 7, reporting the browser broken when the missing thing was the gate's own path. Fixed by resolving the artifact (promoted ./nx_browser.elf first, then buildroot/_build, then the legacy /tmp) and ANNOUNCING the choice, and by writing the .docx fixture at runtime with the promoted nx_docx instead of copying web_assets/vizsla_agreement_demo.docx, which is ABSENT on this host. Now proven end to end against the PROMOTED browser: md and csv and docx each converted and laid out INLINE over the browser's own HTTP stack, a plain .html left on the normal pipeline as the negative control, every output script-free. 2026-09-03 land ADOPTION DELTA 2026-09-03: the viewer fleet was seven PROMOTED-UNREGISTERED binaries nobody could call. nx_doc_view, nx_doc_view_gate, nx_pdf_gate, nx_md, nx_csv and nx_docx are now REGISTERED and callable; nx_pptx REFUSED with elf-not-found-or-not-a-valid-ELF and its catalog row shows PROMOTED 81491 B against BUILT 62135 B, a served binary LARGER than a fresh build of its source, which is the AHEAD class where promoting destroys capability -- left alone and named, never guessed at. ⚠The register API takes a BASENAME (nx_x.elf or _offc/nx_x.elf), not an absolute path: seven registrations failed 400 first, and the refusal named the exact fix.

UD3 One URL per vault document served by the portal daemon · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dad_unidoc` · executor Organ · 3 u · stands on UD1
Definition of done	nx_docportal_admin_daemon serves GET /doc/<cid> through ud_render_path with the portal base so the original, versions, annotate and sign forms post back to the daemon, and POST /doc/<cid>/annotate and /sign compose nx_ann_add and of_sign_version; gate: a cross-tenant cid is 404, a no-consent sign is refused, the page carries no script
Matrix cell	PORTAL: One URL per document composing the page, the original, versions, annotations, signature and share -- served by the portal daemon · `runtime/_hdl_build/nx_docportal_admin_daemon.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_docportal_admin_daemon`; declare `nx_docportal_admin_daemon TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-09-03 queue DELIBERATELY NOT DONE, each with its reason: (1) nx_office_closed_gate is still NEVER-BITTEN because biting it mutates and rebuilds nx_office_daemon, and every mutant build is a deploy -- that daemon serves admin.andelinwest.com to a real law firm, so a seconds-long window of mutant code on a client surface is the operator's call, not a seat's; a fixture-only variant or a maintenance window unblocks it. (2) The seven never-bitten lang gates and the LN13 closures rung were left alone because a sibling lane shipped five canaried toolchain promotes today and mutation builds against compiler sources would collide with a lane in flight. (3) UD3 (dad_unidoc) is the next real rung and it is a route change to that same live client daemon, so it wants the health-checked deploy lane and an operator go-ahead on opening it. 2026-10-04 land THE ALPHA URLS NO LONGER 404 (operator: "these all 404 so im not seeing any functionality"): andelinwest.com/alpha/ has a landing page emitted from knowledge/alpha/andelinwest_alpha.rows, and the short URLs /alpha/will.html, trust.html, poa.html and will-redline.html forward to /alpha/docs/ (CSP default-src none, noindex); pub rows 33 to 40 on pub-andelinwest-. Fictional samples only. 2026-10-04 land FORWARDING PAGES EMITTED, NOT HAND-WRITTEN: the four short alpha addresses had been written by hand earlier on 10-04. nx_unidoc forward now emits them (the viewer's own head plus a refresh; the target held to ud_href_ok, the listing page's link rule; a scheme or protocol-relative target is refused HREF-REFUSED by name, asserted by the viewer gate, not yet mutation-tested). All four re-emitted and published over the hand-written copies (pub rows 37 to 40); comparison pages on rows 32, 41 and 42.

UD4 The Nishi browser submits the document page's forms natively · cell WATCHING · gate NO-GATE-DECLARED

Contract	`br_form_submit` · executor Organ · 2 u · stands on nothing
Definition of done	nx_browser serialises a form's fields on submit and POSTs them over its own HTTP stack, then paints the response; gate: the browser document gate gains a form leg that posts a note to the fixture server and reads it back
Matrix cell	NATIVE: The Nishi browser submits the document page's forms natively -- annotate, sign and share without a client script · `runtime/_hdl_build/nx_browser.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_browser`; declare `nx_browser TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD5 List, quote and code blocks in the shared document model · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ud_list_block` · executor Organ · 1.5 u · stands on UD1
Definition of done	The model gains L (list item), Q (quote) and C (code) lines, the unified page renders them, the office editor round-trips them and the Markdown folder emits them; gate: a Markdown list renders as a list element and the office save keeps the L lines
Matrix cell	INTERACT: List, quote and code blocks in the shared document model · `runtime/nx_unidoc_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unidoc_lib`; declare `nx_unidoc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD6 PDF page layout painted, not only reflowed · cell WATCHING · gate NO-GATE-DECLARED

Contract	`pf_page_layout` · executor Organ · 4 u · stands on UD1
Definition of done	Positioned text runs with their fonts and embedded images painted per page through the sovereign renderer; gate: a two-column PDF keeps its columns and a figure is present, measured by nx_struct_diff against a PDF.js capture
Matrix cell	INTERACT: PDF page layout -- positioned text, fonts and figures painted, not only reflowed · `runtime/_hdl_build/nx_pdf.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_pdf`; declare `nx_pdf TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD7 NishiOS opens the portal index as its document window · cell WATCHING · gate NO-GATE-DECLARED

Contract	`nd_portal_index` · executor Organ · 2 u · stands on UD3
Definition of done	nx_nishios_docview lists the vault's documents in the NISHI DOCS window and opens one on selection through the linked unified page; gate: the boot image lists two documents and opens the selected one
Matrix cell	NATIVE: NishiOS portal index -- the vault listing as the desktop's document window, the file browser retired · `runtime/_hdl_build/nx_nishios_docview.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_nishios_docview`; declare `nx_nishios_docview TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD8 Co-editing wired into the office · cell WATCHING · gate NO-GATE-DECLARED

Contract	`of_coedit` · executor Organ · 1 u · stands on UD3
Definition of done	Shared contract with legalpractice LP14: nx_office_serve imports nx_coedit and two browsers converge on one version; gate: the coedit live gate runs against the office route
Matrix cell	INTERACT: Real-time co-editing inside the office · `runtime/nx_office_serve.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_office_serve`; declare `nx_office_serve TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-07 lesson OPERATOR 2026-10-07: Google Docs, Word, Acrobat and Nextcloud are the OFFICE rivals and belong to this document board; the practice board (legalpractice) is specific to DocuSign, Clio, NetDocuments and PandaDoc; measured: eleven rows are carried on both boards as separately graded rows (dad_handle, dx_to_html, nx_ann_add, nx_doc_serve_response, nx_env_send, odt_read_text, of_coedit, of_import, of_save, of_sign_version, pf_to_html) and legalpractice LP14 is UD8 under another id; this board is the HOME of those capabilities, legalpractice LP14, LP15 and LP22 now depend on UD8, UD13 and UD25 so the ranker reads the home rung's state, and the cross-board row kind that renders a home row on another board without re-grading it is ecosystem EC89 2026-10-08 land 2026-10-07 this board is the HOME of the document capabilities legalpractice references: five legalpractice rows became @xrow references (ecosystem EC89: dx_to_html, odt_read_text, pf_to_html, of_save, nx_doc_serve_response) and render here-graded cells on /compare/legalpractice under this board's columns; the Nishi mark on a reference is measured against this board's organ with the one symbol ruler, so a capability is graded once, here, and read everywhere 2026-10-08 land 2026-10-07 three rows on this board that graded an e-sign or legal capability whose exceed is claimed on /compare/legalpractice became @xrow references to it (nx_ann_add the annotation overlay, nx_env_send envelope routing, nx_legal_regime the never-void instrument gate), chosen by the fleet duplicate census (nx_rivalcensus dupes, ecosystem EC89); each reference keeps the document-portal reading (Acrobat Sign Best on routing, Google Docs Part by the 2026-10-07 census) in its note; landed on a predicted size ladder 31957 to 32089 in three steps, every receipt byte-exact; no unidoc rung carries any of the three symbols, so the ranker stays at unmapped=0. This board is in turn the home for dad_handle and the on-premise property row that legalpractice now references 2026-10-08 land 2026-10-07 a fourth reference: the sign-in-place row (of_sign_version) became @xrow legalpractice

UD9 One render core for the browser, the reader and NishiOS · cell WATCHING · gate NO-GATE-DECLARED

Contract	`br_one_core` · executor Organ · 3 u · stands on UD4
Definition of done	Shared contract with the browser board's BR29: the promoted Linux browser paints through the shared render core so the NAS census grades the same pixels the daily driver paints; gate: the same document page renders bit-identical through nx_browser and nx_browser_render
Matrix cell	UNIFY: One render core for the browser, the reader and NishiOS · `runtime/_hdl_build/nx_browser.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_browser`; declare `nx_browser TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD10 The document page states what the law requires of this instrument · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ud_law_panel` · executor Organ · 1.5 u · stands on UD3, legalpractice:LP30 (UNRESOLVED: no such rung on this plan), legalpractice:LP31 (UNRESOLVED: no such rung on this plan)
Definition of done	ud_page renders, for a document with an instrument class and a signer place, a requirements panel built from the law engine's answer (the element set of legalpractice LP30, or the several-places set of LP32 when more than one state is involved): each element, whether the record satisfies it, the law id, the section and the pin of the row that demands it, and the day the row was read; the sign form is emitted only when that answer permits a ceremony for that place and class, otherwise the panel names what is missing or states that this instrument is signed on paper before witnesses; gate: a Utah trust page offers the electronic ceremony with its sections named, a deed page offers none, an unclassified document shows the strictest panel, and the page still carries no script
Matrix cell	INTERACT: The document page states what the law requires of this instrument · `runtime/nx_unidoc_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unidoc_lib`; declare `nx_unidoc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-03 queue UD10 declared 2026-10-03 with legalpractice L4 and L5 and legal M5: the document a client opens is where the law is shown, so the panel composes one answer that the view, the ceremony, the certificate and the audit chain all read. Order: UD3 the portal route first (still open, the host daemon does not declare dad_unidoc), then UD10 once legalpractice LP30 answers the Utah element set and LP31 gives every document its instrument class. Which daemon carries the client's document URL (the live vault daemon here, or the staged legal portal daemon of legalpractice LP9) is an open operator decision recorded on legalpractice.plan row 1791044603 2026-10-03 retract The UD10 watch row was appended to unidoc.matrix with four unassessed rival cells and withdrawn within the hour: the page published at 1791044768 lost its position map (185362 bytes against 207820 before, the heading reading Position map unassessed, 4 peer cells). The matrix is back to its 13718 bytes; UD10 stays on this plan and reads UNMAPPED until its row returns with the four rival cells assessed from the mirrored pages in unidoc.refs 2026-10-03 queue NATIVE DOCUMENT FORMAT STARTED 2026-10-03 and cut off by a usage limit; resume here. Operator: a format superior to Word and Google with no third party in it, interoperable for printing and outside use, state of the art on research read today. Incumbent census: the office spec model is five line tags with no canonical form, no hash and no history; the UXF envelope reserved the DOCUMENT profile (codec 2) on 2026-06-16 and never built it; nx_spendgate nx_uxf_doc reads name FREE; the function prefix uxd_ is ABSENT-PROVEN over buildroot/runtime (27475 files, corpus_complete=1). SOURCE LANDED AND UNBUILT: buildroot/runtime/nx_uxf_doc_lib.nx (32869 B before one rename edit) -- blocks and a manifest as canonical NXR1 records under UXF_DOC, the document identity the manifest CID, a container of manifest then distinct blocks in first-reference order then attachments (signatures and notes that name the document and are not part of its identity), open-and-verify with named refusals, spec import and export projection, tolerant manifest rewrite, a must-understand key rule, a multi-parent prev chain. NOT YET DONE: no rung row and no matrix row for it, no build (expect compile fixes: one helper is defined after its use, two bare literals want names), no CLI nx_uxf_doc, no gate nx_uxf_doc_gate, no export to Word or print, no ship. Found on the way: uxf_cid_profiled never unmaps its two scratch mappings, a leak per CID that a large document multiplies. Research mirrored by nx_research_fetch the same day, pins in the job receipts: RFC 8949 rf_da358f08.raw (deterministic encoding, section 4.2 read), OASIS ODF 1.4 approval of 3 December 2025 rf_ccb35296.raw, PDF Association standards registry rf_0bc78e6a.raw (PDF/UA-2 is ISO 14289-2:2024), NIST FIPS 204 rf_cd15a9c9.raw, Automerge rf_775b195e.raw (a project claim); the W3C post-quantum cryptosuites draft answered 403 and the arXiv CRDT listing job exited 2, so this month's listing is NOT read and no bar is declared. Nothing here may be called state of the art until the listing is read, three independent witnesses stand per bar, and the format's numbers are measured beside Word's and ODF's

UD11 The native document container: canonical content-addressed records under the UXF document profile · cell PRESENT · gate NO-GATE-DECLARED

Contract	`uxd_open` · executor Organ · 2 u · stands on UD1
Definition of done	nx_uxf_doc_lib holds a document as a manifest and blocks, each a canonical NXR1 record under the envelope's document profile, the document's identity the manifest's CID; a container (the manifest, every distinct block once in first-reference order, then attachments that name the document and are not part of its identity) is verified on open with named refusals; unknown keys are preserved and a key that begins with a bang is must-understand and refused when unknown; a version names its parents by CID; the office spec lines are the first import and export projection; nx_uxf_doc is the tool (verify, from-spec, import, to-spec, docx, set); gate nx_uxf_doc_gate: a changed byte is refused and names the reference it broke, a truncated, foreign, orphaned or misattached container is refused by name, an unknown field survives an edit, the spec round trip is byte-identical -- LANDED 2026-10-03, awaiting acceptance
Matrix cell	SECURE: A native document container -- canonical content-addressed records, verified on open, a changed byte refused and the block it broke named · `runtime/nx_uxf_doc_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_doc_lib`; declare `nx_uxf_doc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-03 land UD11 SHIPPED 2026-10-03 through nx_organ_ship, awaiting acceptance: nx_uxf_doc_lib.nx 33853 B (prefix uxd, ABSENT-PROVEN free over 27475 sources before use), nx_uxf_doc.nx 8920 B, nx_uxf_doc_gate.nx 14408 B, all three compiled on their first build. Gate nx_uxf_doc_gate promoted 95fd727b, 27 of 27 GREEN, registered; nx_gate_bite killed a compiling comparison mutant of the library and restored it byte-identical (33853 B), so the green is proven able to go red. Tool nx_uxf_doc promoted ca16fae3, proved by the promoted gate (closure bank CURRENT), registered, twins installed. Composed, never re-implemented: nx_canon_cid, nx_uxf_cid, nx_uxf_decode for the envelope, nx_unidoc_lib for import, the promoted nx_docx for the Word export 2026-10-03 measure Values the gate emits, with a second method for one of them: 233 bytes of spec fold to a 1100-byte container, and a hand recomputation from the record layout gives the same 1100 (head 8, eight frames 32, manifest 673, seven distinct blocks 387). The container is 4.7 times its text because every reference is a 72-character CID; a binary reference would cut the manifest by more than half and is a named improvement, not yet a rung. The same eight paragraphs as a Word package written by nx_docx measure 1882 bytes. A one-paragraph edit shares 6 of 7 blocks with its parent; an attachment adds 138 bytes and leaves the identity unchanged. These are one small fixture, not a general size claim 2026-10-03 lesson An attachment has to be defined in version 1 or it can never be added: a reader that refuses every unreferenced record would refuse the first signed document a later writer produced. So a record that names the document is an attachment from the first byte, travels with it, and is dropped by any edit, because a signature made for one version must never be inherited by the next. Found while composing the envelope: uxf_cid_profiled never unmaps its two scratch mappings, so every CID leaks two mappings; harmless in a one-shot tool, a real cost in a daemon that verifies large documents, to be fixed in nx_uxf_cid with its gate re-run before UD15 puts this in the portal 2026-10-03 measure The shipped tool exercised on real files over the registered MCP surface (nx_job_run nx_uxf_doc): a genuine Word document of 48849 bytes imported to a container of 66 blocks and 24269 bytes (identity private-ref:f2eb136c), exported to a Word package of 22275 bytes with 66 paragraphs, and that export re-imported as 66 blocks (24250 bytes, a different identity because headings come back as paragraphs: the structure loss the docx verb names). The Utah H.B. 181 enrolled PDF of 41024 bytes imported to only 2 blocks: the PDF fold carries text and almost no structure, which is UD6 and the formats board's FM6, not a defect of the container. The board reads bar ATTESTED and FRESH, ladder LADDERED 16 of 16, ranker 16 rungs with 2 done; UD11 reads LIB-UNCENSUSED until the import census beat runs; UD10 and UD12 to UD16 read UNMAPPED on purpose, their matrix rows wait for assessed rival cells; the page republished at 300467 bytes with its position map intact and static checks GREEN (not viewed in a browser) 2026-10-03 land compact references shipped: version 2 of the container names each block by a 43-character base64url digest instead of a 72-character hex identifier (version 1 is still read, only version 2 is written). nx_uxf_doc_gate e9e2825a 32 of 32, nx_uxf_doc f7f2585d. The eight-paragraph fixture container fell 1100 to 861 bytes, equal to the hand prediction; three real sample documents fell 4040 to 3351, 3189 to 2620 and 2593 to 2084 bytes 2026-10-03 land the identifier leak is fixed in nx_uxf_cid (both scratch mappings released before return) and is inside every binary shipped today; its own gate re-qualification is the witness for closing debt 1791059498 2026-10-03 retract row 1791067102 said the identifier leak is fixed. MEASURED FALSE the same evening by a new tooth in nx_uxf_cid_gate (source landed, gate reads 8 of 9 RED, NOT shipped; the promoted gate a9fe6f8e is the older 6 of 6 without this tooth): after a warm-up batch, 65536 more identifier calls grew the address space by 12032 pages, about 752 bytes per call, while a twin that only maps the two scratch regions and never releases them grew 2304 pages, about 144 bytes per call. So the two munmap calls did not close it and the larger leak is inside the hash path (sha256_digest work areas allocated per call), a shared primitive under many daemons. Debt 1791059498 stays OPEN with these figures. Next: one batch that maps and releases the two regions (does release reclaim at all in the arena), then the per-call allocation inside nx_sha256 with its own known-answer gate before any change 2026-10-04 measure the identifier leak is explained and the remedy is proven. Cause, read from the allocator's own source (nx_syscalls): small allocations come from a bump arena and sys_munmap is a deliberate no-op for them, so no leaf function can return its scratch; memory comes back only through sys_arena_mark and sys_arena_reset at a quiet boundary. The two release calls added to nx_uxf_cid on 2026-10-03 were therefore no-ops and are removed (the comment there now states the contract). Measured by nx_uxf_cid_gate 08874f51, 9 of 9: a second mark, 65536 identifier calls, reset grows the address space by 0 pages; the same 65536 calls with no bracket grow 12032 pages (about 752 bytes a call); a twin that only maps the two scratch regions grows 2304 2026-10-04 lesson a release that is a no-op by design reads exactly like a release that works until growth is measured: the fix was typed, the gate stayed green, and the claim was published before any tooth looked at the address space. The tooth that settled it reads the kernel's own figure before and after a batch, with a deliberately leaky twin as its negative control; and the remedy was found by reading the allocator, not by adding more release calls 2026-10-04 retract the citation referee (fleet 38 of 45, the same count as before this lane's rows) named one of this board's references: ms-office-signatures read PROV-MISMATCH, because the row's URL had been changed to the page's canonical address while its mirror was still the fetch of the old redirecting address. Fixed at the source: the canonical URL was fetched directly (0 hops, mirror knowledge/fetched/rf_bafe635d.raw, sha256 1ccbb6bb...), the cited sentence was read in the new mirror, and the row now carries that mirror and pin. The three new deploy references were not named by the referee. Not re-run after the fix: the next referee run is the confirmation

UD12 Concurrent versions merge to one identity · cell PRESENT · gate NO-GATE-DECLARED

Contract	`uxd_merge` · executor Organ · 3 u · stands on UD11
Definition of done	Two versions that name a common ancestor merge deterministically: a block changed on one side is taken, a block changed on both converges at character level with the history kept beside the materialised text and replayed only for the concurrent span, and the result names both parents; gate: two edits to different blocks merge to the same identity in either order, two edits to one block converge to one text on both sides, and a merge with an unrelated document is refused
Matrix cell	SECURE: Concurrent versions merge to one identity, without a server · `runtime/nx_uxf_doc_merge_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_doc_merge_lib`; declare `nx_uxf_doc_merge_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-03 queue Order after UD11: UD15 (the page and the office read and write the container, so it becomes the working format), UD14 (structure-carrying Word and ODF 1.4 export; print waits on the sovereign PDF writer, legalpractice LP15), UD13 (signatures), UD12 (merge), UD16 (marks and legal semantics). Research still owed before any exceed is claimed: the full text of arXiv 2609.18886 and its Melda delta model, a peer-reviewed rich-text formatting model for UD16, and measured numbers beside Word and ODF on real documents (size, open time, tamper location, version sharing). The W3C post-quantum cryptosuites draft answered 403 to the sovereign fetcher and is not a ref 2026-10-04 land SOURCE LANDED, NOT YET BUILT OR GATED: runtime/nx_uxf_doc_merge_lib.nx (28060 B, contract uxd_merge) merges two versions that each name a common base as prev: block lists aligned by an exact LCS of block CIDs, every stretch between blocks both sides kept decided three ways (kept, one side's change taken, an identical change taken once), blocks both sides changed one for one merged at character level through the uxm engine (the base as a linear history, each side's edit as an exact byte-LCS diff, merged on both replicas and checked equal), restructured stretches kept from both sides and counted, manifest and block fields three-way with t and title character-merged; the side with the lower version CID is first, so merge(a,b) and merge(b,a) are the same bytes and identity; prev names both parents sorted and NL-separated; a side that is neither the base nor names it is refused BASE-MISMATCH. nx_uxf_doc gains merge <a.nxd> <b.nxd> <base.nxd> <out.nxd> (11128 B; self-verifies and prints kept, first, second, same, char_merged, both_kept, fast_forward, parents). nx_uxf_doc_gate gains 10 teeth (24628 B): edits to different blocks take both and need no character merge, either order gives the same identity, both parents in prev, one paragraph edited at both ends keeps both edits as one character-merged block, concurrent inserts at one place converge with both runs whole, and two neg-controls (an unrelated base, a side that does not name the base) refused by name. Declared deviations: base must be the direct parent; a restructured stretch keeps both versions rather than interleaving; byte LCS is O(n*m). 2026-10-04 queue BUILDS OWED, ONE AT A TIME AND ONLY ON nx_build_admit check = GRANT: (1) nx_sov_build_run nx_uxf_doc_gate --qualify --run-timeout-ms 120000 (compiles nx_uxf_doc_merge_lib through its import; read the ten merge teeth and the values merged_container_bytes_two_blocks, merged_container_bytes_one_paragraph, character_merged_blocks_one_paragraph, merge_prev_bytes, merge_refusal_unrelated_base); (2) nx_sov_build_run nx_uxf_doc --build-only; (3) on GREEN, nx_organ_ship nx_uxf_doc_gate then nx_organ_ship nx_uxf_doc, reading every LOST line before any allow_loss_v1 (nx_uxf_doc only gains strings, so a loss there is a defect, not a review). nx_uxf_doc_lib is untouched, so nx_unidoc_lib and the viewer that import it do not change. 2026-10-04 land three-way merge of native documents: nx_uxf_doc_gate SHIPPED 17cb45c6 42/42 GREEN (merged_container_bytes_two_blocks=666, one_paragraph=672, character_merged_blocks=1, merge_prev_bytes=145, unrelated base refused -17), nx_uxf_doc SHIPPED 8486d5d9 with the merge verb. Compile fix in nx_uxf_doc_merge_lib (a6ac94f5, 28015 B): the identifier match became a NishiLang keyword, renamed mt in 15 places, signatures of uxdm_hirsch and uxdm_span_eq unchanged. The nx_uxf_doc loss approval (aaca9f18, 4 runs) covered only this seat's own already-shipped nx_unidoc_lib changes carried in by import (the firm-name header, font-src in the CSP, overflow-wrap on .meta), reviewed by the lib owner, not new behaviour

UD13 A version is signed and its publication is provable · cell WATCHING · gate NO-GATE-DECLARED

Contract	`uxd_sign` · executor Organ · 2 u · stands on UD11
Definition of done	A signature attachment over the manifest CID carrying a classical and a post-quantum signature composed from the estate's hybrid signer, and a publication record that makes the version's existence at a time independently auditable, so the evolution of the document is the notarised object and not a snapshot of it; gate: a signed version verifies, a changed byte anywhere fails verification and names the block, a signature moved to another version is refused, and either signature failing alone is reported by name
Matrix cell	SECURE: A version is signed for the long term and its publication is provable · `runtime/nx_uxf_doc_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_doc_lib`; declare `nx_uxf_doc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD14 Structure-carrying export and import: Word, ODF 1.4 and tagged PDF for print · cell WATCHING · gate NO-GATE-DECLARED

Contract	`uxd_export` · executor Organ · 3 u · stands on UD11, legalpractice:LP15 (UNRESOLVED: no such rung on this plan)
Definition of done	Headings, tables and marks survive into a Word package and an ODF 1.4 package and back, print goes through the sovereign PDF writer as an archival tagged PDF, and every target declares a loss ledger naming what it cannot carry; gate: a round trip through each target returns the same identity or names every lost key, an outside reader opens each export, and the loss ledger of a target that drops nothing is empty
Matrix cell	UNIFY: Structure-carrying export and import -- Word, ODF 1.4 and tagged PDF, with a loss ledger · `runtime/nx_uxf_doc_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_doc_lib`; declare `nx_uxf_doc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD15 The unified page and the office open and save the native container · cell WATCHING · gate NO-GATE-DECLARED

Contract	`ud_kind_nxd` · executor Organ · 1.5 u · stands on UD11
Definition of done	The unified page gains the native kind (a doc_viewers.conf row and a fold through the container's own projection), the office saves each version as a container whose manifest names its parent, and the portal serves the container beside the original bytes; gate: the browser paints a container as the same zero-script page, an office save reopens with the same identity, and a tampered container is refused on the page by name
Matrix cell	UNIFY: The unified page and the office open and save the native container · `runtime/nx_unidoc_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unidoc_lib`; declare `nx_unidoc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-03 land the document page reads the native container: nx_unidoc d6c99147 (gate nx_unidoc_gate dbd4ae58, 41 of 41) opens a .nxd, verifies it, and renders the same zero-script page with the line Nishi document, verified identity <its identifier>; a tampered container is refused by name (INTEGRITY-REFUSED) and never shown. New verb nx_unidoc index <rows> <out> <title> emits a listing page whose links are limited to a site path, a ./ path or https, any other link refusing the whole page (HREF-REFUSED). Every page head now declares robots noindex. The office save half of UD15 is still open 2026-10-03 land ALPHA live at https://andelinwest.com/alpha/docs/ (operator 2026-10-03: alpha, then beta, then production, like nishifamily.com/alpha/beach): a landing page, three fictional sample documents (will, trust certification, power of attorney) rendered from native containers, each with its stored record and a Word export. Ten paths registered as draft and asset rows 19 to 28 in knowledge/store/pub-andelinwest-, published with nx_site_publish, sources in knowledge/alpha/andelinwest_docs/. Served 200 by the edge for the pages, the Word files (correct media type) and the containers; a real browser (the estate capture organ on the laptop) loads the landing page and the will page at 390 and 1440 pixels wide. Stage state: ALPHA, shipped, awaiting operator acceptance; beta and production moves belong to the release owner 2026-10-03 measure design hygiene of the alpha pages by nx_ui_audit file: 4 of 12 (tokens 3 of 3, no theme awareness, no media query, no focus style) and craft 3 of 15. The viewer stylesheet is hand-typed values from before the derived-token rule; the remedy is a derived token set and a print stylesheet, queued as the next viewer rung, not typed by a seat 2026-10-03 queue open for the operator: the page header reads Nishi Docs on the firm's own site; say whether client-facing pages should carry the firm's name instead. Open in the format: PDF import still yields no structure, Word export is text-only, signing and tracked changes are unbuilt (UD12, UD13, UD14, UD16) 2026-10-03 measure OPERATOR DECISION 2026-10-03 (asked in session, answer: the firm's name): client-facing document pages carry the firm's name in the header, not the product name. The header becomes a data field of the page (a brand argument on the page and index verbs, default unchanged), and the alpha pages on andelinwest.com are re-emitted with it. Not done yet: it is a viewer change with its own gate tooth 2026-10-04 queue consequence for every long-lived caller of the format (the vault daemon on UD3, office save on UD15): each request is bracketed by sys_arena_mark and sys_arena_reset, and that daemon's gate carries a tooth like T6 (zero steady-state growth over N documents). A command-line tool that exits needs nothing. Named here so the bracket is a done-rule of the adoption, not a memory 2026-10-04 land the page header is a data field: nx_unidoc 4a3c948b (gate nx_unidoc_gate bd33fa58, 44 of 44) takes a last argument brand=<name> on the html, page and index verbs (ud_set_brand in the lib; unset or empty keeps the product name and the default page is byte-identical, a tooth proves it; a hostile name is escaped, a neg-control proves it). The four alpha pages on andelinwest.com were re-emitted with brand=Andelin & West (each page 16 bytes longer, the two replaced names) and republished; a real browser shows the firm's name in the header. The meta line under the header still names the format and the renderer

UD16 Inline marks, lists, fields and legal semantics as typed block keys · cell WATCHING · gate NO-GATE-DECLARED

Contract	`uxd_marks` · executor Organ · 3 u · stands on UD11
Definition of done	Ranges anchored inside a block's text for emphasis, defined terms and cross-references, list and quote blocks, typed merge fields, signature blocks, and the instrument class and jurisdiction on the manifest, every one an optional key an older reader preserves; gate: a marked range survives an edit elsewhere in the block, a defined term used and never defined is named, and a reader that does not know a key round-trips it unchanged
Matrix cell	INTERACT: Inline marks, lists, fields and legal semantics as typed block keys · `runtime/nx_uxf_doc_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_doc_lib`; declare `nx_uxf_doc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD17 Document page layer: sheet geometry, typography and print sheet from a data file · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ud_doc_layer` · executor Organ · 1 u · stands on UD1
Definition of done	nx_unidoc_lib reads knowledge/doc_page.conf (rows key, css value, kind, grounds) on every render and draws every document as a sheet on a desk: each safe row becomes the stylesheet variable --doc-<key>, the print page box and the shipped font faces are written from the same rows, and no dimension lives in code. The sheet is US Letter written as size 8.5in 11in with a 1in letter margin as the paged-media standard's own examples write it [css-page-3], the margin Word gives every page by default [ms-word-margins], at a leading that is one of the four line spacings Google Docs offers [gdocs-spacing]; every row the file marks unmeasured is derived from measured published document pages by nx_ui_audit or keeps its literal with the absence of evidence named; gate: the page carries the variables read from the file, a changed row changes the page without a rebuild, an unsafe or malformed row is refused by name and never half-drawn, the print box keeps the sheet size, and the page still carries no script
Matrix cell	UNIFY: Document page layer -- sheet geometry, typography and the print sheet from a data file · `runtime/nx_unidoc_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unidoc_lib`; declare `nx_unidoc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 land UD17 declared 2026-10-03 with its three references landed in unidoc.refs: css-page-3 (published-standard, mirror knowledge/fetched/rf_801366d0.raw), ms-word-margins (vendor-doc, rf_4bf1c9de.raw), gdocs-spacing (vendor-doc, rf_e750893e.raw); each sha256 re-read by nx_filehash equal to its pin, each row URL the one knowledge/status/fetch_provenance.jrnl holds for its mirror at 0 hops, and each cited sentence read in the mirror bytes (the letter @page size 8.5in 11in and the 1in letter margin example; In Word, each page automatically has a one-inch margin; click Single, 1.15, 1.5, or Double). The document page layer is SOURCE-LANDED in buildroot/runtime/nx_unidoc_lib.nx (ud_doc_layer and ud_doc_layer_from read knowledge/doc_page.conf, or ../knowledge/doc_page.conf from buildroot) and is being shipped by another seat; it is NOT claimed live here. 18 of the 27 rows of knowledge/doc_page.conf are marked unmeasured or calibration owed 2026-10-04 land document page layer SHIPPED and live on the alpha: nx_unidoc_gate 8d619f96 51/51 (seven layer teeth: tokens defined from knowledge/doc_page.conf, tokens referenced, print page box with size margin and page number, policy admits only the site's own font, hostile conf value and malformed key never reach the sheet, page box from the same rows, conf without page keys adds nothing); nx_unidoc 1e659ab6 then 44751d4a (identity line wraps with overflow-wrap:anywhere instead of breaking every word); Liberation Serif Regular and Bold plus LICENSE published under alpha/docs/fonts (pub rows 29-31); four alpha pages re-emitted with brand Andelin and West and republished; real-browser capture OK at 390 and 1440 px reads as a sheet of paper. One continuous sheet, not yet discrete pages: pagination is the next rung. Awaiting operator acceptance. 2026-10-04 measure Derivation proposal for the 18 unmeasured rows of knowledge/doc_page.conf written to knowledge/status/doc_page_derivation_2026-10-03.md (proposal only; the conf's owner applies it). Five real Google Docs pages fetched by nx_research_fetch from links already in mirrored pages (rf_a3bdbbdf, rf_6205cfee, rf_bc27ee49, rf_2eec2536, rf_6de3db21; five authors, ONE generator, so n counts documents and not independent designs). Measured from the bytes: page margin 72pt (1in) in 5 of 5, letter width 612pt in 4 of 5 (one A4), leading 1.15 in 5 of 5 (nx_ui_audit and nx_txtscan agree), ink #000000 in 5 of 5, body 11pt in 5 of 5, title median 26pt, table cells 5pt padding and 1pt solid #000000. No evidence for canvas, shadow, bar-gap, ui-title or gap. Decisions named in the file: the Docs defaults are a general-document genre, not a legal instrument (body, title, heading wait for a mirrored court or firm source), and the rule row serves both the bar border and the table border. RULER GAP for the owner of nx_ui_audit: its value parser reads px, rem, em, ch, s, ms and unitless only, so every pt size read as unparsed and derive built a whole type scale from n=1 of the published page's chrome (14px banner links), not from any document; its body line-height band 1.30..1.80 excludes a document's 1.15 2026-10-04 measure doc_page.conf calibrated from evidence: body 12pt grounded in the Utah paper-format rule (type not smaller than 12-point, margins not less than one inch) [urcp-10], kept over the Google Docs 11pt default because that is a general-document genre; ink #000000 (5 of 5 published Google Docs), cell padding 5pt (7 of 7 cell styles), space above headings 18pt (median n=5), margin 72pt confirmed 5 of 5; title and heading sizes and the screen chrome rows stay declared choices with no evidence (table in knowledge/status/doc_page_derivation_2026-10-03.md) 2026-10-04 land TEXT VISIBLE BEFORE THE WEB FONT ARRIVES: both @font-face rules in nx_unidoc_lib carry font-display swap, so a slow font load shows the fallback serif instead of invisible text; the alpha document pages were re-emitted and served (nx_unidoc de6cc2ef, nx_unidoc_gate 81/81).

