# logicaffeine_system

> Platform IO, networking, HTTP serving, persistence, and post-quantum crypto (Keccak/SHA-3, ChaCha20-Poly1305, ML-KEM, ML-DSA) for LOGOS

Every public module and item of `logicaffeine_system`, module by module, each with its one-line summary and its address. Item pages hold the full signature, documentation, trait implementations and a link to the source.

- Crate page: [logicaffeine_system](https://docs.logicaffeine.com/logicaffeine_system/)
- All items on one page: [logicaffeine_system/all](https://docs.logicaffeine.com/logicaffeine_system/all)
- Source: [src/logicaffeine_system/lib.rs](https://docs.logicaffeine.com/src/logicaffeine_system/lib.rs)
- Every crate: [llms.txt](https://docs.logicaffeine.com/llms.txt)

## logicaffeine_system

- [mod addr](https://docs.logicaffeine.com/logicaffeine_system/addr/): Address normalization — libp2p multiaddr → WebSocket URL.
- [mod aead](https://docs.logicaffeine.com/logicaffeine_system/aead/): ChaCha20-Poly1305 AEAD (RFC 8439) — the symmetric seal that closes the post-quantum channel: an ML-KEM-768 handshake establishes the shared secret, HKDF derives this 32-byte key, and every wire message is sealed here. ChaCha20 is a pure `Word32` ARX cipher (the same primitive the `assets/std/crypto.lg` `chacha20Block` ships in Logos); Poly1305 is the one-time authenticator in constant-time 5×26-bit limbs (no bignum). Verified against the RFC 8439 §2.4.2 / §2.5.2 / §2.8.2 known-answer vectors. The tag compare is constant-time.
- [mod csrf](https://docs.logicaffeine.com/logicaffeine_system/csrf/): The page half of CSRF: a page document carries its visitor’s token in its head, where the browser host reads it and sends it back as `x-csrf-token` on the page’s state-changing requests to its own server. One definition for every tier that composes or reads a page — the dev server, a compiled server, the in-process host and the browser runtime’s shared name.
- [mod env](https://docs.logicaffeine.com/logicaffeine_system/env/): Environment Variable and Argument Access
- [mod failure](https://docs.logicaffeine.com/logicaffeine_system/failure/): Where a failure ends: the program, or the boundary that catches it.
- [mod file](https://docs.logicaffeine.com/logicaffeine_system/file/): Simple File I/O Operations
- [mod fmt](https://docs.logicaffeine.com/logicaffeine_system/fmt/): Formatting utilities
- [mod fs](https://docs.logicaffeine.com/logicaffeine_system/fs/): Virtual File System Abstraction
- [mod http](https://docs.logicaffeine.com/logicaffeine_system/http/): A native HTTP/1.1 server — the runtime a LOGOS program’s `Serve` statement executes on.
- [mod io](https://docs.logicaffeine.com/logicaffeine_system/io/): I/O Operations for LOGOS Programs
- [mod keccak](https://docs.logicaffeine.com/logicaffeine_system/keccak/): Keccak-f[1600] + SHA-3 / SHAKE runtime kernels — the symmetric/hash layer ML-KEM is built on (SHA3-256/512 for hashing, SHAKE128 for matrix expansion, SHAKE256 for the PRF). Reached from compiled LOGOS via the `sha3_256` / `sha3_512` / `shake128` / `shake256` stdlib functions. Verified against the NIST FIPS-202 KATs (see the tests). Input/output are LOGOS `Int` bytes (0..255) carried in a `Seq of Int`.
- [mod mldsa](https://docs.logicaffeine.com/logicaffeine_system/mldsa/): ML-DSA-65 (FIPS-204 / Dilithium) runtime kernels — the post-quantum SIGNATURE scheme that complements ML-KEM-768 in the channel. This module builds bottom-up: the length-256 NTT over the Dilithium prime `q = 8380417` (a COMPLETE transform, unlike Kyber’s incomplete one — `q ≡ 1 (mod 512)`, so `X²⁵⁶+1` splits fully), with signed Montgomery reduction. Validated against the schoolbook negacyclic convolution.
- [mod mlkem](https://docs.logicaffeine.com/logicaffeine_system/mlkem/): ML-KEM-768 (FIPS-203) keygen / encapsulation / decapsulation as a Rust composition of the verified native kernels in `crate::ntt` (NTT, base-multiply, CBD, compress, byte-encode, 4-way AVX2 matrix expansion) and `crate::keccak` (SHA3-256/512, SHAKE256). This is the exact same primitive set the `assets/std/crypto.lg` Logos ML-KEM orchestrates and that the `logicaffeine-tests` AOT gates prove bit-exact vs the FIPS-203 reference — here orchestrated in Rust so the post-quantum channel (`logicaffeine_compile::concurrency::channel`) can run the handshake. Coefficients ride the fast `Word16` carrier throughout.
- [mod net](https://docs.logicaffeine.com/logicaffeine_system/net/): `Net` — the cross-target relay-backed network handle the interpreter holds.
- [mod ntt](https://docs.logicaffeine.com/logicaffeine_system/ntt/): ML-KEM (Kyber) negacyclic NTT runtime kernel — the verified scalar reference + AVX2 i16×16 path that compiled LOGOS reaches through the `mlkemNtt` stdlib function. Ported from the validated `scripts/dev/ntt_simd_proto.rs` (round-trip + AVX2==scalar bit-identical). q = 3329, R = 2¹⁶, the incomplete 7-level transform over ℤ_q[X]/(X²⁵⁶+1). The Montgomery reduction it uses is kernel-certified (`logicaffeine_kernel::field_algebra::montgomery_reduction_*`).
- [mod obs](https://docs.logicaffeine.com/logicaffeine_system/obs/): The observation channel for COMPILED (AOT-Rust) programs — Wave 13.
- [mod random](https://docs.logicaffeine.com/logicaffeine_system/random/): Random Number Generation
- [mod relay](https://docs.logicaffeine.com/logicaffeine_system/relay/): Thin WebSocket relay — the v1 browser↔mesh bridge.
- [mod relay_proto](https://docs.logicaffeine.com/logicaffeine_system/relay_proto/): The relay wire protocol — shared verbatim by the native server/client (`super::relay`) and the browser client (`super::relay_browser`). Both targets serialize the SAME `RelayFrame` with `bincode`, so a browser tab and a native node speak an identical language across the WebSocket.
- [mod stack](https://docs.logicaffeine.com/logicaffeine_system/stack/): The stack a compiled program’s `Main` runs on.
- [mod storage](https://docs.logicaffeine.com/logicaffeine_system/storage/): Persistent Storage with Journaling
- [mod tcp](https://docs.logicaffeine.com/logicaffeine_system/tcp/): TCP client natives (tcp.lg): the SYNC implementations the AOT tier calls via `map_native_function`, plus the shared error-message formatters every tier reuses — one wording, so the tiers cannot drift even in their `Err` text.
- [mod temporal](https://docs.logicaffeine.com/logicaffeine_system/temporal/): Temporal types for Logicaffeine. The date, moment, time-of-day and calendar span values are `logicaffeine-data`’s (`logicaffeine_data::temporal`), where every value model reaches them, re-exported here beside what only a system has: the clock, and how `Show` prints them.
- [mod testworld](https://docs.logicaffeine.com/logicaffeine_system/testworld/): The sealed test world.
- [mod text](https://docs.logicaffeine.com/logicaffeine_system/text/)
- [mod time](https://docs.logicaffeine.com/logicaffeine_system/time/): Time Utilities
- [mod word_rt](https://docs.logicaffeine.com/logicaffeine_system/word_rt/): Runtime support for the `Word8`/`Word16`/`Word32`/`Word64` ring types in COMPILED LOGOS.
- [struct Lanes4Word32](https://docs.logicaffeine.com/logicaffeine_system/struct.Lanes4Word32): Four lanes of `Word32` = one 128-bit register (`__m128i`) — the SHA-1 state/message carrier. Unlike the arithmetic lane types, its vocabulary is the four Intel SHA operations (`sha1rnds4`/`sha1msg1`/ `sha1msg2`/`sha1nexte`), so SHA-1 WRITTEN in Logos over these compiles to the `sha1rnds4` hardware sequence (AOT) and runs the byte-identical software spec `crate::sha_ops` on the interpreter. Lane `i` is bits `[32i+31 : 32i]` — index 0 low, index 3 high — matching `_mm_loadu_si128`.
- [struct Lanes4Word64](https://docs.logicaffeine.com/logicaffeine_system/struct.Lanes4Word64): Four lanes of `Word64` (one 256-bit SIMD register) — the Poly1305 accumulator lane vector. Carries `[u64; 4]`; ops have an AVX2 fast path proven byte-identical to the scalar lanes.
- [struct Lanes8Word32](https://docs.logicaffeine.com/logicaffeine_system/struct.Lanes8Word32): Eight lanes of `Word32` (one 256-bit SIMD register). Operations are lane-wise over the ℤ/2³² ring.
- [struct Lanes16Word8](https://docs.logicaffeine.com/logicaffeine_system/struct.Lanes16Word8): Sixteen `Word8` lanes = one 128-bit register (`__m128i`) — the BYTE-SHUFFLE carrier for SIMD text codecs (hex encode/decode). Its vocabulary is `shuffle` (`pshufb`, a 16-entry byte LUT), byte AND, per-byte shift, and the two byte interleaves — so a hex codec WRITTEN in Logos over it compiles to the `pshufb` sequence (AOT, when SSSE3 is statically enabled) and runs the byte-identical scalar spec on the interpreter. Lane `i` is byte `i` (index 0 low), matching `_mm_loadu_si128`.
- [struct Lanes16Word16](https://docs.logicaffeine.com/logicaffeine_system/struct.Lanes16Word16): Sixteen lanes of `Word16` (one 256-bit SIMD register) — the NTT coefficient lane vector. Carries `[u16; 16]`; the multiply-high is the SIGNED `_mm256_mulhi_epi16` (the Montgomery butterfly’s `mulhi`). Ops have an AVX2 fast path proven byte-identical to the scalar lanes.
- [struct LogosDate](https://docs.logicaffeine.com/logicaffeine_system/struct.LogosDate): Date stored as days since Unix epoch (1970-01-01).
- [struct LogosMoment](https://docs.logicaffeine.com/logicaffeine_system/struct.LogosMoment): Moment stored as nanoseconds since Unix epoch.
- [struct LogosSpan](https://docs.logicaffeine.com/logicaffeine_system/struct.LogosSpan): Calendar span with separate month and day components.
- [struct LogosTime](https://docs.logicaffeine.com/logicaffeine_system/struct.LogosTime): Time-of-day stored as nanoseconds from midnight — the wall-clock face of a `Moment`, with no date or zone. Renders `HH:MM:SS[.frac]`, lossless to the nanosecond (the AOT mirror of the interpreter’s `Time`).
- [struct Word8](https://docs.logicaffeine.com/logicaffeine_system/struct.Word8): A 8-bit wrapping integer: the ring ℤ/2^8ℤ, where every operation is total and wraps modulo 2^8.
- [struct Word16](https://docs.logicaffeine.com/logicaffeine_system/struct.Word16): A 16-bit wrapping integer: the ring ℤ/2^16ℤ, where every operation is total and wraps modulo 2^16.
- [struct Word32](https://docs.logicaffeine.com/logicaffeine_system/struct.Word32): A 32-bit wrapping integer: the ring ℤ/2^32ℤ, where every operation is total and wraps modulo 2^32.
- [struct Word64](https://docs.logicaffeine.com/logicaffeine_system/struct.Word64): A 64-bit wrapping integer: the ring ℤ/2^64ℤ, where every operation is total and wraps modulo 2^64.
- [fn panic_with](https://docs.logicaffeine.com/logicaffeine_system/fn.panic_with): Panic with a custom message (used by generated LOGOS code)

