Source-of-truth: nishi-core/nxc2/runtime/nx_tictactoe.nx (state machine + AI) + nx_tictactoe_render.nx (HTML emit + click dispatch IN NISHILANG) → nxc2 --target wat → nx_tictactoe.wasm (~18 KB).

JS in this page: only the <script> below (~12 LOC mount call) + the shared /_nishi/nishi-host.js (~120 LOC IRREDUCIBLE bridge) used by every Nishi game. Zero per-game JS rendering logic. HTML is emitted by NishiLang writing to sentinel fd 99; host captures bytes + sets innerHTML. Click events route via data-action through NishiLang nx_ttt_action.

Substrate smokes: 12/12 state-machine + 8/8 joy-record + 1 HTML-contract green under qemu-riscv64. Cross-browser playwright (Chromium + Firefox + WebKit): 54/54 with bit-exact state-hash determinism.

No tracking. No account. No third-party at runtime.