UD18 The event-graph text merge engine: concurrent edits converge for any delivery order · cell PRESENT · gate NO-GATE-DECLARED

Contract	`uxm_merge` · executor Organ · 2 u · stands on nothing
Definition of done	nx_uxf_merge_lib keeps a document as plain text beside an event graph: every insert and delete carries its id (agent, sequence) and the version it was made at (its parent events); a local edit applies directly, and a remote event whose parents equal the current version applies directly too; otherwise the library walks back from the current version and the new event to the last single common event, replays only the events after it into a temporary sequence-CRDT state (a prepare state and an effect state per record, retreat and advance between branches, the FugueMax integration order with the agent id as the tie-break) over a placeholder for the common text, emits the new event's effect on the text and discards the state; an event delivered before its parents waits and applies when they arrive; gate nx_uxf_merge_gate: two and three replicas converge under every delivery permutation of a fixed event set, concurrent inserts at one position resolve to one hand-derived order everywhere and two concurrently typed runs never interleave, a delete of concurrently inserted text and a concurrent delete of one character both resolve, re-delivery is idempotent and a reused id with other content is refused by name, the incremental merge equals a full replay from the root, a linear history never replays, a branch after a long shared prefix replays only the branch, and named negative controls show that applying raw positions diverges and that whole-document last-writer-wins loses text on the same fixture
Matrix cell	INTERACT: The event-graph text merge engine -- concurrent edits converge for any delivery order · `runtime/nx_uxf_merge_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_merge_lib`; declare `nx_uxf_merge_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 measure INCUMBENT CENSUS before any byte was written (nx_capsearch merge crdt text, nx_spendgate nx_uxf_merge_lib, nx_shelltool find over buildroot/runtime, 27498 files, corpus_complete=1): nx_crdt_seq.nx (an RGA sequence CRDT, a 512-element cap, no parent versions), nx_crdt_sync.nx (an op log over it, a 1024-op cap, deletes carry no id of their own) and runtime/_hdl_build/nx_coedit.nx (an RGA text CRDT over a file op log with a live sync server, a 65536-op cap, gates nx_coedit_gate and nx_coedit_live_gate, the engine UD8 names). All three keep the CRDT state for the life of the document and reference elements by id; the method UD12 names keeps plain text and positional events with their parent versions and replays only the concurrent span. That is a different op model, not an extension of RGA, so the engine is a new library (nx_uxf_merge_lib, function prefix uxm ABSENT-PROVEN over 27498 files with corpus_complete=1, the gate prefix umg and the relay prefix uxs likewise) and the incumbents stay untouched; UD19 extends the nx_coedit serve lane and UD8 moves onto the new engine through the lifecycle, never by deletion. The paper's full text was mirrored the same hour (knowledge/fetched/cmp_unidoc_egwalker_paper.pdf, 895150 B, sha256 6512c455be24dce0f86e276f4967e6d0fbf10b712315753425bba17b57703b79); the board row egwalker-eurosys25 still points at the abstract mirror 2026-10-04 land SHIPPED 2026-10-03, awaiting acceptance: buildroot/runtime/nx_uxf_merge_lib.nx (35325 B, sha256 5531fbeae444101ccf11566a61070ab6e6b1dc7748f51cc1774eb9f6517b1af3, prefix uxm) and buildroot/runtime/nx_uxf_merge_gate.nx (33817 B, sha256 a4bdb34d27269f98bcda1f157b8d368ac9b55a5be59ab26ac0e127e1fbdeb031, prefix umg), both compiled on their first build by the sovereign toolchain; gate GREEN 37/37 under --qualify and again in the ship loop (PROVE on a fresh build of this run), promoted sha 564a5c5abdcb79e077f42bae95321b852c6646dfd855a026bc1d44dd0f95bb93 (121208 B), _offc twin installed, registered callable (no schema row). nx_gate_bite over the library: the first compiling comparison mutant (byte 9624) was killed, the library restored byte-identical (35325 B), both twins restored, mutant_live=0, and the promoted gate still hashes 564a5c5a after the run. The library imports only nx_syscalls; the gate composes nx_gate_verdict. Not wired into nx_uxf_doc or any daemon (another seat owns the doc library; nothing deployed) 2026-10-04 measure values the gate emits (one run on the NAS): two-replica fixture of 7 events, all 5040 delivery orders converge to XYP with 0 mismatches against each other, against a full replay from the root, and against the hand-derived answer; 16562 merges replayed a concurrent span, 18718 applied directly, 20832 deliveries waited for a parent, the largest replay 5 events; the same sweep with every event delivered twice: 14448 duplicates, 0 mismatches. Three-replica fixture of 7 events: 5040 orders, cabed, 0 mismatches, largest replay 6. Three inserts at one index: 120 orders, aXYZb (lower agent first). Two concurrently typed runs: 720 orders, aXXYYb, never interleaved. Concurrent deletes around a concurrent insert: 24 orders, aQd. A delete of inserted text concurrent with an insert inside it: 6 orders, abRcd. A branch after a 13-byte shared prefix replayed 2 events over a 13-byte placeholder (15 events in the history); a linear history of 5 applied directly with 0 replays; a reused id refused with code -2; an index beyond the document refused with code -3 on the direct path and on the replay path, the replica unchanged both times; the valid positive control applied and landed at XYPZ. Negative controls on the same fixtures: applying raw positions gave a different text in 3108 of 5040 two-replica orders (4802 of 5040 three-replica), and whole-document last-writer-wins kept aXY and lost 1 byte of the merged XYP. Small fixtures only; no speed or size claim is made (header deviation 1: flat arrays, O(n) lookups) 2026-10-04 lesson the method's full text had to be read before the integration rule could be chosen: the abstract mirror the board cites (rf_73ccfb4d.raw) says nothing about it, while the paper (mirrored the same hour as knowledge/fetched/cmp_unidoc_egwalker_paper.pdf and read through nx_pdf_text) says its implementation uses a Yjs variant conjectured to be maximally non-interleaving, and that placeholders stand only for characters inserted and not deleted before the critical version. That length is not known before the replay, so the placeholder is sized from an upper bound and the real length is derived after the held events replay (L0 = U - (visible - text)) and checked; a remote index is then validated against real records only, which is what lets the replay path refuse an out-of-range index without touching the text 2026-10-04 queue next in order: (1) UD19 the relay, extending the nx_coedit serve lane: events carried by id with their parents by id, every request bracketed by sys_arena_mark and sys_arena_reset; (2) a merge verb on nx_uxf_doc and uxd_merge for UD12 (a block changed on one side taken, a block changed on both merged by uxm over its text) once the doc-format seat opens nx_uxf_doc_lib; (3) the engine's declared deviations as rungs: an order-statistic tree for O(log n) lookups, multi-event critical versions, the event-graph encoding of the paper's section 3.8; (4) UD8 moves from the nx_coedit RGA kernel onto this engine through the lifecycle; (5) the refs row egwalker-eurosys25 still points at the abstract mirror and should carry the full-text mirror (sha256 6512c455be24dce0f86e276f4967e6d0fbf10b712315753425bba17b57703b79) once the citation referee reads it; (6) UD18 has no matrix row on purpose: its rival cells must be assessed from mirrored pages before a watch row is added

UD19 A sync relay carries events between the clients of one document · cell PRESENT · gate NO-GATE-DECLARED

Contract	`uxs_relay` · executor Organ · 3 u · stands on UD18
Definition of done	A relay daemon over the sovereign HTTP stack keeps each document's event log append-only, accepts events from clients and answers each client with the events it lacks given the version it names, so every client merges through uxm_merge and the relay never transforms anything; it extends the incumbent relay lane in nx_coedit serve (cd_live_sync, which relays RGA op lines) instead of standing beside it, and nx_coedit is retired onto it through the lifecycle once its gates re-run; every request is bracketed by sys_arena_mark and sys_arena_reset; gate: three clients converge through the relay, a client that reconnects naming an old version receives exactly the events it lacks, a duplicate post is idempotent, an event posted to another document is refused by name, and steady-state address-space growth over a run of requests is zero pages
Matrix cell	INTERACT: A sync relay carries events between the clients of one document · `runtime/nx_uxf_sync_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_sync_lib`; declare `nx_uxf_sync_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 land SOURCE LANDED, NOT YET BUILT OR GATED: runtime/nx_uxf_sync_lib.nx (43416 B, contract uxs_relay) relays Eg-walker events untransformed -- every posted event goes through uxm_receive and its refusal is answered by the engine's own name (REFUSED-CONFLICT, REFUSED-POSITION, REFUSED-KIND, REFUSED-PARENTS) plus REFUSED-MALFORMED and REFUSED-DOCUMENT; a client names its version (the ids at its frontier) and receives every held event outside the causal past of that version and of what it just posted; each document keeps an append-only fsynced log at the logroot row of knowledge/uxs_relay.conf (a /tmp root is refused as volatile), a torn last line is refused by name and never written past, and the relay keeps no state between requests (each request replays the log, so a restart loses nothing). runtime/_hdl_build/nx_coedit.nx (36300 B) serve now hands any /uxs/ target to it on the incumbent loopback listener and keeps the RGA lane for every other target; shutdown now needs the exact /shutdown target (the old byte scan would have let a document id such as /uxs/shutter stop the server). Gate runtime/nx_uxf_sync_gate.nx (20382 B, in-process through the handler, no socket): three clients converge, a reconnecting client receives exactly the events it missed, a duplicate post leaves the log byte-identical, malformed and foreign-document and engine refusals pass through by name, a restart from the log alone equals the clients and a full replay, neg-controls last-writer-wins and raw-position relays bite on the same fixture, and the forked serving path shows zero pages of growth over a run. 2026-10-04 lesson READ FROM SOURCE, MEASUREMENT OWED: the arena bracket cannot bound a long-lived relay. nx_syscalls sys_mmap sends every allocation above NXA_SMALL_MAX (256 bytes) to a whole kernel mapping, and sys_arena_reset rewinds only the small band; the engine's vectors grow by copying into a fresh allocation and never free the old one, and its replay trackers are above the band, so the MEMORY line of nx_uxf_merge_lib (a long-lived caller brackets each request with sys_arena_mark and sys_arena_reset) does not hold for any request whose replica outgrows 256 bytes. The relay therefore serves each request from a forked child that exits (uxs_relay_forked), and the gate reports in_process_bracketed_pages_grown_over_the_same_run as a value beside the forked zero-pages tooth. The engine-side remedy (release on growth, a uxm_free) is the merge lib owner's, and only then can the relay answer in-process. 2026-10-04 queue BUILDS OWED, ONE AT A TIME AND ONLY ON nx_build_admit check = GRANT (admission returned QUEUE on every check this session: load1 20 to 22 against a 16.43 ceiling, caused by other lanes): (1) nx_sov_build_run nx_uxf_sync_gate --qualify --run-timeout-ms 120000, read every tooth and the values; (2) on GREEN, nx_organ_ship nx_uxf_sync_gate (tokens before --behavior-args); (3) nx_sov_build_run nx_coedit --build-only, then nx_sov_build_run nx_coedit_gate --qualify --run-timeout-ms 120000 as the RGA-lane regression (it runs the kernel verbs against buildroot/_build/nx_coedit.sov.elf). nx_coedit is BUILT-UNPROMOTED and its serve verb binds a port, so it is NOT promoted or deployed from a seat: the release owner lane (plan-toolsapi-release- style RACI, engineer R, architect A) adds an organ_kind row for it and promotes through the daemon path, with knowledge/uxs_relay.conf (landed, 451 B, root knowledge/uxsrelay/) in the serving directory. Retiring nx_coedit's RGA lane onto the relay through the lifecycle stays owed after that. 2026-10-04 land nx_uxf_sync_gate SHIPPED dfd04a69 (first promote, offc twin installed, registered schema=0), no source edits, GREEN 41/41 on the shipped artifact: three clients converge to 39 B, a reconnecting client receives exactly the 11 events it missed, a duplicate post answers 37 DUPLICATE with the 1188 B log byte-identical, a restart from the log alone equals the clients and a full replay (45 events), refusals pass through by name, a volatile or absent conf root is refused, neg-controls last-writer-wins and raw-position relay BITE-PROVEN, the forked serving path shows 0 pages of growth over 45 runs while the in-process bracketed path grew 6795 pages (the arena lesson of 1791086601 measured). nx_coedit --build-only 8f7efd1f 113136 B, NOT promoted (port-binding daemon, release-owner lane); RGA regression nx_coedit_gate GREEN 7/7 through /api/gate_run on that exact artifact. OPEN: the /uxs/ hand-off and the exact /shutdown target are compiled but not exercised through a socket; nx_coedit_gate reads RED 3/7 under the qualify lane because it opens buildroot/_build/nx_coedit.sov.elf relative to its CWD (gate defect: resolve the instrument on a root ladder and print the path) 2026-10-04 land nx_coedit_gate root-ladder fix SHIPPED c11b2ddb: the gate opened buildroot/_build/nx_coedit.sov.elf relative to its CWD, so the qualify lane (CWD buildroot) read RED 3/7 against an absent instrument while /api/gate_run (CWD nishihost) read 7/7; eg_resolve_ce now tries buildroot/_build/ then _build/ and the gate prints SUBJECT=<path> (or SUBJECT=ABSENT naming both roots). Proven both ways: qualify 7/7 GREEN with SUBJECT=_build/nx_coedit.sov.elf, ship-loop prove 7/7 with SUBJECT=buildroot/_build/nx_coedit.sov.elf; behaviour reviewed (+44 B = that one line); LOST only the two retired ENOMEM wordings. nx_coedit_live_gate carries the same bare path at four sites and is unchanged (its own lane)

UD20 Presence and remote cursors · cell WATCHING · gate NO-GATE-DECLARED

Contract	`uxm_cursor_transform` · executor Organ · 1.5 u · stands on UD18, UD19
Definition of done	A cursor or selection is a position at a named version and is carried to the current text by the same replay that carries an insert, so it stays beside the same character after concurrent edits on any replica; presence frames (agent, display name, colour index, cursor) travel through the relay, are never events and never change the document identity, and expire after an idle interval derived from the relay heartbeat cadence; gate: a cursor placed after a character stays after it when a concurrent insert lands before it elsewhere, a selection whose text is deleted collapses to the deletion point, a frame older than the derived interval is dropped, and the identity is unchanged by any number of presence frames
Matrix cell	INTERACT: Presence and remote cursors carried through the same replay as an edit · `runtime/nx_uxf_merge_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_merge_lib`; declare `nx_uxf_merge_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD21 Comments and suggested edits anchored to the text · cell WATCHING · gate NO-GATE-DECLARED

Contract	`uxm_suggest` · executor Organ · 3 u · stands on UD16, UD18
Definition of done	A comment is a range anchored to character ids (the marks of UD16) that survives edits inside and around it and is reported orphaned, never silently dropped, only when all of its text is deleted; a suggested edit is a branch of events in the same graph that accept merges and reject discards, each decision itself an event naming who decided; gate: a comment range survives a concurrent insert inside it and a delete beside it, an orphaned comment is listed, accepting a suggestion yields the same text as having typed it, rejecting leaves the text byte-identical to the main line, and two concurrent suggestions over one range are both kept as alternatives
Matrix cell	INTERACT: Comments and suggested edits anchored to the text, orphaned never dropped · `runtime/nx_uxf_merge_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_merge_lib`; declare `nx_uxf_merge_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD22 Per-document permissions: owner, editor, commenter, viewer · cell WATCHING · gate NO-GATE-DECLARED

Contract	`uxs_acl_check` · executor Organ · 2 u · stands on UD19
Definition of done	Roles are data on the document (an access record whose changes are themselves events), the relay checks every incoming event against the role of its authenticated agent (the estate session header, never a cookie) and refuses by name: a viewer reads only, a commenter adds comment events only, an editor adds text events, an owner changes roles; a revoked editor's later events are refused while the events accepted before the revocation stay in the history; gate: each role's allowed and refused event kinds with the refusal naming the rule that fired, a revocation that removes no history, and a positive control that an editor's event is accepted
Matrix cell	SECURE: Per-document permissions -- owner, editor, commenter, viewer, as events on the document · `runtime/nx_uxf_sync_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_sync_lib`; declare `nx_uxf_sync_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD23 Offline edits that merge on reconnect · cell WATCHING · gate NO-GATE-DECLARED

Contract	`uxm_since` · executor Organ · 2 u · stands on UD18, UD19
Definition of done	A client keeps its unsent events with the document (a native container attachment or a side log); on reconnect the client and the relay exchange versions, each sends what the other lacks (uxm_since answers the events after a version), and the merge replays only the concurrent span of the two branches; gate: two replicas that each edit offline for a run of events reconnect and converge to the text an always-online replica reaches from the same events, the replay zone covers the two branches and not the shared history, no event is lost or duplicated, and unsent events survive a restart of the client
Matrix cell	INTERACT: Offline edits that merge on reconnect · `runtime/nx_uxf_merge_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_uxf_merge_lib`; declare `nx_uxf_merge_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD24 Document outline: auto-numbered clauses, a navigation pane and live cross-references · cell PRESENT · gate NO-GATE-DECLARED

Contract	`dst_find_clause` · executor Organ · 1 u · stands on UD17
Definition of done	nx_doc_structure_lib derives the outline from the document's own headings: every heading gets a stable anchor and a clause number, the page carries a navigation pane beside the sheet on wide screens and a collapsed Contents block on phones (zero script, a details element), and a written reference such as Article 4 or Section 2.1 becomes a link to its heading; gate: anchors unique and deterministic, numbering matches the heading order, a reference to a missing clause is reported by name and never linked, the pane is hidden in print, and the page still carries no script
Matrix cell	INTERACT: Document outline -- auto-numbered clauses, a navigation pane and live cross-references · `runtime/nx_doc_structure_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_doc_structure_lib`; declare `nx_doc_structure_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 land the same leaf resolves written clause references (Article N, Section N) to the heading that declares them and reports a reference to a missing clause and a heading whose declared number is out of sequence (gate: Article 3 resolves to ordinal 2, Article 9 to DST_MISSING, 1 misnumbered heading). Wired into nx_doc_paginate_lib's line boxes (headings anchored s<ordinal>, definitions dfn id=d<i>, uses and resolved references as links, a missing clause flagged with a wavy underline and a title, every span closed and reopened across line boxes; the dry emission still equals the bytes written, pagination gate 107/107) and into nx_unidoc_lib as the opt-in layout=sheets with an outline pane (details element: pinned beside the sheet when the screen holds page-w + 2 toc-w + 4 gap, a contents list above it otherwise, hidden in print); viewer gate qualify ran 56 checks with all seven sheets teeth PASS and the flowing default unchanged (neg-control). Ships waiting on build admission (load 20.15 against 16.43) 2026-10-04 queue re-emit the alpha pages with layout=sheets once nx_unidoc ships; the sample will now carries five defined terms and two clause references (will.nxd cid private-ref:1dad2c43, 23 blocks); then a real-browser capture at 390 and 1440 px and a print check before any claim

UD25 Defined terms: every definition detected and every use linked back · cell PRESENT · gate NO-GATE-DECLARED

Contract	`dst_defs_collect` · executor Organ · 1 u · stands on UD24
Definition of done	nx_doc_structure_lib finds each definition written in the drafting convention (the "Term") or "Term" means, gives it an anchor, links every later use of the exact term to its definition, and reports terms used before definition, defined but never used, and defined twice; gate: known-answer counts on a fixture will, a capitalised word that is not a defined term is never linked, a term inside another word is never linked, hostile text in a term is escaped, and the report names every finding
Matrix cell	INTERACT: Defined terms -- every definition detected and every use linked back · `runtime/nx_doc_structure_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_doc_structure_lib`; declare `nx_doc_structure_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 land nx_doc_structure_lib (17,995 B, prefix dst_) finds defined terms in the drafting convention, (the "Term") or "Term" means, links every later use at word boundaries with the longest definition winning, and reports terms defined twice, never used and used before definition; gate nx_doc_structure_gate SHIPPED ccb71d6b 27/27 first build: known answers counted by hand on a fixture will (5 definitions, 6 uses, 1 early, 3 unused, 1 twice), Willow and Childish as neg-controls beside a positive control, the longest-match rule, lowercase and unclosed quotes refused as definitions, the report text naming each finding, a declared output bound and a determinism tooth

UD26 Discrete pages laid out by the estate from real font metrics · cell PRESENT · gate NO-GATE-DECLARED

Contract	`dpag_plan` · executor Organ · 2 u · stands on UD17
Definition of done	nx_doc_paginate_lib parses knowledge/doc_page.conf into milli-points, measures every word with the shipped face's hmtx advances through nx_ttf_fontlib, breaks paragraphs by Knuth-Plass total fit with greedy first-fit kept as the oracle, stacks lines into the text box with collapsing gaps, keep-with-next, widow and orphan control and unsplit table rows, and emits one zero-script sheet per page with a Page N of M footer; gate: hand-computed widths from the Times metrics, every line re-measured inside its measure, Knuth-Plass never dearer than greedy and equal to a brute-force enumeration, a hand page count, keep-with-next and widow and orphan control each bite, rows never split, the dry byte count equals the written bytes, and a width-ignorant fixed-pitch breaker overflows where Knuth-Plass fits
Matrix cell	UNIFY: Discrete pages laid out by the estate from real font metrics · `runtime/nx_doc_paginate_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_doc_paginate_lib`; declare `nx_doc_paginate_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 land shipped 2026-10-03: buildroot/runtime/nx_doc_paginate_lib.nx (61,173 B) and nx_doc_paginate_gate.nx (39,218 B); gate GREEN 107/107 under --qualify and again in the ship loop (PROVE fresh build), promoted sha 95f8016526eaceff97a56e94010fd5f28e2d34efcbe4ac3a5039428ceb40b93e, _offc twin installed, registered callable (no schema row yet). NOT yet wired into nx_unidoc_lib (another seat owns it): the viewer calls dpag_conf_read, dpag_plan_from_conf, dpag_err, dpag_emit_len, dpag_emit_css, dpag_emit_sheets. Awaiting acceptance 2026-10-04 measure under the real doc_page.conf (text box 468pt x 648pt, pitch 13.8pt): will 2 pages (45 lines, 8 table rows, one heading carried by keep-with-next), trust 1 page (37 lines, 12 rows), power of attorney 1 page (29 lines, 9 rows), 0 notdef; Liberation Serif advances read through fontlib equal the Times AFM hand sums for 15 glyphs (W 1933, m 1593, space 512, bold W 2048 of 2048 units); Knuth-Plass strictly cheaper than greedy on 99 of 369 measures swept 100pt to 468pt and never dearer; equal to brute force over all 2^11 break sets on 25 measures 2026-10-04 lesson a neg-control built on a guess was vacuous: at pica typewriter pitch (65 characters) a paragraph of plain capitals FITS the 6.5in measure in Times 12pt (0 of 4 lines over), so character count is a fair proxy for ordinary capitals; the bite needs glyphs wider than the average a count stands for (M and W words: 2 of 3 fixed-pitch lines over, Knuth-Plass 0 of 3). Measure the control before trusting it 2026-10-04 queue wire the sheets into nx_unidoc_lib in place of main.doc and its @page rule (owner seat); a font-italic conf row (I lines are measured with the regular face and counted); hyphenation through nx_hyphen; repeat a table's first row on a continuation page; kerning and ligatures measured from the face before the sheet CSS stops switching them off; a browser pixel referee comparing drawn line widths with the plan 2026-10-04 measure nx_gate_bite nx_doc_paginate_gate over nx_doc_paginate_lib.nx: verdict=GREEN, the first compiling mutant (comparison operator at byte 11560) was killed, the library restored byte-identical (61,173 B, sha256 4b8f3cf9...), both twins restored, mutant_live=0; the promoted gate still hashes 95f80165... after the run 2026-10-04 land PHONE REFLOW SHIPPED (operator surface): the sheets layout now emits TWO renderings from one document, the estate-laid Letter sheets (wide screens and print) and a reflowed copy for phones (anchor prefix r, its own outline nav), switched by a min-width derived from page-w and gap in doc_page.conf and by @media print; ids never shared between renderings. nx_doc_paginate_gate 97ee147d, nx_unidoc_gate b45bc7da 61/61 (teeth: phone copy has its own outline anchors and links; neg-control no id shared; width picks the rendering and print takes the sheets), nx_unidoc 9681bd18 then 141893ea (defined-term and reference link styles unscoped from .dpag-sheet so both renderings read the same; phone outline inset by the --doc-gap token). will, trust and poa re-emitted (18751, 15670, 13967 B, each 7 B under the previous emit as the CSS arithmetic predicts) and republished to andelinwest.com/alpha/docs/. Real-browser capture (nx_cdp_capture, 390x844 dsf 2 and 1440x900): the phone page fits the screen with no horizontal cut and the outline, term links and clause links work; the desktop page is unchanged. Awaiting operator acceptance

UD27 Clause-aware legal redline between two versions · cell PRESENT · gate NO-GATE-DECLARED

Contract	`drl_redline` · executor Organ · 2.5 u · stands on UD11, UD24, UD25
Definition of done	nx_doc_redline_lib compares two versions of a native document by clause identity (the anchors and numbers of UD24) and defined-term identity (UD25) instead of by characters: a moved clause is one move, a renumbering alone is no substantive change, a defined-term rename is one change that names every use site, an edit inside a clause is a character redline confined to that clause, and the zero-script redline page names both version identities; Word and LibreOffice compare and combine by characters [ms-compare] [lo-compare]; gate: a fixture will and its revision yield exactly the hand-derived change list (one move, one rename with its use count, one inserted clause, zero changes from renumbering), the same pair always yields the same list, a version whose bytes do not verify is refused by name, and a negative control shows a character diff of the same pair reporting the renumbering as a change on every clause it touched
Matrix cell	INTERACT: Clause-aware legal redline between two versions · `runtime/nx_doc_redline_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_doc_redline_lib`; declare `nx_doc_redline_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 measure RIVAL CENSUS 2026-10-03 of Microsoft Word (Microsoft 365 web and desktop, Current Channel 2609 of 2026-09-30 [ms-current-channel]), Google Docs (Workspace recap of 2026-10-02 [gws-front] [gws-docs-label]) and LibreOffice Writer (26.8.1.1 of 2026-09-16 [lo-core-tags]), every cell read from a mirrored page of the rival's own: 27 capabilities by 3 rivals is 81 cells, 55 assessed and 26 left unassessed and named. Word 12 Yes, 5 Part, 1 No, 9 unassessed; Google Docs 14 Yes, 3 Part, 1 No, 9 unassessed; LibreOffice 11 Yes (2 inferred from it being a desktop editor, labelled so), 1 Part, 7 No, 8 unassessed. Sources: [ms-track-changes] [ms-coauthoring] [ms-compare] [ms-accessible-pdf] [ms-copilot-word] [ms-crossref] [ms-fieldcodes] [ms-copilot-privacy] [ms-purview-audit] [gdocs-suggest] [gdocs-offline] [gdocs-product] [gdocs-esign] [gdocs-toc] [gws-gemini-comments] [gws-gemini-apr26] [gws-ai-privacy] [lo-collab] [lo-compare] [lo-pdf-export] [lo-crossref] [lo-condtext] [lo-signatures] [lo-redlining] [lo-autotext] [lo-navigator] [lo-versions]. The one capability none of the three carries on any page read is defined-term linking (UD25); the full table is knowledge/status/unidoc_rival_census_2026-10.md 2026-10-04 queue CENSUS ROWS MAPPED TO EXISTING RUNGS, not re-declared: real-time co-editing and presence to UD18 (engine shipped, awaiting acceptance), UD19 and UD20; comments and suggestions to UD21 and UD16; permissions to UD22; offline to UD23; version history to UD11 and the office save; outline, table of contents, clause numbering and cross-references to UD24; defined terms to UD25; page layout to UD17 and UD26; accessible tagged PDF and Word or ODF export to UD14; e-signature to UD13 and the shipped consent-gated version signing; what the law requires of the instrument to UD10. New rungs only where the estate can beat all three on a legal document: UD27 clause-aware redline, UD28 AI edit guard, UD29 law-traced assembly, UD30 offline-verifiable audit trail, UD31 clause index. Privacy (no training on content, local processing) is recorded in the census as a property and deliberately not claimed as an exceed (house law). Unassessed and owed: styles, tables and footnotes for all three, Word version history and offline (the fetched support URL answered 404), Google compare documents (the fetched answer URL answered 404), Google cross-references and assembly, LibreOffice comments and page layout. The LibreOffice 26.8 release notes and help site refused the sovereign TLS client (t12-ske-signature, status 0, on wiki.documentfoundation.org, www.libreoffice.org and help.libreoffice.org alike), so that column rests on the help source read from GitHub; that refusal is a defect for the TLS lane, not a rival fact. Footnotes and styles have no rung yet; UD24, UD25 and UD26 have no milestone row yet 2026-10-04 lesson support.microsoft.com and support.google.com/a answered the first fetch through a redirect (hops 1 and 2); the citation referee counts a redirected mirror against its open-redirect ratchet unless its canonical acquits it, so each page was fetched again at the canonical address its own head declares (hops 0) and only those mirrors are cited; the first mirrors stay in knowledge/fetched uncited. The UD28 matrix row is the only new watch row: UD27, UD29, UD30 and UD31 stay UNMAPPED until their Google Drive, Acrobat and Nextcloud cells can be assessed from mirrored pages (Google's compare page was not found and helpx.adobe.com answered 403) 2026-10-04 queue SOURCE-LANDED, NOT YET BUILT (stopped at the coordinator's usage-limit order; build admission read QUEUE twice, load 19.9 then 21.0 against 16.43, so no build was started). buildroot/runtime/nx_doc_redline_lib.nx (77,832 B, sha256 2d75dc6e...82201, prefix drl_, free by a corpus_complete grep) composes nx_doc_structure_lib (dst_declared, dst_ref_at, dst_def_at, dst_use_at, dst_defs_collect), uxdm_hirsch and uxdm_span_eq from nx_uxf_doc_merge_lib (exact LCS, called with rows the result owns so nothing leaks; uxdm_lcs mmaps rows per call and never frees them, a defect for that lib's owner), uxd_open/uxd_doc_cid/uxd_to_spec for verified native versions, and html_escape from nx_html_escape; buildroot/runtime/nx_doc_redline_gate.nx (29,941 B, 41 teeth: six hand-derived full change lists, determinism, page identities, zero script, hostile escaping, containers verified then compared, tamper and wrong identity refused by name, line-diff and character-diff negative controls, drl_free). OWED, in order: (1) nx_build_admit check until GRANT, then nx_sov_build_run nx_doc_redline_gate --qualify --run-timeout-ms 120000, one build in flight; expect compile fixes on a first build (never compiled); iterate to GREEN and treat any differing expected list as a question to answer from the fixture text, never by editing the expected list to match; (2) nx_organ_ship nx_doc_redline_gate, reading every LOST line before any allow_loss_v1; (3) land and measure rows with the gate values; (4) the viewer and the office (nx_unidoc verb, portal route) call drl_new, then drl_redline_nxd(r, a, na, expect_a, b, nb, expect_b) or drl_redline(r, spec_a, la, id_a, spec_b, lb, id_b), then drl_page(r, 0, 0) to size and drl_page(r, buf, n + 1) to fill (drl_changes for the TAB list), then drl_free(r); owned by another seat. DECLARED DEVIATION: the in-clause redline unit is the word, the rung text says character. 2026-10-04 land clause-aware redline: nx_doc_redline_gate SHIPPED c0406d68 (233952 B) 41/41 GREEN on first clean build, no edits: six hand-derived change lists byte-exact (insert plus move plus rename plus one renumbering of 5 articles; a redefined term; a removed term with 5 orphaned uses; REF-BROKEN; two REF-RETARGETED plus a redefinition; a word-level amount edit) and a version against itself reports nothing; the line-diff and character-diff neg-controls flag all 5 renumbered headings as changes; tamper -2 and wrong identity -4 refused by name; drl_free loses 0 allocations; nx_gate_bite killed=1, lib restored byte-identical. Declared deviation stays: the in-clause unit is the word. Viewer and office call sites are still owed 2026-10-04 land REDLINE PAGE ON THE OPERATOR SURFACE: nx_unidoc redline <a.nxd> <b.nxd> <out.html> [brand= changes= expect_a= expect_b=] (nx_unidoc_redline_lib, both versions verified before any write, the viewer chrome with brand, CSP and noindex) shipped e9ca861d then 413daa32; the page list now writes every change as one plain sentence through drl_wsentence in nx_doc_redline_lib (Article 4 Digital assets was added; Wording changed in Article 5 Specific gifts: 2 words added, 2 words removed; In Article 7 Guardian, the reference Article 8 points to a clause that does not exist; The defined term Personal Representative was renamed Executor: 4 uses read the new name and none was missed; 3 clauses renumbered (structure only, not substance): Article 4 to 5, 5 to 6, 6 to 7) with the machine kind kept in a data-kind span and the TSV change list byte-stable; nx_doc_redline_gate c648ea46 41/41, nx_unidoc_gate 37b46220 81/81 (redline_page_bytes 10014 -> 10428, list 560 unchanged). Fictional will_v2.spec and will_v2.nxd (private-ref:322c08fb, verified) added; published andelinwest.com/alpha/docs/will-redline.html (pub row 32; a malformed first put with the actor argument omitted was closed with its reason, history kept); real-browser capture at 390 and 1440 px reads cleanly. Awaiting operator acceptance 2026-10-04 land GUIDED TO EACH CHANGE IN READING ORDER (operator: "especially if guided to the changes"): the change list links each change to an anchored line in the document (Change k of n, its plain sentence, previous, next, all changes), and the numbers now follow the order a reader meets the changes. The first cut numbered them in the order the comparison found them, so on the alpha will the first change on the page read Change 5 of 6 and its next link skipped two changes; a real-browser capture showed it, no gate did. drl_rank runs the body's own walk once into a counting writer and every mark, anchor, neighbour link and list item reads that one order, so no second ordering exists to drift (the per-clause scratch mapping is gone too). nx_doc_redline_gate e349d927 GREEN 53/53 with three new teeth (numbered in reading order, list in document order, anchor equals label) bite-proven RED 50/53 against the old library (1 of 4, 0 of 4, 0 of 4) while the fixture-reached tooth passed; nx_unidoc de6cc2ef (gate 81/81); /alpha/docs/will-redline.html re-emitted and served, labels 1 to 6 down the page and the list in the same order, browser-checked phone and desktop. Shipped, awaiting operator acceptance. 2026-10-04 land TABLE ROWS READ AS CELLS: a redline table row printed its raw pipe separators run into the words; cells now carry a light divider (drl_wesc_cells) and a gate tooth asserts the divider and refuses the bare pipe (nx_doc_redline_gate 93e40e0a, then e349d927). Served on the alpha redline, browser-checked phone and desktop. 2026-10-04 queue the phone capture shows the targeted change line mid-viewport while the desktop capture puts it just under the header; not adjudicated whether that is the capture's paper-then-restore pass or the page, so settle it with a second capture method before touching scroll-margin 2026-10-04 land THE TWO DOCUMENTS SIDE BY SIDE (operator 2026-10-04: "the side by side should be the two documents side by side with the ability to explode out the changes with side by side logical on desktop and top vs bottom on mobile ... capabilities emitting from the nishi estate and not being handcrafted"): the redline's one walk now draws a second view. drl_page_body takes a view; a side-by-side row sets version a's clause beside version b's, each the clean text of its own version, with the row's change marks and, when the clause differs, a details disclosure that explodes it into before (the words version a loses) beside after (the words version b gains). An unchanged clause under one heading carries a dup twin so a stacked screen draws it once; a moved clause leaves a stub linking to its new row. Stacked is the redline sheet's own rule; two columns is the viewer's rule, written from the page conf (two measures of page-w less two margins plus three gaps, ud_compare_css), so no layout length lives in code. nx_unidoc redline views=all writes side by side, every change exploded and inline as three pages from one comparison, each with a view switch. nx_doc_redline_gate 257ccb77 GREEN 73/73 (20 side-by-side teeth: rows equal the line view's, exploded panels mark exactly the line view's inserted and deleted words while the clean columns mark none, the line view byte-identical through drl_page and drl_page_view, two neg-controls); nx_unidoc 7eb52207 (gate 99/99; behaviour IDENTICAL on a real render). Served at /alpha/docs/will-redline.html, -exploded.html and -inline.html; real browser: two columns at 1440 px, version a above version b at 390 px, exploded panels beside and stacked. The side-by-side teeth are not yet mutation-tested. Shipped, awaiting operator acceptance. 2026-10-04 measure the two-column threshold is the document's own measure: 2 x (8.5in - 2 x 1in) + 3 x 24px = 1320 px, so a 1280 px laptop gets the stacked layout. A narrower comparison column would be a THRESHOLD row in doc_page.conf with its calibration evidence, never a code change. 2026-10-04 queue renumbered clauses with unchanged text still draw twice on a phone (their headings differ); drawing the body once under both headings is the next refinement. Mutation-test the side-by-side and forward teeth (nx_gate_bite on nx_doc_redline_lib drl_sbs_row and nx_unidoc_lib ud_forward_page).