## logicaffeine_system::addr
Address normalization — libp2p multiaddr → WebSocket URL.

- [fn canonical_topic](https://docs.logicaffeine.com/logicaffeine_system/addr/fn.canonical_topic): The canonical relay topic for a peer address — its stable identity on the relay, computed identically by both endpoints.
- [fn multiaddr_to_ws_url](https://docs.logicaffeine.com/logicaffeine_system/addr/fn.multiaddr_to_ws_url): Normalize a peer address to a WebSocket URL the relay can dial.

## logicaffeine_system::aead
ChaCha20-Poly1305 AEAD (RFC 8439) — the symmetric seal that closes the post-quantum channel: an ML-KEM-768 handshake establishes the shared secret, HKDF derives this 32-byte key, and every wire message is sealed here. ChaCha20 is a pure `Word32` ARX cipher (the same primitive the `assets/std/crypto.lg` `chacha20Block` ships in Logos); Poly1305 is the one-time authenticator in constant-time 5×26-bit limbs (no bignum). Verified against the RFC 8439 §2.4.2 / §2.5.2 / §2.8.2 known-answer vectors. The tag compare is constant-time.

- [const BOX_BYTES_LABEL](https://docs.logicaffeine.com/logicaffeine_system/aead/constant.BOX_BYTES_LABEL): The associated data a box of bytes is sealed under.
- [const BOX_OVERHEAD](https://docs.logicaffeine.com/logicaffeine_system/aead/constant.BOX_OVERHEAD): What a box adds to what it seals: its 24-byte nonce in front and its 16-byte tag behind.
- [const BOX_VALUE_LABEL](https://docs.logicaffeine.com/logicaffeine_system/aead/constant.BOX_VALUE_LABEL): The associated data a box of a wire-encoded value is sealed under: a box of one kind never opens as the other.
- [const MAX_PLAINTEXT](https://docs.logicaffeine.com/logicaffeine_system/aead/constant.MAX_PLAINTEXT): The longest plaintext one (key, nonce) seals (RFC 8439 §2.8): the payload’s blocks start at counter 1 and must not wrap the 32-bit counter back onto the one-time key’s keystream.
- [fn chacha20_encrypt_seq](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.chacha20_encrypt_seq): `chacha20Encrypt(key, nonce, counter, data)` → `data ⊕ keystream` (RFC 8439 §2.4): a 32-byte key, a 12-byte nonce, and a block counter the data’s blocks stay inside of.
- [fn chacha20_xor](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.chacha20_xor): ChaCha20 keystream XOR (RFC 8439 §2.4): `data ⊕ ChaCha20(key, counter‖nonce)`. AVX2 (8 blocks at a time) when available, else scalar — bit-identical.
- [fn chacha20poly1305_open](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.chacha20poly1305_open): AEAD open: verifies the tag (constant-time) and decrypts, or `None` on tamper/truncation.
- [fn chacha20poly1305_seal](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.chacha20poly1305_seal): AEAD seal: returns `ciphertext ‖ tag[16]`.
- [fn hchacha20](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.hchacha20): HChaCha20 (draft-irtf-cfrg-xchacha §2.2): the ChaCha20 rounds over `key` and a 128-bit `nonce` in the counter-and-nonce words, without the final addition, returning the first and last rows — a subkey as uniform as the key, one per nonce.
- [fn open_box](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.open_box): The plaintext of a box sealed under `key` and `label`, or `None` when it is shorter than a box or does not authenticate.
- [fn poly1305](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.poly1305): Poly1305 one-time authenticator: `tag = ((Σ blockᵢ·r^(n−i)) mod (2¹³⁰−5)) + s mod 2¹²⁸`. AVX2 (4 blocks/group via precomputed r¹..r⁴) for long messages, else scalar — bit-identical.
- [fn poly1305_seq](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.poly1305_seq): `poly1305Mac(key, msg)` → 16-byte tag. The MAC primitive (constant-time 5×26-bit limbs).
- [fn seal_box](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.seal_box): The box of `plaintext` under `key`, its nonce drawn from the system’s entropy: 192 random bits, so one key seals any number of boxes without two sharing a nonce.
- [fn seal_box_under](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.seal_box_under): The box of `plaintext` under `key` and `nonce`: `nonce ‖ XChaCha20-Poly1305(key, nonce, label, plaintext)`.
- [fn xchacha20poly1305_open](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.xchacha20poly1305_open): XChaCha20-Poly1305 open: verifies the tag (constant-time) and decrypts, or `None` on tamper/truncation.
- [fn xchacha20poly1305_seal](https://docs.logicaffeine.com/logicaffeine_system/aead/fn.xchacha20poly1305_seal): XChaCha20-Poly1305 seal: `ciphertext ‖ tag[16]`. Its 192-bit nonce is wide enough to draw at random for every message under one key, which a 96-bit nonce is not.

## logicaffeine_system::csrf
The page half of CSRF: a page document carries its visitor’s token in its head, where the browser host reads it and sends it back as `x-csrf-token` on the page’s state-changing requests to its own server. One definition for every tier that composes or reads a page — the dev server, a compiled server, the in-process host and the browser runtime’s shared name.

- [const CSRF_META_NAME](https://docs.logicaffeine.com/logicaffeine_system/csrf/constant.CSRF_META_NAME): The `<meta name>` a page document carries its visitor’s CSRF token under.
- [fn with_csrf_meta](https://docs.logicaffeine.com/logicaffeine_system/csrf/fn.with_csrf_meta): `document` carrying `token` in its head as `<meta name="csrf-token">`. The meta opens the head, so a page’s own `Head:` merges over it by identity like every other head element. A document with no `<head>` is returned as it is.

## logicaffeine_system::env
Environment Variable and Argument Access

- [fn args](https://docs.logicaffeine.com/logicaffeine_system/env/fn.args): Returns command-line arguments as a vector.
- [fn get](https://docs.logicaffeine.com/logicaffeine_system/env/fn.get): Returns the value of an environment variable.

## logicaffeine_system::failure
Where a failure ends: the program, or the boundary that catches it.

- [fn caught](https://docs.logicaffeine.com/logicaffeine_system/failure/fn.caught): Run `f`, catching a panic it raises; while it runs, `is_caught` answers true on this thread.
- [fn is_caught](https://docs.logicaffeine.com/logicaffeine_system/failure/fn.is_caught): Whether a panic raised on this thread now ends at an enclosing `caught` rather than ending the program. Never in a build that aborts on panic, where no boundary can catch one.

## logicaffeine_system::file
Simple File I/O Operations

- [fn read](https://docs.logicaffeine.com/logicaffeine_system/file/fn.read): Reads a file as a UTF-8 string.
- [fn read_bytes](https://docs.logicaffeine.com/logicaffeine_system/file/fn.read_bytes): Reads a file’s raw bytes. The total counterpart of the trapping `readBytes` builtin.
- [fn read_reals](https://docs.logicaffeine.com/logicaffeine_system/file/fn.read_reals): Reads a file of little-endian IEEE-754 binary64 values, eight bytes a value in order: the numbers a program reads at run time rather than carries as code (`readReals`; a model’s weights). The interpreter and the AOT-Rust lowering both call this, so the read and its refusals are one. A file that is not a whole number of values is refused.
- [fn write](https://docs.logicaffeine.com/logicaffeine_system/file/fn.write): Writes a string to a file.

