nx_adnet_recbeat.nx

nx_adnet_recbeat.nx -- THE BEAT: refresh campaign spend (field 7) from the measured journals. nx_adnet_reconcile is a PURE transform with no IO so it stays gateable; this is the thin runner that owns the dangerous half -- reading the confs and replacing a live file. Keeping that in one small, reviewable organ is the point of the split. ★ ATOMIC BY CONSTRUCTION: write a temp beside the target, then rename. A half-written campaign conf is a serving outage -- every paid campaign would read as malformed and stop serving at once. rename(2) on the same filesystem is the only step that touches the live path. ★ NEVER-BRICK: the previous conf is banked as .prev before the swap, and EVERY refusal below leaves the live file byte-untouched. An absent campaigns conf is NOT an error -- it means no paid campaigns yet, and the beat exits 0 having done nothing. ★ FAIL-LOUD ON A SHRINKING CONF: if the refreshed output is materially smaller than the input, something was dropped and we REFUSE to install it. A reconciler that silently truncates the file it maintains is the worst outcome here, so the size check is a hard gate rather than a warning. run: nx_adnet_recbeat (paths are compiled in; no argv, so a cron row cannot mis-target it) expect_exit: 0 license_tier: ORIGINAL