UD28 AI edits held to the document's structure before they can be accepted · cell LANDED · gate NO-GATE-DECLARED

Contract	`dgd_check` · executor Organ · 2 u · stands on UD21, UD24, UD25
Definition of done	nx_doc_aiguard_lib takes an AI-proposed edit as a suggestion (the branch events of UD21) with a declared target span and checks it against the document's structure graph (the clauses and references of UD24, the defined terms of UD25) before it can be accepted: every changed byte lies inside the declared span, no defined term, reference target, party name, amount or date outside the span changes, and a reference the edit breaks is named; a failing suggestion is refused by name and never applied; Word and Google Docs make AI edits reviewable but their pages describe no check of what an edit touched [ms-copilot-word] [gws-gemini-apr26], and frontier models silently corrupt long documents under delegation [arxiv-doc-editing]; gate: planted model outputs that rename a defined term outside the span, delete a clause a reference points to, and change an amount outside the span are each refused naming what was touched, an in-scope edit is accepted and its diff equals its declared span, and a negative control shows that applying the same outputs unchecked changes the term and reference report
Matrix cell	INTERACT: An AI-proposed edit to a legal draft is a suggestion checked against the document's structure before it can be accepted -- a defined term, cross-reference target, amount or date outside its declared span cannot change silently · `runtime/nx_doc_aiguard_lib.nx` · LANDED decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_doc_aiguard_lib`; declare `nx_doc_aiguard_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 queue SOURCE LANDED, NOT YET BUILT OR GATED (stopped at a usage limit; admission read QUEUE on every check, load1 18.5 to 20.5 against 16.43): runtime/nx_doc_aiguard_lib.nx (56922 B, sha256 d8160a9ce04b65aa56900f95d6cb9d175ea7be1e05e4e9314717fb7ceeeb6c60, contract dgd_check, prefix dgd ABSENT-PROVEN free over 27512 files corpus_complete=1) and runtime/nx_doc_aiguard_gate.nx (27673 B, sha256 c8ec96e44ca1e268717bbe3a6a40783c8fcee42f60c73a9179e51d38e25dac77, 76 teeth, helpers dgg). The lib composes nx_doc_structure_lib (dst_def_at, dst_use_at, dst_ref_at, dst_declared, dst_report) and nx_uxf_merge_lib (uxm_local applies an event batch). Rules, each a named REFUSE line: SPAN-INVALID, EVENT-REFUSED, EVENT-OUTSIDE-SPAN (held per event), HEADING-NUMBERING-CHANGED (anywhere, inside the span too), DEFINITION-REMOVED/ADDED/REDEFINED (outside the span), REFERENCE-BROKEN, REFERENCE-RETARGETED, TERM-USE-BROKEN, TERM-USE-CAPTURED, AMOUNT-OR-DATE-OUTSIDE-SPAN, WHITESPACE-OUTSIDE-SPAN (decided REFUSED: byte identity outside the span), TEXT-OUTSIDE-SPAN, SPAN-LINE-BREAK, STRUCTURE-NEW-FINDING; ACCEPT returns the trimmed diff. Five imprecisions declared in the header. BUILD AND SHIP STEPS OWED, ONE AT A TIME, ONLY ON nx_build_admit check = GRANT: (1) nx_sov_build_run nx_doc_aiguard_gate --qualify --run-timeout-ms 120000; on a compile failure fix the named line and rebuild, then read every tooth (expected primary rules: leak TEXT 14, rename TERM-USE-BROKEN 10, dropped definition DEFINITION-REMOVED 5, Article 4 to 9 REFERENCE-BROKEN 8, Article 4 to 1 REFERENCE-RETARGETED 9, heading renumbered HEADING 4, whitespace 13, amount 12, clause delete in span REFERENCE-BROKEN 8, in-span definition removal TERM-USE-BROKEN x3, own heading renumbered HEADING 4, Executor capture TERM-USE-CAPTURED 11, orphaned Will STRUCTURE-NEW-FINDING 16, newline in a byte span SPAN-LINE-BREAK 15, three invalid spans 1, events outside 3, engine refusal 2) and the printed values; a RED tooth is diagnosed from the report text, never by loosening the tooth; (2) nx_gate_bite nx_doc_aiguard_gate runtime/nx_doc_aiguard_lib.nx 2 to show a mutant dies; (3) nx_organ_ship nx_doc_aiguard_gate, reading every LOST line before any approval (a new organ has no live twin, so nothing should be lost); (4) land a measure row with the gate's values. CALL SITE RECOMMENDED, NOT WIRED and not verified to exist yet: the accept of a suggestion branch (UD21 uxm_suggest, unbuilt) is where dgd_check_events belongs, so no AI edit merges until the guard accepts it; until UD21 lands, whatever lane writes a model's proposed document back into a .nxd version (nx_uxf_doc save, the office save half of UD15) calls dgd_check(base, proposal, declared span) first and keeps the version unchanged on REFUSE. The matrix watch row _ABSENT_:dgd_check flips on the next regen because the symbol now exists; the flip is a receipt, not the proof, which is the gate above 2026-10-04 land AI edit guard: nx_doc_aiguard_gate SHIPPED 78cb8123 (159456 B) 76/76 GREEN on first build, no edits: all 17 fixture cases refused by the primary rule declared before the run, positive controls accepted with the diff rebuilding the proposal byte for byte, and 4 neg-controls show the structure report alone misses the text leak, whitespace, retargeted reference and changed amount, while plain text comparison alone accepts the touch-and-restore batch the event check refuses (e1_events=128, e3_events_outside=2); nx_gate_bite killed=1 (first-kill stop, one mutant). The call site (accept of a suggestion branch, or any lane writing a model's proposal into a .nxd) is still NOT wired 2026-10-04 land AI edit guard IN THE PATH: nx_uxf_doc propose <base.nxd> <proposal.nxd> <a> <z> <out.nxd> (or clause <k> for the k-th heading and its body) verifies both containers, runs dgd_check over their spec projections with the declared byte span of the base's projection, and writes a new version ONLY on ACCEPT -- rebuilt from the accepted projection, prev = base, the base title and fields kept, re-opened and compared byte for byte before the write; on REFUSE it prints PROPOSE-REFUSED <RULE> with the guard's own report, exits 1 and writes nothing. nx_uxf_doc af7f3c4f (probe IDENTICAL on verify; LOST only the reviewed .dpag-sheet link rule), nx_uxf_doc_gate 284b1948 67/67 (25 new end-to-end teeth: accept with prev and 9 of 10 blocks shared, TEXT-OUTSIDE-SPAN with no file, TERM-USE-BROKEN with no file, the clause form, SPAN-INVALID on a heading line, two named neg-controls). Live on the sample will: ACCEPT of an in-span insertion at byte 905; DEFINITION-REDEFINED refused (120 hours to 72 hours inside the Residuary Estate definition) with no output file. No nx_gate_bite pass yet on the new teeth 2026-10-04 queue BYPASS TO CLOSE: uxd_set_meta refuses b r n kind v but not prev, so from-spec then set prev <cid> creates an unchecked child of any base. Reserve prev in uxd_set_meta (merge and propose become the only writers of a parent link) and move the gate's xg_child helper off set prev; owed by the lib owner once the lanes compiling against nx_uxf_doc_lib are quiet; then bite the propose teeth 2026-10-04 land BYPASS CLOSED: nx_uxf_doc set now refuses prev by name (UXF-DOC-REFUSED set prev: a parent link is written only by merge and propose, which check the lineage; nothing written), so from-spec plus set can no longer forge a checked child; the library contract is unchanged because propose writes its parent link through uxd_set_meta after the guard accepts. nx_uxf_doc 97d542e1, nx_uxf_doc_gate 993dc383 70/70 (fixture reached, refusal with no output file, neg-control set title still writes); refusal witnessed live through the registered tool

UD29 Reproducible document assembly with the law behind each clause · cell WATCHING · gate NO-GATE-DECLARED

Contract	`das_assemble` · executor Organ · 3 u · stands on UD11, UD16, UD10
Definition of done	nx_doc_assemble_lib assembles an instrument from a native template whose blocks carry typed fields and conditions (the field keys of UD16): a validated answer set selects clauses deterministically, each conditional clause names its condition and, where the law engine demands it, the law row behind it (the answer UD10 composes), and the assembled document carries the template identity and the answer set as an attachment so it re-assembles to the same identity; Word fields and LibreOffice conditional text select text, and their pages describe neither keeping the answers nor naming why a clause is there [ms-fieldcodes] [lo-condtext]; gate: one answer set assembles to the same identity twice, changing one answer changes exactly the clauses whose conditions read it, a missing or mistyped required answer is refused by name, and every statutory clause names its law row
Matrix cell	INTERACT: Reproducible document assembly with the law behind each clause · `runtime/nx_docgen_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_docgen_lib`; declare `nx_docgen_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD30 An audit trail bound to the document that a third party verifies offline · cell WATCHING · gate NO-GATE-DECLARED

Contract	`dau_chain` · executor Organ · 2 u · stands on UD11, UD19, UD22
Definition of done	nx_doc_audit_lib records every view, edit, comment, suggestion decision, signature and export of a document as an append-only event naming the actor, the version identity and the hash of the event before it, and exports an audit report that verifies from the report alone with no server; Google Docs appends an audit trail page to a completed signature request and Microsoft Purview keeps an administrator log retained 180 days by default [gdocs-esign] [ms-purview-audit]; gate: a fixture history verifies, a deleted, reordered or altered event is refused naming its position, an event naming a version that does not exist is refused, the exported report re-verifies with no server, and every relay request that touches the document leaves exactly one event
Matrix cell	SECURE: An audit trail bound to the document that a third party verifies offline · `runtime/nx_doc_audit_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_doc_audit_lib`; declare `nx_doc_audit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD31 Clause index across the vault with stale-clause recall · cell PRESENT · gate NO-GATE-DECLARED

Contract	`dci_query` · executor Organ · 2 u · stands on UD11, UD24
Definition of done	nx_doc_clause_index_lib indexes every clause block of every vault document by its content identity and a normalised text fingerprint, answers which documents carry a given clause and at which version, and when a template clause is superseded lists every document still carrying the old one; Copilot and Workspace Intelligence search a tenant's files by prompt, not by clause identity [ms-copilot-privacy] [gws-gemini-apr26], LibreOffice AutoText stores reusable text for insertion [lo-autotext], and none of the three pages describes finding every document that uses a clause; gate: a fixture vault of documents sharing clauses returns exactly the documents and versions for each clause, a superseded template clause lists exactly the stale documents, a private document never appears in another tenant's answer, and an index rebuilt from scratch equals the incremental one
Matrix cell	INTERACT: Clause index across the vault with stale-clause recall · `runtime/nx_doc_clauseidx_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_doc_clauseidx_lib`; declare `nx_doc_clauseidx_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 land SOURCE LANDED, NOT YET BUILT OR GATED (admission QUEUE on every check, load1 19 to 22 against 16.43): runtime/nx_doc_clauseidx_lib.nx (39156 B, contract dci_query; the rung prose names nx_doc_clause_index_lib, the organ carries the shorter name and no matrix row maps dci_query yet) indexes every clause of a native container (a heading plus the blocks up to the next heading, uxd_open plus the dst_ outline leaf) as one canonical NXR1 row {w tenant, d document key, v version = manifest CID, o heading ordinal, t title, f exact fingerprint, n normalised fingerprint}. Exact fingerprint = cid_of a canonical record of the title with its declared Article or Section number stripped plus the body blocks' existing profiled CIDs, so an identical clause in two documents and a renumbered copy share it without re-hashing text; normalised fingerprint = lowercased words with punctuation folded and a number after Article or Section folded to one mark, for near-identical wording. Index = NCI1 framing of rows in strictly ascending byte order, so an incremental update (dci_add_doc replaces one document key) and a rebuild are byte-identical by construction, and dci_load refuses a reordered, duplicated or truncated index by name. Supersession is an authored NCS1 table {w tenant, a axis f or n, p old, r new}; DCI_Q_STALE lists the tenant's rows still carrying an old fingerprint. Every answer is scoped to one tenant and an empty tenant is refused. Store paths come from knowledge/doc_clauseidx.conf (599 B, nishihost root, rows index and supersede) and a /tmp path is refused as volatile; publication is temp file, fsync, rename. The segment store was read and not used for the index: its segment bytes keep write order and history, so equal row sets do not give equal bytes. Gate runtime/nx_doc_clauseidx_gate.nx (33055 B): a runtime vault of five documents in two tenants with the done-rule as teeth, full-population brute-force and version cross-checks, neg-controls (whole-text and line-number fingerprints miss the renumbered copy, unscoped scan, duplicated and truncated index, tampered document, /tmp conf row), and the three sample documents' clause counts re-derived from the spec projection. 2026-10-04 queue OWED AFTER THE GATE, NOT BUILT BY THIS SEAT: (1) a CLI organ nx_doc_clauseidx over the lib (this seat may not edit nx_uxf_doc*), verbs add <tenant> <key> <file.nxd>, query <tenant> exact or norm <fingerprint>, clause <tenant> <key> <ordinal> (prints f and n via dci_fp_of), stale <tenant>, supersede <tenant> f or n <old> <new>, rebuild <tenant> <list of key and path pairs>; each verb resolves the store with dci_store_path(knowledge/doc_clauseidx.conf, index or supersede), reads with dci_store_read (DCI_ERR_ABSENT means start from an empty index), and every read-modify-write holds one lease around read, dci_add_doc and dci_store_write, because two concurrent writers would otherwise lose one update at the rename (the lib is single-writer by contract); (2) the vault and portal wiring, owned by the viewer seat: on every document save call dci_add_doc(index, tenant, key, container bytes, n) then dci_store_write; the clause panel calls dci_fp_of for the clause under the cursor and dci_query(index, 0, tenant, DCI_Q_EXACT or DCI_Q_NORM, fp, hits, cap) and renders each hit's d, v and o; the stale view calls dci_query(index, sup, tenant, DCI_Q_STALE, empty key, hits, cap); a return above cap means the hit list is a prefix and must be re-asked with a larger cap; the tenant comes from the authenticated session, never from the request; (3) a matrix row mapping dci_query to runtime/nx_doc_clauseidx_lib.nx once the Google Drive, Acrobat and Nextcloud cells can be assessed from mirrored pages (the UD27 lesson keeps UD31 unmapped until then). 2026-10-04 queue BUILDS OWED, ONE AT A TIME AND ONLY ON nx_build_admit check = GRANT (every check this session read QUEUE, reason LOAD_AND_RUNQUEUE_POLICY, load1 18.4 to 21.6 and procs_running 17 to 25 against max_centiload 1643): (1) nx_sov_build_run nx_doc_clauseidx_gate --qualify --run-timeout-ms 120000 (compiles nx_doc_clauseidx_lib through its import; sources pinned sha256 76f80c02 lib 39156 B and b496fd7d gate 33055 B), read every tooth and the values; predictions written before the run: vault_rows 12, exact_hits_firm_a 2, normalised_hits_firm_a 3, exact_hits_firm_b 1, unscoped_carriers 3, stale_hits_axis_f 2, stale_hits_after_update 1, index_bytes_incremental equal to index_bytes_rebuilt and index_cid_incremental equal to index_cid_rebuilt, duplicate_row_refusal -104, tampered_document_refusal -7, volatile_conf_refusal -109, sample_rows_will 8, sample_rows_trust 4, sample_rows_poa 5 (heading counts read from the to-spec projections today); (2) on GREEN, nx_organ_ship nx_doc_clauseidx_gate, reading every LOST line before any allow_loss_v1 (a new gate has no live twin, so a loss is not expected); (3) nx_gate_bite nx_doc_clauseidx_gate nx_doc_clauseidx_lib.nx with the tenant filter, the title strip and the sort as mutation sites. Not deployed: a lib and a gate only. 2026-10-04 measure clause index: nx_doc_clauseidx_gate SHIPPED 5656781a (177456 B) 71/71 GREEN on first build, no edits; every predicted value matched (vault_rows 12, exact firm_a 2, normalised firm_a 3, exact firm_b 1, unscoped 3, stale axis f 2, stale after update 1, index 3752 B with cid private-ref:79e7e59b equal for incremental and rebuilt, refusals -104 -7 -109, samples will 8 trust 4 poa 5). Bite killed=1 in dci_fp_of but found two gaps: the DCI_ERR_TENANT literal survives (the tooth compares the code with the lib's own constant) and dci_err_name is never reached (the refused-by-name teeth check codes, not names) 2026-10-04 queue gate gap to close: add teeth that assert the refusal NAMES (EMPTY-TENANT and its siblings through dci_err_name) against literal strings, so a changed code or a broken name table goes RED; then re-bite. The CLI organ and the vault wiring of 1791087460 are still owed 2026-10-04 land clause index CLI: nx_doc_clauseidx 6ca83ec3 (add, query, clause, stale, supersede, rebuild; conf found in the working directory then its parent; one nx_lease_lib writer lease beside the index, lease_ttl_s=300 in doc_clauseidx.conf; re-asks above cap); nx_doc_clauseidx_gate 59aa4408 71 -> 160/160 GREEN: all 12 refusal codes held to literal names through dci_err_name and to literal wire integers, 63 CLI end-to-end teeth whose stores are byte-identical to the lib's own serialisation, a planted lease refuses add by name; nx_gate_bite killed=1 at dci_err_name (the function the first bite never reached). OWED: a tool_schemas row (registered, not discoverable) and populating the production index from a firm's vault

UD32 Words in this document: the legal words a document uses, marked at first use and explained beside it · cell PRESENT · gate NO-GATE-DECLARED

Contract	`udw_marks` · executor Organ · 2 u · stands on UD33, UD27
Definition of done	nx_unidoc_words_lib marks the first use of each word the Nishi Lexicon explains (the IRS estate terms, the federal courts' glossary in its general sense, and the dictionary senses that WordNet's own domain_topic relation files under law, chosen by knowledge/lexicon/view.conf with a calibrated least share of law senses) in the sheets and the phone copy, and lists every one in reading order in a panel with its sources' definitions, similar words and credits, the document's own definitions and references taking precedence; a reading interface that contextualizes ambiguous contract language with definitions while always foregrounding the original binding text made Terms of Service significantly easier to read and navigate in a within-subjects study (N=20) [termsight-2026]; gate: nx_unidoc_words_gate -- a sense outside the view never explains a word, a word whose law senses fall short of the share is not marked, a use inside a longer explained use is not marked while the later standalone use is, both renderings carry the marks, the panel escapes and credits, and without a view or an explained word the page is the viewer's byte for byte
Matrix cell	INTERACT: Words in this document -- the legal words a document uses, marked at first use and explained beside it · `runtime/nx_unidoc_words_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unidoc_words_lib`; declare `nx_unidoc_words_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 retract the first panel on the sample will glossed shows and give by a rare law sense (provide evidence for; accord by verdict). The view now asks a least share of law senses, a calibrated threshold in view.conf: give 23 permil, show 67, minor 83, will 167, witness 286, codicil and residuary 1000; any share from 84 to 167 selects the same words, 100 chosen inside that interval; the stated cost is minor (minor child) no longer glossed; re-calibrate on the trust and the power of attorney 2026-10-04 queue the matrix watch rows wait on a rival census read this month of the dictionary and thesaurus features of Google Docs, Microsoft Word, Acrobat and Nextcloud; estate words such as testator and intestate need a sourced estate glossary (WordNet files testator outside law), and the Utah Code definitions section (75-1-201) refused the sovereign TLS client earlier (rc -212); the flowing layout shows the panel without inline marks; the words gate passed every tooth on its first run and is owed a mutation bite 2026-10-04 land nx_unidoc promoted with words=on (unidoc gate 99/99, content ruler one-way gain, behavior identical on the default path); nx_unidoc_words_gate 37/37 (a weak-share word not marked, a table-first word marked at its first paragraph use, byte-for-byte negative controls); the three alpha documents re-rendered and published: the will explains will, codicil, personal representative (quoted from IRS Publication 559), residuary and witness (4 weak uses held back: show, give twice, minor); the certification of trust explains settlor (from its table) and trustee; the power of attorney explains will, power of attorney and notary. Served will page verified GREEN at 21,469 bytes; seen in Edge at 390 and 1440 pixels: the glossed words carry a blue dotted link to the panel, the will's own defined terms keep their links, and a word first used inside the will's own definition (Residuary Estate) is left to the will 2026-10-04 lesson a scan that reports each term once per line drops a word's later standalone use when its first use sits inside a longer explained term; the words layer now asks the lexicon for every use (lx_lex_scan_all), and the gate pins the standalone use

UD33 The Nishi Lexicon: dictionary, thesaurus and legal glossaries as one estate store with an MCP tool · cell PRESENT · gate NO-GATE-DECLARED

Contract	`lx_lookup` · executor Organ · 3 u · stands on UD11
Definition of done	nx_lexicon_lib keeps sorted stores of one row schema (term, part of speech, sense, domain, definition, synonyms, antonyms, example, source) searched by binary search, finds base forms through WordNet's irregular forms and morphy rules of detachment in their part of speech, scans a text for the terms a store holds (longest first, inflected uses included), and opens the sources a conf declares with every unreadable or unsorted source counted; nx_lexicon_lmf_lib ingests a WN-LMF wordnet with synonyms, antonyms, examples and each sense's domain from its domain_topic relation; nx_lexicon serves define, legal, synonyms, antonyms, lemma, scan, sources and the ingests on the MCP surface with a credit line per source; gate: nx_lexicon_gate -- fixture known answers for the store, the lookup and its negative controls, both ingests with every unresolved reference counted, the scan and the sources, and real-data teeth pinned to the ingested stores
Matrix cell	UNIFY: The Nishi Lexicon -- dictionary, thesaurus and legal glossaries as one estate store with an MCP tool · `runtime/nx_lexicon_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_lexicon_lib`; declare `nx_lexicon_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 land nx_lexicon promoted (gate nx_lexicon_gate 94/94), registered on the MCP surface, cap minted for 30 days (lexicon1004), MCP call verified: synonyms of revoke returned the dictionary's two synonym sets with the source credit. Stores: Open English WordNet 2025, 185,129 sense rows (partition: 185,129 senses = 185,129 rows + 0 without synset) with 7,988 antonym links and 9,656 domain topics, 0 unresolved, plus 4,473 irregular forms; the U.S. Courts glossary, 243 rows = 241 page terms + 2 abbreviations (ADR, AO), reconciled against the page's own term count; 5 estate rows quoted from IRS Publication 559 2026-10-04 lesson the first gate run caught a real ingest defect (an unresolved synset member counted once per pass, 2 for 1); the tooth was written before the fix and went RED then GREEN across it. The glossary ingest wrote a qualifier such as Insider (bankruptcy) as a second name, and the domain markers read civil and criminal cases as criminal; both fixed (abbreviations are capitals only; two courts rows ahead of the criminal markers) with teeth in both directions

UD34 Plain-language measures for a legal draft, reported per clause · cell PRESENT · gate NO-GATE-DECLARED

Contract	`plg_measure` · executor Organ · 2 u · stands on UD33
Definition of done	nx_plainlang_lib measures each clause of a draft: sentence length, passive constructions, shall where an obligation reads must, and legalese that a sourced data table pairs with a plain alternative (the federal plain-language guidelines, read and pinned first), reporting numbers per clause and no verdict until a threshold is calibrated on real drafts; gate: fixture clauses with hand-counted answers, plain text reading zero, and every suggestion naming its source row
Matrix cell	INTERACT: Plain-language measures for a legal draft, reported per clause · `runtime/nx_plainlang_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_plainlang_lib`; declare `nx_plainlang_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 measure the sources were read before a line of code: the plainlanguage.gov list of 237 Don't say and Say pairs [plainlang-simplewords] (its 12 bold rows match the page's own dirty dozen) and the Federal Plain Language Guidelines 2011 [fplg-2011] (must for requirements on p. 25; unnecessary words and doublets on pp. 38-39). Measured on the sample will through nx_plainlang measure: 8 clauses, 21 sentences, 307 words, longest sentence 24 words, 3 passives, 1 shall, 4 swaps each naming its source row; the numbers carry no verdict because no threshold has been calibrated on real drafts 2026-10-04 land nx_plainlang_lib + nx_plainlang (MCP: measure, swap, ingest-table, merge) shipped 43b34998 with nx_plainlang_gate 31/31 hand-counted (shipped a6cca37f, mutation bite KILLED): the swap table is data in the lexicon's own store schema (knowledge/plainlang/swaps.rows, 252 rows = 239 ingested + 13 read by hand, every row keeping its source and row or page), found by the lexicon's scan through word forms, so the dictionary and the measures share one engine; clauses are numbered as the page's data-c 2026-10-04 land reading the 2011 Guidelines exposed the PDF reader splitting words (Th e Pl ain L anguag e): nx_pdf_text now models the pen (glyph widths from /Widths or /W and /DW, Tc, Tw, Tz, Tm and Td) and breaks a word only at a measured gap of half a narrow space or a line change, reads hex strings, and has an ops verb; nx_pdf_text_gate 16/16 (synthetic fixtures with hand-computed positions plus the pinned Guidelines PDF) shipped with the reader a8e0ec57; the PDF viewer's gate stays 10/10 2026-10-04 lesson a source that cannot be read cleanly is a defect in the reader, not a reason to type its table from memory: the Guidelines PDF was unreadable through the estate's own extractor, the extractor was fixed from the ops dump (Word writes each word's pieces in separate text objects), and the clean text then showed its tables are laid out column by column, so those pairs were read by hand with page numbers while the HTML list was ingested mechanically with row numbers 2026-10-04 queue owed: a plain-language panel on the document page beside the words panel (per-clause numbers and swaps by data-c); calibrate any threshold only against real drafts and a published readability study read first; the residual PDF glyph with no Unicode map (an apostrophe drawn from a CID font without ToUnicode) needs the embedded font's cmap 2026-10-04 land the plain-language check is on the document page: nx_unidoc html <doc> <out> plain=on (or plain=<conf>) splices nx_unidoc_plain_lib's panel after the document, one row per clause (sentences, words, longest sentence, passive, shall, plainer wordings) and a whole-document row, then every plainer wording in reading order naming its guide and row [plainlang-simplewords] [fplg-2011], a credit with the licence and how each number is counted, and no grade; each clause name links to its own anchor in the sheets (s<k>) and the phone copy (rs<k>), so the focus mode lights the clause, shown by the viewer's own layout switch through .only-sheets and .only-reflow (the threshold is written once); the numbers come from a record sink in nx_plainlang_lib (one walk, capacity guarded, cleared after) and the spec from one shared reader ud_spec_read that the words panel now uses too. Shipped nx_unidoc 7d0ab5bd, nx_unidoc_plain_gate 599b30ca (54/54 hand-counted, mutation bite KILLED), nx_unidoc_gate 250e0612 (114/114), nx_plainlang 5224c000 (behaviour identical) 2026-10-04 measure served on the three alpha documents with the words panel: will 8 clauses, 21 sentences, 307 words, longest 24, 3 passives, 1 shall, 4 plainer wordings; trust 4 clauses and 4 wordings; power of attorney 5 clauses and 4 wordings; plain_over=0 and every clause linked on all three; Edge captures at 1440 and 390 show the panel, and the phone table scrolls inside its own frame (a data table may need two dimensions) 2026-10-04 lesson every gate was green and the page was still wrong: the first browser capture showed each wording broken onto its own line because the layout switch shows main and nav as blocks and the new classes rode the same declaration; a link is inline text, so .only-sheets got its own display:inline inside the same media block. A pinned tooth (the print rule's exact text) caught the switch change and was extended to the new rule at the same strictness, never loosened 2026-10-04 queue owed: mark plainer wordings and passives in the text itself (the paginator holds one mark set, so two sets is a paginator rung); a readability formula needs syllable counts and a source for them read first; a rival census (Word's readability statistics, Hemingway, WordRake, Grammarly clarity) before any matrix row; nx_unidoc_words_gate and nx_uxf_doc compile the changed libs and read BEHIND until shipped 2026-10-04 land closure caught up the same hour, so the BEHIND item in the queue row above is closed: nx_plainlang_gate 82a76434 (31/31), nx_unidoc_words_gate cfe9e9a5 (37/37, its fixture pages each exactly 95 bytes larger: the switch classes 65 and the inline declaration 30), nx_uxf_doc 305f6d21 (behaviour identical on its import workload); every importer of the changed libs is shipped (nx_absent over buildroot/runtime, coverage complete: nx_unidoc_lib 7 importers, nx_unidoc_redline_lib 2) 2026-10-07 land 2026-10-07 rung repointed from _ABSENT_:plg_measure to plg_measure and UD35 from _ABSENT_:ud_paper_css to ud_paper_css: the matrix rows landed the same day carry the bare symbols, so the ranker read both UNMAPPED (RANK unmapped=2) while the organs exist; a rung that keeps the _ABSENT_ prefix after its row lands is the dark contract seen from the other side

UD35 Focus and paper modes for a document page, zero script · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ud_paper_css` · executor Organ · 1 u · stands on UD17
Definition of done	a focus control that dims every clause except the one targeted or in focus (CSS :has and :target), and a paper mode for e-ink and slow-refresh screens chosen by the media query update: slow and by a reader toggle (black on white, no motion, heavier strokes), every value from knowledge/doc_page.conf; gate: the emitted CSS references every paper token it defines, the page carries no script, and update: slow selects the same declarations as the toggle
Matrix cell	INTERACT: Focus and paper modes for a document page, zero script · `runtime/nx_unidoc_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unidoc_lib`; declare `nx_unidoc_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-04 measure the focus dim is derived, not picked: nx_eink_tone ramp 16 lists the 16 panel levels, and the lightest that keeps WCAG 2.2 SC 1.4.3 AA over white is L* 46.66 = sRGB 111 (#6f6f6f measures 5.02:1 by nx_contrast; the next level #808080 measures 3.94:1); black ink at opacity .565 over white composites to 111, so a dimmed clause stays readable and lands on a panel level. The screen desk #e9eaed measures L* 92.69 (between levels 86.66 and 93.32, so a panel dithers it) and the screen rule #9aa0a6 measures 2.64:1; both are replaced in the paper view 2026-10-04 land focus and paper modes, zero script, every value a knowledge/doc_page.conf row: the paginator writes data-c on every line and cell and one rule per heading that dims every other clause through the consumer's --doc-focus (nx_doc_paginate_lib; gate 113/113 shipped f565d87b with six new teeth); nx_unidoc_lib writes the same on the phone's reflowed copy, the Focus control (ud_focus_css, armed by the focus-dim row), the Paper view (ud_paper_css: every eink-<k> row overrides token <k>, selected by @media update:slow, monochrome and prefers-contrast:more AND by the Paper view checkbox, written by one call so the two cannot disagree) and a stroke token thickened only in the paper view (no advance width changes, so pagination is identical); nx_unidoc_gate 114/114 with a byte-equality tooth for the two selections; a mutation bite on ud_clause_of was KILLED and the source restored byte-identical 2026-10-04 lesson a style rule shared by two layouts names both layouts on every page: the stroke rule written as main.doc,.dpag-sheet made the flowing page mention a sheet, and the existing negative control (a flowing page carries no dpag-sheet) refused the ship loop; the sheet rule is now written only on sheets pages. A negative control written for one rung caught a defect in a later one 2026-10-04 queue owed: calibrate eink-stroke (.25px chosen unmeasured) against a capture of this page on a panel; a served browser check of the focus state with the control ticked; matrix watch rows only after the rival census (Word Focus, iA Writer focus mode, the Kindle and Kobo weight controls), because an unassessed rival cell withdraws the page's position map

UD36 A Nishi text face for documents · cell WATCHING · gate NO-GATE-DECLARED

Contract	`_ABSENT_:nfont_text_set` · executor Organ · 5 u · stands on nothing
Definition of done	the sovereign-font ladder (nx_font_ttf_emit carries .notdef, space, H, I and T today) grown to the Latin text set a will and a trust use, re-parsed and checksummed like the R2 emitter, and compared for legibility against a published legibility study read and pinned first; gate: every glyph of the set present, metrics and checksums verified by re-parse, and the measured legibility comparison against the incumbent face
Matrix cell	UNIFY: A Nishi text face for documents · `runtime/nx_font_ttf_emit.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_font_ttf_emit`; declare `nx_font_ttf_emit TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

UD37 Word-processor editing in the browser, emitted by the estate · cell PRESENT · gate NO-GATE-DECLARED

Contract	`ude_page` · executor Organ · 2 u · stands on UD1, UD17
Definition of done	nx_unidoc edit emits an editing page for any document the unified page reads (nx_unidoc_edit_lib, on the viewer's own paper and tokens, settings from knowledge/doc_editor.conf): the estate's own client (web_assets/nishi_editor.js, loaded by a content-versioned URL under script-src self, no third-party code) edits headings, paragraphs, bold, italic, underline, bulleted and numbered lists and tables, keeps undo and redo, find and replace, paste from Word and Google Docs reduced to the document's own marks, the shortcuts those editors use and an outline, writes the page back to the office spec with inline marks as R lines, and keeps a draft in the reader's browser behind a restore banner; every viewer page links to its editor (edit=); gate: nx_unidoc_edit_gate renders the spec's marks, lists and tables to hand-written HTML, refuses unknown lines and bad runs by name, carries one self-only script and no inline handler, pins the content version, and keeps the find bar and banner hidden on load; journeys: nx_cdp_capture journey editor-will (33 steps), editor-trust and editor-poa (12 steps each) pass on a phone and a desktop door
Matrix cell	INTERACT: Word-processor editing in the browser, emitted by the estate · `runtime/nx_unidoc_edit_lib.nx` · PRESENT decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unidoc_edit_lib`; declare `nx_unidoc_edit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	2026-10-05 land operator: "i cant edit or use any of this like an actual word or google doc". The alpha pages were a read-only zero-script viewer and the office editor works line by line, so the estate now emits a real editor: nx_unidoc edit <doc> <out> doc= view= js= (nx_unidoc_lib's new edit= option adds an Edit this document link to every viewer page). Shipped: nx_unidoc_edit_gate 64d55def (40/40, new), nx_unidoc_gate 7c992980 (114 to 117/117: the edit link drawn, escaped, and absent when no editor is named), knowledge/doc_editor.conf (idle-ms 700, undo-steps 300, both THRESHOLD rows marked unmeasured). Published on andelinwest.com/alpha/docs/: will-edit.html, trust-edit.html, poa-edit.html (pub rows 43 to 45), nishi_editor.js (row 46, 38,241 B, sha cb11239e), the three viewer pages with their edit links and the index with an Edit a document section and an honest Where this stands row. Fictional samples, noindex 2026-10-05 measure served and driven in a real browser through nx_cdp_capture journeys (new step kinds js, type and key, with the key chords as data in nx_cdp_lib): editor-will 33 steps at the phone (390) and desktop (1440) doors, verdict OK: the client loads at its versioned URL, the page reads back to exactly its spec, typing lands in the text, Ctrl+B writes an R b line, two undos return the spec byte-equal to the baseline and redo restores it, Enter makes a paragraph, Ctrl+Shift+8 makes a list written as an L line, the draft reaches localStorage, a hostile paste keeps its text and drops span, script and handler, and replace-all is undone in one step; editor-trust and editor-poa 12 steps each, OK at both doors: Tab moves to the next table cell, typing in a cell reaches the spec, the row count is unchanged, one undo returns the baseline. Receipt blocks: will 15 blocks 8 rows, trust 7 and 12, poa 8 and 9, zero unknown lines and zero bad runs on all three 2026-10-05 lesson three defects that every gate passed and only the browser showed: (1) Chrome's insertUnorderedList writes the list inside the paragraph it started in, so the normaliser lifts a list or table out of a p or h2 before it touches leaves; (2) a browser keeps a cached script under the same URL, so a fixed client never reached the page until the emitter versioned the URL by the first 16 hex of the file's sha256 (two gate teeth); (3) an author display rule beats the hidden attribute, so the find bar showed on load and the phone toolbar wrapped to four rows until each overlay got its own [hidden] rule and the toolbar became one scrolling row (two gate teeth). A journey field longer than its 512-byte buffer had been read as empty and now refuses by name 2026-10-05 queue OWED: (1) UD38, saving edits to the firm with versions, compare and a Word download, needs a decision that is not a seat's: the office daemon serves admin.andelinwest.com/office to the firm, so wiring the save into it restarts a live client surface, while a separate alpha office instance would leave the firm's office untouched; (2) nx_cdp_capture and nx_cdp_lib ship with the seven new nx_cdp_capture_gate teeth for the js, type and key steps; (3) heading levels beyond one, nested lists, live page breaks while editing, comments and suggestions (UD21), and co-editing (UD8, UD19) in the editor; (4) a rival census read this month of Word for the web and Google Docs editing features before any matrix row, because an unassessed rival cell withdraws the page's position map; (5) the toolbar scrolls on a phone with no visible cue that more buttons sit to the right

UD38 The browser editor saves to the firm: versions, compare and a Word download · cell WATCHING · gate NO-GATE-DECLARED

Contract	`_ABSENT_:ude_save` · executor Organ · 2 u · stands on UD37, UD15, UD22
Definition of done	the editing page posts its spec to the office as a new native container version naming its parent (UD15), lists the versions, opens the clause-aware redline between any two (UD27) and downloads the current version as Word (UD14); gate: a save reopens with the new identity and names its parent, a save whose parent is no longer current is refused by name and offered the merge, a viewer-role session cannot save, and the download opens in an outside reader
Matrix cell	INTERACT: The browser editor saves to the firm -- versions, compare and a Word download · `runtime/nx_unidoc_edit_lib.nx` · WATCHING decl
Gate	NO-GATE-DECLARED — `knowledge/organ_gate.conf` carries no row for `nx_unidoc_edit_lib`; declare `nx_unidoc_edit_lib TAB <gate>` and the ship loop proves it and the verdict lands here.
Work log	no log row names this rung yet

dossiers=38 cells_joined=38 no_matrix_row=0 (sum 38) gates_recorded=0 gates_unrecorded=0 no_gate_declared=38 (sum 38 of cells_joined) evgates=UNSTAMPED

Capability comparisons

Compare the field, search individual capabilities and open their source and adoption evidence. Documented presence does not establish comparative quality.