## logicaffeine_system::fmt
Formatting utilities

- [fn format](https://docs.logicaffeine.com/logicaffeine_system/fmt/fn.format)

## logicaffeine_system::fs
Virtual File System Abstraction

- [struct DirEntry](https://docs.logicaffeine.com/logicaffeine_system/fs/struct.DirEntry): A directory entry returned by `list_dir`.
- [struct MemVfs](https://docs.logicaffeine.com/logicaffeine_system/fs/struct.MemVfs): The sealed test world’s VFS: an in-memory filesystem that bridges the `crate::testworld` thread-local, so `Given a file …` seeds and Vfs-backed `Read`/`Write` statements share ONE source of truth. Installed per-test by the `largo test` runner; there is no real disk behind it (unless the test grants the filesystem capability, which routes it to a real `NativeVfs` instead). Its body only reads and writes the `testworld` thread-local, so it is equally at home behind either `Vfs` shape — the in-browser guide’s page test runner drives it through the `?Send` one.
- [struct NativeVfs](https://docs.logicaffeine.com/logicaffeine_system/fs/struct.NativeVfs): Native filesystem VFS using tokio::fs.
- [enum VfsError](https://docs.logicaffeine.com/logicaffeine_system/fs/enum.VfsError): Error type for VFS operations
- [trait Vfs](https://docs.logicaffeine.com/logicaffeine_system/fs/trait.Vfs): Virtual File System trait for platform-agnostic file operations.
- [fn get_platform_vfs](https://docs.logicaffeine.com/logicaffeine_system/fs/fn.get_platform_vfs): Get the platform-default VFS instance.
- [type PlatformVfs](https://docs.logicaffeine.com/logicaffeine_system/fs/type.PlatformVfs): Type alias for platform-specific VFS.
- [type VfsResult](https://docs.logicaffeine.com/logicaffeine_system/fs/type.VfsResult)

## logicaffeine_system::http
A native HTTP/1.1 server — the runtime a LOGOS program’s `Serve` statement executes on.

- [mod engine](https://docs.logicaffeine.com/logicaffeine_system/http/engine/): Engine selection + the pre-serialized static-response table — the cross-platform half of the HTTP fast path.
- [mod lifecycle](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/): The production server LIFECYCLE — the shared state machine that makes a LOGOS `Serve` “serious and stays serving”: it drains gracefully (never drops an in-flight request), gates readiness separately from liveness, sheds load with bounded backpressure (503, never an unbounded hang), bounds per-request time, survives malformed floods, and stamps every response/log line with a correlation id (secret-safe).
- [mod server](https://docs.logicaffeine.com/logicaffeine_system/http/server/): The tokio accept loop — the runtime under a LOGOS `Serve`.
- [mod wire](https://docs.logicaffeine.com/logicaffeine_system/http/wire/): HTTP/1.1 wire format — hand-rolled parsers and writers over plain byte buffers. No hyper, no allocations beyond the owned result. The server half is `parse_request` + `serialize_response`; the client half is its exact mirror, `serialize_request` + `parse_response` — same error taxonomy, same limits, same `ParseError::Incomplete` retry contract.

## logicaffeine_system::http::engine
Engine selection + the pre-serialized static-response table — the cross-platform half of the HTTP fast path.

- [struct EngineChoice](https://docs.logicaffeine.com/logicaffeine_system/http/engine/struct.EngineChoice): The outcome of `choose_engine`: the engine plus the human-readable reason that goes on stderr.
- [struct StaticResponses](https://docs.logicaffeine.com/logicaffeine_system/http/engine/struct.StaticResponses): Pre-serialized static responses — the memcpy fast path.
- [enum EngineKind](https://docs.logicaffeine.com/logicaffeine_system/http/engine/enum.EngineKind): Which engine a serve entry runs on.
- [fn announce](https://docs.logicaffeine.com/logicaffeine_system/http/engine/fn.announce): The one loud line: which engine this serve entry runs on, and why.
- [fn choose_engine](https://docs.logicaffeine.com/logicaffeine_system/http/engine/fn.choose_engine): Read the selection knobs from the environment and apply `choose_engine_from`. `LOGOS_HTTP_FORCE_FALLBACK=1` makes the uring probe fail artificially (the fallback-honesty test hook — it exercises the same path a ring-init failure takes on a real kernel without io_uring).
- [fn choose_engine_from](https://docs.logicaffeine.com/logicaffeine_system/http/engine/fn.choose_engine_from): The pure selection law. `probe` initializes a throwaway ring (or explains why it cannot); it runs only when uring is actually a candidate.
- [fn lifecycle_knob_requested](https://docs.logicaffeine.com/logicaffeine_system/http/engine/fn.lifecycle_knob_requested): The name of the first lifecycle knob the environment sets, if any — the pure half of the rule above, so it can be tested without the process environment.
- [fn shard_count_from](https://docs.logicaffeine.com/logicaffeine_system/http/engine/fn.shard_count_from): The shard-count law for the uring engine: `LOGOS_HTTP_SHARDS` when it parses to a positive count (clamped to 1024), else the box’s available parallelism, else 1. Pure so it is testable without touching the process environment.

## logicaffeine_system::http::lifecycle
The production server LIFECYCLE — the shared state machine that makes a LOGOS `Serve` “serious and stays serving”: it drains gracefully (never drops an in-flight request), gates readiness separately from liveness, sheds load with bounded backpressure (503, never an unbounded hang), bounds per-request time, survives malformed floods, and stamps every response/log line with a correlation id (secret-safe).

- [struct DrainOutcome](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/struct.DrainOutcome): The outcome of a graceful `Lifecycle::drain`.
- [struct Lifecycle](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/struct.Lifecycle): The shared, cloneable lifecycle handle. One is created per server; the accept loop consults it per connection/request and an orchestrator flips readiness / requests drain through it.
- [struct LifecycleConfig](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/struct.LifecycleConfig): Tunables for the server lifecycle. Every field is public so an embedder can dial them; `Default` is the deployed shape.
- [struct SlotGuard](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/struct.SlotGuard): A held in-flight slot: while it lives, one of the `max_inflight` slots is occupied and the in-flight gauge counts it. Dropping it (handler returned, panicked, or timed out) frees the slot — RAII, so no path can leak one.
- [enum Admission](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/enum.Admission): The verdict of `Lifecycle::admit`: whether a request may reach the handler, and if not, WHY — so both tiers answer the identical status.
- [const CORRELATION_HEADER](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/constant.CORRELATION_HEADER): The response header that carries the correlation id (canonical casing).
- [fn access_log_line](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/fn.access_log_line): A structured, SECRET-SAFE request log line: method, path, status, correlation id, and duration — and never an arbitrary request header VALUE (so a secret in `Authorization`/`Cookie` can never leak into logs). Returned as a string so the caller decides the sink (both tiers format identically).
- [fn service_unavailable](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/fn.service_unavailable): over capacity — shared by both tiers (the readiness/backpressure twin of the wire core’s `bad_request`/`internal_error`).
- [fn shutdown_requested](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/fn.shutdown_requested): The canned `503` a request gets when the server is not ready, draining, or Resolve when the process is asked to stop: `SIGTERM` or `SIGINT` on unix, Ctrl-C elsewhere.
- [fn stamp_correlation_id](https://docs.logicaffeine.com/logicaffeine_system/http/lifecycle/fn.stamp_correlation_id): Stamp `resp` with the correlation-id header (canonical casing), IN PLACE. Shared by both tiers so the header they emit is identical. A handler-set `X-Correlation-Id` (any casing) is replaced — the lifecycle owns this header exactly as the wire writer owns the framing headers.

