host-persist: durable storage adapter for persist/* ops + acceptance

Sx_persist_store services every persist/* IO op against on-disk storage
(append-only log + separate monotonic .seq high-water + per-key kv files,
SX-serialized). Wired into the (eval) suspension loop, cek_run_with_io
bridge, and in-process _cek_io_resolver. Data-loss repro now (3 3 3).
New persist_durable_test.sh: durable + monotonic-seq + streams + kv +
real process restart all green (5/5).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

plans/persist-on-sx.md

@@ -197,6 +197,20 @@ durable backend. Other subsystem loops copy this pattern; it does not touch the
 real `lib/acl`.
 
 ## Progress log
+- **Host durable-storage adapter — durable+recovery LIVE (5/5 acceptance).**
+  `hosts/ocaml/lib/sx_persist_store.ml` services every `persist/*` IO op against
+  real on-disk storage (append-only log + separate monotonic `.seq` high-water
+  per stream + per-key kv files; SX-serialized, structurally round-tripping).
+  Wired into all three kernel IO sites in `hosts/ocaml/bin/sx_server.ml`: the
+  `(eval ...)` suspension loop (was the silent-no-op), the `cek_run_with_io`
+  bridge, and the in-process `_cek_io_resolver`. The spec's data-loss repro now
+  returns `(3 3 3)` instead of `(1 0 nil)`. `last-seq` climbs across `truncate`;
+  `streams` survives compaction. New `hosts/ocaml/test/persist_durable_test.sh`
+  drives `persist/durable-backend` (REAL `perform`) under the worktree binary —
+  durable, monotonic-seq, streams, kv, and a **real process restart** (write,
+  exit, fresh process, replay from `$SX_PERSIST_DIR`) all green. Existing mock
+  suites unaffected (durable 15/0, recovery 6/0 against worktree binary).
+  Remaining: blob adapter (`blob/put|get|has?`).
 - **Reference migration: acl grants (201/201).** `lib/persist/examples/acl.sx` —
   a worked, in-scope template migrating an ACL-grants store from a hand-rolled
   ephemeral map to persist: grants/revokes as events, current set as a
@@ -309,11 +323,20 @@ real `lib/acl`.
 
 ## Blockers
 
-### OPEN — host durable-storage adapter (the only gap to real durability)
+### IN PROGRESS — host durable-storage adapter (the only gap to real durability)
 
-**Owner:** a `hosts/` loop (NOT this one — `lib/persist/**` is the scope fence,
-and `sx_build` is forbidden here). **Without it, durable persistence silently
-drops all writes.**
+**Owner:** the `loops/host-persist` loop (`hosts/**` scope; `lib/persist/**` is
+its contract, not its code).
+
+**Status (2026-06-06):** durable `persist/*` ops DONE — implemented in
+`hosts/ocaml/lib/sx_persist_store.ml`, wired into all three IO sites of
+`hosts/ocaml/bin/sx_server.ml`, acceptance + real-restart recovery green
+(`hosts/ocaml/test/persist_durable_test.sh`, 5/5). The silent-data-loss repro
+below now returns the correct values. **Remaining before CLOSED:** the blob
+adapter (`blob/put|get|has?`, see "Blobs" below). Original spec retained for
+reference.
+
+**Without it, durable persistence silently drops all writes.**
 
 **Symptom / minimal repro.** `persist/durable-backend` performs
 `{:op "persist/..." :args (...)}` for every storage op. Under `sx_server.exe`