Position map — centrality and distinctiveness

The four-quadrant map the field uses for brand strategy (Dawar and Bagga, HBR June 2015), re-derived from this matrix on every publish. Centrality is the share of the category's feature mass a player covers, each feature weighted by how many hold it; distinctiveness is the average lead over each rival on the rows the player holds; breadth is the depth-weighted share of the whole matrix (the bubble); depth is how deeply the rows held are held; momentum is the day-over-day move off the spine (green rising, red falling, grey until day two); the dashed path runs first day → previous day → today. Dividers are the category means. Axes are fitted to the field of play, so read the tick numerals, not the frame. Rival marks are documented presence, so a rival's position reads the record, never its quality. The picture grades its own readability below; the table beside it is the same data for a screen reader or a second method.

Rows. 51 feature rows mapped of 64 matrix rows; 13 substrate rows (kernels, bounds and instruments the plan's rungrole marks substrate) are the estate's scaffolding, not category features, and stay off the map

Views. 2D cut: centrality, distinctiveness · 3D cube: centrality, distinctiveness, breadth · axes registered: centrality, distinctiveness, breadth, depth, momentum · a board picks its own in knowledge/compare/unidoc.cdmap (cut|x|y, cube|x|y|z); absent = the HBR defaults

bubble area = breadth · ring = momentum (green rising, red falling, grey until day two) · dashed = category means · axes fitted to the field of play: centrality 300–1000, distinctiveness 100–450 of 0–1000 permil (the full range put every player in one corner)
readability of the 2D cut, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 1 (a fact of the data: two players that close are that close) · data spread 687 permil of the plot · quadrant words unseated 0
text contrast, measured with wcag2-ratio (floors from contrast.conf), light theme: labels 16.24 (floor 4.50) · notes 16.24 (floor 4.50) · quadrant words 5.89 (floor 4.50) · tick numerals 5.89 (floor 4.50) · axis titles 5.59 (floor 4.50) · dark theme: labels 13.78 (floor 4.50) · quadrant words 5.55 (floor 4.50) · axis titles 5.97 (floor 4.50) · dark classes under their floor 0 (one figure serves both themes: a dark shortfall is a token to fix, never a class to hide) · classes refused under their floor 0 (a refused class is not drawn; the scale classes are measured, never hidden) · export: SVG PNG (receipt, rendered by the estate's own rasteriser from this page)

axes fitted: centrality 300–1000 · distinctiveness 100–450 · breadth 100–700 permil · farther bubbles are painted first, nearer ones over them · the floor shadow is each bubble's (x, y) at height 0
readability of the 3D cube, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 1 · unresolved labels 0 · mark overlaps 2 (a fact of the data: two players that close are that close) · data spread 206 permil of the plot

Nishi Google Drive Microsoft 365 web Adobe Acrobat web Nextcloud Hub
10 panels over 5 registered axes, every pair once (the lower axis on x, the higher on y) · each panel fitted to its own field of play, first and last tick numerals shown · no labels in a small cut, the legend names the colours; the grade below reports the mark terms only (MM summed over the panels, spread averaged)
readability of the small multiples, self-graded by the layout ruler: label overlaps 0 · labels over marks 0 · off-canvas 0 · unresolved labels 0 · mark overlaps 3 (a fact of the data: two players that close are that close) · data spread 639 permil of the plot

Player	Quadrant	centrality	distinctiveness	breadth	depth	momentum	Rows held	Days on spine	First seen
Nishi	Unconventional	751	381	516	731	-8 since 2026-10-07	36	14	2026-09-15
Google Drive	Aspirational	913	241	509	684	+16 since 2026-10-07	38	14	2026-09-15
Microsoft 365 web	Aspirational	919	237	503	658	+40 since 2026-10-07	39	14	2026-09-15
Adobe Acrobat web	Peripheral	428	156	196	625	-102 since 2026-10-07	16	14	2026-09-15
Nextcloud Hub	Mainstream	807	145	366	583	+5 since 2026-10-07	32	14	2026-09-15

Day	Matrix rows reviewed	Players recorded
2026-09-15	36	5
2026-09-16	36	5
2026-09-17	36	5
2026-09-18	36	5
2026-09-19	36	5
2026-09-20	36	5
2026-09-21	36	5
2026-09-22	36	5
2026-09-23	36	5
2026-10-03	36	5
2026-10-04	33	5
2026-10-05	34	5
2026-10-07	53	5
2026-10-08	53	5

How to read this evidence. A Nishi source mark records whether the named symbol is declared in the selected source file. It does not establish working behavior or accepted delivery. A watching tag names an expected source entry; discovering it updates source coverage only. A dark tag means the file exists but the named symbol was not found: inspect the source and contract before assuming the capability is missing or renaming code. Peer codes are authored assessments; unassessed means no comparison is established, not absence. Qualification, deployment identity, runtime observations and acceptance must carry their own evidence. Adoption records the catalog's observed path through source, build, promotion, registration and invocation; libraries use importer evidence and gates use declared execution surfaces. A full catalog path does not establish quality, freshness or a successful user outcome. Partial and unknown states retain their stated next action. Census stamps: importers asof 1790637268, gate census asof 1790104131 (unix seconds; -1 = census absent).

Capability matrix — measured against source

◉ authored stronger claim; source present● present◐ partial○ absent? unassessed; excluded from relative comparison · click any capability for its evidence

Peer cell coverage: authored assessed 256, unassessed 0. Authored assessments are not verified outcomes.

Capability	Nishi	Google Drive	Microsoft 365 web	Adobe Acrobat web	Nextcloud Hub
OPEN
Word .docx opened as a page (paragraphs, headings, tables) Measured: `dx_to_html` exists in `runtime/_hdl_build/nx_docx.nx`, verified at emit. Own OPC reader over ECMA-376 [ecma-376]: headings, bold and italic runs, tables, a download link, zero script. Drive and Microsoft 365 open Word files in the browser [google-drive-view] [m365-web]; Nextcloud needs a bundled office app (Part) [nextcloud-server]; Acrobat is PDF-only (index-level) [acrobat-web] Adoption: `RUN-BY:fork:nx_doc_view_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	◐
Word .docx read -- own OPC/ZIP reader, text runs extracted Measured: `docx_read_text` exists in `runtime/_hdl_build/nx_docx.nx`, verified at emit. docx_read_part unzips STORED and DEFLATE parts of the OOXML package [ecma-376] and docx_read_text extracts the w:t runs, the text stage the import and the page above stand on; text-level (no structural DOM) with a 1 MiB read cap declared in source. The rival cells are the same feature as the row above (opening a Word file) and inherit its witnesses: Drive and Microsoft 365 open Word files in the browser [google-drive-view] [m365-web], Nextcloud through a bundled office app (Part) [nextcloud-server], Acrobat PDF-only (index-level) [acrobat-web]. Moved here from /compare/legalpractice 2026-10-07 (ecosystem EC89: a document capability is graded on the document board) Adoption: `RUN-BY:fork:nx_doc_view_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	◐
Paragraph-faithful Word extraction -- headings, paragraphs and table rows kept as structure, not a run soup Measured: `docx_read_spec` exists in `runtime/_hdl_build/nx_docx.nx`, verified at emit. docx_read_text joins every w:t run with a newline (a bold word shreds its paragraph into three lines); docx_read_spec keeps paragraph boundaries, maps Heading and Title styles to H, table rows to T with cells, everything else to P, decodes entities and keeps UTF-8 punctuation intact -- the spec verb the import consumes. Rival cells inherited from the dx_to_html row (the same feature, opening a Word file, the same witnesses [google-drive-view] [m365-web] [nextcloud-server] [acrobat-web]). Moved here from /compare/legalpractice 2026-10-07 Adoption: `RUN-BY:fork:nx_doc_view_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	◐
OpenDocument .odt opened as a page Measured: `odt_read_text` exists in `runtime/_hdl_build/nx_odt.nx`, verified at emit. ODF 1.3 content.xml read natively [odf-1-3]; the spec verb keeps headings. Drive and Microsoft 365 open .odt; Nextcloud through its office app (Part); Acrobat No (index-level) Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run. not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web, Nextcloud HubCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run	●	●	●	○	◐
PDF opened as a page -- text layer reflowed, figures and layout not painted Measured: `pf_to_html` exists in `runtime/_hdl_build/nx_pdf.nx`, verified at emit. Honest v1: the proven extractor's text layer with a language filter; page layout, fonts and figures are the pf_page_layout watch below. Acrobat is the reference (Best, index-level) [acrobat-web]; the open in-browser bar is PDF.js [pdfjs] Adoption: `RUN-BY:fork:nx_pdf_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Adobe Acrobat web (leads)	●	●	●	◉	●
Markdown opened as a page Measured: `md_to_html` exists in `runtime/_hdl_build/nx_md_lib.nx`, verified at emit. Headings, lists, code fences, quotes, tables and inline marks with every byte escaped; shared by the Linux dispatch and the NishiOS app layer (no process fork there, so the renderer LINKS). Nextcloud renders Markdown in its text app [nextcloud-server] [nextcloud-text]; Drive showed it as plain text until October 5, 2026, when Google announced preview, edit and collaboration on Markdown files natively across Drive and Docs (Yes, re-graded 2026-10-07 by the rival census) [gws-front-oct] Adoption: `LIB-WIRED importers=2 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Microsoft 365 web, Adobe Acrobat web; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	○	○	●
CSV opened as a table Measured: `cv_to_html` exists in `runtime/_hdl_build/nx_csv.nx`, verified at emit. Quoted cells and doubled quotes handled, first row the header. Drive and Microsoft 365 open CSV in the sheet viewer; Nextcloud in its viewer rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-UNAUTHORISED` — PARTIAL: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_browser_doc_gate -- a mention, not a run. not adopted: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_browser_doc_gate -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat webCons not adopted yet: registered, no cap ever minted; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_browser_doc_gate -- a mention, not a run	●	●	●	○	●
Spreadsheet .xlsx opened as a page with its charts rendered Measured: `xlsx_to_html` exists in `runtime/_hdl_build/nx_xlsx.nx`, verified at emit. Own SpreadsheetML reader with shared strings, chart HTML and the office's formula engine behind it; Nextcloud through its office app (Part) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run. not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web, Nextcloud HubCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run	●	●	●	○	◐
Presentation .pptx opened as a page Measured: `pptx_to_html` exists in `runtime/_hdl_build/nx_pptx.nx`, verified at emit. Own PresentationML reader, one section per slide; Nextcloud through its office app (Part) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `PROMOTED-UNREGISTERED` — PARTIAL: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run. not adopted: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web, Nextcloud HubCons not adopted yet: a real binary nobody can call over MCP: /api/tools/register it; no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by unpromoted-source -- a mention, not a run	●	●	●	○	◐
Registry-dispatched renderers -- adding a format is one data row and one focused organ, the dispatcher never changes Measured: `dv_lookup` exists in `runtime/_hdl_build/nx_doc_view.nx`, verified at emit. knowledge/doc_viewers.conf maps an extension to a renderer organ that shares one interface; the rivals' converters are inside their apps (Yes) and Acrobat has one format rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:fork:nx_pptx_gate` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	●
UNIFY
One page for every kind -- the office's own document model (H, P, T, B, I blocks) rendered as a zero-script page with a fail-closed policy and the portal's actions as plain forms Source present; authored stronger claim: `ud_render_path` in `runtime/nx_unidoc_lib.nx`, verified at emit. Exceed with the why: a .docx, .odt, .pdf, .md, .csv or .txt becomes the SAME page shape over the SAME model the office edits, versions and signs, so view, edit, annotate and sign are one surface rather than four; the rivals each open a document inside their own app (Yes) and none of the four shares a model between viewer, editor and signer. Landed 2026-09-03 (UD1): nx_unidoc_gate 28 teeth, refusals named (UNKNOWN-KIND, REFUSED-HTML, RENDERER-FAILED, TOO-BIG, READ-FAILED, OUT-CAP) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Source symbol found; stronger capability claim is authored; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	◉	●	●	●	●
A web page is refused as a document -- .html is served as itself, never wrapped Measured: `ud_kind_of_ext` exists in `runtime/nx_unidoc_lib.nx`, verified at emit. The distinction the unified portal rests on: a page is a page and a document is a document, and the kind table says which is which; a rival viewer wraps an uploaded .html as a preview (No on this row means they do not refuse) Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Every format organ composed through its promoted spec verb, never re-implemented Measured: `ud_spec_from_fork` exists in `runtime/nx_unidoc_lib.nx`, verified at emit. The docx and odt spec verbs the office import already runs are captured with nx_tool_run; the PDF text layer through the proven extractor; Markdown, CSV and text folded here because their grammar is the model's grammar. A property of the estate, not a rival capability Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
SECURE
Untrusted document text escaped by construction -- a document that contains the text of a script tag renders as that text Measured: `ud_esc_n` exists in `runtime/nx_unidoc_lib.nx`, verified at emit. Five characters become references before any byte reaches the page; bite-proven (fires on angle brackets, silent on plain text). The field reaches the same safety by sandboxing an embedded frame [whatwg-sandbox]; the sovereign page has no script surface at all Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Document page ships a fail-closed Content-Security-Policy -- default-src none, form-action self, base-uri none Measured: `ud_page` exists in `runtime/nx_unidoc_lib.nx`, verified at emit. The meta policy [csp3] forbids every script and every foreign fetch even if a byte slipped past the escaper; the rivals' viewers are script-driven applications behind their own policies (Part: their document cannot run script, their app must) Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	◐	◐	◐
Renderers out of process -- a malformed document cannot take the browser down Measured: `dv_run` exists in `runtime/_hdl_build/nx_doc_view.nx`, verified at emit. The dispatcher fork-execs the renderer; the rivals convert server-side, isolated by construction (Yes) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `RUN-BY:fork:nx_pptx_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Byte-exact original always served beside the page, header-injection safe Measured: `nx_doc_serve_response` exists in `runtime/nx_doc_serve.nx`, verified at emit. Content-Length framing round-trips embedded CRLFCRLF and NUL, a malicious filename cannot inject a header, unknown types download rather than render rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=6 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	●	●
Input ceiling announced, never a silent cut -- a document above the named cap is refused with the number Measured: `ud_check_size` exists in `runtime/nx_unidoc_lib.nx`, verified at emit. 8388608 bytes per page, refused as TOO-BIG with the ceiling in the message; the rivals publish per-format size limits in help pages and truncate or fail without naming the bound in the viewer (No on this row means the refusal is not named) Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
Owner usage policy travels with the document -- public search, AI derivation, external share as flags on the immutable plane Measured: `dp_may` exists in `runtime/_hdl_build/nx_docportal_lib.nx`, verified at emit. Sharing controls exist in every rival; a consent flag for AI derivation is not on their mirrored pages (Part) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=16 nonval=8` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	◐	◐	○	◐
Private vault isolated from the public search index, proven Measured: `dp_ingest` exists in `runtime/_hdl_build/nx_docportal_lib.nx`, verified at emit. A private upload is absent from the public store and the public search source by construction rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=16 nonval=8` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	●
NATIVE
The Nishi browser opens a document it navigates to, inline, instead of dead-ending on a download Measured: `br_doc_conv` exists in `runtime/_hdl_build/nx_browser.nx`, verified at emit. A registered extension diverts the fetched bytes through the dispatch and the browser paints the renderer's page; proven live on a .docx URL through the sovereign TLS stack. The rivals open documents inside their web apps (Yes); no third-party browser opens a .docx URL as a page rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `REGISTERED-DARK` — PARTIAL: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_browser_doc_gate -- a mention, not a run. not adopted: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_browser_doc_gate -- a mention, not a run Pros Implementing source symbol found; runtime acceptance separateCons not adopted yet: callable, authorised, completed MCP invocation not established by supplied journal window; lifetime history unknown (direct execution may be recorded elsewhere; this scan does not establish lifetime use); no execution surface runs it either (clock, cron, daemon, roster, actlog and surfaced forks checked); only referenced by nx_browser_doc_gate -- a mention, not a run	●	●	●	●	●
NishiOS opens a document from boot with the same renderer linked in -- no file browser, the OS window is the page Measured: `nd_reg_render` exists in `runtime/_hdl_build/nx_nishios_docview.nx`, verified at emit. The on-OS registry routes an extension to a linked renderer and br_layout paints the NISHI DOCS window; the rivals have no OS surface (No) Adoption: `BUILT-UNPROMOTED` — PARTIAL: compiled, never promoted to the serving root: /api/promote it. not adopted: compiled, never promoted to the serving root: /api/promote it Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: compiled, never promoted to the serving root: /api/promote it	●	○	○	○	○
The Nishi browser submits the document page's forms natively -- annotate, sign and share without a client script DARK — `runtime/_hdl_build/nx_browser.nx` EXISTS but does not declare `br_form_submit`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The page's actions are plain forms so the sovereign browser can carry them; the browser's form-submission leg is the contract (UD3). The rivals' apps are interactive through their own script (Yes) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching br_form_submit Pros none measured yetCons behind Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; open contract; expected source declaration not established	○	●	●	●	●
NishiOS portal index -- the vault listing as the desktop's document window, the file browser retired DARK — `runtime/_hdl_build/nx_nishios_docview.nx` EXISTS but does not declare `nd_portal_index`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The OS-side twin of the portal index (UD6); the rivals have no OS dossierwatching nd_portal_index Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
PORTAL
The vault index is the file browser -- a page listing documents by matter and folder with search Measured: `dad_handle` exists in `runtime/_hdl_build/nx_docportal_admin_daemon.nx`, verified at emit. LIVE at admin.andelinwest.com: invite-gated login, no cookies, public versus private uploads, private uploads absent from public search. Drive, Microsoft 365 and Nextcloud are the index references (Best) [google-drive-view] [m365-web] [nextcloud-server]; Acrobat lists PDFs only (index-level) Adoption: `LIVE-DAEMON` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Google Drive (leads), Microsoft 365 web (leads), Nextcloud Hub (leads)	●	◉	◉	●	◉
Office home with folders, stars, thumbnails and versions Measured: `of_home` exists in `runtime/nx_office_serve.nx`, verified at emit. Zero-script server-rendered browse, open, version and diff; the rivals' home surfaces are the reference (Best) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web; fully adopted on the estate ladderCons behind Google Drive (leads), Microsoft 365 web (leads), Nextcloud Hub (leads)	●	◉	◉	○	◉
One URL per document composing the page, the original, versions, annotations, signature and share -- served by the portal daemon DARK — `runtime/_hdl_build/nx_docportal_admin_daemon.nx` EXISTS but does not declare `dad_unidoc`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The daemon route that hands a vault document to ud_render_path with its portal base so the forms post back to the same daemon (UD2); each rival has one document page inside its app (Yes) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching dad_unidoc Pros none measured yetCons behind Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; open contract; expected source declaration not established	○	●	●	●	●
Import a Word or ODF file as a versioned document Measured: `of_import` exists in `runtime/nx_office_serve.nx`, verified at emit. POST /import keeps the original bytes as v1 and extracts the spec; a genuine Microsoft Word document proven live rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	●
Mobile-first page -- one column, 24 by 24 CSS pixel targets, wide tables scroll in their own container, no horizontal page scroll Measured: `ud_css` exists in `runtime/nx_unidoc_lib.nx`, verified at emit. WCAG 2.2 AA target size and single-column layout with the house tokens referenced, never merely defined [wcag22]; the rivals' mobile viewers are their strongest surface (Best) Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; fully adopted on the estate ladderCons behind Google Drive (leads), Microsoft 365 web (leads), Adobe Acrobat web (leads), Nextcloud Hub (leads)	●	◉	◉	◉	◉
INTERACT
Edit as a new version, restore as a new version, diff served Measured: `of_save` exists in `runtime/nx_office_serve.nx`, verified at emit. Append-only manifest; the exceed for never-lose versioning is claimed on /compare/office and not re-counted here. Microsoft 365 hands editing to its Word app (Part); Acrobat edits PDF only (index-level, No here) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them Adoption: `LIB-WIRED importers=5 nonval=2` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Microsoft 365 web, Adobe Acrobat web; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	◐	○	●
Real-time co-editing inside the office DARK — `runtime/nx_office_serve.nx` EXISTS but does not declare `of_coedit`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The RGA CRDT is built and gated in nx_coedit.nx and not yet imported by the office (UD8 shares the contract with the legalpractice rung LP14); Drive and Microsoft 365 co-edit natively (Best) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching of_coedit Pros none measured yetCons behind Google Drive (leads), Microsoft 365 web (leads), Nextcloud Hub; open contract; expected source declaration not established	○	◉	◉	○	●
List, quote and code blocks in the shared document model DARK — `runtime/nx_unidoc_lib.nx` EXISTS but does not declare `ud_list_block`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Today a Markdown list item is a paragraph carrying its marker so nothing is lost; the model grows a list block and the office editor learns it (UD4) rival marks uncited — the Yes, Best or Part codes on this row are an observation read with no reference mark behind them dossierwatching ud_list_block Pros none measured yetCons behind Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; open contract; expected source declaration not established	○	●	●	●	●
PDF page layout -- positioned text, fonts and figures painted, not only reflowed DARK — `runtime/_hdl_build/nx_pdf.nx` EXISTS but does not declare `pf_page_layout`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. The distance to PDF.js and Acrobat on the PDF row [pdfjs] [acrobat-web] (UD5) dossierwatching pf_page_layout Pros none measured yetCons behind Google Drive, Microsoft 365 web, Adobe Acrobat web (leads), Nextcloud Hub; open contract; expected source declaration not established	○	●	●	◉	●
SOV
On the family's own hardware, no telemetry -- documents never leave the host Measured: `dv_ext` exists in `runtime/_hdl_build/nx_doc_view.nx`, verified at emit. A PROPERTY, not a capability, and deliberately NOT claimed as an exceed; Nextcloud is also self-hosted (Yes) [nextcloud-server], the other three are cloud services Adoption: `RUN-BY:fork:nx_pptx_gate` — fully adopted (top of its ladder). Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	●
SECURE
A native document container -- canonical content-addressed records, verified on open, a changed byte refused and the block it broke named Measured: `uxd_open` exists in `runtime/nx_uxf_doc_lib.nx`, verified at emit. SHIPPED 2026-10-03 (UD11), awaiting acceptance: a document is a manifest and blocks as canonical records under the UXF document profile, its identity the manifest's CID; uxd_open checks framing, the version, every reference against the hash of the record it names, first-reference order, orphans, attachments and must-understand keys before a byte is believed. Gate nx_uxf_doc_gate 27 of 27 with a bite-proven tamper cell (nx_gate_bite killed a compiling mutant); measured there: 233 bytes of spec fold to a 1100-byte container (each reference is a 72-character CID) against 1882 bytes for the same eight paragraphs as a Word package written by nx_docx, and a one-paragraph edit shares 6 of 7 blocks with its parent. The design follows deterministic encoding before hashing [rfc8949], history kept beside materialised state [egwalker-eurosys25] [automerge-site] and the September 2026 line that makes a document's evolution the verifiable object [arxiv-collab-editing]. Rivals from their own pages: Microsoft 365 documents integrity only for a digitally signed file (Part) [ms-office-signatures]; PDF carries signature profiles for long-term verification (Part, index-level) [pdfa-standards]; Google Docs documents version history and restore, not a verifiable content identity (No) [google-docs-versions]; Nextcloud documents expiring file versions (No) [nextcloud-versions]. Not built: merge, signatures [fips-204] and structure-carrying export [odf-1-4] are rungs UD12 to UD14 Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	●	○	◐	◐	○
INTERACT
An AI-proposed edit to a legal draft is a suggestion checked against the document's structure before it can be accepted -- a defined term, cross-reference target, amount or date outside its declared span cannot change silently Measured: `dgd_check` exists in `runtime/nx_doc_aiguard_lib.nx`, verified at emit. Watch row for rung UD28, not built. Rival cells from their own pages, October 2026 census: Google Docs with Gemini shows Gemini's suggested edits only to the user until approved and lets Gemini suggest edits from comment threads for review [gws-gemini-apr26] [gws-gemini-comments], and the Docs API now proposes revisions as suggestions rather than altering content directly [gws-front] (Part: the edit is reviewable, nothing checks what it touched); Microsoft 365 previews Copilot's suggested changes and adds nothing to the document until the user approves [ms-copilot-word] (Part, for the same reason); Acrobat is graded from its product page, which describes viewing, annotating and signing PDF only (No, index-level) [acrobat-web]; the Nextcloud README describes no AI assistant (No) [nextcloud-server]. Why it matters for a will or a trust: frontier models silently corrupt an average of 25 percent of document content over long delegated editing workflows, and an explicit dependency graph of structure and references raises edit consistency from 56 to 76 percent [arxiv-doc-editing]; the guard takes the outline and defined terms of UD24 and UD25 as that graph Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	●	◐	◐	○	○
UNIFY
One render core for the browser, the reader and NishiOS DARK — `runtime/_hdl_build/nx_browser.nx` EXISTS but does not declare `br_one_core`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD9: the promoted browser paints through the shared render core so the census grades the pixels the daily driver paints; no rival has an OS surface (No) dossierwatching br_one_core Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
INTERACT
The document page states what the law requires of this instrument DARK — `runtime/nx_unidoc_lib.nx` EXISTS but does not declare `ud_law_panel`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD10: a requirements panel from the law engine's answer per instrument class and place, the sign form offered only where that answer permits a ceremony; none of the four pages states the law of a document (No) dossierwatching ud_law_panel Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
SECURE
Concurrent versions merge to one identity, without a server Source present; authored stronger claim: `uxd_merge` in `runtime/nx_uxf_doc_merge_lib.nx`, verified at emit. Exceed with the why: two versions naming a common ancestor merge deterministically to one content identity on either machine with no server in the trust path, history kept beside the text [egwalker-eurosys25]. Google Docs merges offline edits on reconnect through its service (Yes) [gdocs-offline]; Word co-authors live and merges on save through the service (Part) [ms-coauthoring]; Acrobat has no concurrent editing (No) [acrobat-sign-online]; the Nextcloud Text README describes live collaboration, not an offline merge (No) [nextcloud-text]. Graded 2026-10-07 by the rival census and the seat Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Source symbol found; stronger capability claim is authored; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	◉	●	◐	○	○
A version is signed for the long term and its publication is provable DARK — `runtime/nx_uxf_doc_lib.nx` EXISTS but does not declare `uxd_sign`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD13: a classical and a post-quantum signature over the manifest identity [fips-204] with an auditable publication record. Google Docs eSignature appends an audit-trail page to the signed PDF (Part) [gdocs-esign]; Microsoft 365 signs a file with a certificate (Part) [ms-office-signatures]; Acrobat is the reference for certificate-based signatures meeting eIDAS qualified levels and the PAdES long-term profiles (Best) [acrobat-sign-online] [pdfa-standards]; the Nextcloud pages describe no signing (No) dossierwatching uxd_sign Pros none measured yetCons behind Google Drive, Microsoft 365 web, Adobe Acrobat web (leads); open contract; expected source declaration not established	○	◐	◐	◉	○
UNIFY
Structure-carrying export and import -- Word, ODF 1.4 and tagged PDF, with a loss ledger DARK — `runtime/nx_uxf_doc_lib.nx` EXISTS but does not declare `uxd_export`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD14: headings, tables and marks survive into a Word package and an ODF 1.4 package [odf-1-4] and print goes through the sovereign PDF writer as a tagged PDF, every target declaring what it cannot carry. Google Docs exports Word, ODF and PDF (Yes) [gdocs-product]; Microsoft 365 is the reference, with ODF 1.4 support in the October 2026 channel and document structure tags on PDF export (Best) [ms-current-channel-oct] [ms-accessible-pdf]; Acrobat converts PDF to and from Word (Part) [acrobat-sign-online]; Nextcloud exports through its office app (Part) [nextcloud-server] dossierwatching uxd_export Pros none measured yetCons behind Google Drive, Microsoft 365 web (leads), Adobe Acrobat web, Nextcloud Hub; open contract; expected source declaration not established	○	●	◉	◐	◐
The unified page and the office open and save the native container DARK — `runtime/nx_unidoc_lib.nx` EXISTS but does not declare `ud_kind_nxd`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD15: the office saves each version as a container naming its parent and the portal serves the container beside the original bytes; a native verifiable container is nobody else's format (No on every rival by definition) dossierwatching ud_kind_nxd Pros none measured yetCons open contract; expected source declaration not established	○	○	○	○	○
INTERACT
Inline marks, lists, fields and legal semantics as typed block keys DARK — `runtime/nx_uxf_doc_lib.nx` EXISTS but does not declare `uxd_marks`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD16: ranges for emphasis, defined terms and cross-references, typed merge fields, signature blocks, instrument class and jurisdiction, every one an optional key an older reader preserves. Google Docs carries formatting and suggestions without typed legal keys (Part) [gdocs-suggest]; Word carries field codes and cross-references but no instrument class (Part) [ms-fieldcodes] [ms-crossref]; Acrobat marks a PDF, not a structured document (No); Nextcloud Text carries Markdown marks (Part) [nextcloud-text] dossierwatching uxd_marks Pros none measured yetCons behind Google Drive, Microsoft 365 web, Nextcloud Hub; open contract; expected source declaration not established	○	◐	◐	○	◐
UNIFY
Document page layer -- sheet geometry, typography and the print sheet from a data file Measured: `ud_doc_layer` exists in `runtime/nx_unidoc_lib.nx`, verified at emit. Landed 2026-10-03 (UD17): every safe row of knowledge/doc_page.conf becomes a stylesheet variable, the print page box and the shipped faces are written from the same rows, no dimension lives in code [css-page-3] [urcp-10]. Google Docs offers page size, margins and line spacing (Yes) [gdocs-spacing]; Word is the one-inch default and the margins and line-spacing commands (Yes) [ms-word-margins] [ms-track-changes]; Acrobat lays out PDF pages, not a sheet from data (No); the Nextcloud Text page describes no page geometry (No) Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	●	●	○	○
INTERACT
The event-graph text merge engine -- concurrent edits converge for any delivery order Source present; authored stronger claim: `uxm_merge` in `runtime/nx_uxf_merge_lib.nx`, verified at emit. Exceed with the why: every edit carries its causal parents, a remote edit delivered in any order replays only the concurrent span and converges on every replica with no server deciding, proven by the gate over every delivery permutation [egwalker-eurosys25]. Google Docs and Word co-edit live through their services and are the reference for the experience (Best) [gdocs-product] [ms-coauthoring]; Acrobat has none (No); Nextcloud Text collaborates live through the server (Yes) [nextcloud-text] Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Source symbol found; stronger capability claim is authored; ahead of Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	◉	◉	◉	○	●
A sync relay carries events between the clients of one document Measured: `uxs_relay` exists in `runtime/nx_uxf_sync_lib.nx`, verified at emit. Landed (UD19): the relay keeps each document's event log append-only and answers a client with the events it lacks, never transforming anything; the rivals' services are the reference relays (Best) [gdocs-product] [ms-coauthoring]; Acrobat none (No); Nextcloud Text syncs through the server (Yes) [nextcloud-text] Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat webCons behind Google Drive (leads), Microsoft 365 web (leads); not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	●	◉	◉	○	●
Presence and remote cursors carried through the same replay as an edit DARK — `runtime/nx_uxf_merge_lib.nx` EXISTS but does not declare `uxm_cursor_transform`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD20. Google Docs: multiple people work on the same document at the same time (Best) [gdocs-product]; Word: you see their presence and the changes they are making (Best) [ms-coauthoring]; Acrobat none (No); Nextcloud Text works together on one document (Yes) [nextcloud-text] dossierwatching uxm_cursor_transform Pros none measured yetCons behind Google Drive (leads), Microsoft 365 web (leads), Nextcloud Hub; open contract; expected source declaration not established	○	◉	◉	○	●
Comments and suggested edits anchored to the text, orphaned never dropped DARK — `runtime/nx_uxf_merge_lib.nx` EXISTS but does not declare `uxm_suggest`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD21. Google Docs suggesting mode and comments, now programmable through the API (Best) [gdocs-suggest] [gws-front]; Word track changes and comments (Best) [ms-track-changes]; Acrobat annotates a PDF with comments and offers no suggested edits (Part, index-level) [acrobat-web]; Nextcloud comments on files, no suggestions (Part) [nextcloud-server] dossierwatching uxm_suggest Pros none measured yetCons behind Google Drive (leads), Microsoft 365 web (leads), Adobe Acrobat web, Nextcloud Hub; open contract; expected source declaration not established	○	◉	◉	◐	◐
SECURE
Per-document permissions -- owner, editor, commenter, viewer, as events on the document DARK — `runtime/nx_uxf_sync_lib.nx` EXISTS but does not declare `uxs_acl_check`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD22. Google Docs sharing settings control who can view and edit (Yes) [gdocs-product]; Microsoft 365 permissions bound what Copilot and people may open (Yes) [ms-copilot-privacy]; the Acrobat signing page names no roles (No); Nextcloud file sharing (Yes) [nextcloud-server] dossierwatching uxs_acl_check Pros none measured yetCons behind Google Drive, Microsoft 365 web, Nextcloud Hub; open contract; expected source declaration not established	○	●	●	○	●
INTERACT
Offline edits that merge on reconnect DARK — `runtime/nx_uxf_merge_lib.nx` EXISTS but does not declare `uxm_since`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD23. Google Docs works offline and syncs (Yes) [gdocs-offline]; Word opens files offline and merges on reconnect (Yes) [ms-current-channel-oct]; Acrobat's signing page is online (No); the Nextcloud Text README describes no offline mode (No) dossierwatching uxm_since Pros none measured yetCons behind Google Drive, Microsoft 365 web; open contract; expected source declaration not established	○	●	●	○	○
Document outline -- auto-numbered clauses, a navigation pane and live cross-references Measured: `dst_find_clause` exists in `runtime/nx_doc_structure_lib.nx`, verified at emit. Landed (UD24): anchors and clause numbers from the headings, a navigation pane, written references turned into links. Google Docs has the document outline and a table of contents but no cross-references (Part) [gdocs-toc]; Word has the outline, the table of contents field and cross-references (Best) [ms-crossref] [ms-fieldcodes]; Acrobat none (No); the Nextcloud Text README names none (No) Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Adobe Acrobat web, Nextcloud HubCons behind Microsoft 365 web (leads); not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	●	◐	◉	○	○
Defined terms -- every definition detected and every use linked back Source present; authored stronger claim: `dst_defs_collect` in `runtime/nx_doc_structure_lib.nx`, verified at emit. Exceed with the why: each definition written in the drafting convention gets an anchor, every later use links to it, and terms used before definition, defined but never used, and defined twice are reported; none of the four pages describes defined-term proofing (No on all four, uncontested). Landed (UD25) Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Source symbol found; stronger capability claim is authored; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	◉	○	○	○	○
UNIFY
Discrete pages laid out by the estate from real font metrics Measured: `dpag_plan` exists in `runtime/nx_doc_paginate_lib.nx`, verified at emit. Landed (UD26): Knuth-Plass line breaking over the shipped face's advances, keep-with-next, widow and orphan control, one sheet per page [css-page-3]. Google Docs lays out pages in pages mode (Yes) [gdocs-spacing]; Word is the reference paginator (Best) [ms-word-margins]; Acrobat shows the fixed pages of a PDF (Yes) [acrobat-sign-online]; Nextcloud Text flows Markdown without pages (No) [nextcloud-text] Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Implementing source symbol found; runtime acceptance separate; ahead of Nextcloud HubCons behind Microsoft 365 web (leads); not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	●	●	◉	●	○
INTERACT
Clause-aware legal redline between two versions Source present; authored stronger claim: `drl_redline` in `runtime/nx_doc_redline_lib.nx`, verified at emit. Exceed with the why: a moved clause is one move, a renumbering alone is no substantive change, a defined-term rename is one change naming every use, and an edit inside a clause is a character redline confined to it. Google Docs compares nothing but version history (No) [google-docs-versions]; Word compares and combines two versions by characters (Part) [ms-compare]; the Acrobat signing page offers no compare (No); Nextcloud none (No). Landed (UD27) Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Source symbol found; stronger capability claim is authored; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	◉	○	◐	○	○
Reproducible document assembly with the law behind each clause DARK — `runtime/nx_docgen_lib.nx` EXISTS but does not declare `das_assemble`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD29: a validated answer set selects clauses deterministically and each conditional clause names its condition and the law row behind it. Google none (No); Word fields select conditional text (Part) [ms-fieldcodes]; Acrobat Sign templates and custom workflows assemble agreements (Part) [acrobat-sign-relnotes]; Nextcloud none (No) dossierwatching das_assemble Pros none measured yetCons behind Microsoft 365 web, Adobe Acrobat web; open contract; expected source declaration not established	○	○	◐	◐	○
SECURE
An audit trail bound to the document that a third party verifies offline Open — watching `runtime/nx_doc_audit_lib.nx` : `dau_chain`, re-measured on every compare beat. Ship that symbol and this mark flips itself; the `comparewatch-` plane row flips with it. Watch row for rung UD30: every view, edit, comment, decision, signature and export an append-only event naming the actor, the version identity and the hash of the event before it, exported as a report that verifies with no server. Google Docs appends an audit-trail page to a completed signature request (Part) [gdocs-esign]; Microsoft Purview keeps an administrator log bounded by licence (Part) [ms-purview-audit]; Acrobat keeps audit trails on its service, some behind a paid plan (Part) [acrobat-sign-online]; Nextcloud none (No) dossierwatching dau_chain Pros none measured yetCons behind Google Drive, Microsoft 365 web, Adobe Acrobat web; open contract; expected source declaration not established	○	◐	◐	◐	○
INTERACT
Clause index across the vault with stale-clause recall Source present; authored stronger claim: `dci_query` in `runtime/nx_doc_clauseidx_lib.nx`, verified at emit. Exceed with the why: every clause of every vault document is indexed by content identity and a normalised fingerprint, so which documents carry a clause, and which still carry a superseded one, is one query. Google searches a tenant's files by prompt through Workspace Intelligence (Part) [gws-gemini-apr26]; Microsoft 365 Copilot surfaces data a user may see (Part) [ms-copilot-privacy]; Acrobat none (No); Nextcloud none on its pages (No). Landed (UD31) Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Source symbol found; stronger capability claim is authored; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	◉	◐	◐	○	○
Words in this document -- the legal words a document uses, marked at first use and explained beside it Source present; authored stronger claim: `udw_marks` in `runtime/nx_unidoc_words_lib.nx`, verified at emit. Exceed with the why: the first use of each word the Nishi Lexicon explains is marked in the sheets and the phone copy and listed in reading order with its sources, the document's own definitions taking precedence, the reading-aid design a within-subjects study found makes contract text easier to read [termsight-2026]; none of the four pages explains the words of a document beside it (No on all four). Landed (UD32) Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Source symbol found; stronger capability claim is authored; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	◉	○	○	○	○
UNIFY
The Nishi Lexicon -- dictionary, thesaurus and legal glossaries as one estate store with an MCP tool Measured: `lx_lookup` exists in `runtime/nx_lexicon_lib.nx`, verified at emit. Landed (UD33): WordNet senses, the federal courts' glossary and IRS estate terms in one sorted store with word forms and a scan. None of the four MIRRORED pages describes a dictionary or thesaurus (No by evidence; Docs and Word ship dictionary tools whose help pages are not yet mirrored, queued for the next census) Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	●	○	○	○	○
INTERACT
Plain-language measures for a legal draft, reported per clause Source present; authored stronger claim: `plg_measure` in `runtime/nx_plainlang_lib.nx`, verified at emit. Exceed with the why: sentence length, passives, shall-for-must and legalese paired with a plainer wording from the federal plain-language guidelines, per clause, with no verdict until a threshold is calibrated on real drafts [plainlang-simplewords] [fplg-2011]; none of the four mirrored pages offers readability measures (No; Word's readability statistics page is not yet mirrored, queued). Landed (UD34) Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Source symbol found; stronger capability claim is authored; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud HubCons not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	◉	○	○	○	○
Focus and paper modes for a document page, zero script Measured: `ud_paper_css` exists in `runtime/nx_unidoc_lib.nx`, verified at emit. Landed (UD35): a focus control that dims every clause but the one in focus and a paper mode for e-ink screens chosen by the media query and by a toggle, every value from knowledge/doc_page.conf; none of the four mirrored pages describes a focus or paper mode (No by evidence; Word's Focus mode page is not yet mirrored, queued) Adoption: `LIB-WIRED importers=2 nonval=1` — fully adopted (top of its ladder). dossier Pros Implementing source symbol found; runtime acceptance separate; ahead of Google Drive, Microsoft 365 web, Adobe Acrobat web, Nextcloud Hub; fully adopted on the estate ladderCons none on the measured axes (rival marks are documented presence, not depth)	●	○	○	○	○
UNIFY
A Nishi text face for documents DARK — `runtime/nx_font_ttf_emit.nx` EXISTS but does not declare `nfont_text_set`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD36: the sovereign-font ladder grown to the Latin text set a will and a trust use. Google Docs and Word ship their own faces (Yes) [gws-gemini-apr26] [ms-current-channel-oct]; the Acrobat and Nextcloud pages name no face (No) dossierwatching nfont_text_set Pros none measured yetCons behind Google Drive, Microsoft 365 web; open contract; expected source declaration not established	○	●	●	○	○
INTERACT
Word-processor editing in the browser, emitted by the estate Measured: `ude_page` exists in `runtime/nx_unidoc_edit_lib.nx`, verified at emit. Landed 2026-10-04 (UD37): the editing page emitted by nx_unidoc edit with the estate's own client, marks written back as R lines, a draft kept in the browser. Google Docs and Word are the reference editors (Best) [gdocs-product] [ms-copilot-word]; Acrobat edits a PDF (Part) [acrobat-sign-online]; Nextcloud Text edits Markdown (Yes) [nextcloud-text] Adoption: `LIB-UNCENSUSED` — PARTIAL: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime). dossiernot adopted: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime) Pros Implementing source symbol found; runtime acceptance separate; ahead of Adobe Acrobat webCons behind Google Drive (leads), Microsoft 365 web (leads); not adopted yet: a library absent from the import-graph census (younger than the last eco-graph build, or unreachable from buildroot/runtime)	●	◉	◉	◐	●
The browser editor saves to the firm -- versions, compare and a Word download DARK — `runtime/nx_unidoc_edit_lib.nx` EXISTS but does not declare `ude_save`: something shipped at this path under another name, and this mark would read open forever. Repoint the contract to the real entry point (the plan rung AND this row) or rename the function; the flip follows on the next beat, and the `comparewatch-` plane row reads DARK until then. Watch row for rung UD38. Google Docs version history and restore (Best) [google-docs-versions]; Word and OneDrive version history (Best) [m365-web]; the Acrobat signing page keeps no versions (No); Nextcloud versions (Yes) [nextcloud-versions] dossierwatching ude_save Pros none measured yetCons behind Google Drive (leads), Microsoft 365 web (leads), Nextcloud Hub; open contract; expected source declaration not established	○	◉	◉	○	●