## logicaffeine_system::http::server
The tokio accept loop — the runtime under a LOGOS `Serve`.

- [struct Conn](https://docs.logicaffeine.com/logicaffeine_system/http/server/struct.Conn): One accepted connection: the socket plus its receive buffer, which persists across requests — keep-alive drains exactly one request’s frame per parse and keeps the remainder (a pipelined next request) buffered, and the allocation is reused for every request on the connection.
- [struct HttpServer](https://docs.logicaffeine.com/logicaffeine_system/http/server/struct.HttpServer): A running server spawned onto the tokio runtime. Dropping the handle aborts the accept loop (mirrors `relay::RelayServer`). The handler must be `Send`; the interpreter’s `!Send` handler uses `Listener`/`Conn` directly instead.
- [struct Listener](https://docs.logicaffeine.com/logicaffeine_system/http/server/struct.Listener): A bound TCP listener. Resolve `127.0.0.1:0` to its real port via `Listener::local_addr` before dialing.
- [enum ReadError](https://docs.logicaffeine.com/logicaffeine_system/http/server/enum.ReadError): Reading a request off a connection failed.
- [const MAX_INFLIGHT](https://docs.logicaffeine.com/logicaffeine_system/http/server/constant.MAX_INFLIGHT): The most connections either tier holds open at once. Accepting pauses at the cap (further connections wait in the OS backlog), so a flood of held-open sockets cannot exhaust memory.
- [fn announce_serving](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.announce_serving): Announce the address a `Serve` statement bound, on stdout and at once: `Serving on http://<bound>`. Every tier prints it from here, after the listener is bound and before the first request is read, so whoever started the server (the full-stack dev server, a test, an orchestrator) learns the real address, including the port the system chose for a requested port `0`. It is flushed because a server never returns: anything left in a buffer would never be seen.
- [fn bad_request](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.bad_request): The canned `400` a connection gets when its bytes don’t parse — shared by both tiers so the differential stays byte-identical.
- [fn env_bind_address](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.env_bind_address): The whole address a `Serve` statement binds — host AND port, composed HERE so no tier can build one of its own.
- [fn env_port_override](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.env_port_override): The port a `Serve` statement actually binds: the `LOGOS_PORT` environment variable when set (falling back to `PORT`, the Fly/Heroku/Render convention), else the program’s own port expression. ONE seam serving both the largo full-stack dev proxy (which runs the program as a child on a port it chose) and PaaS deployment — implemented here so the interpreter and AOT tiers cannot drift.
- [fn internal_error](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.internal_error): The canned `500` a request gets when its handler fails (a runtime error on the interpreter tier, a panic on the AOT tier) — shared by both tiers. The failure detail is deliberately NOT on the wire (it goes to stderr): status 500, `text/plain`, body `internal error`.
- [fn page_with_visitor_token](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.page_with_visitor_token): A page document composed for one visitor of a server that answers CSRF tokens: `page` with the visitor’s token in its head (`token` is the server’s answer at its reserved token path), that answer’s `Set-Cookie` set on it, and the whole never stored by a cache — the document is this visitor’s alone. `None` when `token` is no token (a server with no `## Session` does not serve the path), and the page goes out as it was.
- [fn payload_too_large](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.payload_too_large): The canned `413` a request gets when its declared body or header block is larger than the server’s cap — a DEFINED “too large” refusal (distinct from the malformed `400`) so a client can tell the two apart. Shared by both tiers. `text/plain`, body `Payload Too Large`.
- [fn read_error_response](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.read_error_response): Map a request read error to the response the server writes: an oversized BODY (a declared `Content-Length` past the cap) is a defined `413` (never buffered / never dispatched) so a client can tell “too big” from “malformed”. Everything else — including an oversized HEADER block, whose head the server cannot even parse — is the malformed `400` (the shape the cross-tier `http_differential` lock pins). THE shared read-error law both the tokio and io_uring engines apply so their refusals are identical.
- [fn serve](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.serve): Bind `addr` and serve forever — THE AOT entry, and the engine-selection seam: `LOGOS_HTTP_ENGINE=uring|tokio` picks the engine, defaulting to the Linux thread-per-core io_uring engine wherever a probe ring initializes (else tokio), always announced with one stderr line. Handler calls are serialized either way (the `FnMut` contract); `serve_with_statics` is the shared-handler entry that also carries the static-response fast path.
- [fn serve_here](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.serve_here): `serve` for a handler that cannot leave the thread it was made on — one that holds the program’s own bindings, whose collections are not `Send`. The handler runs on the thread that awaits this future, one request at a time, exactly as `serve` serializes its calls; the engine runs on a thread and runtime of its own and hands each request across, so the caller’s runtime may be of any flavor. A panic inside a call answers the engines’ shared `500`.
- [fn serve_here_with_upgrades](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.serve_here_with_upgrades): `serve_here` with a table of protocol-upgrade paths, as `serve_with_upgrades`.
- [fn serve_on](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.serve_on): Serve on an already-bound `Listener`, looping forever — the TOKIO engine. Connections run CONCURRENTLY (one task each, capped at `MAX_INFLIGHT`) with HTTP/1.1 keep-alive, so a stalled or held-open connection never blocks the rest; handler calls are serialized on a mutex (one at a time, matching the single-threaded interpreter tier). A handler panic answers the shared `internal_error` `500` for that request and the server keeps serving. A parse error answers `400` and closes; a closed/errored socket just ends that connection.
- [fn serve_on_shared](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.serve_on_shared): `serve_on` with a SHARED handler (`Fn + Send + Sync`) — calls run CONCURRENTLY across connection tasks instead of queueing on one mutex.
- [fn serve_on_shared_with](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.serve_on_shared_with): `serve_on_shared` with a table of protocol-upgrade paths (see `UpgradeHandler`) — a `GET` to one of them, asking to upgrade, is answered `101` and handed off instead of reaching `handler`. Every other request goes through the ordinary request/response path unchanged, so `serve_on_shared(l, h)` is exactly `serve_on_shared_with(l, h, [])`.
- [fn serve_on_with](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.serve_on_with): `serve_on` with a table of protocol-upgrade paths (see `UpgradeHandler`) — a `GET` to one of them, asking to upgrade, is answered `101` and handed off instead of reaching `handler`. Every other request is unaffected, so `serve_on(l, h)` is exactly `serve_on_with(l, h, [])`.
- [fn serve_with_statics](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.serve_with_statics): Bind `addr` and serve forever with a SHARED handler (`Fn + Send + Sync` — the compiled-handler contract; calls may run concurrently across shards or connection tasks) and an optional pre-serialized `StaticResponses` table both engines consult before dispatching. Engine selection as in `serve`.
- [fn serve_with_upgrades](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.serve_with_upgrades): `serve` with a table of protocol-upgrade paths (see `UpgradeHandler`) — a `GET` to one of them carrying `Upgrade: websocket` is handed to its handler once the handshake is answered, on either engine. A compiled backend whose pages talk to the relay registers `/_relay` here (`relay::RelayHub::upgrades`).
- [fn spawn](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.spawn): Bind `addr`, spawn the accept loop onto the tokio runtime, and return a handle carrying the bound port. For tests and embedders (the handler is `Send`). Always the TOKIO engine: the handle’s drop-aborts contract needs a task, not OS threads — engine selection belongs to the blocking `serve` entry (the io_uring engine’s own handle is `engine_uring::UringServer`).
- [fn spawn_with_lifecycle](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.spawn_with_lifecycle): Bind `addr`, spawn the LIFECYCLE-AWARE accept loop, and return a handle that exposes the full production lifecycle: `HttpServer::set_ready`, `HttpServer::drain`, and — because `config.stamp_correlation_id` defaults on — an `X-Correlation-Id` on every response. THE entry an embedder (and the AOT `Serve` lowering, via a config seam) uses for a server that “stays serving”: graceful drain, readiness gating, bounded backpressure, per-request time bounds, malformed-flood survival, and correlation ids.
- [fn try_upgrade](https://docs.logicaffeine.com/logicaffeine_system/http/server/fn.try_upgrade): The RFC 6455 handshake decision for `req` against `upgrades`, in ONE place so every tier that drives its own connection loop (the tokio `serve_connection` below; the interpreter, which is `!Send` and never reaches `serve_connection` at all) reaches the exact same answer rather than hand-copying the accept-key derivation and the `101` response line a second time.
- [type UpgradeHandler](https://docs.logicaffeine.com/logicaffeine_system/http/server/type.UpgradeHandler): A protocol-upgrade handler: takes over a connection’s raw socket once the shared loop has completed the HTTP-level handshake (a `GET <path>` request carrying `Upgrade: websocket`, answered `101 Switching Protocols`) — the socket, plus any bytes already read into the connection’s buffer past that request (almost always empty; a bodyless `GET` ends its own frame at the header block, but a pipelined first WS frame is possible and must not be dropped). Spawned as its own task by the loop, which then moves on to the next connection — the handler owns the socket for as long as it likes.

## logicaffeine_system::http::wire
HTTP/1.1 wire format — hand-rolled parsers and writers over plain byte buffers. No hyper, no allocations beyond the owned result. The server half is `parse_request` + `serialize_response`; the client half is its exact mirror, `serialize_request` + `parse_response` — same error taxonomy, same limits, same `ParseError::Incomplete` retry contract.

- [struct HttpRequest](https://docs.logicaffeine.com/logicaffeine_system/http/wire/struct.HttpRequest): A parsed HTTP request. `path` and `query` values are percent-decoded; header keys are lowercased. `body` is the raw bytes (a LOGOS `Request.body: Text` is derived from this at the interpreter/AOT bridge).
- [struct HttpResponse](https://docs.logicaffeine.com/logicaffeine_system/http/wire/struct.HttpResponse): A response to serialize. `status` is the numeric code; `headers` are written verbatim (except `Content-Length`/`Connection`/`Transfer-Encoding`, which the writer owns); `body` is raw bytes.
- [enum ParseError](https://docs.logicaffeine.com/logicaffeine_system/http/wire/enum.ParseError): Why a byte buffer could not be parsed into a complete request.
- [const MAX_BODY](https://docs.logicaffeine.com/logicaffeine_system/http/wire/constant.MAX_BODY): Largest request body accepted, in bytes. Requests declaring a larger `Content-Length` are rejected with `ParseError::BodyTooLarge`.
- [const MAX_HEADERS](https://docs.logicaffeine.com/logicaffeine_system/http/wire/constant.MAX_HEADERS): Largest header block (request line + headers, up to the blank line) accepted.
- [fn parse_request](https://docs.logicaffeine.com/logicaffeine_system/http/wire/fn.parse_request): Parse a complete HTTP/1.1 request from `bytes`.
- [fn parse_request_consuming](https://docs.logicaffeine.com/logicaffeine_system/http/wire/fn.parse_request_consuming): `parse_request` plus the number of bytes the request occupied — the keep-alive keystone: a persistent connection drains exactly `consumed` bytes and keeps the remainder (a pipelined next request) buffered.
- [fn parse_response](https://docs.logicaffeine.com/logicaffeine_system/http/wire/fn.parse_response): Parse a complete HTTP/1.1 response from `bytes` — the client-side mirror of `parse_request`: same `ParseError::Incomplete` retry contract, same `MAX_BODY`/`MAX_HEADERS` caps, same lowercased header keys, same `Transfer-Encoding` rejection.
- [fn request_wants_keep_alive](https://docs.logicaffeine.com/logicaffeine_system/http/wire/fn.request_wants_keep_alive): Whether the server should keep the connection open after answering `req` — THE ONE keep-alive law both execution tiers (the interpreter’s serve loop and the AOT `serve_on`) apply, so their `Connection:` responses can never drift: HTTP/1.1 connections persist unless the client’s `Connection` header token list contains `close` (case-insensitive).
- [fn response_header_allowed](https://docs.logicaffeine.com/logicaffeine_system/http/wire/fn.response_header_allowed): Whether a handler-supplied response header may pass to the wire — THE ONE law both execution tiers (the interpreter bridge and AOT-emitted code) apply before merging a LOGOS `Response.headers` map, so they can never drift: the name must be non-empty, must not be writer-owned framing or hop-by-hop (`connection`, `content-length`, `transfer-encoding`, `keep-alive`, `upgrade`), must not be `content-type` (the `Response.contentType` field is authoritative), and neither name nor value may contain CR, LF, or NUL (response splitting). The typed surface (`withHeader` in `http.lg`) rejects these with an `Err` up front; this filter is the defense-in-depth for maps poked directly.
- [fn safe_content_type](https://docs.logicaffeine.com/logicaffeine_system/http/wire/fn.safe_content_type): The `Content-Type` actually emitted for a handler’s `contentType` field: the field verbatim when it is wire-safe, else the `text/plain` default — so a CR/LF smuggled into `contentType` can never split the response. Both execution tiers route the field through this, keeping them byte-identical.
- [fn serialize_request](https://docs.logicaffeine.com/logicaffeine_system/http/wire/fn.serialize_request): Serialize a request to bytes: request line (method, percent-encoded path and query, `HTTP/1.1`), the request’s headers (minus the writer-owned framing ones), an accurate `Content-Length`, `Connection: close`, the blank line, then the body — the exact client-side mirror of `serialize_response`.
- [fn serialize_response](https://docs.logicaffeine.com/logicaffeine_system/http/wire/fn.serialize_response): Serialize a response to bytes: status line, the response’s headers (minus the writer-owned ones), an accurate `Content-Length`, `Connection: close`, the blank line, then the body — the one-shot form of `serialize_response_conn`.
- [fn serialize_response_conn](https://docs.logicaffeine.com/logicaffeine_system/http/wire/fn.serialize_response_conn): Serialize a response with an explicit connection disposition: the writer owns the `Connection:` header (`keep-alive` to hold the connection open for the next request, `close` to end it) exactly as it owns `Content-Length` — a handler can never desync framing or force persistence.

