DX1: a usable C ABI, the CLI, and the names we publish under #12

Lands with M1. The C ABI stops being a skeleton and starts being usable, the CLI exists so there is something to type before any binding ships, and the names everything will publish under get reserved while they are still free.

Scope

• The six handle types, real, over the M1 engine
• yo_iter_next_batch with BATCH_MAX of 64, and the _many forms on every single-key read
• yo_iter_age_us and YO_ERR_EPOCH_STALLED, so a slow iterator is a diagnosable error and not a memory leak
• yo-c: YO_STR, YO_TRY, cleanup attributes, the things that make the C surface bearable
• libyo_debug with assertion-heavy builds
• yo CLI: open, get, set, check, dump
• The single documented callback shape, used everywhere a callback is needed

Name reservation

New in dx/16-name-reservation.md, and it moves here from DX8 deliberately: a name is first-come, free to take, and unrecoverable once someone else has it. Discovering the problem at M9 is a rename across an engine, eleven repositories, a docs site and every install one-liner anyone ever posted.

• Register tamnd.dev, point yo.tamnd.dev at the docs host. This is a blocker: dx/01 section 6 requires every error message URL to resolve, CI-checked, and the domain does not currently exist
• Create tamnd/yo-swift, tamnd/yo-dart, tamnd/homebrew-tap, tamnd/scoop-bucket
• Register the publishing identity on every registry in dx/16 section 7, 2FA everywhere
• Take the namespaces, which outlast this project: com.tamnd on Maven Central, Tamnd.* on NuGet, @tamnd and @yodb on npm, tamnd on Docker Hub, the tamnd.com verified publisher on pub.dev
• names.toml beside clients.toml, and dx/12 section 2's name table generated from it
• xtask reserve with audit / plan / apply / verify; idempotent, redacting, one registry per invocation by default
• Publish the 0.0.0 placeholders under the policy in dx/16 section 6 — honest, minimal, buildable, superseded within the milestone track. Not squatting, and the difference is written down
• Configure trusted publishing (OIDC) at the moment of the first publish, which is the cheapest moment to bind publisher to repository
• xtask reserve verify weekly in CI and in the release train

Two open questions this closes

1. npm yodb is a tombstone. The registry returns 200 with an empty versions map: versions 0.0.1-0.0.7 published December 2019 and fully unpublished 2020-07-16, no maintainers, no repository. Probe with a 0.0.0 publish; if refused, file a support request; if that stalls, the name becomes @yodb/core and dx/12 section 2 records the exception rather than quietly keeping the claim.
2. tamnd.dev is not registered (tamnd.com is, on Cloudflare, since 2026-05-12). Register the .dev and no string in the spec changes; move to yo.tamnd.com and it touches dx/12, 17, every crate's homepage and every URL in the error catalogue.

Credentials live in ~/data/.env at mode 600, at the identity level and not the project level, using each tool's own environment variable name (CARGO_REGISTRY_TOKEN, NPM_TOKEN, GEM_HOST_API_KEY) so no project needs a translation layer. dx/16 section 8.

Exit

The C 60-second snippet in dx/09 section 1 compiles and runs as written, in 24 lines or fewer, and is run by CI as part of the snippet check.

xtask reserve audit shows no row in state free for any primary name. yo.tamnd.dev resolves, so the error-URL check can pass.

Reference: dx/02-c-abi.md, dx/09-c-and-tier3.md, dx/11-cli-and-shell.md, dx/16-name-reservation.md.