Capabilities measured on other boards

Graded once, on the home board. Each row below is a row of another board, where it is measured against the rivals that sell the capability; this board references it and never re-grades it. The cells and the column names are the home board's, copied at publish; the Nishi mark is measured with the same source ruler the home page uses. A reference whose home row cannot be read says so by name and is never folded into open or present.

Capability (home: legalpractice)	Nishi	DocuSign	Clio	NetDocuments	PandaDoc	Note
EDIT: Format-agnostic annotation overlay -- notes, threads, redlines, checklists and signature-field placement, frozen once the envelope completes nx_ann_add	PRESENT (stronger claim)	PART	NO	PART	PART	The format-agnostic annotation overlay (notes, threads, redlines, checklists and signature-field placement, additive and frozen once the envelope completes) is graded on /compare/legalpractice, where its exceed is claimed; the document-portal reading on this board was Yes on all four rivals (comments inside each vendor's editor)
SIGN: Sign any office document version in place -- consent-gated ceremony, per-version hash-chained log, sealed certificate served as the receipt of_sign_version	PRESENT	BEST	YES	PART	BEST	Signing a document version in place under the UETA and ESIGN consent gate, with the per-version hash-chained log and the sealed certificate, is graded on /compare/legalpractice against the e-sign vendors (rung LP4); the document-portal reading on this board was Acrobat Best for in-place signing [acrobat-sign-online], Google Docs Yes with eSignature in Docs (re-graded 2026-10-07 by the rival census) [gdocs-product] [gdocs-esign], Microsoft 365 Part (a certificate signature with no consent ceremony) [ms-office-signatures] and Nextcloud Part through an app
SIGN: Envelope routing -- ordered signers, CC and approver roles, decline, void, out-of-order refused nx_env_send	PRESENT	YES	YES	PART	YES	Envelope routing (ordered signers, CC and approver roles, decline, void, out-of-order refused) is graded on /compare/legalpractice against the e-sign vendors; the document-portal reading on this board was Acrobat Sign Best with complex routing and bulk send [acrobat-sign-online], Google Docs Part (signature requests with reminders and no signing order, decline or void on its page, re-graded 2026-10-07 by the rival census) [gdocs-esign], Microsoft 365 No and Nextcloud Part through an app
SIGN: Never-void instrument gate -- a Will routed for e-signature outside an e-wills posture is refused at send and at seal nx_legal_regime	PRESENT (stronger claim)	NO	NO	NO	NO	The never-void instrument gate (a will is not routed for ordinary e-signature) is graded on /compare/legalpractice, where its exceed is claimed; no document-portal rival refuses to route a will

xrows declared=4 resolved=4 norow=0 noboard=0 badrow=0 (partition sums)

Rival-claim provenance. Every Yes, Best or Part mark in a rival column is a claim about someone else's product. A cited row carries a reference mark that resolves to a pinned mirror (the refs gate measures that); an uncited row is an observation read and is badged in its evidence until a reference lands. The badge is the receipt, never the proof: a mark proves a mirror exists, not that the mirror supports the code. The rows are counted below.

Rival claims, counted
Class	Count	Note
rows with rival marks	51	rows carrying a Yes, Best or Part in a rival column
cited	34	a reference mark resolves to a pinned mirror
uncited	17	an observation read, badged until a reference lands
rows, summed	51	RECONCILED: the parts sum to the total 51

Delivery and evidence

Inspect risks, technical debt, rendered observations, experiments and references. Read scope and limitations alongside every result.

Risk register

Risk	Likelihood x impact	Mitigation
A renderer that copies document text verbatim into HTML turns a document into a script carrier	possible x high	UD1 done-rule: ud_esc_n on every byte, bite-proven, plus the CSP that forbids script even if a byte slipped; the gate plants a script tag in a text document and asserts it renders as text.
A unified page that wraps a web page as a document confuses the two surfaces it exists to unify	possible x medium	UD1 refuses .html by name (REFUSED-HTML); the gate asserts the refusal.
Registering the unified page for kinds that already have a renderer silently changes what the live browser paints	likely x medium	UD2 adds only the kinds nothing served (txt, odt); replacing the docx, md and csv rows waits for the browser document gate to be re-run against the unified page.

Release history and work log

The worked plan, on the board. Every leg appends what it measured, landed, retracted, learned and left queued, per rung, so a crash leaves the next seat a ledger here rather than a transcript to mine. Kinds: measure, land, retract, lesson, queue. Newest last.