## logicaffeine_system::io
I/O Operations for LOGOS Programs

- [trait Showable](https://docs.logicaffeine.com/logicaffeine_system/io/trait.Showable): Custom trait for LOGOS Show verb - provides clean, natural output. Primitives display without quotes, collections display with brackets.
- [fn eprintln](https://docs.logicaffeine.com/logicaffeine_system/io/fn.eprintln)
- [fn flush_stdout](https://docs.logicaffeine.com/logicaffeine_system/io/fn.flush_stdout): Write everything shown so far. Called wherever stdout’s order against something else becomes observable: before stderr, before input is read, before a program’s own Rust writes to stdout, and when a program fails.
- [fn format_currency](https://docs.logicaffeine.com/logicaffeine_system/io/fn.format_currency): A currency hole (`{x:$}`), rendered exactly as the interpreter’s `apply_format_spec`: an integer or a float as money with two decimals, an exact integer beyond `i64` with an exact `.00`, and every other value — an exact decimal keeps its own digits — as `$` before its own display.
- [fn format_fixed](https://docs.logicaffeine.com/logicaffeine_system/io/fn.format_fixed): A fixed-precision hole (`{x:.2}`), rendered exactly as the interpreter’s `apply_format_spec`: an integer or a float to `precision` places, and every other value as its own display.
- [fn print](https://docs.logicaffeine.com/logicaffeine_system/io/fn.print)
- [fn println](https://docs.logicaffeine.com/logicaffeine_system/io/fn.println)
- [fn read_line](https://docs.logicaffeine.com/logicaffeine_system/io/fn.read_line)
- [fn show](https://docs.logicaffeine.com/logicaffeine_system/io/fn.show): The Show verb - prints value with natural formatting Takes a reference to avoid moving the value.
- [fn show_string](https://docs.logicaffeine.com/logicaffeine_system/io/fn.show_string): Render any `Showable` value to a `String` using the SAME natural formatting as `show` — used by string interpolation holes so `"{s}"` matches `Show s` byte-for-byte, even for types (Sets, user structs) that implement `Showable` but not `std::fmt::Display`.

## logicaffeine_system::keccak
Keccak-f[1600] + SHA-3 / SHAKE runtime kernels — the symmetric/hash layer ML-KEM is built on (SHA3-256/512 for hashing, SHAKE128 for matrix expansion, SHAKE256 for the PRF). Reached from compiled LOGOS via the `sha3_256` / `sha3_512` / `shake128` / `shake256` stdlib functions. Verified against the NIST FIPS-202 KATs (see the tests). Input/output are LOGOS `Int` bytes (0..255) carried in a `Seq of Int`.

- [fn keccak_f1600](https://docs.logicaffeine.com/logicaffeine_system/keccak/fn.keccak_f1600): The Keccak-f[1600] permutation: 24 rounds of θ, ρ·π, χ, ι over the 5×5×64 state.
- [fn sha3_256](https://docs.logicaffeine.com/logicaffeine_system/keccak/fn.sha3_256): SHA3-256 — the compiled form of LOGOS `sha3_256(a)`. 32 output bytes.
- [fn sha3_512](https://docs.logicaffeine.com/logicaffeine_system/keccak/fn.sha3_512): SHA3-512 — 64 output bytes.
- [fn sha3_256_bytes](https://docs.logicaffeine.com/logicaffeine_system/keccak/fn.sha3_256_bytes)
- [fn sha3_512_bytes](https://docs.logicaffeine.com/logicaffeine_system/keccak/fn.sha3_512_bytes)
- [fn shake128](https://docs.logicaffeine.com/logicaffeine_system/keccak/fn.shake128): SHAKE128 XOF — `outlen` output bytes.
- [fn shake256](https://docs.logicaffeine.com/logicaffeine_system/keccak/fn.shake256): SHAKE256 XOF — `outlen` output bytes.
- [fn shake128_bytes](https://docs.logicaffeine.com/logicaffeine_system/keccak/fn.shake128_bytes)
- [fn shake256_bytes](https://docs.logicaffeine.com/logicaffeine_system/keccak/fn.shake256_bytes)

## logicaffeine_system::mldsa
ML-DSA-65 (FIPS-204 / Dilithium) runtime kernels — the post-quantum SIGNATURE scheme that complements ML-KEM-768 in the channel. This module builds bottom-up: the length-256 NTT over the Dilithium prime `q = 8380417` (a COMPLETE transform, unlike Kyber’s incomplete one — `q ≡ 1 (mod 512)`, so `X²⁵⁶+1` splits fully), with signed Montgomery reduction. Validated against the schoolbook negacyclic convolution.

- [enum SignError](https://docs.logicaffeine.com/logicaffeine_system/mldsa/enum.SignError): Why `sign` refuses its inputs: FIPS 204 returns ⊥ for these instead of a signature.
- [const PK_BYTES](https://docs.logicaffeine.com/logicaffeine_system/mldsa/constant.PK_BYTES): `pk` = ρ ‖ pack(t1).
- [const SIG_BYTES](https://docs.logicaffeine.com/logicaffeine_system/mldsa/constant.SIG_BYTES): ML-DSA-65 signature length.
- [const SK_BYTES](https://docs.logicaffeine.com/logicaffeine_system/mldsa/constant.SK_BYTES): `sk` = ρ ‖ K ‖ tr ‖ pack(s1) ‖ pack(s2) ‖ pack(t0).
- [fn bench_verify_breakdown](https://docs.logicaffeine.com/logicaffeine_system/mldsa/fn.bench_verify_breakdown): Dev-only profiler: break `verify`’s cost into components to locate the hot spot. Not shipped logic.
- [fn keygen](https://docs.logicaffeine.com/logicaffeine_system/mldsa/fn.keygen): ML-DSA.KeyGen_internal(ξ) → (pk, sk), deterministic in the 32-byte seed ξ.
- [fn mldsa_keypair_seq](https://docs.logicaffeine.com/logicaffeine_system/mldsa/fn.mldsa_keypair_seq): `mldsaKeypair(seed)` → pk(1952) ‖ sk(4032).
- [fn mldsa_sign_seq](https://docs.logicaffeine.com/logicaffeine_system/mldsa/fn.mldsa_sign_seq): `mldsaSign(sk, msg, ctx)` → signature(3309).
- [fn mldsa_verify_seq](https://docs.logicaffeine.com/logicaffeine_system/mldsa/fn.mldsa_verify_seq): `mldsaVerify(pk, msg, ctx, sig)` → 1 if valid, else 0. Whatever is not a byte string of the right shape verifies nothing, so it answers 0 rather than failing the program.
- [fn sign](https://docs.logicaffeine.com/logicaffeine_system/mldsa/fn.sign): Deterministic ML-DSA-65 signature over `m` with context `ctx` (the `rnd = 0` variant).
- [fn sign_randomized](https://docs.logicaffeine.com/logicaffeine_system/mldsa/fn.sign_randomized): Hedged ML-DSA-65 signature, FIPS 204’s default variant: `rnd` is 32 fresh random bytes mixed into the signature’s mask seed, so signing one message twice, or under an injected fault, never repeats the mask.
- [fn verify](https://docs.logicaffeine.com/logicaffeine_system/mldsa/fn.verify): Verify an ML-DSA-65 signature; `true` iff valid for `(pk, m, ctx)`.

## logicaffeine_system::mlkem
ML-KEM-768 (FIPS-203) keygen / encapsulation / decapsulation as a Rust composition of the verified native kernels in `crate::ntt` (NTT, base-multiply, CBD, compress, byte-encode, 4-way AVX2 matrix expansion) and `crate::keccak` (SHA3-256/512, SHAKE256). This is the exact same primitive set the `assets/std/crypto.lg` Logos ML-KEM orchestrates and that the `logicaffeine-tests` AOT gates prove bit-exact vs the FIPS-203 reference — here orchestrated in Rust so the post-quantum channel (`logicaffeine_compile::concurrency::channel`) can run the handshake. Coefficients ride the fast `Word16` carrier throughout.

- [enum KemError](https://docs.logicaffeine.com/logicaffeine_system/mlkem/enum.KemError): Why `encaps` or `decaps` refuses its inputs: the FIPS 203 §7.2–7.3 input checks.
- [const CT_BYTES](https://docs.logicaffeine.com/logicaffeine_system/mlkem/constant.CT_BYTES): `ct` = K·(32·du) + 32·dv (ciphertext).
- [const DK_BYTES](https://docs.logicaffeine.com/logicaffeine_system/mlkem/constant.DK_BYTES): `dk` = dk_pke ‖ ek ‖ H(ek) ‖ z (decapsulation / secret key).
- [const EK_BYTES](https://docs.logicaffeine.com/logicaffeine_system/mlkem/constant.EK_BYTES): `ek` = K·384 + 32 (encapsulation / public key).
- [const SS_BYTES](https://docs.logicaffeine.com/logicaffeine_system/mlkem/constant.SS_BYTES): Shared secret length.
- [fn decaps](https://docs.logicaffeine.com/logicaffeine_system/mlkem/fn.decaps): ML-KEM.Decaps(dk, c) → shared secret, with the Fujisaki-Okamoto implicit reject. The FIPS 203 §7.3 input checks run first, the key’s before the ciphertext’s, so a malformed key is reported whatever ciphertext arrives with it.
- [fn encaps](https://docs.logicaffeine.com/logicaffeine_system/mlkem/fn.encaps): ML-KEM.Encaps(ek, m) → (ciphertext, shared secret). `m` is the 32-byte message randomness. An `ek` that fails the FIPS 203 §7.2 input checks is refused.
- [fn keygen](https://docs.logicaffeine.com/logicaffeine_system/mlkem/fn.keygen): ML-KEM.KeyGen(d, z) → (ek, dk) where dk = dk_pke ‖ ek ‖ H(ek) ‖ z.
- [fn mlkem_decaps_seq](https://docs.logicaffeine.com/logicaffeine_system/mlkem/fn.mlkem_decaps_seq): `mlkemDecapsKem(dk, ct)` → shared_secret(32). The ciphertext is the peer’s: one of the wrong length is answered with an empty sequence; a malformed decapsulation key fails the program.
- [fn mlkem_encaps_seq](https://docs.logicaffeine.com/logicaffeine_system/mlkem/fn.mlkem_encaps_seq): `mlkemEncapsKem(ek, m)` → ciphertext(1088) ‖ shared_secret(32). The ek is the peer’s: one that fails FIPS 203’s checks is answered with an empty sequence, never encapsulated to.
- [fn mlkem_keypair_seq](https://docs.logicaffeine.com/logicaffeine_system/mlkem/fn.mlkem_keypair_seq): `mlkemKeypair(d, z)` → ek(1184) ‖ dk(2400).
- [fn mlkem_noise_batch_from_int](https://docs.logicaffeine.com/logicaffeine_system/mlkem/fn.mlkem_noise_batch_from_int): `mlkemNoiseBatch(seed, base, count)` → `count·256` raw CBD_2 Word16 coefficients (nonces `base..base+count`, no NTT), the flat concatenation of `count` noise polynomials. The fast primitive the Logos `mlkem768Keygen`/`mlkemEncrypt` call once instead of `count` scalar `mlkemPrfNoise`s — one 4-way SHAKE256 permutation covers four PRF streams (see `noise_batch_raw`).