When	Rung	Kind	Entry
2026-09-03	UD1	land	2026-09-03: nx_unidoc_lib.nx (28893 B, sha 9af39ebb), nx_unidoc.nx (2722 B, sha f20a64c2) and nx_unidoc_gate.nx (11584 B, sha 46f7bcb9) written on the laptop, compiled by the local sovereign toolchain first try (nx_unidoc 49993 B, nx_unidoc_gate 66554 B), gate 28 of 28 teeth pass locally with the Word-fixture precondition SKIP (the fixture lives on the NAS), sources pushed to buildroot/runtime over the wire lane and nx_filehash read the same three digests on both trees; nx_organ_ship nx_unidoc launched through nx_job_run
2026-09-03	UD1	lesson	gv_bite takes fired_on_bad and fired_on_good, not passed_bad and passed_good: the first draft passed the good-input PASS as fired_on_good and the tooth read FALSE-POSITIVE; read the base class before composing it
2026-09-03	UD1	measure	nx_catalog 2026-09-03 over the viewer fleet: nx_doc_view, nx_doc_view_gate, nx_pdf_gate, nx_md, nx_csv, nx_pptx, nx_docx PROMOTED-UNREGISTERED; nx_xlsx registered-unauthorised; nx_browser REGISTERED-DARK; nx_browser_doc_gate, nx_nishios_docview, nx_docx_gate, nx_css_vars_engine_gate BUILT-UNPROMOTED; nx_browser_render and nx_md_lib are libs -- the renderers ship and run, the gates around them are not all promoted, which is the .gates map's honest starting point
2026-09-03	UD2	queue	Next in order: UD2 registry rows for txt and odt, then the .gates map after the ship receipt, then UD3 the portal route (the daemon change), then UD4 the browser form leg; UD6 PDF layout is the long pole and the byte-up lane's
2026-09-03	UD1	land	SHIPPED on the NAS 2026-09-03 through nx_organ_ship: nx_unidoc_gate built and run 30 of 30 GREEN against the promoted docx organ and the genuine Word fixture, promoted sha 230bc7c0 and registered; nx_unidoc promoted sha 50f18daf, adopt-gate APPROVED (content GREEN, behave IDENTICAL, evidence WEAK because the probe compared a usage line on a first promote), _offc twin byte-identical to the build, registered; the first ship receipt read prove=NO-GATE-FOUND because the gate had not been built yet, the second read prove=GREEN after the gate lane shipped; smoke over the served binary: a text document with a planted script tag rendered as a 3496-byte page, script=0 csp=1
2026-09-03	UD2	land	knowledge/doc_viewers.conf (626 to 751 B) gained txt and odt rows routed to _offc/nx_unidoc.elf, the two kinds no renderer served, so the browser omnitool now opens a .txt or a .odt URL as the unified page; the docx, md, csv, xlsx, pptx and pdf rows are untouched until the browser document gate is re-run against the unified page
2026-09-03	UD1	measure	nx_swcompare_evidence unidoc 2026-09-03: MEASURED-HONEST, present 30 grounded 30 ungrounded 0, absent 6 all named, gates_green 1 of 1, partitions reconcile (30 plus 6 equals 36); nx_domain_admit unidoc: ADMIT with C3 gates file present, C4 never-bitten until the bite below records, C5 second method class ABSENT (the shared evidence debt of every board), C2 unpinned declared in the matrix header
2026-09-03	UD1	measure	nx_gate_bite nx_unidoc_gate runtime/nx_unidoc_lib.nx 2 on 2026-09-03: baseline GREEN, comparison mutant at offset 4179 COMPILED and the gate went RED, KILLED; source restored byte-identical (28920 B) and both deployed twins restored; valid_mutants=1 killed=1 not_reached=0 verdict=GREEN -- the gate bites, so the green above is not a green that never had a red
2026-09-03	UD1	land	PUBLISHED 2026-09-03 by nishi_compare_regen (job 1788443801): /compare/unidoc api.json 22240 B and index.html 95370 B (first publish), hub api.json 89908 to 91020 B; nx_page_verify https://nishifamily.com/compare/unidoc status 200, a11y-lite 0 issues, VERDICT=GREEN; the regen itself read RED for 8 other domains (performersearch, foodscience, water, livingdocs, lang, smallos, devguardrails, gpu: stray pipes and present-under-5 liar-kills, none on this board) and named the matrix generator fork STALE (buildroot/_offc 322744 B vs promoted 357136 B), so this first page was emitted by the older generator copy; nx_restage nx_swcompare_matrix launched the same minute and the next beat republishes with the fresh copy
2026-09-03	UD1	measure	nx_restage nx_swcompare_matrix on 2026-09-03 returned RESTAGED buildroot/_offc/nx_swcompare_matrix.elf 323342 B from the current source, while the PROMOTED serving-root copy is 357136 B: a fresh build of today's source is 33794 B SMALLER than what was promoted, so the fork and the promoted artifact still differ and the next regen will again name the fork -- a size delta is a question, not a verdict (toolchain shrink versus a served binary ahead of its source); it belongs to the compare-emitter lane and is named here, not chased from this board
2026-09-03	UD2	land	BLOCKERS CLEARED 2026-09-03, both were DATA defects that stopped a whole page publishing: lang.matrix carried a data row ABOVE its @cols header so the generator parsed it before the schema existed (9 fields against a 5-field default) -- the row was moved below @cols and the file returned to EXACTLY its original 77130 bytes, which is the proof the row was restored byte-for-byte rather than rewritten; gpu.matrix row 47 carried two stray pipes inside a note (a door
2026-09-03	UD2	land	nx_browser_doc_gate REPAIRED AND SHIPPED 7 of 7 GREEN (sha ba3f74cf, promoted + _offc twin + registered). It was INOPERATIVE, not failing: it asked for its browser at /tmp/nx_browser.sov.elf and the sovereign builder writes <cwd>/_build/<t>.sov.elf, so its FIRST tooth could never pass and the six below it were unreachable -- 1 of 7, reporting the browser broken when the missing thing was the gate's own path. Fixed by resolving the artifact (promoted ./nx_browser.elf first, then buildroot/_build, then the legacy /tmp) and ANNOUNCING the choice, and by writing the .docx fixture at runtime with the promoted nx_docx instead of copying web_assets/vizsla_agreement_demo.docx, which is ABSENT on this host. Now proven end to end against the PROMOTED browser: md and csv and docx each converted and laid out INLINE over the browser's own HTTP stack, a plain .html left on the normal pipeline as the negative control, every output script-free.
2026-09-03	UD1	measure	SECOND METHOD CLASS ESTABLISHED (C5 ABSENT to UNSIGNED-CANDIDATE, carrier knowledge/status/evclass_unidoc.conf, rows=1, verifier REACHABLE). The first class is our own gate; the second is an OUTSIDE engine that can disagree, exactly the pattern lang uses with V8. Google Chrome over the DevTools protocol was handed two pages generated from ONE 88-byte hostile text document whose payload sets a global: the nx_unidoc page reported pwned=undefined scripts=0 literal_visible=true (the payload neither ran nor became an element and is readable as text) and the SAME witness on the same bytes written unescaped reported pwned=number scripts=1 literal_visible=false. The control is the load-bearing half: a witness that cannot disagree is decoration. UNSIGNED BY DESIGN -- attestation needs an operator-registered durable key, so this is evidence that is not yet proof and the gate says so; fabricating a signature would defeat the instrument that makes PROVEN mean anything.
2026-09-03	UD2	land	ADOPTION DELTA 2026-09-03: the viewer fleet was seven PROMOTED-UNREGISTERED binaries nobody could call. nx_doc_view, nx_doc_view_gate, nx_pdf_gate, nx_md, nx_csv and nx_docx are now REGISTERED and callable; nx_pptx REFUSED with elf-not-found-or-not-a-valid-ELF and its catalog row shows PROMOTED 81491 B against BUILT 62135 B, a served binary LARGER than a fresh build of its source, which is the AHEAD class where promoting destroys capability -- left alone and named, never guessed at. ⚠The register API takes a BASENAME (nx_x.elf or _offc/nx_x.elf), not an absolute path: seven registrations failed 400 first, and the refusal named the exact fix.
2026-09-03	UD1	lesson	A 503 ON A WRITE IS DECIDED ONLY BY THE ARTIFACT, AND THE READ PATH LAGS THE WRITE PATH: a 503'd edit read as unchanged on TWO spaced size reads and had in fact LANDED -- the duplicate retry was refused by the expect= guard, which is the only reason it did not double-apply. Chain every edit on one file by the byte count the previous edit REPORTED, never by a fresh read, and never fire concurrent edits at one file. Six of today's 503s had landed.
2026-09-03	UD3	queue	DELIBERATELY NOT DONE, each with its reason: (1) nx_office_closed_gate is still NEVER-BITTEN because biting it mutates and rebuilds nx_office_daemon, and every mutant build is a deploy -- that daemon serves admin.andelinwest.com to a real law firm, so a seconds-long window of mutant code on a client surface is the operator's call, not a seat's; a fixture-only variant or a maintenance window unblocks it. (2) The seven never-bitten lang gates and the LN13 closures rung were left alone because a sibling lane shipped five canaried toolchain promotes today and mutation builds against compiler sources would collide with a lane in flight. (3) UD3 (dad_unidoc) is the next real rung and it is a route change to that same live client daemon, so it wants the health-checked deploy lane and an operator go-ahead on opening it.
2026-10-03	UD10	queue	UD10 declared 2026-10-03 with legalpractice L4 and L5 and legal M5: the document a client opens is where the law is shown, so the panel composes one answer that the view, the ceremony, the certificate and the audit chain all read. Order: UD3 the portal route first (still open, the host daemon does not declare dad_unidoc), then UD10 once legalpractice LP30 answers the Utah element set and LP31 gives every document its instrument class. Which daemon carries the client's document URL (the live vault daemon here, or the staged legal portal daemon of legalpractice LP9) is an open operator decision recorded on legalpractice.plan row 1791044603
2026-10-03	UD10	retract	The UD10 watch row was appended to unidoc.matrix with four unassessed rival cells and withdrawn within the hour: the page published at 1791044768 lost its position map (185362 bytes against 207820 before, the heading reading Position map unassessed, 4 peer cells). The matrix is back to its 13718 bytes; UD10 stays on this plan and reads UNMAPPED until its row returns with the four rival cells assessed from the mirrored pages in unidoc.refs
2026-10-03	UD10	queue	NATIVE DOCUMENT FORMAT STARTED 2026-10-03 and cut off by a usage limit; resume here. Operator: a format superior to Word and Google with no third party in it, interoperable for printing and outside use, state of the art on research read today. Incumbent census: the office spec model is five line tags with no canonical form, no hash and no history; the UXF envelope reserved the DOCUMENT profile (codec 2) on 2026-06-16 and never built it; nx_spendgate nx_uxf_doc reads name FREE; the function prefix uxd_ is ABSENT-PROVEN over buildroot/runtime (27475 files, corpus_complete=1). SOURCE LANDED AND UNBUILT: buildroot/runtime/nx_uxf_doc_lib.nx (32869 B before one rename edit) -- blocks and a manifest as canonical NXR1 records under UXF_DOC, the document identity the manifest CID, a container of manifest then distinct blocks in first-reference order then attachments (signatures and notes that name the document and are not part of its identity), open-and-verify with named refusals, spec import and export projection, tolerant manifest rewrite, a must-understand key rule, a multi-parent prev chain. NOT YET DONE: no rung row and no matrix row for it, no build (expect compile fixes: one helper is defined after its use, two bare literals want names), no CLI nx_uxf_doc, no gate nx_uxf_doc_gate, no export to Word or print, no ship. Found on the way: uxf_cid_profiled never unmaps its two scratch mappings, a leak per CID that a large document multiplies. Research mirrored by nx_research_fetch the same day, pins in the job receipts: RFC 8949 rf_da358f08.raw (deterministic encoding, section 4.2 read), OASIS ODF 1.4 approval of 3 December 2025 rf_ccb35296.raw, PDF Association standards registry rf_0bc78e6a.raw (PDF/UA-2 is ISO 14289-2:2024), NIST FIPS 204 rf_cd15a9c9.raw, Automerge rf_775b195e.raw (a project claim); the W3C post-quantum cryptosuites draft answered 403 and the arXiv CRDT listing job exited 2, so this month's listing is NOT read and no bar is declared. Nothing here may be called state of the art until the listing is read, three independent witnesses stand per bar, and the format's numbers are measured beside Word's and ODF's
2026-10-03	UD11	land	UD11 SHIPPED 2026-10-03 through nx_organ_ship, awaiting acceptance: nx_uxf_doc_lib.nx 33853 B (prefix uxd, ABSENT-PROVEN free over 27475 sources before use), nx_uxf_doc.nx 8920 B, nx_uxf_doc_gate.nx 14408 B, all three compiled on their first build. Gate nx_uxf_doc_gate promoted 95fd727b, 27 of 27 GREEN, registered; nx_gate_bite killed a compiling comparison mutant of the library and restored it byte-identical (33853 B), so the green is proven able to go red. Tool nx_uxf_doc promoted ca16fae3, proved by the promoted gate (closure bank CURRENT), registered, twins installed. Composed, never re-implemented: nx_canon_cid, nx_uxf_cid, nx_uxf_decode for the envelope, nx_unidoc_lib for import, the promoted nx_docx for the Word export
2026-10-03	UD11	measure	Values the gate emits, with a second method for one of them: 233 bytes of spec fold to a 1100-byte container, and a hand recomputation from the record layout gives the same 1100 (head 8, eight frames 32, manifest 673, seven distinct blocks 387). The container is 4.7 times its text because every reference is a 72-character CID; a binary reference would cut the manifest by more than half and is a named improvement, not yet a rung. The same eight paragraphs as a Word package written by nx_docx measure 1882 bytes. A one-paragraph edit shares 6 of 7 blocks with its parent; an attachment adds 138 bytes and leaves the identity unchanged. These are one small fixture, not a general size claim
2026-10-03	UD11	lesson	An attachment has to be defined in version 1 or it can never be added: a reader that refuses every unreferenced record would refuse the first signed document a later writer produced. So a record that names the document is an attachment from the first byte, travels with it, and is dropped by any edit, because a signature made for one version must never be inherited by the next. Found while composing the envelope: uxf_cid_profiled never unmaps its two scratch mappings, so every CID leaks two mappings; harmless in a one-shot tool, a real cost in a daemon that verifies large documents, to be fixed in nx_uxf_cid with its gate re-run before UD15 puts this in the portal
2026-10-03	UD12	queue	Order after UD11: UD15 (the page and the office read and write the container, so it becomes the working format), UD14 (structure-carrying Word and ODF 1.4 export; print waits on the sovereign PDF writer, legalpractice LP15), UD13 (signatures), UD12 (merge), UD16 (marks and legal semantics). Research still owed before any exceed is claimed: the full text of arXiv 2609.18886 and its Melda delta model, a peer-reviewed rich-text formatting model for UD16, and measured numbers beside Word and ODF on real documents (size, open time, tamper location, version sharing). The W3C post-quantum cryptosuites draft answered 403 to the sovereign fetcher and is not a ref
2026-10-03	UD11	measure	The shipped tool exercised on real files over the registered MCP surface (nx_job_run nx_uxf_doc): a genuine Word document of 48849 bytes imported to a container of 66 blocks and 24269 bytes (identity private-ref:f2eb136c), exported to a Word package of 22275 bytes with 66 paragraphs, and that export re-imported as 66 blocks (24250 bytes, a different identity because headings come back as paragraphs: the structure loss the docx verb names). The Utah H.B. 181 enrolled PDF of 41024 bytes imported to only 2 blocks: the PDF fold carries text and almost no structure, which is UD6 and the formats board's FM6, not a defect of the container. The board reads bar ATTESTED and FRESH, ladder LADDERED 16 of 16, ranker 16 rungs with 2 done; UD11 reads LIB-UNCENSUSED until the import census beat runs; UD10 and UD12 to UD16 read UNMAPPED on purpose, their matrix rows wait for assessed rival cells; the page republished at 300467 bytes with its position map intact and static checks GREEN (not viewed in a browser)
2026-10-03	UD11	land	compact references shipped: version 2 of the container names each block by a 43-character base64url digest instead of a 72-character hex identifier (version 1 is still read, only version 2 is written). nx_uxf_doc_gate e9e2825a 32 of 32, nx_uxf_doc f7f2585d. The eight-paragraph fixture container fell 1100 to 861 bytes, equal to the hand prediction; three real sample documents fell 4040 to 3351, 3189 to 2620 and 2593 to 2084 bytes
2026-10-03	UD15	land	the document page reads the native container: nx_unidoc d6c99147 (gate nx_unidoc_gate dbd4ae58, 41 of 41) opens a .nxd, verifies it, and renders the same zero-script page with the line Nishi document, verified identity <its identifier>; a tampered container is refused by name (INTEGRITY-REFUSED) and never shown. New verb nx_unidoc index <rows> <out> <title> emits a listing page whose links are limited to a site path, a ./ path or https, any other link refusing the whole page (HREF-REFUSED). Every page head now declares robots noindex. The office save half of UD15 is still open
2026-10-03	UD11	land	the identifier leak is fixed in nx_uxf_cid (both scratch mappings released before return) and is inside every binary shipped today; its own gate re-qualification is the witness for closing debt 1791059498
2026-10-03	UD15	land	ALPHA live at https://andelinwest.com/alpha/docs/ (operator 2026-10-03: alpha, then beta, then production, like nishifamily.com/alpha/beach): a landing page, three fictional sample documents (will, trust certification, power of attorney) rendered from native containers, each with its stored record and a Word export. Ten paths registered as draft and asset rows 19 to 28 in knowledge/store/pub-andelinwest-, published with nx_site_publish, sources in knowledge/alpha/andelinwest_docs/. Served 200 by the edge for the pages, the Word files (correct media type) and the containers; a real browser (the estate capture organ on the laptop) loads the landing page and the will page at 390 and 1440 pixels wide. Stage state: ALPHA, shipped, awaiting operator acceptance; beta and production moves belong to the release owner
2026-10-03	UD15	measure	design hygiene of the alpha pages by nx_ui_audit file: 4 of 12 (tokens 3 of 3, no theme awareness, no media query, no focus style) and craft 3 of 15. The viewer stylesheet is hand-typed values from before the derived-token rule; the remedy is a derived token set and a print stylesheet, queued as the next viewer rung, not typed by a seat
2026-10-03	UD15	queue	open for the operator: the page header reads Nishi Docs on the firm's own site; say whether client-facing pages should carry the firm's name instead. Open in the format: PDF import still yields no structure, Word export is text-only, signing and tracked changes are unbuilt (UD12, UD13, UD14, UD16)
2026-10-03	UD15	measure	OPERATOR DECISION 2026-10-03 (asked in session, answer: the firm's name): client-facing document pages carry the firm's name in the header, not the product name. The header becomes a data field of the page (a brand argument on the page and index verbs, default unchanged), and the alpha pages on andelinwest.com are re-emitted with it. Not done yet: it is a viewer change with its own gate tooth
2026-10-03	UD11	retract	row 1791067102 said the identifier leak is fixed. MEASURED FALSE the same evening by a new tooth in nx_uxf_cid_gate (source landed, gate reads 8 of 9 RED, NOT shipped; the promoted gate a9fe6f8e is the older 6 of 6 without this tooth): after a warm-up batch, 65536 more identifier calls grew the address space by 12032 pages, about 752 bytes per call, while a twin that only maps the two scratch regions and never releases them grew 2304 pages, about 144 bytes per call. So the two munmap calls did not close it and the larger leak is inside the hash path (sha256_digest work areas allocated per call), a shared primitive under many daemons. Debt 1791059498 stays OPEN with these figures. Next: one batch that maps and releases the two regions (does release reclaim at all in the arena), then the per-call allocation inside nx_sha256 with its own known-answer gate before any change
2026-10-04	UD11	measure	the identifier leak is explained and the remedy is proven. Cause, read from the allocator's own source (nx_syscalls): small allocations come from a bump arena and sys_munmap is a deliberate no-op for them, so no leaf function can return its scratch; memory comes back only through sys_arena_mark and sys_arena_reset at a quiet boundary. The two release calls added to nx_uxf_cid on 2026-10-03 were therefore no-ops and are removed (the comment there now states the contract). Measured by nx_uxf_cid_gate 08874f51, 9 of 9: a second mark, 65536 identifier calls, reset grows the address space by 0 pages; the same 65536 calls with no bracket grow 12032 pages (about 752 bytes a call); a twin that only maps the two scratch regions grows 2304
2026-10-04	UD15	queue	consequence for every long-lived caller of the format (the vault daemon on UD3, office save on UD15): each request is bracketed by sys_arena_mark and sys_arena_reset, and that daemon's gate carries a tooth like T6 (zero steady-state growth over N documents). A command-line tool that exits needs nothing. Named here so the bracket is a done-rule of the adoption, not a memory
2026-10-04	UD11	lesson	a release that is a no-op by design reads exactly like a release that works until growth is measured: the fix was typed, the gate stayed green, and the claim was published before any tooth looked at the address space. The tooth that settled it reads the kernel's own figure before and after a batch, with a deliberately leaky twin as its negative control; and the remedy was found by reading the allocator, not by adding more release calls
2026-10-04	UD15	land	the page header is a data field: nx_unidoc 4a3c948b (gate nx_unidoc_gate bd33fa58, 44 of 44) takes a last argument brand=<name> on the html, page and index verbs (ud_set_brand in the lib; unset or empty keeps the product name and the default page is byte-identical, a tooth proves it; a hostile name is escaped, a neg-control proves it). The four alpha pages on andelinwest.com were re-emitted with brand=Andelin & West (each page 16 bytes longer, the two replaced names) and republished; a real browser shows the firm's name in the header. The meta line under the header still names the format and the renderer
2026-10-04	UD11	retract	the citation referee (fleet 38 of 45, the same count as before this lane's rows) named one of this board's references: ms-office-signatures read PROV-MISMATCH, because the row's URL had been changed to the page's canonical address while its mirror was still the fetch of the old redirecting address. Fixed at the source: the canonical URL was fetched directly (0 hops, mirror knowledge/fetched/rf_bafe635d.raw, sha256 1ccbb6bb...), the cited sentence was read in the new mirror, and the row now carries that mirror and pin. The three new deploy references were not named by the referee. Not re-run after the fix: the next referee run is the confirmation
2026-10-04	UD17	land	UD17 declared 2026-10-03 with its three references landed in unidoc.refs: css-page-3 (published-standard, mirror knowledge/fetched/rf_801366d0.raw), ms-word-margins (vendor-doc, rf_4bf1c9de.raw), gdocs-spacing (vendor-doc, rf_e750893e.raw); each sha256 re-read by nx_filehash equal to its pin, each row URL the one knowledge/status/fetch_provenance.jrnl holds for its mirror at 0 hops, and each cited sentence read in the mirror bytes (the letter @page size 8.5in 11in and the 1in letter margin example; In Word, each page automatically has a one-inch margin; click Single, 1.15, 1.5, or Double). The document page layer is SOURCE-LANDED in buildroot/runtime/nx_unidoc_lib.nx (ud_doc_layer and ud_doc_layer_from read knowledge/doc_page.conf, or ../knowledge/doc_page.conf from buildroot) and is being shipped by another seat; it is NOT claimed live here. 18 of the 27 rows of knowledge/doc_page.conf are marked unmeasured or calibration owed
2026-10-04	UD17	land	document page layer SHIPPED and live on the alpha: nx_unidoc_gate 8d619f96 51/51 (seven layer teeth: tokens defined from knowledge/doc_page.conf, tokens referenced, print page box with size margin and page number, policy admits only the site's own font, hostile conf value and malformed key never reach the sheet, page box from the same rows, conf without page keys adds nothing); nx_unidoc 1e659ab6 then 44751d4a (identity line wraps with overflow-wrap:anywhere instead of breaking every word); Liberation Serif Regular and Bold plus LICENSE published under alpha/docs/fonts (pub rows 29-31); four alpha pages re-emitted with brand Andelin and West and republished; real-browser capture OK at 390 and 1440 px reads as a sheet of paper. One continuous sheet, not yet discrete pages: pagination is the next rung. Awaiting operator acceptance.
2026-10-04	UD18	measure	INCUMBENT CENSUS before any byte was written (nx_capsearch merge crdt text, nx_spendgate nx_uxf_merge_lib, nx_shelltool find over buildroot/runtime, 27498 files, corpus_complete=1): nx_crdt_seq.nx (an RGA sequence CRDT, a 512-element cap, no parent versions), nx_crdt_sync.nx (an op log over it, a 1024-op cap, deletes carry no id of their own) and runtime/_hdl_build/nx_coedit.nx (an RGA text CRDT over a file op log with a live sync server, a 65536-op cap, gates nx_coedit_gate and nx_coedit_live_gate, the engine UD8 names). All three keep the CRDT state for the life of the document and reference elements by id; the method UD12 names keeps plain text and positional events with their parent versions and replays only the concurrent span. That is a different op model, not an extension of RGA, so the engine is a new library (nx_uxf_merge_lib, function prefix uxm ABSENT-PROVEN over 27498 files with corpus_complete=1, the gate prefix umg and the relay prefix uxs likewise) and the incumbents stay untouched; UD19 extends the nx_coedit serve lane and UD8 moves onto the new engine through the lifecycle, never by deletion. The paper's full text was mirrored the same hour (knowledge/fetched/cmp_unidoc_egwalker_paper.pdf, 895150 B, sha256 6512c455be24dce0f86e276f4967e6d0fbf10b712315753425bba17b57703b79); the board row egwalker-eurosys25 still points at the abstract mirror
2026-10-04	UD17	measure	Derivation proposal for the 18 unmeasured rows of knowledge/doc_page.conf written to knowledge/status/doc_page_derivation_2026-10-03.md (proposal only; the conf's owner applies it). Five real Google Docs pages fetched by nx_research_fetch from links already in mirrored pages (rf_a3bdbbdf, rf_6205cfee, rf_bc27ee49, rf_2eec2536, rf_6de3db21; five authors, ONE generator, so n counts documents and not independent designs). Measured from the bytes: page margin 72pt (1in) in 5 of 5, letter width 612pt in 4 of 5 (one A4), leading 1.15 in 5 of 5 (nx_ui_audit and nx_txtscan agree), ink #000000 in 5 of 5, body 11pt in 5 of 5, title median 26pt, table cells 5pt padding and 1pt solid #000000. No evidence for canvas, shadow, bar-gap, ui-title or gap. Decisions named in the file: the Docs defaults are a general-document genre, not a legal instrument (body, title, heading wait for a mirrored court or firm source), and the rule row serves both the bar border and the table border. RULER GAP for the owner of nx_ui_audit: its value parser reads px, rem, em, ch, s, ms and unitless only, so every pt size read as unparsed and derive built a whole type scale from n=1 of the published page's chrome (14px banner links), not from any document; its body line-height band 1.30..1.80 excludes a document's 1.15
2026-10-04	UD17	measure	doc_page.conf calibrated from evidence: body 12pt grounded in the Utah paper-format rule (type not smaller than 12-point, margins not less than one inch) [urcp-10], kept over the Google Docs 11pt default because that is a general-document genre; ink #000000 (5 of 5 published Google Docs), cell padding 5pt (7 of 7 cell styles), space above headings 18pt (median n=5), margin 72pt confirmed 5 of 5; title and heading sizes and the screen chrome rows stay declared choices with no evidence (table in knowledge/status/doc_page_derivation_2026-10-03.md)
2026-10-04	UD26	land	shipped 2026-10-03: buildroot/runtime/nx_doc_paginate_lib.nx (61,173 B) and nx_doc_paginate_gate.nx (39,218 B); gate GREEN 107/107 under --qualify and again in the ship loop (PROVE fresh build), promoted sha 95f8016526eaceff97a56e94010fd5f28e2d34efcbe4ac3a5039428ceb40b93e, _offc twin installed, registered callable (no schema row yet). NOT yet wired into nx_unidoc_lib (another seat owns it): the viewer calls dpag_conf_read, dpag_plan_from_conf, dpag_err, dpag_emit_len, dpag_emit_css, dpag_emit_sheets. Awaiting acceptance
2026-10-04	UD26	measure	under the real doc_page.conf (text box 468pt x 648pt, pitch 13.8pt): will 2 pages (45 lines, 8 table rows, one heading carried by keep-with-next), trust 1 page (37 lines, 12 rows), power of attorney 1 page (29 lines, 9 rows), 0 notdef; Liberation Serif advances read through fontlib equal the Times AFM hand sums for 15 glyphs (W 1933, m 1593, space 512, bold W 2048 of 2048 units); Knuth-Plass strictly cheaper than greedy on 99 of 369 measures swept 100pt to 468pt and never dearer; equal to brute force over all 2^11 break sets on 25 measures
2026-10-04	UD26	lesson	a neg-control built on a guess was vacuous: at pica typewriter pitch (65 characters) a paragraph of plain capitals FITS the 6.5in measure in Times 12pt (0 of 4 lines over), so character count is a fair proxy for ordinary capitals; the bite needs glyphs wider than the average a count stands for (M and W words: 2 of 3 fixed-pitch lines over, Knuth-Plass 0 of 3). Measure the control before trusting it
2026-10-04	UD26	queue	wire the sheets into nx_unidoc_lib in place of main.doc and its @page rule (owner seat); a font-italic conf row (I lines are measured with the regular face and counted); hyphenation through nx_hyphen; repeat a table's first row on a continuation page; kerning and ligatures measured from the face before the sheet CSS stops switching them off; a browser pixel referee comparing drawn line widths with the plan
2026-10-04	UD26	measure	nx_gate_bite nx_doc_paginate_gate over nx_doc_paginate_lib.nx: verdict=GREEN, the first compiling mutant (comparison operator at byte 11560) was killed, the library restored byte-identical (61,173 B, sha256 4b8f3cf9...), both twins restored, mutant_live=0; the promoted gate still hashes 95f80165... after the run
2026-10-04	UD18	land	SHIPPED 2026-10-03, awaiting acceptance: buildroot/runtime/nx_uxf_merge_lib.nx (35325 B, sha256 5531fbeae444101ccf11566a61070ab6e6b1dc7748f51cc1774eb9f6517b1af3, prefix uxm) and buildroot/runtime/nx_uxf_merge_gate.nx (33817 B, sha256 a4bdb34d27269f98bcda1f157b8d368ac9b55a5be59ab26ac0e127e1fbdeb031, prefix umg), both compiled on their first build by the sovereign toolchain; gate GREEN 37/37 under --qualify and again in the ship loop (PROVE on a fresh build of this run), promoted sha 564a5c5abdcb79e077f42bae95321b852c6646dfd855a026bc1d44dd0f95bb93 (121208 B), _offc twin installed, registered callable (no schema row). nx_gate_bite over the library: the first compiling comparison mutant (byte 9624) was killed, the library restored byte-identical (35325 B), both twins restored, mutant_live=0, and the promoted gate still hashes 564a5c5a after the run. The library imports only nx_syscalls; the gate composes nx_gate_verdict. Not wired into nx_uxf_doc or any daemon (another seat owns the doc library; nothing deployed)
2026-10-04	UD18	measure	values the gate emits (one run on the NAS): two-replica fixture of 7 events, all 5040 delivery orders converge to XYP with 0 mismatches against each other, against a full replay from the root, and against the hand-derived answer; 16562 merges replayed a concurrent span, 18718 applied directly, 20832 deliveries waited for a parent, the largest replay 5 events; the same sweep with every event delivered twice: 14448 duplicates, 0 mismatches. Three-replica fixture of 7 events: 5040 orders, cabed, 0 mismatches, largest replay 6. Three inserts at one index: 120 orders, aXYZb (lower agent first). Two concurrently typed runs: 720 orders, aXXYYb, never interleaved. Concurrent deletes around a concurrent insert: 24 orders, aQd. A delete of inserted text concurrent with an insert inside it: 6 orders, abRcd. A branch after a 13-byte shared prefix replayed 2 events over a 13-byte placeholder (15 events in the history); a linear history of 5 applied directly with 0 replays; a reused id refused with code -2; an index beyond the document refused with code -3 on the direct path and on the replay path, the replica unchanged both times; the valid positive control applied and landed at XYPZ. Negative controls on the same fixtures: applying raw positions gave a different text in 3108 of 5040 two-replica orders (4802 of 5040 three-replica), and whole-document last-writer-wins kept aXY and lost 1 byte of the merged XYP. Small fixtures only; no speed or size claim is made (header deviation 1: flat arrays, O(n) lookups)
2026-10-04	UD18	lesson	the method's full text had to be read before the integration rule could be chosen: the abstract mirror the board cites (rf_73ccfb4d.raw) says nothing about it, while the paper (mirrored the same hour as knowledge/fetched/cmp_unidoc_egwalker_paper.pdf and read through nx_pdf_text) says its implementation uses a Yjs variant conjectured to be maximally non-interleaving, and that placeholders stand only for characters inserted and not deleted before the critical version. That length is not known before the replay, so the placeholder is sized from an upper bound and the real length is derived after the held events replay (L0 = U - (visible - text)) and checked; a remote index is then validated against real records only, which is what lets the replay path refuse an out-of-range index without touching the text
2026-10-04	UD18	queue	next in order: (1) UD19 the relay, extending the nx_coedit serve lane: events carried by id with their parents by id, every request bracketed by sys_arena_mark and sys_arena_reset; (2) a merge verb on nx_uxf_doc and uxd_merge for UD12 (a block changed on one side taken, a block changed on both merged by uxm over its text) once the doc-format seat opens nx_uxf_doc_lib; (3) the engine's declared deviations as rungs: an order-statistic tree for O(log n) lookups, multi-event critical versions, the event-graph encoding of the paper's section 3.8; (4) UD8 moves from the nx_coedit RGA kernel onto this engine through the lifecycle; (5) the refs row egwalker-eurosys25 still points at the abstract mirror and should carry the full-text mirror (sha256 6512c455be24dce0f86e276f4967e6d0fbf10b712315753425bba17b57703b79) once the citation referee reads it; (6) UD18 has no matrix row on purpose: its rival cells must be assessed from mirrored pages before a watch row is added
2026-10-04	UD25	land	nx_doc_structure_lib (17,995 B, prefix dst_) finds defined terms in the drafting convention, (the "Term") or "Term" means, links every later use at word boundaries with the longest definition winning, and reports terms defined twice, never used and used before definition; gate nx_doc_structure_gate SHIPPED ccb71d6b 27/27 first build: known answers counted by hand on a fixture will (5 definitions, 6 uses, 1 early, 3 unused, 1 twice), Willow and Childish as neg-controls beside a positive control, the longest-match rule, lowercase and unclosed quotes refused as definitions, the report text naming each finding, a declared output bound and a determinism tooth
2026-10-04	UD24	land	the same leaf resolves written clause references (Article N, Section N) to the heading that declares them and reports a reference to a missing clause and a heading whose declared number is out of sequence (gate: Article 3 resolves to ordinal 2, Article 9 to DST_MISSING, 1 misnumbered heading). Wired into nx_doc_paginate_lib's line boxes (headings anchored s<ordinal>, definitions dfn id=d<i>, uses and resolved references as links, a missing clause flagged with a wavy underline and a title, every span closed and reopened across line boxes; the dry emission still equals the bytes written, pagination gate 107/107) and into nx_unidoc_lib as the opt-in layout=sheets with an outline pane (details element: pinned beside the sheet when the screen holds page-w + 2 toc-w + 4 gap, a contents list above it otherwise, hidden in print); viewer gate qualify ran 56 checks with all seven sheets teeth PASS and the flowing default unchanged (neg-control). Ships waiting on build admission (load 20.15 against 16.43)
2026-10-04	UD24	queue	re-emit the alpha pages with layout=sheets once nx_unidoc ships; the sample will now carries five defined terms and two clause references (will.nxd cid private-ref:1dad2c43, 23 blocks); then a real-browser capture at 390 and 1440 px and a print check before any claim
2026-10-04	UD27	measure	RIVAL CENSUS 2026-10-03 of Microsoft Word (Microsoft 365 web and desktop, Current Channel 2609 of 2026-09-30 [ms-current-channel]), Google Docs (Workspace recap of 2026-10-02 [gws-front] [gws-docs-label]) and LibreOffice Writer (26.8.1.1 of 2026-09-16 [lo-core-tags]), every cell read from a mirrored page of the rival's own: 27 capabilities by 3 rivals is 81 cells, 55 assessed and 26 left unassessed and named. Word 12 Yes, 5 Part, 1 No, 9 unassessed; Google Docs 14 Yes, 3 Part, 1 No, 9 unassessed; LibreOffice 11 Yes (2 inferred from it being a desktop editor, labelled so), 1 Part, 7 No, 8 unassessed. Sources: [ms-track-changes] [ms-coauthoring] [ms-compare] [ms-accessible-pdf] [ms-copilot-word] [ms-crossref] [ms-fieldcodes] [ms-copilot-privacy] [ms-purview-audit] [gdocs-suggest] [gdocs-offline] [gdocs-product] [gdocs-esign] [gdocs-toc] [gws-gemini-comments] [gws-gemini-apr26] [gws-ai-privacy] [lo-collab] [lo-compare] [lo-pdf-export] [lo-crossref] [lo-condtext] [lo-signatures] [lo-redlining] [lo-autotext] [lo-navigator] [lo-versions]. The one capability none of the three carries on any page read is defined-term linking (UD25); the full table is knowledge/status/unidoc_rival_census_2026-10.md
2026-10-04	UD27	queue	CENSUS ROWS MAPPED TO EXISTING RUNGS, not re-declared: real-time co-editing and presence to UD18 (engine shipped, awaiting acceptance), UD19 and UD20; comments and suggestions to UD21 and UD16; permissions to UD22; offline to UD23; version history to UD11 and the office save; outline, table of contents, clause numbering and cross-references to UD24; defined terms to UD25; page layout to UD17 and UD26; accessible tagged PDF and Word or ODF export to UD14; e-signature to UD13 and the shipped consent-gated version signing; what the law requires of the instrument to UD10. New rungs only where the estate can beat all three on a legal document: UD27 clause-aware redline, UD28 AI edit guard, UD29 law-traced assembly, UD30 offline-verifiable audit trail, UD31 clause index. Privacy (no training on content, local processing) is recorded in the census as a property and deliberately not claimed as an exceed (house law). Unassessed and owed: styles, tables and footnotes for all three, Word version history and offline (the fetched support URL answered 404), Google compare documents (the fetched answer URL answered 404), Google cross-references and assembly, LibreOffice comments and page layout. The LibreOffice 26.8 release notes and help site refused the sovereign TLS client (t12-ske-signature, status 0, on wiki.documentfoundation.org, www.libreoffice.org and help.libreoffice.org alike), so that column rests on the help source read from GitHub; that refusal is a defect for the TLS lane, not a rival fact. Footnotes and styles have no rung yet; UD24, UD25 and UD26 have no milestone row yet
2026-10-04	UD27	lesson	support.microsoft.com and support.google.com/a answered the first fetch through a redirect (hops 1 and 2); the citation referee counts a redirected mirror against its open-redirect ratchet unless its canonical acquits it, so each page was fetched again at the canonical address its own head declares (hops 0) and only those mirrors are cited; the first mirrors stay in knowledge/fetched uncited. The UD28 matrix row is the only new watch row: UD27, UD29, UD30 and UD31 stay UNMAPPED until their Google Drive, Acrobat and Nextcloud cells can be assessed from mirrored pages (Google's compare page was not found and helpx.adobe.com answered 403)
2026-10-04	UD19	land	SOURCE LANDED, NOT YET BUILT OR GATED: runtime/nx_uxf_sync_lib.nx (43416 B, contract uxs_relay) relays Eg-walker events untransformed -- every posted event goes through uxm_receive and its refusal is answered by the engine's own name (REFUSED-CONFLICT, REFUSED-POSITION, REFUSED-KIND, REFUSED-PARENTS) plus REFUSED-MALFORMED and REFUSED-DOCUMENT; a client names its version (the ids at its frontier) and receives every held event outside the causal past of that version and of what it just posted; each document keeps an append-only fsynced log at the logroot row of knowledge/uxs_relay.conf (a /tmp root is refused as volatile), a torn last line is refused by name and never written past, and the relay keeps no state between requests (each request replays the log, so a restart loses nothing). runtime/_hdl_build/nx_coedit.nx (36300 B) serve now hands any /uxs/ target to it on the incumbent loopback listener and keeps the RGA lane for every other target; shutdown now needs the exact /shutdown target (the old byte scan would have let a document id such as /uxs/shutter stop the server). Gate runtime/nx_uxf_sync_gate.nx (20382 B, in-process through the handler, no socket): three clients converge, a reconnecting client receives exactly the events it missed, a duplicate post leaves the log byte-identical, malformed and foreign-document and engine refusals pass through by name, a restart from the log alone equals the clients and a full replay, neg-controls last-writer-wins and raw-position relays bite on the same fixture, and the forked serving path shows zero pages of growth over a run.
2026-10-04	UD19	lesson	READ FROM SOURCE, MEASUREMENT OWED: the arena bracket cannot bound a long-lived relay. nx_syscalls sys_mmap sends every allocation above NXA_SMALL_MAX (256 bytes) to a whole kernel mapping, and sys_arena_reset rewinds only the small band; the engine's vectors grow by copying into a fresh allocation and never free the old one, and its replay trackers are above the band, so the MEMORY line of nx_uxf_merge_lib (a long-lived caller brackets each request with sys_arena_mark and sys_arena_reset) does not hold for any request whose replica outgrows 256 bytes. The relay therefore serves each request from a forked child that exits (uxs_relay_forked), and the gate reports in_process_bracketed_pages_grown_over_the_same_run as a value beside the forked zero-pages tooth. The engine-side remedy (release on growth, a uxm_free) is the merge lib owner's, and only then can the relay answer in-process.
2026-10-04	UD12	land	SOURCE LANDED, NOT YET BUILT OR GATED: runtime/nx_uxf_doc_merge_lib.nx (28060 B, contract uxd_merge) merges two versions that each name a common base as prev: block lists aligned by an exact LCS of block CIDs, every stretch between blocks both sides kept decided three ways (kept, one side's change taken, an identical change taken once), blocks both sides changed one for one merged at character level through the uxm engine (the base as a linear history, each side's edit as an exact byte-LCS diff, merged on both replicas and checked equal), restructured stretches kept from both sides and counted, manifest and block fields three-way with t and title character-merged; the side with the lower version CID is first, so merge(a,b) and merge(b,a) are the same bytes and identity; prev names both parents sorted and NL-separated; a side that is neither the base nor names it is refused BASE-MISMATCH. nx_uxf_doc gains merge <a.nxd> <b.nxd> <base.nxd> <out.nxd> (11128 B; self-verifies and prints kept, first, second, same, char_merged, both_kept, fast_forward, parents). nx_uxf_doc_gate gains 10 teeth (24628 B): edits to different blocks take both and need no character merge, either order gives the same identity, both parents in prev, one paragraph edited at both ends keeps both edits as one character-merged block, concurrent inserts at one place converge with both runs whole, and two neg-controls (an unrelated base, a side that does not name the base) refused by name. Declared deviations: base must be the direct parent; a restructured stretch keeps both versions rather than interleaving; byte LCS is O(n*m).
2026-10-04	UD19	queue	BUILDS OWED, ONE AT A TIME AND ONLY ON nx_build_admit check = GRANT (admission returned QUEUE on every check this session: load1 20 to 22 against a 16.43 ceiling, caused by other lanes): (1) nx_sov_build_run nx_uxf_sync_gate --qualify --run-timeout-ms 120000, read every tooth and the values; (2) on GREEN, nx_organ_ship nx_uxf_sync_gate (tokens before --behavior-args); (3) nx_sov_build_run nx_coedit --build-only, then nx_sov_build_run nx_coedit_gate --qualify --run-timeout-ms 120000 as the RGA-lane regression (it runs the kernel verbs against buildroot/_build/nx_coedit.sov.elf). nx_coedit is BUILT-UNPROMOTED and its serve verb binds a port, so it is NOT promoted or deployed from a seat: the release owner lane (plan-toolsapi-release- style RACI, engineer R, architect A) adds an organ_kind row for it and promotes through the daemon path, with knowledge/uxs_relay.conf (landed, 451 B, root knowledge/uxsrelay/) in the serving directory. Retiring nx_coedit's RGA lane onto the relay through the lifecycle stays owed after that.
2026-10-04	UD12	queue	BUILDS OWED, ONE AT A TIME AND ONLY ON nx_build_admit check = GRANT: (1) nx_sov_build_run nx_uxf_doc_gate --qualify --run-timeout-ms 120000 (compiles nx_uxf_doc_merge_lib through its import; read the ten merge teeth and the values merged_container_bytes_two_blocks, merged_container_bytes_one_paragraph, character_merged_blocks_one_paragraph, merge_prev_bytes, merge_refusal_unrelated_base); (2) nx_sov_build_run nx_uxf_doc --build-only; (3) on GREEN, nx_organ_ship nx_uxf_doc_gate then nx_organ_ship nx_uxf_doc, reading every LOST line before any allow_loss_v1 (nx_uxf_doc only gains strings, so a loss there is a defect, not a review). nx_uxf_doc_lib is untouched, so nx_unidoc_lib and the viewer that import it do not change.
2026-10-04	UD31	land	SOURCE LANDED, NOT YET BUILT OR GATED (admission QUEUE on every check, load1 19 to 22 against 16.43): runtime/nx_doc_clauseidx_lib.nx (39156 B, contract dci_query; the rung prose names nx_doc_clause_index_lib, the organ carries the shorter name and no matrix row maps dci_query yet) indexes every clause of a native container (a heading plus the blocks up to the next heading, uxd_open plus the dst_ outline leaf) as one canonical NXR1 row {w tenant, d document key, v version = manifest CID, o heading ordinal, t title, f exact fingerprint, n normalised fingerprint}. Exact fingerprint = cid_of a canonical record of the title with its declared Article or Section number stripped plus the body blocks' existing profiled CIDs, so an identical clause in two documents and a renumbered copy share it without re-hashing text; normalised fingerprint = lowercased words with punctuation folded and a number after Article or Section folded to one mark, for near-identical wording. Index = NCI1 framing of rows in strictly ascending byte order, so an incremental update (dci_add_doc replaces one document key) and a rebuild are byte-identical by construction, and dci_load refuses a reordered, duplicated or truncated index by name. Supersession is an authored NCS1 table {w tenant, a axis f or n, p old, r new}; DCI_Q_STALE lists the tenant's rows still carrying an old fingerprint. Every answer is scoped to one tenant and an empty tenant is refused. Store paths come from knowledge/doc_clauseidx.conf (599 B, nishihost root, rows index and supersede) and a /tmp path is refused as volatile; publication is temp file, fsync, rename. The segment store was read and not used for the index: its segment bytes keep write order and history, so equal row sets do not give equal bytes. Gate runtime/nx_doc_clauseidx_gate.nx (33055 B): a runtime vault of five documents in two tenants with the done-rule as teeth, full-population brute-force and version cross-checks, neg-controls (whole-text and line-number fingerprints miss the renumbered copy, unscoped scan, duplicated and truncated index, tampered document, /tmp conf row), and the three sample documents' clause counts re-derived from the spec projection.
2026-10-04	UD31	queue	OWED AFTER THE GATE, NOT BUILT BY THIS SEAT: (1) a CLI organ nx_doc_clauseidx over the lib (this seat may not edit nx_uxf_doc*), verbs add <tenant> <key> <file.nxd>, query <tenant> exact or norm <fingerprint>, clause <tenant> <key> <ordinal> (prints f and n via dci_fp_of), stale <tenant>, supersede <tenant> f or n <old> <new>, rebuild <tenant> <list of key and path pairs>; each verb resolves the store with dci_store_path(knowledge/doc_clauseidx.conf, index or supersede), reads with dci_store_read (DCI_ERR_ABSENT means start from an empty index), and every read-modify-write holds one lease around read, dci_add_doc and dci_store_write, because two concurrent writers would otherwise lose one update at the rename (the lib is single-writer by contract); (2) the vault and portal wiring, owned by the viewer seat: on every document save call dci_add_doc(index, tenant, key, container bytes, n) then dci_store_write; the clause panel calls dci_fp_of for the clause under the cursor and dci_query(index, 0, tenant, DCI_Q_EXACT or DCI_Q_NORM, fp, hits, cap) and renders each hit's d, v and o; the stale view calls dci_query(index, sup, tenant, DCI_Q_STALE, empty key, hits, cap); a return above cap means the hit list is a prefix and must be re-asked with a larger cap; the tenant comes from the authenticated session, never from the request; (3) a matrix row mapping dci_query to runtime/nx_doc_clauseidx_lib.nx once the Google Drive, Acrobat and Nextcloud cells can be assessed from mirrored pages (the UD27 lesson keeps UD31 unmapped until then).
2026-10-04	UD31	queue	BUILDS OWED, ONE AT A TIME AND ONLY ON nx_build_admit check = GRANT (every check this session read QUEUE, reason LOAD_AND_RUNQUEUE_POLICY, load1 18.4 to 21.6 and procs_running 17 to 25 against max_centiload 1643): (1) nx_sov_build_run nx_doc_clauseidx_gate --qualify --run-timeout-ms 120000 (compiles nx_doc_clauseidx_lib through its import; sources pinned sha256 76f80c02 lib 39156 B and b496fd7d gate 33055 B), read every tooth and the values; predictions written before the run: vault_rows 12, exact_hits_firm_a 2, normalised_hits_firm_a 3, exact_hits_firm_b 1, unscoped_carriers 3, stale_hits_axis_f 2, stale_hits_after_update 1, index_bytes_incremental equal to index_bytes_rebuilt and index_cid_incremental equal to index_cid_rebuilt, duplicate_row_refusal -104, tampered_document_refusal -7, volatile_conf_refusal -109, sample_rows_will 8, sample_rows_trust 4, sample_rows_poa 5 (heading counts read from the to-spec projections today); (2) on GREEN, nx_organ_ship nx_doc_clauseidx_gate, reading every LOST line before any allow_loss_v1 (a new gate has no live twin, so a loss is not expected); (3) nx_gate_bite nx_doc_clauseidx_gate nx_doc_clauseidx_lib.nx with the tenant filter, the title strip and the sort as mutation sites. Not deployed: a lib and a gate only.
2026-10-04	UD28	queue	SOURCE LANDED, NOT YET BUILT OR GATED (stopped at a usage limit; admission read QUEUE on every check, load1 18.5 to 20.5 against 16.43): runtime/nx_doc_aiguard_lib.nx (56922 B, sha256 d8160a9ce04b65aa56900f95d6cb9d175ea7be1e05e4e9314717fb7ceeeb6c60, contract dgd_check, prefix dgd ABSENT-PROVEN free over 27512 files corpus_complete=1) and runtime/nx_doc_aiguard_gate.nx (27673 B, sha256 c8ec96e44ca1e268717bbe3a6a40783c8fcee42f60c73a9179e51d38e25dac77, 76 teeth, helpers dgg). The lib composes nx_doc_structure_lib (dst_def_at, dst_use_at, dst_ref_at, dst_declared, dst_report) and nx_uxf_merge_lib (uxm_local applies an event batch). Rules, each a named REFUSE line: SPAN-INVALID, EVENT-REFUSED, EVENT-OUTSIDE-SPAN (held per event), HEADING-NUMBERING-CHANGED (anywhere, inside the span too), DEFINITION-REMOVED/ADDED/REDEFINED (outside the span), REFERENCE-BROKEN, REFERENCE-RETARGETED, TERM-USE-BROKEN, TERM-USE-CAPTURED, AMOUNT-OR-DATE-OUTSIDE-SPAN, WHITESPACE-OUTSIDE-SPAN (decided REFUSED: byte identity outside the span), TEXT-OUTSIDE-SPAN, SPAN-LINE-BREAK, STRUCTURE-NEW-FINDING; ACCEPT returns the trimmed diff. Five imprecisions declared in the header. BUILD AND SHIP STEPS OWED, ONE AT A TIME, ONLY ON nx_build_admit check = GRANT: (1) nx_sov_build_run nx_doc_aiguard_gate --qualify --run-timeout-ms 120000; on a compile failure fix the named line and rebuild, then read every tooth (expected primary rules: leak TEXT 14, rename TERM-USE-BROKEN 10, dropped definition DEFINITION-REMOVED 5, Article 4 to 9 REFERENCE-BROKEN 8, Article 4 to 1 REFERENCE-RETARGETED 9, heading renumbered HEADING 4, whitespace 13, amount 12, clause delete in span REFERENCE-BROKEN 8, in-span definition removal TERM-USE-BROKEN x3, own heading renumbered HEADING 4, Executor capture TERM-USE-CAPTURED 11, orphaned Will STRUCTURE-NEW-FINDING 16, newline in a byte span SPAN-LINE-BREAK 15, three invalid spans 1, events outside 3, engine refusal 2) and the printed values; a RED tooth is diagnosed from the report text, never by loosening the tooth; (2) nx_gate_bite nx_doc_aiguard_gate runtime/nx_doc_aiguard_lib.nx 2 to show a mutant dies; (3) nx_organ_ship nx_doc_aiguard_gate, reading every LOST line before any approval (a new organ has no live twin, so nothing should be lost); (4) land a measure row with the gate's values. CALL SITE RECOMMENDED, NOT WIRED and not verified to exist yet: the accept of a suggestion branch (UD21 uxm_suggest, unbuilt) is where dgd_check_events belongs, so no AI edit merges until the guard accepts it; until UD21 lands, whatever lane writes a model's proposed document back into a .nxd version (nx_uxf_doc save, the office save half of UD15) calls dgd_check(base, proposal, declared span) first and keeps the version unchanged on REFUSE. The matrix watch row _ABSENT_:dgd_check flips on the next regen because the symbol now exists; the flip is a receipt, not the proof, which is the gate above
2026-10-04	UD27	queue	SOURCE-LANDED, NOT YET BUILT (stopped at the coordinator's usage-limit order; build admission read QUEUE twice, load 19.9 then 21.0 against 16.43, so no build was started). buildroot/runtime/nx_doc_redline_lib.nx (77,832 B, sha256 2d75dc6e...82201, prefix drl_, free by a corpus_complete grep) composes nx_doc_structure_lib (dst_declared, dst_ref_at, dst_def_at, dst_use_at, dst_defs_collect), uxdm_hirsch and uxdm_span_eq from nx_uxf_doc_merge_lib (exact LCS, called with rows the result owns so nothing leaks; uxdm_lcs mmaps rows per call and never frees them, a defect for that lib's owner), uxd_open/uxd_doc_cid/uxd_to_spec for verified native versions, and html_escape from nx_html_escape; buildroot/runtime/nx_doc_redline_gate.nx (29,941 B, 41 teeth: six hand-derived full change lists, determinism, page identities, zero script, hostile escaping, containers verified then compared, tamper and wrong identity refused by name, line-diff and character-diff negative controls, drl_free). OWED, in order: (1) nx_build_admit check until GRANT, then nx_sov_build_run nx_doc_redline_gate --qualify --run-timeout-ms 120000, one build in flight; expect compile fixes on a first build (never compiled); iterate to GREEN and treat any differing expected list as a question to answer from the fixture text, never by editing the expected list to match; (2) nx_organ_ship nx_doc_redline_gate, reading every LOST line before any allow_loss_v1; (3) land and measure rows with the gate values; (4) the viewer and the office (nx_unidoc verb, portal route) call drl_new, then drl_redline_nxd(r, a, na, expect_a, b, nb, expect_b) or drl_redline(r, spec_a, la, id_a, spec_b, lb, id_b), then drl_page(r, 0, 0) to size and drl_page(r, buf, n + 1) to fill (drl_changes for the TAB list), then drl_free(r); owned by another seat. DECLARED DEVIATION: the in-clause redline unit is the word, the rung text says character.
2026-10-04	UD19	land	nx_uxf_sync_gate SHIPPED dfd04a69 (first promote, offc twin installed, registered schema=0), no source edits, GREEN 41/41 on the shipped artifact: three clients converge to 39 B, a reconnecting client receives exactly the 11 events it missed, a duplicate post answers 37 DUPLICATE with the 1188 B log byte-identical, a restart from the log alone equals the clients and a full replay (45 events), refusals pass through by name, a volatile or absent conf root is refused, neg-controls last-writer-wins and raw-position relay BITE-PROVEN, the forked serving path shows 0 pages of growth over 45 runs while the in-process bracketed path grew 6795 pages (the arena lesson of 1791086601 measured). nx_coedit --build-only 8f7efd1f 113136 B, NOT promoted (port-binding daemon, release-owner lane); RGA regression nx_coedit_gate GREEN 7/7 through /api/gate_run on that exact artifact. OPEN: the /uxs/ hand-off and the exact /shutdown target are compiled but not exercised through a socket; nx_coedit_gate reads RED 3/7 under the qualify lane because it opens buildroot/_build/nx_coedit.sov.elf relative to its CWD (gate defect: resolve the instrument on a root ladder and print the path)
2026-10-04	UD12	land	three-way merge of native documents: nx_uxf_doc_gate SHIPPED 17cb45c6 42/42 GREEN (merged_container_bytes_two_blocks=666, one_paragraph=672, character_merged_blocks=1, merge_prev_bytes=145, unrelated base refused -17), nx_uxf_doc SHIPPED 8486d5d9 with the merge verb. Compile fix in nx_uxf_doc_merge_lib (a6ac94f5, 28015 B): the identifier match became a NishiLang keyword, renamed mt in 15 places, signatures of uxdm_hirsch and uxdm_span_eq unchanged. The nx_uxf_doc loss approval (aaca9f18, 4 runs) covered only this seat's own already-shipped nx_unidoc_lib changes carried in by import (the firm-name header, font-src in the CSP, overflow-wrap on .meta), reviewed by the lib owner, not new behaviour
2026-10-04	UD27	land	clause-aware redline: nx_doc_redline_gate SHIPPED c0406d68 (233952 B) 41/41 GREEN on first clean build, no edits: six hand-derived change lists byte-exact (insert plus move plus rename plus one renumbering of 5 articles; a redefined term; a removed term with 5 orphaned uses; REF-BROKEN; two REF-RETARGETED plus a redefinition; a word-level amount edit) and a version against itself reports nothing; the line-diff and character-diff neg-controls flag all 5 renumbered headings as changes; tamper -2 and wrong identity -4 refused by name; drl_free loses 0 allocations; nx_gate_bite killed=1, lib restored byte-identical. Declared deviation stays: the in-clause unit is the word. Viewer and office call sites are still owed
2026-10-04	UD28	land	AI edit guard: nx_doc_aiguard_gate SHIPPED 78cb8123 (159456 B) 76/76 GREEN on first build, no edits: all 17 fixture cases refused by the primary rule declared before the run, positive controls accepted with the diff rebuilding the proposal byte for byte, and 4 neg-controls show the structure report alone misses the text leak, whitespace, retargeted reference and changed amount, while plain text comparison alone accepts the touch-and-restore batch the event check refuses (e1_events=128, e3_events_outside=2); nx_gate_bite killed=1 (first-kill stop, one mutant). The call site (accept of a suggestion branch, or any lane writing a model's proposal into a .nxd) is still NOT wired
2026-10-04	UD31	measure	clause index: nx_doc_clauseidx_gate SHIPPED 5656781a (177456 B) 71/71 GREEN on first build, no edits; every predicted value matched (vault_rows 12, exact firm_a 2, normalised firm_a 3, exact firm_b 1, unscoped 3, stale axis f 2, stale after update 1, index 3752 B with cid private-ref:79e7e59b equal for incremental and rebuilt, refusals -104 -7 -109, samples will 8 trust 4 poa 5). Bite killed=1 in dci_fp_of but found two gaps: the DCI_ERR_TENANT literal survives (the tooth compares the code with the lib's own constant) and dci_err_name is never reached (the refused-by-name teeth check codes, not names)
2026-10-04	UD31	queue	gate gap to close: add teeth that assert the refusal NAMES (EMPTY-TENANT and its siblings through dci_err_name) against literal strings, so a changed code or a broken name table goes RED; then re-bite. The CLI organ and the vault wiring of 1791087460 are still owed
2026-10-04	UD26	land	PHONE REFLOW SHIPPED (operator surface): the sheets layout now emits TWO renderings from one document, the estate-laid Letter sheets (wide screens and print) and a reflowed copy for phones (anchor prefix r, its own outline nav), switched by a min-width derived from page-w and gap in doc_page.conf and by @media print; ids never shared between renderings. nx_doc_paginate_gate 97ee147d, nx_unidoc_gate b45bc7da 61/61 (teeth: phone copy has its own outline anchors and links; neg-control no id shared; width picks the rendering and print takes the sheets), nx_unidoc 9681bd18 then 141893ea (defined-term and reference link styles unscoped from .dpag-sheet so both renderings read the same; phone outline inset by the --doc-gap token). will, trust and poa re-emitted (18751, 15670, 13967 B, each 7 B under the previous emit as the CSS arithmetic predicts) and republished to andelinwest.com/alpha/docs/. Real-browser capture (nx_cdp_capture, 390x844 dsf 2 and 1440x900): the phone page fits the screen with no horizontal cut and the outline, term links and clause links work; the desktop page is unchanged. Awaiting operator acceptance
2026-10-04	UD19	land	nx_coedit_gate root-ladder fix SHIPPED c11b2ddb: the gate opened buildroot/_build/nx_coedit.sov.elf relative to its CWD, so the qualify lane (CWD buildroot) read RED 3/7 against an absent instrument while /api/gate_run (CWD nishihost) read 7/7; eg_resolve_ce now tries buildroot/_build/ then _build/ and the gate prints SUBJECT=<path> (or SUBJECT=ABSENT naming both roots). Proven both ways: qualify 7/7 GREEN with SUBJECT=_build/nx_coedit.sov.elf, ship-loop prove 7/7 with SUBJECT=buildroot/_build/nx_coedit.sov.elf; behaviour reviewed (+44 B = that one line); LOST only the two retired ENOMEM wordings. nx_coedit_live_gate carries the same bare path at four sites and is unchanged (its own lane)
2026-10-04	UD28	land	AI edit guard IN THE PATH: nx_uxf_doc propose <base.nxd> <proposal.nxd> <a> <z> <out.nxd> (or clause <k> for the k-th heading and its body) verifies both containers, runs dgd_check over their spec projections with the declared byte span of the base's projection, and writes a new version ONLY on ACCEPT -- rebuilt from the accepted projection, prev = base, the base title and fields kept, re-opened and compared byte for byte before the write; on REFUSE it prints PROPOSE-REFUSED <RULE> with the guard's own report, exits 1 and writes nothing. nx_uxf_doc af7f3c4f (probe IDENTICAL on verify; LOST only the reviewed .dpag-sheet link rule), nx_uxf_doc_gate 284b1948 67/67 (25 new end-to-end teeth: accept with prev and 9 of 10 blocks shared, TEXT-OUTSIDE-SPAN with no file, TERM-USE-BROKEN with no file, the clause form, SPAN-INVALID on a heading line, two named neg-controls). Live on the sample will: ACCEPT of an in-span insertion at byte 905; DEFINITION-REDEFINED refused (120 hours to 72 hours inside the Residuary Estate definition) with no output file. No nx_gate_bite pass yet on the new teeth
2026-10-04	UD28	queue	BYPASS TO CLOSE: uxd_set_meta refuses b r n kind v but not prev, so from-spec then set prev <cid> creates an unchecked child of any base. Reserve prev in uxd_set_meta (merge and propose become the only writers of a parent link) and move the gate's xg_child helper off set prev; owed by the lib owner once the lanes compiling against nx_uxf_doc_lib are quiet; then bite the propose teeth
2026-10-04	UD27	land	REDLINE PAGE ON THE OPERATOR SURFACE: nx_unidoc redline <a.nxd> <b.nxd> <out.html> [brand= changes= expect_a= expect_b=] (nx_unidoc_redline_lib, both versions verified before any write, the viewer chrome with brand, CSP and noindex) shipped e9ca861d then 413daa32; the page list now writes every change as one plain sentence through drl_wsentence in nx_doc_redline_lib (Article 4 Digital assets was added; Wording changed in Article 5 Specific gifts: 2 words added, 2 words removed; In Article 7 Guardian, the reference Article 8 points to a clause that does not exist; The defined term Personal Representative was renamed Executor: 4 uses read the new name and none was missed; 3 clauses renumbered (structure only, not substance): Article 4 to 5, 5 to 6, 6 to 7) with the machine kind kept in a data-kind span and the TSV change list byte-stable; nx_doc_redline_gate c648ea46 41/41, nx_unidoc_gate 37b46220 81/81 (redline_page_bytes 10014 -> 10428, list 560 unchanged). Fictional will_v2.spec and will_v2.nxd (private-ref:322c08fb, verified) added; published andelinwest.com/alpha/docs/will-redline.html (pub row 32; a malformed first put with the actor argument omitted was closed with its reason, history kept); real-browser capture at 390 and 1440 px reads cleanly. Awaiting operator acceptance
2026-10-04	UD31	land	clause index CLI: nx_doc_clauseidx 6ca83ec3 (add, query, clause, stale, supersede, rebuild; conf found in the working directory then its parent; one nx_lease_lib writer lease beside the index, lease_ttl_s=300 in doc_clauseidx.conf; re-asks above cap); nx_doc_clauseidx_gate 59aa4408 71 -> 160/160 GREEN: all 12 refusal codes held to literal names through dci_err_name and to literal wire integers, 63 CLI end-to-end teeth whose stores are byte-identical to the lib's own serialisation, a planted lease refuses add by name; nx_gate_bite killed=1 at dci_err_name (the function the first bite never reached). OWED: a tool_schemas row (registered, not discoverable) and populating the production index from a firm's vault
2026-10-04	UD28	land	BYPASS CLOSED: nx_uxf_doc set now refuses prev by name (UXF-DOC-REFUSED set prev: a parent link is written only by merge and propose, which check the lineage; nothing written), so from-spec plus set can no longer forge a checked child; the library contract is unchanged because propose writes its parent link through uxd_set_meta after the guard accepts. nx_uxf_doc 97d542e1, nx_uxf_doc_gate 993dc383 70/70 (fixture reached, refusal with no output file, neg-control set title still writes); refusal witnessed live through the registered tool
2026-10-04	UD27	land	GUIDED TO EACH CHANGE IN READING ORDER (operator: "especially if guided to the changes"): the change list links each change to an anchored line in the document (Change k of n, its plain sentence, previous, next, all changes), and the numbers now follow the order a reader meets the changes. The first cut numbered them in the order the comparison found them, so on the alpha will the first change on the page read Change 5 of 6 and its next link skipped two changes; a real-browser capture showed it, no gate did. drl_rank runs the body's own walk once into a counting writer and every mark, anchor, neighbour link and list item reads that one order, so no second ordering exists to drift (the per-clause scratch mapping is gone too). nx_doc_redline_gate e349d927 GREEN 53/53 with three new teeth (numbered in reading order, list in document order, anchor equals label) bite-proven RED 50/53 against the old library (1 of 4, 0 of 4, 0 of 4) while the fixture-reached tooth passed; nx_unidoc de6cc2ef (gate 81/81); /alpha/docs/will-redline.html re-emitted and served, labels 1 to 6 down the page and the list in the same order, browser-checked phone and desktop. Shipped, awaiting operator acceptance.
2026-10-04	UD27	land	TABLE ROWS READ AS CELLS: a redline table row printed its raw pipe separators run into the words; cells now carry a light divider (drl_wesc_cells) and a gate tooth asserts the divider and refuses the bare pipe (nx_doc_redline_gate 93e40e0a, then e349d927). Served on the alpha redline, browser-checked phone and desktop.
2026-10-04	UD17	land	TEXT VISIBLE BEFORE THE WEB FONT ARRIVES: both @font-face rules in nx_unidoc_lib carry font-display swap, so a slow font load shows the fallback serif instead of invisible text; the alpha document pages were re-emitted and served (nx_unidoc de6cc2ef, nx_unidoc_gate 81/81).
2026-10-04	UD3	land	THE ALPHA URLS NO LONGER 404 (operator: "these all 404 so im not seeing any functionality"): andelinwest.com/alpha/ has a landing page emitted from knowledge/alpha/andelinwest_alpha.rows, and the short URLs /alpha/will.html, trust.html, poa.html and will-redline.html forward to /alpha/docs/ (CSP default-src none, noindex); pub rows 33 to 40 on pub-andelinwest-. Fictional samples only.
2026-10-04	UD27	queue	the phone capture shows the targeted change line mid-viewport while the desktop capture puts it just under the header; not adjudicated whether that is the capture's paper-then-restore pass or the page, so settle it with a second capture method before touching scroll-margin
2026-10-04	UD27	land	THE TWO DOCUMENTS SIDE BY SIDE (operator 2026-10-04: "the side by side should be the two documents side by side with the ability to explode out the changes with side by side logical on desktop and top vs bottom on mobile ... capabilities emitting from the nishi estate and not being handcrafted"): the redline's one walk now draws a second view. drl_page_body takes a view; a side-by-side row sets version a's clause beside version b's, each the clean text of its own version, with the row's change marks and, when the clause differs, a details disclosure that explodes it into before (the words version a loses) beside after (the words version b gains). An unchanged clause under one heading carries a dup twin so a stacked screen draws it once; a moved clause leaves a stub linking to its new row. Stacked is the redline sheet's own rule; two columns is the viewer's rule, written from the page conf (two measures of page-w less two margins plus three gaps, ud_compare_css), so no layout length lives in code. nx_unidoc redline views=all writes side by side, every change exploded and inline as three pages from one comparison, each with a view switch. nx_doc_redline_gate 257ccb77 GREEN 73/73 (20 side-by-side teeth: rows equal the line view's, exploded panels mark exactly the line view's inserted and deleted words while the clean columns mark none, the line view byte-identical through drl_page and drl_page_view, two neg-controls); nx_unidoc 7eb52207 (gate 99/99; behaviour IDENTICAL on a real render). Served at /alpha/docs/will-redline.html, -exploded.html and -inline.html; real browser: two columns at 1440 px, version a above version b at 390 px, exploded panels beside and stacked. The side-by-side teeth are not yet mutation-tested. Shipped, awaiting operator acceptance.
2026-10-04	UD3	land	FORWARDING PAGES EMITTED, NOT HAND-WRITTEN: the four short alpha addresses had been written by hand earlier on 10-04. nx_unidoc forward now emits them (the viewer's own head plus a refresh; the target held to ud_href_ok, the listing page's link rule; a scheme or protocol-relative target is refused HREF-REFUSED by name, asserted by the viewer gate, not yet mutation-tested). All four re-emitted and published over the hand-written copies (pub rows 37 to 40); comparison pages on rows 32, 41 and 42.
2026-10-04	UD27	measure	the two-column threshold is the document's own measure: 2 x (8.5in - 2 x 1in) + 3 x 24px = 1320 px, so a 1280 px laptop gets the stacked layout. A narrower comparison column would be a THRESHOLD row in doc_page.conf with its calibration evidence, never a code change.
2026-10-04	UD27	queue	renumbered clauses with unchanged text still draw twice on a phone (their headings differ); drawing the body once under both headings is the next refinement. Mutation-test the side-by-side and forward teeth (nx_gate_bite on nx_doc_redline_lib drl_sbs_row and nx_unidoc_lib ud_forward_page).
2026-10-04	UD33	land	nx_lexicon promoted (gate nx_lexicon_gate 94/94), registered on the MCP surface, cap minted for 30 days (lexicon1004), MCP call verified: synonyms of revoke returned the dictionary's two synonym sets with the source credit. Stores: Open English WordNet 2025, 185,129 sense rows (partition: 185,129 senses = 185,129 rows + 0 without synset) with 7,988 antonym links and 9,656 domain topics, 0 unresolved, plus 4,473 irregular forms; the U.S. Courts glossary, 243 rows = 241 page terms + 2 abbreviations (ADR, AO), reconciled against the page's own term count; 5 estate rows quoted from IRS Publication 559
2026-10-04	UD33	lesson	the first gate run caught a real ingest defect (an unresolved synset member counted once per pass, 2 for 1); the tooth was written before the fix and went RED then GREEN across it. The glossary ingest wrote a qualifier such as Insider (bankruptcy) as a second name, and the domain markers read civil and criminal cases as criminal; both fixed (abbreviations are capitals only; two courts rows ahead of the criminal markers) with teeth in both directions
2026-10-04	UD32	retract	the first panel on the sample will glossed shows and give by a rare law sense (provide evidence for; accord by verdict). The view now asks a least share of law senses, a calibrated threshold in view.conf: give 23 permil, show 67, minor 83, will 167, witness 286, codicil and residuary 1000; any share from 84 to 167 selects the same words, 100 chosen inside that interval; the stated cost is minor (minor child) no longer glossed; re-calibrate on the trust and the power of attorney
2026-10-04	UD32	queue	the matrix watch rows wait on a rival census read this month of the dictionary and thesaurus features of Google Docs, Microsoft Word, Acrobat and Nextcloud; estate words such as testator and intestate need a sourced estate glossary (WordNet files testator outside law), and the Utah Code definitions section (75-1-201) refused the sovereign TLS client earlier (rc -212); the flowing layout shows the panel without inline marks; the words gate passed every tooth on its first run and is owed a mutation bite
2026-10-04	UD32	land	nx_unidoc promoted with words=on (unidoc gate 99/99, content ruler one-way gain, behavior identical on the default path); nx_unidoc_words_gate 37/37 (a weak-share word not marked, a table-first word marked at its first paragraph use, byte-for-byte negative controls); the three alpha documents re-rendered and published: the will explains will, codicil, personal representative (quoted from IRS Publication 559), residuary and witness (4 weak uses held back: show, give twice, minor); the certification of trust explains settlor (from its table) and trustee; the power of attorney explains will, power of attorney and notary. Served will page verified GREEN at 21,469 bytes; seen in Edge at 390 and 1440 pixels: the glossed words carry a blue dotted link to the panel, the will's own defined terms keep their links, and a word first used inside the will's own definition (Residuary Estate) is left to the will
2026-10-04	UD32	lesson	a scan that reports each term once per line drops a word's later standalone use when its first use sits inside a longer explained term; the words layer now asks the lexicon for every use (lx_lex_scan_all), and the gate pins the standalone use
2026-10-04	UD35	measure	the focus dim is derived, not picked: nx_eink_tone ramp 16 lists the 16 panel levels, and the lightest that keeps WCAG 2.2 SC 1.4.3 AA over white is L* 46.66 = sRGB 111 (#6f6f6f measures 5.02:1 by nx_contrast; the next level #808080 measures 3.94:1); black ink at opacity .565 over white composites to 111, so a dimmed clause stays readable and lands on a panel level. The screen desk #e9eaed measures L* 92.69 (between levels 86.66 and 93.32, so a panel dithers it) and the screen rule #9aa0a6 measures 2.64:1; both are replaced in the paper view
2026-10-04	UD35	land	focus and paper modes, zero script, every value a knowledge/doc_page.conf row: the paginator writes data-c on every line and cell and one rule per heading that dims every other clause through the consumer's --doc-focus (nx_doc_paginate_lib; gate 113/113 shipped f565d87b with six new teeth); nx_unidoc_lib writes the same on the phone's reflowed copy, the Focus control (ud_focus_css, armed by the focus-dim row), the Paper view (ud_paper_css: every eink-<k> row overrides token <k>, selected by @media update:slow, monochrome and prefers-contrast:more AND by the Paper view checkbox, written by one call so the two cannot disagree) and a stroke token thickened only in the paper view (no advance width changes, so pagination is identical); nx_unidoc_gate 114/114 with a byte-equality tooth for the two selections; a mutation bite on ud_clause_of was KILLED and the source restored byte-identical
2026-10-04	UD35	lesson	a style rule shared by two layouts names both layouts on every page: the stroke rule written as main.doc,.dpag-sheet made the flowing page mention a sheet, and the existing negative control (a flowing page carries no dpag-sheet) refused the ship loop; the sheet rule is now written only on sheets pages. A negative control written for one rung caught a defect in a later one
2026-10-04	UD35	queue	owed: calibrate eink-stroke (.25px chosen unmeasured) against a capture of this page on a panel; a served browser check of the focus state with the control ticked; matrix watch rows only after the rival census (Word Focus, iA Writer focus mode, the Kindle and Kobo weight controls), because an unassessed rival cell withdraws the page's position map
2026-10-04	UD34	measure	the sources were read before a line of code: the plainlanguage.gov list of 237 Don't say and Say pairs [plainlang-simplewords] (its 12 bold rows match the page's own dirty dozen) and the Federal Plain Language Guidelines 2011 [fplg-2011] (must for requirements on p. 25; unnecessary words and doublets on pp. 38-39). Measured on the sample will through nx_plainlang measure: 8 clauses, 21 sentences, 307 words, longest sentence 24 words, 3 passives, 1 shall, 4 swaps each naming its source row; the numbers carry no verdict because no threshold has been calibrated on real drafts
2026-10-04	UD34	land	nx_plainlang_lib + nx_plainlang (MCP: measure, swap, ingest-table, merge) shipped 43b34998 with nx_plainlang_gate 31/31 hand-counted (shipped a6cca37f, mutation bite KILLED): the swap table is data in the lexicon's own store schema (knowledge/plainlang/swaps.rows, 252 rows = 239 ingested + 13 read by hand, every row keeping its source and row or page), found by the lexicon's scan through word forms, so the dictionary and the measures share one engine; clauses are numbered as the page's data-c
2026-10-04	UD34	land	reading the 2011 Guidelines exposed the PDF reader splitting words (Th e Pl ain L anguag e): nx_pdf_text now models the pen (glyph widths from /Widths or /W and /DW, Tc, Tw, Tz, Tm and Td) and breaks a word only at a measured gap of half a narrow space or a line change, reads hex strings, and has an ops verb; nx_pdf_text_gate 16/16 (synthetic fixtures with hand-computed positions plus the pinned Guidelines PDF) shipped with the reader a8e0ec57; the PDF viewer's gate stays 10/10
2026-10-04	UD34	lesson	a source that cannot be read cleanly is a defect in the reader, not a reason to type its table from memory: the Guidelines PDF was unreadable through the estate's own extractor, the extractor was fixed from the ops dump (Word writes each word's pieces in separate text objects), and the clean text then showed its tables are laid out column by column, so those pairs were read by hand with page numbers while the HTML list was ingested mechanically with row numbers
2026-10-04	UD34	queue	owed: a plain-language panel on the document page beside the words panel (per-clause numbers and swaps by data-c); calibrate any threshold only against real drafts and a published readability study read first; the residual PDF glyph with no Unicode map (an apostrophe drawn from a CID font without ToUnicode) needs the embedded font's cmap
2026-10-04	UD34	land	the plain-language check is on the document page: nx_unidoc html <doc> <out> plain=on (or plain=<conf>) splices nx_unidoc_plain_lib's panel after the document, one row per clause (sentences, words, longest sentence, passive, shall, plainer wordings) and a whole-document row, then every plainer wording in reading order naming its guide and row [plainlang-simplewords] [fplg-2011], a credit with the licence and how each number is counted, and no grade; each clause name links to its own anchor in the sheets (s<k>) and the phone copy (rs<k>), so the focus mode lights the clause, shown by the viewer's own layout switch through .only-sheets and .only-reflow (the threshold is written once); the numbers come from a record sink in nx_plainlang_lib (one walk, capacity guarded, cleared after) and the spec from one shared reader ud_spec_read that the words panel now uses too. Shipped nx_unidoc 7d0ab5bd, nx_unidoc_plain_gate 599b30ca (54/54 hand-counted, mutation bite KILLED), nx_unidoc_gate 250e0612 (114/114), nx_plainlang 5224c000 (behaviour identical)
2026-10-04	UD34	measure	served on the three alpha documents with the words panel: will 8 clauses, 21 sentences, 307 words, longest 24, 3 passives, 1 shall, 4 plainer wordings; trust 4 clauses and 4 wordings; power of attorney 5 clauses and 4 wordings; plain_over=0 and every clause linked on all three; Edge captures at 1440 and 390 show the panel, and the phone table scrolls inside its own frame (a data table may need two dimensions)
2026-10-04	UD34	lesson	every gate was green and the page was still wrong: the first browser capture showed each wording broken onto its own line because the layout switch shows main and nav as blocks and the new classes rode the same declaration; a link is inline text, so .only-sheets got its own display:inline inside the same media block. A pinned tooth (the print rule's exact text) caught the switch change and was extended to the new rule at the same strictness, never loosened
2026-10-04	UD34	queue	owed: mark plainer wordings and passives in the text itself (the paginator holds one mark set, so two sets is a paginator rung); a readability formula needs syllable counts and a source for them read first; a rival census (Word's readability statistics, Hemingway, WordRake, Grammarly clarity) before any matrix row; nx_unidoc_words_gate and nx_uxf_doc compile the changed libs and read BEHIND until shipped
2026-10-04	UD34	land	closure caught up the same hour, so the BEHIND item in the queue row above is closed: nx_plainlang_gate 82a76434 (31/31), nx_unidoc_words_gate cfe9e9a5 (37/37, its fixture pages each exactly 95 bytes larger: the switch classes 65 and the inline declaration 30), nx_uxf_doc 305f6d21 (behaviour identical on its import workload); every importer of the changed libs is shipped (nx_absent over buildroot/runtime, coverage complete: nx_unidoc_lib 7 importers, nx_unidoc_redline_lib 2)
2026-10-05	UD37	land	operator: "i cant edit or use any of this like an actual word or google doc". The alpha pages were a read-only zero-script viewer and the office editor works line by line, so the estate now emits a real editor: nx_unidoc edit <doc> <out> doc= view= js= (nx_unidoc_lib's new edit= option adds an Edit this document link to every viewer page). Shipped: nx_unidoc_edit_gate 64d55def (40/40, new), nx_unidoc_gate 7c992980 (114 to 117/117: the edit link drawn, escaped, and absent when no editor is named), knowledge/doc_editor.conf (idle-ms 700, undo-steps 300, both THRESHOLD rows marked unmeasured). Published on andelinwest.com/alpha/docs/: will-edit.html, trust-edit.html, poa-edit.html (pub rows 43 to 45), nishi_editor.js (row 46, 38,241 B, sha cb11239e), the three viewer pages with their edit links and the index with an Edit a document section and an honest Where this stands row. Fictional samples, noindex
2026-10-05	UD37	measure	served and driven in a real browser through nx_cdp_capture journeys (new step kinds js, type and key, with the key chords as data in nx_cdp_lib): editor-will 33 steps at the phone (390) and desktop (1440) doors, verdict OK: the client loads at its versioned URL, the page reads back to exactly its spec, typing lands in the text, Ctrl+B writes an R b line, two undos return the spec byte-equal to the baseline and redo restores it, Enter makes a paragraph, Ctrl+Shift+8 makes a list written as an L line, the draft reaches localStorage, a hostile paste keeps its text and drops span, script and handler, and replace-all is undone in one step; editor-trust and editor-poa 12 steps each, OK at both doors: Tab moves to the next table cell, typing in a cell reaches the spec, the row count is unchanged, one undo returns the baseline. Receipt blocks: will 15 blocks 8 rows, trust 7 and 12, poa 8 and 9, zero unknown lines and zero bad runs on all three
2026-10-05	UD37	lesson	three defects that every gate passed and only the browser showed: (1) Chrome's insertUnorderedList writes the list inside the paragraph it started in, so the normaliser lifts a list or table out of a p or h2 before it touches leaves; (2) a browser keeps a cached script under the same URL, so a fixed client never reached the page until the emitter versioned the URL by the first 16 hex of the file's sha256 (two gate teeth); (3) an author display rule beats the hidden attribute, so the find bar showed on load and the phone toolbar wrapped to four rows until each overlay got its own [hidden] rule and the toolbar became one scrolling row (two gate teeth). A journey field longer than its 512-byte buffer had been read as empty and now refuses by name
2026-10-05	UD37	queue	OWED: (1) UD38, saving edits to the firm with versions, compare and a Word download, needs a decision that is not a seat's: the office daemon serves admin.andelinwest.com/office to the firm, so wiring the save into it restarts a live client surface, while a separate alpha office instance would leave the firm's office untouched; (2) nx_cdp_capture and nx_cdp_lib ship with the seven new nx_cdp_capture_gate teeth for the js, type and key steps; (3) heading levels beyond one, nested lists, live page breaks while editing, comments and suggestions (UD21), and co-editing (UD8, UD19) in the editor; (4) a rival census read this month of Word for the web and Google Docs editing features before any matrix row, because an unassessed rival cell withdraws the page's position map; (5) the toolbar scrolls on a phone with no visible cue that more buttons sit to the right
2026-10-07	UD34	land	2026-10-07 rung repointed from _ABSENT_:plg_measure to plg_measure and UD35 from _ABSENT_:ud_paper_css to ud_paper_css: the matrix rows landed the same day carry the bare symbols, so the ranker read both UNMAPPED (RANK unmapped=2) while the organs exist; a rung that keeps the _ABSENT_ prefix after its row lands is the dark contract seen from the other side
2026-10-07	UD1	measure	rival census (nx_rivalcensus, ecosystem EC88) pass 1 over 34 mirrored pages: 136 cells, 56 exact, 27 presence (Yes proposed where the seat graded Best), 47 disagree, 6 unadjudicated, 430 permil exact; pass 2 with the two-word phrase table: 131 keyed cells, 59 exact, 27 presence, 45 disagree, 0 unadjudicated, 450 permil exact and 656 with presence, ratchet HOLDS, 45 lesson rows in unidoc.census_lessons; three cells re-graded on this month's evidence (Markdown in Docs and eSignature in Docs read Yes from the October Workspace page, Nextcloud Text reads Part for signature requests)
2026-10-07	UD1	lesson	a bare word is a homonym on a vendor page: convert, preview, approve, compare, version, search, train and at the same time each matched a menu, a rollout note, a price page or a file list, so every census phrase is at least two words the page uses for THIS capability; support.google.com answer pages render their body from script so the sovereign reader sees only the shell, and the Google column is graded from blog and product pages; a Part the seat gave where the page is silent is a No by evidence with the missing page named in the queue
2026-10-07	UD1	queue	the 45 remaining census disagreements are each a cell to adjudicate with a witness (the organ names the page and the snippet) or a phrase to refine; the Nextcloud Office app page, the Docs dictionary page, Word's readability statistics page and Word's Focus mode page are not mirrored, so those cells read No by evidence until they are; render the census grade row on the page beside the position map (EC88 done-rule); a rendering reader for script-built support pages or a server-rendered source for each such page
2026-10-07	UD8	lesson	OPERATOR 2026-10-07: Google Docs, Word, Acrobat and Nextcloud are the OFFICE rivals and belong to this document board; the practice board (legalpractice) is specific to DocuSign, Clio, NetDocuments and PandaDoc; measured: eleven rows are carried on both boards as separately graded rows (dad_handle, dx_to_html, nx_ann_add, nx_doc_serve_response, nx_env_send, odt_read_text, of_coedit, of_import, of_save, of_sign_version, pf_to_html) and legalpractice LP14 is UD8 under another id; this board is the HOME of those capabilities, legalpractice LP14, LP15 and LP22 now depend on UD8, UD13 and UD25 so the ranker reads the home rung's state, and the cross-board row kind that renders a home row on another board without re-grading it is ecosystem EC89
2026-10-08	UD8	land	2026-10-07 this board is the HOME of the document capabilities legalpractice references: five legalpractice rows became @xrow references (ecosystem EC89: dx_to_html, odt_read_text, pf_to_html, of_save, nx_doc_serve_response) and render here-graded cells on /compare/legalpractice under this board's columns; the Nishi mark on a reference is measured against this board's organ with the one symbol ruler, so a capability is graded once, here, and read everywhere
2026-10-08	UD8	land	2026-10-07 three rows on this board that graded an e-sign or legal capability whose exceed is claimed on /compare/legalpractice became @xrow references to it (nx_ann_add the annotation overlay, nx_env_send envelope routing, nx_legal_regime the never-void instrument gate), chosen by the fleet duplicate census (nx_rivalcensus dupes, ecosystem EC89); each reference keeps the document-portal reading (Acrobat Sign Best on routing, Google Docs Part by the 2026-10-07 census) in its note; landed on a predicted size ladder 31957 to 32089 in three steps, every receipt byte-exact; no unidoc rung carries any of the three symbols, so the ranker stays at unmapped=0. This board is in turn the home for dad_handle and the on-premise property row that legalpractice now references
2026-10-08	UD8	land	2026-10-07 a fourth reference: the sign-in-place row (of_sign_version) became @xrow legalpractice
2026-10-08	UD1	land	2026-10-07 two Word-extraction rows moved HOME to this board from /compare/legalpractice (ecosystem EC89, a document capability is graded on the document board): docx_read_text (own OPC/ZIP reader, w:t runs) and docx_read_spec (paragraph-faithful extraction, the spec verb the import consumes), both runtime/_hdl_build/nx_docx.nx, graded 1