## logicaffeine_system::net
`Net` — the cross-target relay-backed network handle the interpreter holds.

- [struct Net](https://docs.logicaffeine.com/logicaffeine_system/net/struct.Net): Native relay handle (async `tokio-tungstenite` client).

## logicaffeine_system::ntt
ML-KEM (Kyber) negacyclic NTT runtime kernel — the verified scalar reference + AVX2 i16×16 path that compiled LOGOS reaches through the `mlkemNtt` stdlib function. Ported from the validated `scripts/dev/ntt_simd_proto.rs` (round-trip + AVX2==scalar bit-identical). q = 3329, R = 2¹⁶, the incomplete 7-level transform over ℤ_q[X]/(X²⁵⁶+1). The Montgomery reduction it uses is kernel-certified (`logicaffeine_kernel::field_algebra::montgomery_reduction_*`).

- [fn mlkem_add_mod_q_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_add_mod_q_w16): `(a + b) mod q`, element-wise on Word16 [0, q) — the native modular-add the Logos matrix-vector loop calls (so the orchestration never does Word16 arithmetic, only structure).
- [fn mlkem_base_mul](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_base_mul): The compiled form of LOGOS `mlkemBaseMul(a, b)` — pointwise multiply of two NTT-domain polynomials. `mlkemInvNtt(mlkemBaseMul(mlkemNtt(a), mlkemNtt(b)))` is the ML-KEM polynomial product a·b in ℤ_q[X]/(X²⁵⁶+1).
- [fn mlkem_base_mul_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_base_mul_w16)
- [fn mlkem_base_mul_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_base_mul_w16_seq)
- [fn mlkem_byte_decode](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_byte_decode): The compiled form of LOGOS `byteDecode(bytes, d)` — unpack bytes to coefficients.
- [fn mlkem_byte_decode_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_byte_decode_w16): ByteDecode_d of one polynomial: exactly `32·d` bytes to 256 coefficients, reduced mod q for d = 12.
- [fn mlkem_byte_decode_w16_from_int](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_byte_decode_w16_from_int)
- [fn mlkem_byte_decode_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_byte_decode_w16_seq)
- [fn mlkem_byte_encode](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_byte_encode): The compiled form of LOGOS `byteEncode(coeffs, d)` — pack coefficients to bytes.
- [fn mlkem_byte_encode_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_byte_encode_w16)
- [fn mlkem_byte_encode_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_byte_encode_w16_seq)
- [fn mlkem_byte_encode_w16_to_int](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_byte_encode_w16_to_int)
- [fn mlkem_cbd2](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_cbd2): The compiled form of LOGOS `cbd2(buf)` — sample a noise polynomial (η=2) from 128 bytes of (SHAKE) randomness; 256 coefficients in [−2, 2].
- [fn mlkem_cbd3](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_cbd3): The compiled form of LOGOS `cbd3(buf)` — η=3 noise from 192 bytes; coefficients in [−3, 3].
- [fn mlkem_cbd2_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_cbd2_w16): CBD noise sampled to [0, q) Word16 (the reduced form the Word16 NTT consumes directly).
- [fn mlkem_cbd2_w16_from_int](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_cbd2_w16_from_int)
- [fn mlkem_cbd2_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_cbd2_w16_seq)
- [fn mlkem_cbd3_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_cbd3_w16)
- [fn mlkem_cbd3_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_cbd3_w16_seq)
- [fn mlkem_compress](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_compress): The compiled form of LOGOS `compress(coeffs, d)` — element-wise Compress_d.
- [fn mlkem_compress_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_compress_w16)
- [fn mlkem_compress_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_compress_w16_seq)
- [fn mlkem_decompress](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_decompress): The compiled form of LOGOS `decompress(coeffs, d)` — element-wise Decompress_d.
- [fn mlkem_decompress_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_decompress_w16)
- [fn mlkem_decompress_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_decompress_w16_seq)
- [fn mlkem_inv_ntt](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_inv_ntt): The compiled form of LOGOS `mlkemInvNtt(a)` — the inverse ML-KEM NTT (`tomont`), so `mlkemInvNtt(mlkemNtt(p)) = p·2285 mod q`. Together with `mlkemNtt` and a base-multiply this is the polynomial-multiplication primitive ML-KEM is built on.
- [fn mlkem_inv_ntt_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_inv_ntt_w16): `Word16`-native inverse NTT, base multiply, and tomont — same zero-conversion carrier.
- [fn mlkem_inv_ntt_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_inv_ntt_w16_seq)
- [fn mlkem_ntt](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_ntt): The compiled form of LOGOS `mlkemNtt(a)` — the runtime entry the generated Rust calls (and the interpreter dispatches to). Takes/returns the LOGOS `Seq of Int` carrier.
- [fn mlkem_ntt_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_ntt_w16): `Word16`-native forward NTT — coefficients are carried as `Word16` (u16) in [0, q), so the boundary is a plain reinterpret (`w.0 as i16`, exact since q < 2¹⁵), no rem_euclid and no i64 round-trip. The experimental fast carrier for the Word16-representation crypto.
- [fn mlkem_ntt_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_ntt_w16_seq): Native entry for the LOGOS `Seq of Word16` carrier — wraps the raw Word16 NTT in a `LogosSeq`.
- [fn mlkem_sample_a](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_sample_a): The compiled form of LOGOS `sampleA(seed, i, j)` — expand matrix entry Â[i][j] from the 32-byte seed ρ via SHAKE128, with the XOF and rejection handled in one verified step.
- [fn mlkem_sample_a_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_sample_a_w16): Matrix entry Â[i][j] sampled to [0, q) Word16 — streaming SHAKE128 rejection (scalar reference).
- [fn mlkem_sample_a_w16_from_int](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_sample_a_w16_from_int)
- [fn mlkem_sample_a_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_sample_a_w16_seq)
- [fn mlkem_sample_matrix_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_sample_matrix_w16): Sample the full ML-KEM-768 3×3 matrix  at once (9 × 256 Word16, entry Â[r][c] at slot `(r·3+c)·256`), batching four rejection-sampling streams per 4-way AVX2 SHAKE128 permutation. Bit-identical to nine `mlkem_sample_a_w16` calls; falls back to scalar without AVX2. This is the matrix-expansion keystone — sampleA is ~60% of keygen and is `×9` again in encaps.
- [fn mlkem_sample_matrix_w16_from_int](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_sample_matrix_w16_from_int): Native entry for the full 3×3 matrix  (9 × 256 Word16, entry Â[r][c] at slot `(r·3+c)·256`), 4-way AVX2 SHAKE128 batched — the shipped-Logos `mlkemSampleMatrixW16(rho)`.
- [fn mlkem_sample_ntt](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_sample_ntt): The compiled form of LOGOS `sampleNtt(stream)` — rejection-sample a uniform NTT-domain polynomial directly from a caller-provided byte stream.
- [fn mlkem_sub_mod_q_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_sub_mod_q_w16): `(a − b) mod q`, element-wise on Word16 [0, q).
- [fn mlkem_to_mont](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_to_mont): The compiled form of LOGOS `toMont(coeffs)` — multiply a polynomial into the Montgomery domain.
- [fn mlkem_to_mont_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_to_mont_w16)
- [fn mlkem_to_mont_w16_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_to_mont_w16_seq)
- [fn mlkem_zeros_w16](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.mlkem_zeros_w16): A run of `n` zero coefficients (Word16).
- [fn sha3_256_w8_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.sha3_256_w8_seq)
- [fn sha3_512_w8_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.sha3_512_w8_seq)
- [fn shake128_w8_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.shake128_w8_seq)
- [fn shake256_w8_seq](https://docs.logicaffeine.com/logicaffeine_system/ntt/fn.shake256_w8_seq)

## logicaffeine_system::obs
The observation channel for COMPILED (AOT-Rust) programs — Wave 13.

- [struct ObsEvent](https://docs.logicaffeine.com/logicaffeine_system/obs/struct.ObsEvent): One observation event captured in a compiled program.
- [fn capturing](https://docs.logicaffeine.com/logicaffeine_system/obs/fn.capturing): Is a sink capturing on this thread? (Emission is a no-op otherwise.)
- [fn drain](https://docs.logicaffeine.com/logicaffeine_system/obs/fn.drain): Take and clear the captured events (empty if nothing was installed).
- [fn install](https://docs.logicaffeine.com/logicaffeine_system/obs/fn.install): Begin capturing observation events on this thread (a fresh, empty buffer).
- [fn record](https://docs.logicaffeine.com/logicaffeine_system/obs/fn.record): Emit a `Note`/`Warn`/`Record` message with its captured payloads.
- [fn span_enter](https://docs.logicaffeine.com/logicaffeine_system/obs/fn.span_enter): Emit a `During` span entry.
- [fn span_exit](https://docs.logicaffeine.com/logicaffeine_system/obs/fn.span_exit): Emit a `During` span exit (always paired with its `span_enter`).

## logicaffeine_system::random
Random Number Generation

- [fn fill_from_entropy](https://docs.logicaffeine.com/logicaffeine_system/random/fn.fill_from_entropy): Fill `buf` from the operating system’s entropy: what a nonce or a key is drawn from. A sealed test world never decides it, since a nonce a test world fixed would repeat across seals.
- [fn randomFloat](https://docs.logicaffeine.com/logicaffeine_system/random/fn.randomFloat): Generates a random floating-point number.
- [fn randomInt](https://docs.logicaffeine.com/logicaffeine_system/random/fn.randomInt): Generates a random integer in an inclusive range.