On these two registers. Rows are declared in the domain's plan file and carry the debt id, which is the join key back to the sovereign debt plane — that plane, not this page, is the authority on state. Reconciling them automatically (the regen reading the plane and refreshing these rows) is a named, owed rung; until it lands, treat an id here as a pointer to look up, not a status to trust.

Honest verdict. The coverage above records source-symbol presence. Stronger comparisons are authored claims, not measured runtime superiority or accepted outcomes. A watch contract names an expected source symbol; finding it changes source discovery only. Qualification, deployment and runtime acceptance require their own evidence.

Person · product · place — not yet measured for this domain

Every compare carries this layer. Declare knowledge/compare/unidoc.ppp (rows surface|nishi or c1..c4|label|url|connect naming OUR live surface and each rival's front door), run nx_ppp_probe domain unidoc, and this section fills itself on the next beat: the same ruler on both sides — privacy and CX (third-party hosts, tracker classes, cookies, security headers), design and longevity (design hygiene, computed WCAG contrast, render-blocking resources, unsized media, script weight, theme and motion queries), findability (landmarks, skip link, on-site search, breadcrumb, headings, internal links).

The field — discovered, not chosen

Rows written by nx_field_discover from unidoc.seeds: the industry's own lists (Wikipedia wikitext, GitHub topics, awesome lists) read mechanically, every candidate counted across seeds. The matrix columns above are a SEAT'S pick; this band is the population they were picked from, and the stats line measures one against the other. A rival here is a lead, never a verdict — it earns a column when its capabilities are read and pinned.

Discovery receipt. One row per counter the run wrote, in the receipt's own order; the rival rows follow in their own table.

Field discovery, counted
Class	Count	Note
seeds	4
scanned	3
fetched	3
reused	0
failed	1
named	4
candidates	4
mentions	4
capped	0

Rank	Rival	Seeds	Mentions	First seed	Kind	Link
1	Google Drive	1	1	col0-google	named	https://support.google.com/drive/answer/2423485
2	Microsoft 365 web	1	1	col1-microsoft	named	https://www.microsoft.com/en-us/microsoft-365/free-office-online-for-the-web
3	Adobe Acrobat web	1	1	col2-adobe	named	https://www.adobe.com/acrobat/online/pdf-reader.html
4	Nextcloud Hub	1	1	col3-nextcloud	named	https://github.com/nextcloud/server

Exclusive and shared capabilities

One capability is graded on one board; every other board references it. The fleet duplicate census (nx_rivalcensus dupes, on the fleetdupes clock row) reads every board's matrix and names each capability graded as a row on two or more boards, with a home derived from evidence: rung when exactly one board's plan contracts the symbol (that board is starred), gates when no plan contracts it and exactly one board's executed gate map runs the organ's gate (that board is plussed), ambiguous when several boards carry the deciding evidence (a decision for their seats), and none when no evidence decides it, with the reason beside it: unmapped (no board of the duplicate declares a gates map; declare the maps) or unproven (a map exists and runs none of the organ's gates; gate the organ on its proving board, or declare it a shared library by policy). A home elsewhere means this board should carry an @xrow reference to the home board's row rather than a graded row of its own; a home here means the other boards should. The table is this board's slice of one estate-wide census: the shape is shared, the rows are the board's.

This board grades 64 capabilities: 63 exclusive to it and 1 shared with other boards. Shared rows on this page: 1 = home here 0 + home elsewhere 0 + ambiguous 0 + undecided 1 + refused 0 (partition 1); undecided = unmapped 0 + unproven 1 + unevidenced 0; homonyms 0; since the previous census: new 0, resolved 0. Census FRESH age_s=7101.

Capability	Organ	Boards grading it	Home	Rule	Evidence	Standing on this board
br_doc_conv	`nx_browser.nx`	browser, unidoc	—	none	unproven	undecided

Gaps from the record — what the estate does that no board carries

The record census (nx_goalmap record) reads the invoked-tool population and every plan queue row and files each organ or directive that NO matrix, plan or gates row names. A row here is a callout the boards missed: adjudicate it onto a board or declare it infrastructure. Census state STALE (age 1396206 s), sources read 4 of 7 declared — a BLIND census is a FLOOR: unread sources can only add rows.

kind	name	board	source	evidence

rows shown 0|this board's directives 0|estate-wide un-boarded organs 452 (listed in full on /compare/ecosystem)|census rows 639|malformed 0 (counted, never rendered)

References

Beyond a link list. Every reference below resolves twice — the publisher's copy and, where banked, the estate's own non-rottable library mirror with a content pin — and carries its evidence class plus the exact claim on this page it grounds. Keyed marks like [key] in the matrix notes jump here. A dash means honestly absent, never assumed.

[google-drive-view] Google. Drive Help: View and open files -- the file kinds Google Drive previews in the browser (Office documents, PDF, text, images, video and more) and the open-with app model (support page). Accessed 2026-09-03. publisher · read in our library knowledge/fetched/cmp_unidoc_google-drive-view.html · pin h32c71e281393c9376051f97ac92335183cf91984b1b3e02e90d36d424e5b06ad · accessed 2026-09-03 · vendor-docGrounds: The Google Drive column on every OPEN row and the Yes on the one-page-per-document, index, comments and share rows: the cloud viewer reference.
[m365-web] Microsoft. Microsoft 365 for the web -- Word, Excel and PowerPoint in the browser, view and edit documents online, files kept in OneDrive (product page). Accessed 2026-09-03. publisher · read in our library knowledge/fetched/cmp_unidoc_m365-web.html · pin h5701b41d50298c2f4eb945fcb0ae60c28b28a21a3041518923ce7976ac0fa2fe · accessed 2026-09-03 · vendor-docGrounds: The Microsoft 365 column on the OPEN, EDIT and co-editing rows: the office-in-the-browser reference.
[acrobat-web] Adobe. Acrobat online PDF reader -- view, annotate and sign PDF in the browser (product page). The sovereign fetcher could not complete a TLS handshake with adobe.com on 2026-09-03 (status 0 on two pages), so no mirror is banked; the URL was witnessed and the column is graded from the vendor's public product description only, at index level. publisher · accessed 2026-09-03 · vendor-docGrounds: The Adobe Acrobat column: Best on the PDF row and on PDF annotation and signing, No on every non-PDF kind; every Acrobat cell says index-level in its note.
[nextcloud-server] Nextcloud. Nextcloud Server (GitHub repository README): the self-hosted files platform with an in-browser viewer for text, Markdown, images, video and PDF, office editing through Collabora or ONLYOFFICE apps, sharing, versions and comments, on your own hardware. Accessed 2026-09-03. publisher · read in our library knowledge/fetched/cmp_unidoc_nextcloud-server.html · pin h84ae25cb24dbbed08e5e120a8ac4727359a9c9ca4888af5a839075604c69300d · accessed 2026-09-03 · vendor-docGrounds: The Nextcloud Hub column: the self-hosted unified-portal reference, Part where a capability needs a bundled third-party app (office editing) and Yes where the platform itself carries it (files index, versions, comments, share).
[pdfjs] Mozilla. PDF.js -- a general-purpose, web standards-based platform for parsing and rendering PDFs, the in-browser PDF renderer shipped in Firefox (project page). Accessed 2026-09-03. publisher · read in our library knowledge/fetched/cmp_unidoc_pdfjs.html · pin h13ee816c48a07c4e6cec2bb8dcf3ac8fcb924c0f7a5f4d24c7dfdc7b65c90789 · accessed 2026-09-03 · vendor-docGrounds: The PDF row: the open in-browser page-layout renderer our text-layer reflow is measured against, and the pf_page_layout watch's bar.
[csp3] W3C. Content Security Policy Level 3 (Working Draft): default-src, script-src, form-action and base-uri directives, the policy delivered by header or by the http-equiv meta element. Accessed 2026-09-03. publisher · read in our library knowledge/fetched/cmp_unidoc_csp3.html · pin ha28120328f5265dbf2028d8a7272bece363016915b3d6e53641643c270ac65b2 · accessed 2026-09-03 · published-standardGrounds: The 'Document page ships a fail-closed Content-Security-Policy' row: the directive set the page carries (default-src none, form-action self, base-uri none).
[whatwg-sandbox] WHATWG. HTML Living Standard, the iframe element and the sandbox attribute: the flags that disable script, forms, top navigation and plugins in embedded content. Accessed 2026-09-03. publisher · read in our library knowledge/fetched/cmp_unidoc_whatwg-iframe-sandbox.html · pin h2f02864ed3d35e01bbb0985a23bffb93ceaa45279cebb59b1cc4b395902a0d7b · accessed 2026-09-03 · published-standardGrounds: The 'Untrusted document text escaped by construction' and 'Renderers out of process' rows: the field isolates a document by sandboxing an embedded frame; the sovereign page has no script surface to sandbox and isolates the renderer by process instead.
[ecma-376] Ecma International. ECMA-376: Office Open XML File Formats (WordprocessingML, Open Packaging Conventions), also ISO/IEC 29500. publisher · read in our library knowledge/fetched/cmp_office_ecma376.html · pin h7861648cf663c18dbdc3a4d4779b8de50603ec0604b1a3ee6d571ea76efe84f7 · accessed 2026-08-18 · published-standardGrounds: The 'Word .docx opened as a page' row: the package and paragraph model the docx spec verb reads.
[odf-1-3] OASIS. Open Document Format for Office Applications (OpenDocument) Version 1.3, Part 1. OASIS Standard, 2021 (also ISO/IEC 26300). publisher · read in our library knowledge/fetched/cmp_office_odf13.html · pin hdbfa9338c0751bcc8248a77aa421ab00ef0cad1fd237ed445a3469fecafae330 · accessed 2026-08-18 · published-standardGrounds: The 'OpenDocument .odt opened as a page' row.
[wcag22] W3C. Web Content Accessibility Guidelines (WCAG) 2.2, W3C Recommendation, 2023-10-05: level AA success criteria including Target Size (Minimum) 24 by 24 CSS pixels, Dragging Movements, Focus Not Obscured (Minimum), Consistent Help, Redundant Entry and Accessible Authentication (Minimum). publisher · read in our library knowledge/fetched/cmp_legalpractice_wcag22.html · pin h6e3c5fe397257cae509a2fb4752b73062cf8cbeb92c2cec618989b17e4cf7057 · accessed 2026-09-03 · published-standardGrounds: The 'Mobile-first page' row: the target-size and single-column bar the emitted page is measured against.
[arxiv-collab-editing] arXiv API listing, search abs:"collaborative editing" sorted by submission date, the 15 newest entries, fetched and read 2026-10-03; newest on-subject entry arXiv 2609.18886 (Brocco, Gremlich, Guidi: Fluid Notarization: Verifiable Evolution of Concurrently Edited Structured Documents, submitted 2026-09-16, revised 2026-09-22); the next on-subject entry is arXiv 2607.28101 (Mechaoui, Imine: ESBT, a sequence CRDT with bounded identifier growth, submitted 2026-07-30); the entries of 2026-09-08 (Wikidata edit history analytics) and 2026-08-24 (agent coordination) are off-subject. publisher · read in our library knowledge/fetched/rf_accbab59.raw · pin h9e7c3d4821cee0a014d3290d6740f24cdce6e00fb3ee879cea89cf73efe2f2e9 · accessed 2026-10-03 · mirrored-indexGrounds: The dated bar SB-DOCFORMAT and the 'native document container' row: the September 2026 line that makes a document's evolution the verifiable object.
[egwalker-eurosys25] Gentle, Kleppmann. Collaborative Text Editing with Eg-walker: Better, Faster, Smaller. EuroSys 2025 (arXiv 2409.14252, doi 10.1145/3689031.3696076): an order of magnitude less memory than existing CRDTs in the steady state and orders of magnitude faster loading from disk. publisher · read in our library knowledge/fetched/rf_73ccfb4d.raw · pin he05c34dda715463d97090efdf245d0d045fd1585676b92af6b04c7155f2ba3c7 · accessed 2026-10-03 · published-paperGrounds: The best-in-class target T-BIC-DOC and the merge rung UD12: a document that loads as plain state and keeps its history beside it.
[rfc8949] IETF RFC 8949. Concise Binary Object Representation (CBOR), section 4.2 Deterministically Encoded CBOR: the core deterministic encoding requirements (shortest-form arguments, sorted map keys) that give a data item one encoding. publisher · read in our library knowledge/fetched/rf_da358f08.raw · pin hf1164a5b31a39350ad46abe29b83575eb933ca6c45366989c118b6b1058a214a · accessed 2026-10-03 · published-standardGrounds: The 'native document container' row: deterministic encoding before hashing, carried here by the estate's own canonical record form.
[odf-1-4] OASIS Open. OASIS Approves Open Document Format (ODF) V1.4 Standard, announcement of 3 December 2025: approved as an OASIS Standard, with new features and full backward compatibility. publisher · read in our library knowledge/fetched/rf_ccb35296.raw · pin h37d773ca01232bb78f643ee7f32a2c6a564e31505a1053162b58efef9c72d1e9 · accessed 2026-10-03 · published-standardGrounds: The export rung UD14: the current open office-document standard a native document must write and read.
[pdfa-standards] PDF Association. PDF standards registry: PDF/UA-2 is ISO 14289-2:2024 on PDF 2.0, and ISO 14533-3 gives the long-term signature profiles for PAdES. publisher · read in our library knowledge/fetched/rf_0bc78e6a.raw · pin h2519e3d18021b68301f4cc754f4a22311db760f0501178acfd6e698e190d4391 · accessed 2026-10-03 · mirrored-indexGrounds: The 'native document container' row (the Acrobat cell, index-level) and the print export rung UD14.
[fips-204] NIST. FIPS 204, Module-Lattice-Based Digital Signature Standard, published 2024-08-13 (doi 10.6028/NIST.FIPS.204). publisher · read in our library knowledge/fetched/rf_cd15a9c9.raw · pin h7146bec0740962c11cf0b32ae31b2f5ff8c5402705f7d4d5ba41e53d35973574 · accessed 2026-10-03 · published-standardGrounds: The signing rung UD13: the post-quantum signature a long-lived legal document carries beside a classical one.
[automerge-site] Automerge project site (a project's own claim): Automerge supports millions of changes in a single doc and uses a compressed columnar store on disk and in memory. publisher · read in our library knowledge/fetched/rf_775b195e.raw · pin h5c919a436bb391f7ba28c6a766623d24214d4f12e8eff4826a5855609672d724 · accessed 2026-10-03 · vendor-docGrounds: The best-in-class target T-BIC-DOC: history kept with the document, as a labelled project claim.
[ms-office-signatures] Microsoft Support. Add or remove a digital signature in Microsoft 365 files: a digital signature guarantees integrity, that the content has not been changed or tampered with since it was digitally signed. publisher · read in our library knowledge/fetched/rf_bafe635d.raw · pin h1ccbb6bbe43736e67fa216245f62eef35b97b9691cde016045c813b1323d0c6d · accessed 2026-10-03 · vendor-docGrounds: The 'native document container' row, Microsoft 365 cell: integrity is documented for a signed file only (Part).
[google-docs-versions] Google Docs Editors Help, answer 190843 (version history): choose an earlier version and Restore this version. publisher · read in our library knowledge/fetched/rf_566d8427.raw · pin h18bf3e65a2edf5352f19f1087a6fdd2c8633be670eeb260efb21582e0b130d29 · accessed 2026-10-03 · vendor-docGrounds: The 'native document container' row, Google cell: version history is documented, a verifiable content identity is not (No).
[nextcloud-versions] Nextcloud user manual. Version control: a simple version control system for files whose old versions the versioning app expires automatically. publisher · read in our library knowledge/fetched/rf_9ed442b3.raw · pin h64df8f23b5f789d62fe6bbfd7d627825253024da489baa153050ce775402a6df · accessed 2026-10-03 · vendor-docGrounds: The 'native document container' row, Nextcloud cell: expiring file versions are documented, a verifiable content identity is not (No).
[css-page-3] W3C CSS Working Group. CSS Paged Media Module Level 3 (Editor's Draft): the @page rule with its size and margin descriptors; its examples write a letter page as size 8.5in 11in (8.5 inches wide and 11 inches high) and give letter sheets a 1in page margin. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/rf_801366d0.raw · pin hf8b5cba763466651dee5144e8563ba601c3151fbb09633cf4bf56c66ab68e061 · accessed 2026-10-03 · published-standardGrounds: The UD17 document page layer and the page-w, page-h and margin rows of knowledge/doc_page.conf: the sheet size and the letter page margin the viewer draws and prints.
[ms-word-margins] Microsoft Support. Word training, Change margins: In Word, each page automatically has a one-inch margin; preset, mirrored and custom margin settings (support page). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/rf_4bf1c9de.raw · pin h2ff62bf2dbe985049da174fb942ab1f0f77720389ac60cd42a573c984f99584e · accessed 2026-10-03 · vendor-docGrounds: The UD17 document page layer and the margin row of knowledge/doc_page.conf: the default page margin a reader of a Word document expects.
[gdocs-spacing] Google Docs Editors Help, answer 1663349 (line and paragraph spacing): to change your paragraph spacing, click Single, 1.15, 1.5, or Double; custom spacing is also offered (support page). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/rf_e750893e.raw · pin h8ab70a68aeea1583886325594f8d235a03a7a22b922f468ca04b8ea5c69d725a · accessed 2026-10-03 · vendor-docGrounds: The UD17 document page layer and the leading row of knowledge/doc_page.conf: the line spacings a document editor offers, of which the page uses 1.15.
[urcp-10] Utah Rules of Civil Procedure Rule 10 (d) Paper format, Utah State Courts publisher · read in our library knowledge/fetched/cmp_unidoc_urcp10.html · pin h18ef807a42f306293489ee7f9540e36241db1184a94c843f97ba7bd489b17c44 · accessed 2026-10-03 · published-standardGrounds: UD17 document page layer: Letter paper, margins of not less than one inch, type not smaller than 12-point size
[ms-track-changes] Microsoft Support. Word training, Track changes in Word: turn Track Changes on and off, view and navigate tracked changes, accept or reject them one at a time or all at once, comments in the margin, and Keep Track Changes on behind a password, for Word desktop, Word for the web, iPad and iPhone (page updated 2026-09-25). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_track_changes_c.html · pin hf3e3f247133942892c78e629bc4c8f87fe26fb2d0a4c09f2ccf9c86d34bb5350 · accessed 2026-10-03 · vendor-docGrounds: The October 2026 rival census (Word column: suggestions and tracked changes, comments) and the best-in-class target T-BIC-LEGALDOC.
[ms-coauthoring] Microsoft Support. Word training, Collaborate on Word documents with real-time co-authoring: when others work in the document at the same time you see their presence and the changes they are making; without a Microsoft 365 subscription you can still edit at the same time but without real-time collaboration (page updated 2026-09-25). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_coauthoring_c.html · pin hda184ce51e222aa3eeb0e37e244cfc7368b1b209ca7804a53b378036a3da4b90 · accessed 2026-10-03 · vendor-docGrounds: The rival census (Word column: real-time co-editing and presence).
[ms-compare] Microsoft Support. Compare and merge two versions of a document: Review then Compare shows the differences between two versions, and Compare then Combine Documents merges the revisions of several reviewers (page updated 2026-09-25). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_compare_c.html · pin hc3cb33379497103846d451f3c47d30239d21f46e0158427808c9af1f52da9aac · accessed 2026-10-03 · vendor-docGrounds: The rival census (Word column: compare and redline) and rung UD27, the clause-aware redline measured against a compare that works on characters.
[ms-accessible-pdf] Microsoft Support. Create accessible PDFs: save a Word document as PDF with the option Document structure tags for accessibility selected; the page does not name PDF/UA. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_accessible_pdf_c.html · pin h67d22b86390a6c0e9fa7af45e0377e887e4441d76c50120ef7a96c55e6f05263 · accessed 2026-10-03 · vendor-docGrounds: The rival census (Word column: accessible output and PDF export, Part because PDF/UA is not named).
[ms-copilot-word] Microsoft Support. Welcome to Copilot in Word: start a draft from a prompt, outline, notes or a referenced file, improve text with Edit with Copilot, a preview of suggested changes in chat where nothing is added to the document until you review and approve it, summaries and questions about the document, and grounding in relevant files or work context. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_copilot_word_c.html · pin h599e28baddaaa7597a88713214ddf5a939891df0594da40bf26789ad8b8b22b0 · accessed 2026-10-03 · vendor-docGrounds: The rival census (Word column: AI drafting and review, AI grounded in sources) and the Microsoft 365 cell of the AI edit integrity row (Part: reviewable before it applies, not structurally checked).
[ms-crossref] Microsoft Support. Create a cross-reference: the Word help page for inserting a cross-reference to another part of the same document (title read from the mirror; page updated 2026-09-25). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_crossref_c.html · pin hdc8738f31dac3cdaa858e521cf803669f035546822cbdf336da386370093825a · accessed 2026-10-03 · vendor-docGrounds: The rival census (Word column: auto-numbered clauses and cross-references) mapped to rung UD24.
[ms-fieldcodes] Microsoft Support. List of field codes in Word: the field reference, including the If, NextIf, SkipIf and Set fields that drive conditional text and assembly, the NoteRef field for footnote references and the TOC (Table of Contents) field (page updated 2026-09-25). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_fieldcodes_c.html · pin h58b538cef1cfa50bd1a2280d678f5370b8781edeb2cde5ece0de0c7ed4a3738b · accessed 2026-10-03 · vendor-docGrounds: The rival census (Word column: document assembly, table of contents, footnotes) and rung UD29.
[ms-copilot-privacy] Microsoft Learn. Data, privacy and security for Microsoft 365 Copilot: prompts, responses and data accessed through Microsoft Graph are not used to train foundation LLMs, and Copilot only surfaces organisational data to which an individual user has at least view permission. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_copilot_privacy_c.html · pin h20909dd7d98bafe0d1545257883022ad4ed778a74a494a6253b224a4eb5e054e · accessed 2026-10-03 · vendor-docGrounds: The rival census (Word column: privacy, and search across documents through Copilot, both Part) and rung UD31.
[ms-purview-audit] Microsoft Learn. Microsoft Purview auditing solutions overview: the unified audit log captures, records and retains user and admin operations across Microsoft services; Audit (Standard) keeps records 180 days, Audit (Premium) keeps Exchange, SharePoint and Entra records one year by default, and 10 years needs a per-user add-on licence. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_purview_audit.html · pin h5c629ff9ccf65ee4339fb467f7435112b539cc9d4a7e9eff18a382e1e023d30d · accessed 2026-10-03 · vendor-docGrounds: The rival census (Word column: audit trail, Part because it is an administrator log bounded by licence, not a record bound to the document) and rung UD30.
[ms-current-channel] Microsoft Learn. Release notes for Current Channel (Microsoft 365 Apps): newest entry Version 2609 of 2026-09-30 (Build 20430.20118, fixes); the Version 2603 entry of 2026-04-09 carries the Word line When drafting with Copilot, users will see the Copilot chat pane open with their prompt. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_ms_current_channel.html · pin hc42e4c64d366ad955d9e5d80e281c48245d1dcde2f80d720c25a647c0743c309 · accessed 2026-10-03 · mirrored-indexGrounds: The rival census: the newest Word desktop release it was taken against (a vendor channel, not a witness of the bar).
[gws-docs-label] Google Workspace Updates blog, label Google Docs: 17 post summaries read from the mirror, newest 2026-09-30 (programmatic comment and suggestion support in the Docs, Sheets and Slides APIs), then 2026-09-23 (ground AI prompts in Google Docs on existing sources from Gemini Notebook), 2026-07-28 (Gemini-powered comment workflows; generate and edit visuals with Gemini), 2026-05-04 (custom instructions for Gemini), 2026-04-22 (new Gemini capabilities), 2026-02-12 (audio summaries) and 2025-06-04 (suggestions in client-side encrypted documents). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gws_docs_label.html · pin h3405cd01596dafdc4c8c6449adb87be011a7bfd094b8f05f4e8ec33e2fc6016c · accessed 2026-10-03 · mirrored-indexGrounds: The rival census (Google Docs column and the capabilities the minimum list missed: AI grounding in sources, audio summaries, client-side encryption).
[gws-front] Google Workspace Updates blog front page: the Google Workspace Weekly Recap of 2026-10-02 summarises programmatic comment and suggestion support in the Docs, Sheets and Slides APIs (in Docs, API support for suggested edits so automated tools propose revisions for user review rather than altering content directly), skills replacing Gems for tailoring Gemini, and the 2026-10-01 simple setup option for Workspace client-side encryption. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gws_front.html · pin h91f9a8eebeab4f1283553975d4de0c96201db269358d16baee74d5c8868bb1e9 · accessed 2026-10-03 · mirrored-indexGrounds: The rival census (Google Docs column, the newest dated incumbent state: API suggestions, client-side encryption) and the Google Drive cell of the AI edit integrity row.
[gws-gemini-comments] Google Workspace Updates, 2026-07-28: Streamline collaboration in Google Docs with Gemini-powered comment workflows: Gemini summarises comment threads, adds comments on request, drafts grounded replies and suggests document edits for the user to review, approve and apply; available to Docs users with edit access. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gws_gemini_comments.html · pin hbc9af5add9f157708a3b4687ef92b4458d65133f159177ac1df4f5206109f806 · accessed 2026-10-03 · vendor-docGrounds: The rival census (Google Docs column: comments and AI review) and the Google Drive cell of the AI edit integrity row (Part).
[gws-gemini-apr26] Google Workspace Updates, 2026-04-22: New Gemini capabilities in Google Docs: Help me create generates formatted first drafts from files, email, chat and the web through Workspace Intelligence (data across Drive, Gmail and Chat), and with Help me write Gemini makes edits across the document whose suggested edits are only visible to the user until approved. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gws_gemini_apr26.html · pin hf632b47ff1393fc26cdf7a001182f1d6f94ec669fe5ad38bcfd03817e2107888 · accessed 2026-10-03 · vendor-docGrounds: The rival census (Google Docs column: AI drafting, search across documents through Workspace Intelligence) and the AI edit integrity row.
[gdocs-suggest] Google Docs Editors Help, answer 6033474: Suggest edits in Google Docs (title read from the mirror). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gdocs_suggest.html · pin hd54a057bfd3a815800f6bb3924fa2fbf1f619714f8ec7e2f846515a3cca431ba · accessed 2026-10-03 · vendor-docGrounds: The rival census (Google Docs column: suggestions and tracked changes).
[gdocs-offline] Google Docs Editors Help, answer 6388102: Work on Google Docs, Sheets and Slides offline (title read from the mirror). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gdocs_offline.html · pin h9ba86de45a8c3d67236b35ec8b3afb1219d96a2bdb6769c6d88d32ac2a281873 · accessed 2026-10-03 · vendor-docGrounds: The rival census (Google Docs column: offline editing) mapped to rung UD23.
[gdocs-product] Google Workspace. Google Docs product page (vendor marketing): co-editing means multiple people can work on the same document at the same time, sharing settings control who can view and edit, revision history, eSignature in Docs, and Stay productive, even offline. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gdocs_product.html · pin h05f24124e150e7f5f08ce8506f89815ab2572c2dc5951e1a998a8429e7c9a8b9 · accessed 2026-10-03 · vendor-docGrounds: The rival census (Google Docs column: co-editing, permissions and sharing, offline, e-signature).
[gdocs-esign] Google Docs Editors Help, answer 12315692: Send signature requests and sign documents with eSignature: reminders, an audit trail locale chosen in the request dialog, and a final PDF whose last page is an audit trail logging the request's events with timestamps. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gdocs_esign.html · pin h033b732869def5f379a2108f8bdb24691c1acc57bae3550a2ed5a95af18e018f · accessed 2026-10-03 · vendor-docGrounds: The rival census (Google Docs column: e-signature Yes, audit trail Part) and rung UD30.
[gdocs-toc] Google Docs Editors Help, answer 116338: Add a title, heading, or table of contents in a document, with the document outline (title read from the mirror; the phrase Document outline occurs twice). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gdocs_toc.html · pin h602abcf6c2668571855bd03d0c7fa69d3fe967134ccb189dacb648ac1f7eed81 · accessed 2026-10-03 · vendor-docGrounds: The rival census (Google Docs column: outline and table of contents) mapped to rung UD24.
[gws-ai-privacy] Google Workspace Help. Generative AI in Google Workspace Privacy Hub: Workspace does not use customer data for training models without the customer's prior permission or instruction, and content is not human reviewed or used for generative AI model training outside the domain without permission. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_gws_ai_privacy_c.html · pin h5bdf997755b2aca48ce0992b733ae41ce0f5d9ba6ab7138af056c6049818df9c · accessed 2026-10-03 · vendor-docGrounds: The rival census (Google Docs column: privacy, Part because it is a contractual promise over cloud processing).
[lo-collab] The Document Foundation. LibreOffice Help source (help repository, master branch), Collaboration: in LibreOffice Writer, Impress and Draw only one user at a time can open any document for writing; in Calc many users can. Read from the GitHub mirror of the help source because help.libreoffice.org and wiki.documentfoundation.org refused the sovereign TLS client on 2026-10-03 (t12-ske-signature, status 0, four tries each). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_collab.xhp · pin hf2dd9719227862674afc4f166c92447a2b1fb9fab9365051ee86815c680e52e2 · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice Writer column: real-time co-editing No, permissions and sharing No).
[lo-compare] The Document Foundation. LibreOffice Help source, Comparing Versions of a Document: File then Compare Document combines the older and newer documents into the reviewer's document with every insertion and deletion marked for accept or reject. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_compare.xhp · pin he2040a68c2b839cd07276e25a9aa137324528dd8df4c44c104144e65a348aa55 · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice column: compare and redline) and rung UD27.
[lo-pdf-export] The Document Foundation. LibreOffice Help source, PDF export General options: PDF/UA (universal accessibility), with Tagged PDF automatically enabled and not disableable when PDF/UA is selected, and Hybrid PDF that embeds the ODF file. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_pdf_export.xhp · pin h42f37d18c7ad7e0d08a977b7e3e608fdf8069f65a086df027a77d1253ccbaeaf · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice column: accessible output Yes, export Yes) mapped to rung UD14.
[lo-crossref] The Document Foundation. LibreOffice Help source, Inserting Cross-References (Writer): cross-references jump to specific text passages and objects in the same document and are updated. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_crossref.xhp · pin h30bc97e5c61fd3f1e4a0f9c6eb2107e50e6f3c4dd37680e48a6089a46578c583 · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice column: cross-references) mapped to rung UD24.
[lo-condtext] The Document Foundation. LibreOffice Help source, Conditional Text (Writer): fields that display text when a condition you define is met (if-then queries as fields). Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_condtext.xhp · pin hd85997574bb72cb9005a8e5762dd8d0f1cd4fd333a6f5569732b1357c73505e4 · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice column: document assembly) and rung UD29.
[lo-signatures] The Document Foundation. LibreOffice Help source, About Digital Signatures: in LibreOffice you can digitally sign your documents and macros with certificates. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_signatures.xhp · pin h83f2aa13cfb2d1267c872687252a0998242f2681384dbec13dee6e8cb560e1ff · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice column: e-signature Part, certificate signing without signature routing).
[lo-redlining] The Document Foundation. LibreOffice Help source, Recording and Displaying Changes: the review function (Track Changes) for text documents and spreadsheets. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_redlining.xhp · pin hd01bc081ec0573b7add54bcc99e54caf06e42c183982756cbadf4f0774ad5926 · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice column: suggestions and tracked changes).
[lo-autotext] The Document Foundation. LibreOffice Help source, Using AutoText (Writer): store text, also containing graphics, tables and fields, for reuse. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_autotext.xhp · pin h9ed88e0a11e2ae30291918c1c8426566bf092a4fe50464c728dc2616f8b85510 · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice column: clause library and reusable text) and rung UD31.
[lo-navigator] The Document Foundation. LibreOffice Help source, Navigator (Writer): shows or hides the Navigator window, where you can quickly jump to different parts of your document. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_navigator.xhp · pin hf357b6493a3bb284b4953094532317e4ffd66ef37703444c88834362fee51281 · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice column: outline and navigation) mapped to rung UD24.
[lo-versions] The Document Foundation. LibreOffice Help source, Versions: saves and organizes multiple versions of the current document in the same file. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_versions.xhp · pin h794422abf5c358902e3680b03e0c7b20dd0972229d2d95dfe3a70b2b7f052232 · accessed 2026-10-03 · vendor-docGrounds: The rival census (LibreOffice column: version history).
[lo-core-tags] LibreOffice core repository tags (the project's GitHub mirror): newest tag libreoffice-26.8.1.1 of 2026-09-16, with 26.8.0.1 to 26.8.0.3 and 26.2.6.x below it. The 26.8 release notes at wiki.documentfoundation.org refused the sovereign TLS client on 2026-10-03, so the 26.8 feature list is NOT read and the LibreOffice column rests on the help source. Accessed 2026-10-03. publisher · read in our library knowledge/fetched/cmp_unidoc_lo_core_tags.html · pin hf507d4a4fc347743204971783edf65ce5b18ab83130fe14c32bc13987e8631f2 · accessed 2026-10-03 · mirrored-indexGrounds: The rival census: the LibreOffice Writer release it was taken against.
[arxiv-legal-drafting] arXiv API listing, search abs:"legal drafting" sorted by submission date, 9 entries read 2026-10-03: newest arXiv 2609.22127 (Beyond Accuracy and Surface Fluency: Risk-Sensitive Evaluation of LLMs for Legal Clause Generation; published field 2026-08-22; accepted to the AI for Law Workshop at ICML 2026): four models across 22 contract clause categories and 34 legally motivated failure modes, scored under a Max Severity Principle so that a single legally decisive defect remains visible instead of being averaged away; the next entry is of 2026-07-11 (also the AI for Law Workshop at ICML 2026). No October 2026 entry. publisher · read in our library knowledge/fetched/cmp_unidoc_arxiv_legal_drafting.raw · pin h288df8ea9d0e9ce606b426712360896626a7e81fd9032fe118d673192133fdc3 · accessed 2026-10-03 · mirrored-indexGrounds: The dated bar SB-LEGALDOC and the frontier target T-FRONT-LEGALDOC: clause-specific, failure-mode judgement of legal drafting.
[arxiv-doc-editing] arXiv API listing, search abs:"document editing" sorted by submission date, 20 entries read 2026-10-03. On subject: arXiv 2606.28379 (LEDGER: Scaling Agentic Document Editing with Dependency-aware Graph Retrieval; ACL 2026; published 2026-06-19): a lightweight dependency graph of hierarchy, explicit references, implicit dependencies and semantic relationships raises edit consistency from 56 to 76 percent across six models on 1.9k test cases while using fewer tokens; arXiv 2609.01610 (a survey of edit intentions, Findings of ACL 2026, published 2026-06-05); arXiv 2604.15597 (LLMs Corrupt Your Documents When You Delegate; Laban, Schnabel and others; published 2026-04-17): DELEGATE-52 over 52 professional domains and 19 models, where even frontier models corrupt an average of 25 percent of document content by the end of long delegated workflows with sparse but severe silent errors. The two newest entries (2609.02170 on advertising recommendation, 2608.02687 on data loss prevention for coding agents) are off subject. publisher · read in our library knowledge/fetched/cmp_unidoc_arxiv_doc_editing.raw · pin h21f5a053fb49d0667142ad50b4543f3227d9aa5beff528ed2a9ab1f5a4d3fc64 · accessed 2026-10-03 · mirrored-indexGrounds: The dated bar SB-LEGALDOC, the frontier target T-FRONT-LEGALDOC and rung UD28, the AI edit integrity guard.
[arxiv-contract-review] arXiv API listing, search abs:"contract review" sorted by submission date, 20 entries read 2026-10-03: newest arXiv 2609.39608 (Is This Evidence Decision-Critical? Learning to Verify Rule-Governed Decisions; published 2026-09-30): counterfactual verification of decision-critical evidence in rule-governed decisions such as eligibility checks and contract reviews (InterPact, 68.28 percent accuracy, above six baselines); the next on-subject entry is arXiv 2606.13184 (LAUKIN, a multi-jurisdictional common law contract dataset, updated 2026-06-11). No October 2026 entry. publisher · read in our library knowledge/fetched/cmp_unidoc_arxiv_contract_review.raw · pin h756e031ea3e23d1fcbf584b98a1f49d26ad540bee12ec08f68835acd99f75059 · accessed 2026-10-03 · mirrored-indexGrounds: The dated bar SB-LEGALDOC, its newest attested month and its barscan.
[termsight-2026] Huang, August and Sundaram, TermSight: Making Service Contracts Approachable, arXiv 2506.12332v2 (submitted 2025-06-14, revised version online 2026-02-01), read from the mirrored abstract page 2026-10-04: an intelligent reading interface that guides readers to relevant clauses with color-coded plain-language snippets and contextualizes ambiguous language with definitions and hypothetical scenarios, whose features always foreground the original, legally-binding contract text; a within-subjects study (N=20) found Terms of Service significantly easier to read and navigate with it, while revealing the challenges of augmenting service contracts. publisher · read in our library knowledge/fetched/cmp_unidoc_termsight_2506.12332v2.html · pin h37bef7d8b05ae62fab1459cb172167a21ec232c181cf6403ae198e8b5e7e9d95 · accessed 2026-10-04 · published-paperGrounds: Rung UD32, the words panel: definitions beside the document with its binding words foregrounded.
[plainlang-simplewords] Plain Language Action and Information Network, Use simple words and phrases, plainlanguage.gov (Internet Archive copy, 2023) publisher · read in our library knowledge/fetched/cmp_unidoc_plainlanguage_simple_words_phrases.html · pin h3f34ca8e576588168edd2aab5928284e316f97c911fc5dd51c5a59a8d505d78c · accessed 2026-10-04 · published-standardGrounds: Rung UD34: the swap table, 237 Don't say and Say pairs ingested by nx_plainlang ingest-table with their row numbers
[fplg-2011] Plain Language Action and Information Network, Federal Plain Language Guidelines, March 2011, revision 1 May 2011 (Internet Archive copy) publisher · read in our library knowledge/fetched/cmp_unidoc_fplg_2011_rev1.pdf · pin h8a3d4b07eec19e2dd5a850892deacec7c55cea9171ab883a93cd72afc9235ba6 · accessed 2026-10-04 · published-standardGrounds: Rung UD34: must for requirements (p. 25), unnecessary words and doublets (pp. 38-39), read by hand into fplg2011.rows
[gws-front-oct] Google Workspace Updates blog front page, read 2026-10-07: October 6, 2026 point-in-time editing in Google Vids and Trello cards from Chat messages; October 5, 2026 Preview, edit and collaborate on Markdown in Google Docs (with the help page View and edit Markdown), stock charts in Sheets, and the secondary-calendar lifecycle change; September 29, 2026 a scheduled-release rollout note. publisher · read in our library knowledge/fetched/rf_bcef6640.raw · pin h59f775451cb22bd3bef6fe386b9c614b1d1c176009ac32c21516d706f84f42bb · accessed 2026-10-07 · mirrored-indexGrounds: The October 2026 rival census (Google column): the newest dated incumbent state, Markdown editing and collaboration in Docs.
[ms-current-channel-oct] Microsoft Learn. Release notes for Current Channel, read 2026-10-07: newest entry Version 2609 of October 06, 2026 (Build 20430.x), then September 30 and September 22; the Word lines carried this month are the Copilot draft pane and a data loss prevention policy that blocks Copilot from processing the open file. publisher · read in our library knowledge/fetched/rf_2c205b93.raw · pin hfad84a9fdfae72476736b9daa5d675b17d1d19b2cdc893fd7ba547f13530e361 · accessed 2026-10-07 · mirrored-indexGrounds: The October 2026 rival census (Word column): the newest Word desktop release the census was taken against.
[acrobat-sign-online] Adobe. Sign a PDF online (Acrobat online tools), Internet Archive copy of 2026 read 2026-10-07 because adobe.com refuses the sovereign TLS client (status 403 on helpx, status 0 on www, witnessed 2026-09-03 and 2026-10-07): the free Fill and Sign tool types, draws or uploads a signature in the browser; requesting e-signatures needs an Adobe account and recipients receive a trusted link by email and can sign from any mobile device without an account; accessing audit trails may require a paid plan; certificate-based digital signatures meet eIDAS qualified levels; Acrobat Sign is the dedicated service for complex routing, bulk send and enterprise-grade authentication; the same free account can create, edit, compress and convert the PDF. publisher · read in our library knowledge/fetched/rf_314b13c4.raw · pin h1d6b84289b6dd67947814889160bd5015115554b80d063b59224184b9261eb08 · accessed 2026-10-07 · vendor-docGrounds: The Adobe Acrobat column, graded from a mirrored page at last: signing, audit trail, certificate signatures, mobile, edit and convert.
[acrobat-sign-relnotes] Adobe. Acrobat Sign release notes (helpx), Internet Archive copy read 2026-10-07; the copy's own header reads last updated February 13, 2026 with a production deployment of February 3, 2026 (grouped checkboxes in authoring and templates, the modern Request Signature experience, rollout dates per server environment) and lists release-note pages back to 2019, so it witnesses the February 2026 release and NOT this month's. publisher · read in our library knowledge/fetched/rf_fd9f2c08.raw · pin hcb1e067ab32278b2dd1343694640af517ebde3b13dae9aa36bc7fb68ed3d1ff5 · accessed 2026-10-07 · vendor-docGrounds: The Adobe Acrobat column: templates and the authoring tools of Acrobat Sign, dated February 2026 by the page itself.
[nextcloud-text] Nextcloud. Nextcloud Text (GitHub repository README), read 2026-10-07: collaborative document editing using Markdown; share and collaborate with people whether or not they use Nextcloud; files are saved as Markdown so any other text editor opens them; math formulas in the toolbar. publisher · read in our library knowledge/fetched/rf_ae31c399.raw · pin hb4b20afef86a64c4544502b4a775e6a6ded938801e999ed95b4a303b601cbd47 · accessed 2026-10-07 · vendor-docGrounds: The Nextcloud Hub column: collaborative editing and the open Markdown format of the Text app.

generated by nx_swcompare_matrix (sovereign NishiLang organ) from knowledge/compare/unidoc.matrix · source checks show implementation presence; runtime and user-outcome evidence are reported separately · JavaScript supports page controls