## logicaffeine_system::relay
Thin WebSocket relay — the v1 browser↔mesh bridge.

- [struct RelayClient](https://docs.logicaffeine.com/logicaffeine_system/relay/struct.RelayClient): A native relay client — and the reference for what the browser does over `web-sys` WebSocket with the same `RelayFrame` protocol.
- [struct RelayHub](https://docs.logicaffeine.com/logicaffeine_system/relay/struct.RelayHub): A `Hub` with no listener of its own — for embedding inside ANOTHER server’s accept loop (`largo serve`’s `/_relay` upgrade, registered on `logicaffeine_system::http::server`’s shared loop, or a compiled full-stack binary’s own `Serve`). `serve` is bind-a-listener plus exactly this; the pub/sub semantics — subscribe, publish (never echoed to the publisher), unsubscribe on drop — are the identical `Hub` either way.
- [struct RelayServer](https://docs.logicaffeine.com/logicaffeine_system/relay/struct.RelayServer): A running relay server. Dropping the handle aborts the accept loop.
- [const RELAY_PATH](https://docs.logicaffeine.com/logicaffeine_system/relay/constant.RELAY_PATH): The path a page’s relay connection dials on the server that served it.
- [fn serve](https://docs.logicaffeine.com/logicaffeine_system/relay/fn.serve): Start a relay (a pure WebSocket pub/sub hub) on `addr` (e.g. `127.0.0.1:0`). This is the browser↔browser-via-relay path and needs no mesh.

## logicaffeine_system::relay_proto
The relay wire protocol — shared verbatim by the native server/client (`super::relay`) and the browser client (`super::relay_browser`). Both targets serialize the SAME `RelayFrame` with `bincode`, so a browser tab and a native node speak an identical language across the WebSocket.

- [enum RelayFrame](https://docs.logicaffeine.com/logicaffeine_system/relay_proto/enum.RelayFrame): A frame on the relay WebSocket. Client→relay: `Subscribe`/`Unsubscribe`/ `Publish`. Relay→client: `SubAck`/`Event`.

## logicaffeine_system::stack
The stack a compiled program’s `Main` runs on.

- [const MAIN_STACK_BYTES](https://docs.logicaffeine.com/logicaffeine_system/stack/constant.MAIN_STACK_BYTES): The room a compiled program’s `Main` has for its calls.
- [fn run_main](https://docs.logicaffeine.com/logicaffeine_system/stack/fn.run_main): Run `main`, a compiled program’s `Main`, on a stack of `MAIN_STACK_BYTES`.

## logicaffeine_system::storage
Persistent Storage with Journaling

- [struct Persistent](https://docs.logicaffeine.com/logicaffeine_system/storage/struct.Persistent): A persistent CRDT wrapper with journaling (native platform).

## logicaffeine_system::tcp
TCP client natives (tcp.lg): the SYNC implementations the AOT tier calls via `map_native_function`, plus the shared error-message formatters every tier reuses — one wording, so the tiers cannot drift even in their `Err` text.

- [const MAX_RECV](https://docs.logicaffeine.com/logicaffeine_system/tcp/constant.MAX_RECV): The largest single `tcpRecv`/`tcpRecvExact` request (64 MiB) — a guard against a hostile or corrupted length field, not a protocol limit (loop for more).
- [fn accept](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.accept): Accept one queued connection (blocks; a `set_timeout` on the listener applies).
- [fn close](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.close): Close the connection or listener; the handle is dead afterwards.
- [fn connect](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.connect): Open a TCP connection; `Ok` carries the opaque connection handle.
- [fn connect_tls](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.connect_tls): Open a TCP connection and complete a TLS handshake over it; `Ok` carries the same opaque handle every other native takes, so `tcpSend`/`tcpRecv` work unchanged.
- [fn ensure_crypto_provider](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.ensure_crypto_provider): The client TLS configuration: the bundled Mozilla roots, plus any extra root the operator names in `LOGOS_TLS_EXTRA_ROOT` (a PEM file).
- [fn err_accept](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_accept)
- [fn err_connect](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_connect)
- [fn err_invalid_len](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_invalid_len)
- [fn err_invalid_port](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_invalid_port)
- [fn err_invalid_timeout](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_invalid_timeout)
- [fn err_listen](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_listen)
- [fn err_recv](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_recv)
- [fn err_send](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_send)
- [fn err_shutdown](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_shutdown)
- [fn err_timeout](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_timeout)
- [fn err_torn](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_torn)
- [fn err_unknown_conn](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.err_unknown_conn)
- [fn listen](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.listen): Bind a listening socket (passive open; port `0` = ephemeral).
- [fn listener_port](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.listener_port): The local port a listener is bound to (how an ephemeral bind is learned).
- [fn recv](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.recv): Block until at least one byte arrives (or EOF), returning up to `max_len` bytes. A clean EOF is `Ok` of the empty Seq — a value, not an error.
- [fn recv_exact](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.recv_exact): Block until exactly `len` bytes arrive; a peer closing early is an `Err` (a torn frame is never silently truncated — protocol framing depends on it).
- [fn send](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.send): Send every byte (each Int masked to 0–255); `Ok` carries the byte count. `data` arrives as the AOT tier’s borrowed `Seq of Int` parameter form.
- [fn set_timeout](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.set_timeout): Set the connection’s read+write timeout in milliseconds (`0` clears it) — Python `settimeout` style: it applies to every subsequent recv/send, whose expiry is the shared `tcp: operation timed out` error.
- [fn shutdown_write](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.shutdown_write): Half-close: send FIN on the write side (`shutdown(SHUT_WR)`), keep reading.
- [fn tls_config](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.tls_config)
- [fn upgrade_tls](https://docs.logicaffeine.com/logicaffeine_system/tcp/fn.upgrade_tls): Wrap an ESTABLISHED plain connection in TLS, in place.

## logicaffeine_system::temporal
Temporal types for Logicaffeine. The date, moment, time-of-day and calendar span values are `logicaffeine-data`’s (`logicaffeine_data::temporal`), where every value model reaches them, re-exported here beside what only a system has: the clock, and how `Show` prints them.

- [struct LogosDate](https://docs.logicaffeine.com/logicaffeine_system/temporal/struct.LogosDate): Date stored as days since Unix epoch (1970-01-01).
- [struct LogosMoment](https://docs.logicaffeine.com/logicaffeine_system/temporal/struct.LogosMoment): Moment stored as nanoseconds since Unix epoch.
- [struct LogosSpan](https://docs.logicaffeine.com/logicaffeine_system/temporal/struct.LogosSpan): Calendar span with separate month and day components.
- [struct LogosTime](https://docs.logicaffeine.com/logicaffeine_system/temporal/struct.LogosTime): Time-of-day stored as nanoseconds from midnight — the wall-clock face of a `Moment`, with no date or zone. Renders `HH:MM:SS[.frac]`, lossless to the nanosecond (the AOT mirror of the interpreter’s `Time`).
- [fn current_moment](https://docs.logicaffeine.com/logicaffeine_system/temporal/fn.current_moment): The instant the system clock reads now.

## logicaffeine_system::testworld
The sealed test world.

- [struct Capabilities](https://docs.logicaffeine.com/logicaffeine_system/testworld/struct.Capabilities): Which resources a test may touch FOR REAL (granted by capability sentences).
- [struct TestWorld](https://docs.logicaffeine.com/logicaffeine_system/testworld/struct.TestWorld): One test’s sealed world.
- [const SEALED_EPOCH_MS](https://docs.logicaffeine.com/logicaffeine_system/testworld/constant.SEALED_EPOCH_MS): The sealed world’s fixed epoch: 2020-01-01T00:00:00Z in ms — a stable, obviously-synthetic date (no test can accidentally depend on today).
- [fn advance_clock](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.advance_clock): Advance the virtual clock (`Advance time by …`). Returns false when no world is installed (the caller reports the test-only error).
- [fn install](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.install): Install a sealed world for the current thread (the runner, per test).
- [fn intercept_env_get](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.intercept_env_get)
- [fn intercept_now](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.intercept_now)
- [fn intercept_random_float](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.intercept_random_float)
- [fn intercept_random_int](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.intercept_random_int): A uniform draw from `min..=max` off the world’s seeded stream: a word at or above the largest multiple of the span is drawn again, so no value is likelier than another — the rule every real host’s `randomInt` draws by.
- [fn intercept_read](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.intercept_read)
- [fn intercept_sleep](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.intercept_sleep): A sealed `sleep` advances logical time INSTANTLY — the statement that turns a timeout test into a microsecond assertion. Returns true when handled.
- [fn intercept_write](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.intercept_write)
- [fn restore](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.restore): Put back a world a matching `take` returned (or `None`, mirroring its absence).
- [fn seed_file](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.seed_file): Seed a fixture file (`Given a file "…" containing "…".`).
- [fn take](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.take): Take the installed world, if any, leaving none installed — a nested caller (a candidate page tier compared against the reference) saves whatever world its caller had before installing its own, and `restore`s it when it is done.
- [fn uninstall](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.uninstall): Remove the sealed world (the runner, after each test).
- [fn with_world](https://docs.logicaffeine.com/logicaffeine_system/testworld/fn.with_world): Run `f` against the installed world, if any.

## logicaffeine_system::text

- [fn chr](https://docs.logicaffeine.com/logicaffeine_system/text/fn.chr)
- [fn parseFloat](https://docs.logicaffeine.com/logicaffeine_system/text/fn.parseFloat)
- [fn parseInt](https://docs.logicaffeine.com/logicaffeine_system/text/fn.parseInt)

## logicaffeine_system::time
Time Utilities

- [fn now](https://docs.logicaffeine.com/logicaffeine_system/time/fn.now): Returns the current time as milliseconds since Unix epoch.
- [fn sleep](https://docs.logicaffeine.com/logicaffeine_system/time/fn.sleep): Blocks the current thread for the specified duration.

## logicaffeine_system::word_rt
Runtime support for the `Word8`/`Word16`/`Word32`/`Word64` ring types in COMPILED LOGOS.

- [struct Lanes4Word32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/struct.Lanes4Word32): Four lanes of `Word32` = one 128-bit register (`__m128i`) — the SHA-1 state/message carrier. Unlike the arithmetic lane types, its vocabulary is the four Intel SHA operations (`sha1rnds4`/`sha1msg1`/ `sha1msg2`/`sha1nexte`), so SHA-1 WRITTEN in Logos over these compiles to the `sha1rnds4` hardware sequence (AOT) and runs the byte-identical software spec `crate::sha_ops` on the interpreter. Lane `i` is bits `[32i+31 : 32i]` — index 0 low, index 3 high — matching `_mm_loadu_si128`.
- [struct Lanes4Word64](https://docs.logicaffeine.com/logicaffeine_system/word_rt/struct.Lanes4Word64): Four lanes of `Word64` (one 256-bit SIMD register) — the Poly1305 accumulator lane vector. Carries `[u64; 4]`; ops have an AVX2 fast path proven byte-identical to the scalar lanes.
- [struct Lanes8Word32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/struct.Lanes8Word32): Eight lanes of `Word32` (one 256-bit SIMD register). Operations are lane-wise over the ℤ/2³² ring.
- [struct Lanes16Word8](https://docs.logicaffeine.com/logicaffeine_system/word_rt/struct.Lanes16Word8): Sixteen `Word8` lanes = one 128-bit register (`__m128i`) — the BYTE-SHUFFLE carrier for SIMD text codecs (hex encode/decode). Its vocabulary is `shuffle` (`pshufb`, a 16-entry byte LUT), byte AND, per-byte shift, and the two byte interleaves — so a hex codec WRITTEN in Logos over it compiles to the `pshufb` sequence (AOT, when SSSE3 is statically enabled) and runs the byte-identical scalar spec on the interpreter. Lane `i` is byte `i` (index 0 low), matching `_mm_loadu_si128`.
- [struct Lanes16Word16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/struct.Lanes16Word16): Sixteen lanes of `Word16` (one 256-bit SIMD register) — the NTT coefficient lane vector. Carries `[u16; 16]`; the multiply-high is the SIGNED `_mm256_mulhi_epi16` (the Montgomery butterfly’s `mulhi`). Ops have an AVX2 fast path proven byte-identical to the scalar lanes.
- [struct Word8](https://docs.logicaffeine.com/logicaffeine_system/word_rt/struct.Word8): A 8-bit wrapping integer: the ring ℤ/2^8ℤ, where every operation is total and wraps modulo 2^8.
- [struct Word16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/struct.Word16): A 16-bit wrapping integer: the ring ℤ/2^16ℤ, where every operation is total and wraps modulo 2^16.
- [struct Word32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/struct.Word32): A 32-bit wrapping integer: the ring ℤ/2^32ℤ, where every operation is total and wraps modulo 2^32.
- [struct Word64](https://docs.logicaffeine.com/logicaffeine_system/word_rt/struct.Word64): A 64-bit wrapping integer: the ring ℤ/2^64ℤ, where every operation is total and wraps modulo 2^64.
- [trait WordRotate](https://docs.logicaffeine.com/logicaffeine_system/word_rt/trait.WordRotate): Width-defined bit rotation, available on every word width so `rotl(x, n)` is one name.
- [fn and_not4](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.and_not4): `andNot4(a, b)` — Keccak χ’s `(¬a) ∧ b` in one lane op (`vpandn`). The compiled form of the builtin.
- [fn byte_add16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.byte_add16): Per-byte wrapping add — compiled `byteAdd16(a, b)` (the ASCII→nibble decode).
- [fn hsum_lanes4](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.hsum_lanes4): The horizontal sum of a `Lanes4Word64`’s lanes as an `Int` — the compiled form of `hsumLanes4(v)`.
- [fn int_of_word8](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.int_of_word8): The unsigned value of a `Word8` as an `Int` (0..255) — the compiled form of `intOfWord8(w)`.
- [fn int_of_word16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.int_of_word16): The unsigned value of a `Word16` as an `Int` (0..2¹⁶−1) — the compiled form of `intOfWord16(w)`, the ML-KEM NTT’s Word16-coefficient → Int boundary.
- [fn int_of_word32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.int_of_word32): The unsigned value of a `Word32` as an `Int` — the compiled form of `intOfWord32(w)`, used to serialize a keystream word into bytes (`Int` mod/div) for the XOR against a `Seq of Int` payload.
- [fn int_of_word64](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.int_of_word64): The value of a `Word64` as an `Int` — `intOfWord64(w)`. For values ≥ 2⁶³ this is a negative `i64` (two’s-complement bits); used on byte-masked lanes (`< 256`) in Keccak’s squeeze.
- [fn interleave_hi16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.interleave_hi16): High-eight byte interleave (`_mm_unpackhi_epi8`) — compiled `interleaveHi16(a, b)`.
- [fn interleave_lo16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.interleave_lo16): Low-eight byte interleave (`_mm_unpacklo_epi8`) — compiled `interleaveLo16(a, b)`.
- [fn lanes4_of](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.lanes4_of): Pack four `Word32`s straight into a SHA-1 lane register — compiled `lanes4Of(a, b, c, d)`. The alloc-free constructor (no `Seq`, no heap): the Logos SHA-1 packs a lane this way every round.
- [fn lanes4_word32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.lanes4_word32): Pack the first 4 `Word32`s of a Seq into a SHA-1 lane register — compiled `lanes4Word32(s)`.
- [fn lanes4_word64](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.lanes4_word64): Pack the first 4 `Int`s of a Seq into a `Lanes4Word64` — the compiled form of `lanes4Word64(s)`.
- [fn lanes8_word32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.lanes8_word32): Pack the first 8 `Word32`s of a Seq into a lane vector — the compiled form of `lanes8Word32(s)`.
- [fn lanes16_word8](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.lanes16_word8): Pack the first 16 bytes of a `Seq of Int` into a byte-shuffle register — compiled `lanes16Word8(s)`.
- [fn lanes16_word16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.lanes16_word16): Pack the first 16 `Int`s of a Seq into a `Lanes16Word16` — the compiled form of `lanes16Word16(s)`.
- [fn maddubs16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.maddubs16): Multiply-add adjacent byte pairs (`pmaddubsw`) — compiled `maddubs16(a, w)` (nibble-pair → byte).
- [fn montmul32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.montmul32): The signed i32 Montgomery multiply (`vpmuldq`) — the compiled form of `montmul32(a, b, q, qinv)`, the ML-DSA NTT butterfly multiply.
- [fn mul32x32to64](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.mul32x32to64): Lane-wise widening low-32 multiply (`vpmuludq`) — the compiled form of `mul32x32to64(a, b)`.
- [fn mulhi16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.mulhi16): Lane-wise SIGNED high-16 multiply (`vpmulhw`) — the compiled form of `mulhi16(a, b)`.
- [fn packus16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.packus16): Pack two `8×i16` vectors to `16×u8` with unsigned saturation (`packuswb`) — compiled `packus16(a, b)`.
- [fn rotl](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.rotl): Left rotation — the compiled form of `rotl(x, n)`. The amount is taken as `i64` (the type of a LOGOS `Int`) and reduced to the rotation width.
- [fn rotr](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.rotr): Right rotation — the compiled form of `rotr(x, n)`.
- [fn seq_of_lanes4](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.seq_of_lanes4): Unpack a `Lanes4Word64` into a Seq of 4 `Int` lanes — the compiled form of `seqOfLanes4(v)`.
- [fn seq_of_lanes8](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.seq_of_lanes8): Unpack a lane vector into a Seq of 8 `Word32` — the compiled form of `seqOfLanes8(v)`.
- [fn seq_of_lanes4w32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.seq_of_lanes4w32): The 4 lanes back as a `Seq of Word32` — compiled `seqOfLanes4W32(v)`.
- [fn seq_of_lanes16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.seq_of_lanes16): Unpack a `Lanes16Word16` into a Seq of 16 `Int` lanes (u16 bits) — `seqOfLanes16(v)`.
- [fn seq_of_lanes16w8](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.seq_of_lanes16w8): The 16 bytes back as a `Seq of Int` — compiled `seqOfLanes16W8(v)`.
- [fn sha1msg1](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.sha1msg1): `sha1msg1(a, b)` — message-schedule step 1. Lowers to `sha1msg1`.
- [fn sha1msg2](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.sha1msg2): `sha1msg2(a, b)` — message-schedule step 2. Lowers to `sha1msg2`.
- [fn sha1nexte](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.sha1nexte): `sha1nexte(a, b)` — fold the next round E. Lowers to `sha1nexte`.
- [fn sha1rnds4](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.sha1rnds4): `sha1rnds4(abcd, msg, func)` — four SHA-1 rounds. Lowers to the `sha1rnds4` instruction.
- [fn shr_bytes16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.shr_bytes16): Per-byte logical shift right — compiled `shrBytes16(v, n)`.
- [fn shuffle16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.shuffle16): Byte shuffle (`pshufb`) — compiled `shuffle16(table, idx)`.
- [fn splat4_word64](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.splat4_word64): `splat4Word64(x)` — broadcast one `Word64` into all four Keccak lanes (the ι round-constant XOR, and the all-ones vector for χ’s complement). The compiled form of the Logos builtin.
- [fn splat8_word32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.splat8_word32): Broadcast one `Word32` into all 8 lanes — the compiled form of `splat8Word32(x)` (a crypto kernel loads a shared constant/key word into every block’s lane this way).
- [fn splat16_word8](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.splat16_word8): Broadcast one byte into all 16 lanes — compiled `splat16Word8(x)`.
- [fn splat16_word16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.splat16_word16): Broadcast a `Word16`/`Int` into all 16 lanes — the compiled form of `splat16Word16(x)`.
- [fn word8](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word8): Construct a word from the low bits of an integer — the compiled form of `word32(x)` etc.
- [fn word16](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word16)
- [fn word32](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word32)
- [fn word64](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word64)
- [fn word32_shr](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word32_shr): `word32Shr(w, n)` — logical shift-right of a `Word32` by `n` bits (SHA-256’s `σ0`/`σ1` message schedule, where the shift is NOT a rotate — the vacated high bits are zero).
- [fn word64_and](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word64_and): `word64And(a, b)` — bitwise AND of two `Word64`s (Keccak χ’s `¬b ∧ c`, and byte masking).
- [fn word64_shl](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word64_shl): `word64Shl(w, n)` — logical shift-left of a `Word64` by `n` bits (Keccak lane byte-packing).
- [fn word64_shr](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word64_shr): `word64Shr(w, n)` — logical shift-right of a `Word64` by `n` bits (Keccak squeeze byte-extract).
- [fn word_and](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word_and): Bitwise AND/OR/NOT — the compiled form of `word_and`/`word_or`/`word_not`. Distinct from the `and`/`or` keywords (logical short-circuit) so word crypto written in LOGOS (the MD5/SHA-1 round functions) is bit-exact on every tier. Word8/16/32/64 impl these operators, so they lower to a single machine `and`/`or`/`not`; a lane vector lowers to the AVX2 vector form.
- [fn word_not](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word_not)
- [fn word_or](https://docs.logicaffeine.com/logicaffeine_system/word_rt/fn.word_or)