nx_cronwatch_put.nx

nx_cronwatch_put.nx -- THE MISSING PRODUCER for the cron dead-man's-switch registry (2026-08-15). WHY THIS EXISTS. nx_cron_watch is the estate's dead-man's switch: every scheduled job pings by leaving a `ts=<epoch>` in its own evidence log, and a check-in missed beyond grace reports STALE. Its manifest moved to the seg-store plane knowledge/store/cronwatch- -- and NOTHING COULD WRITE IT. nx_store_put projects its own row shape onto a foreign grammar (the exact hazard nx_clockjob was built for on the clock plane, where a half-written row still sits in the live registry with no name at all, skipped by the dispatcher on every window). A RECONCILER WITH NO PRODUCER IS A CONSUMER WITH NOTHING TO CONSUME, and THE ABSENCE OF A SANCTIONED WRITER DOES NOT STOP WRITES -- IT ONLY MAKES THEM MALFORMED. nx_cronwatch_put put <name> <heartbeat-file> <ts-marker> <max-age-secs> <remediation> nx_cronwatch_put selftest Grammar is EXACTLY nx_cron_watch's: name<TAB>heartbeat-file<TAB>ts-marker<TAB>max-age<TAB>remediation. Validated at the boundary so a malformed row never reaches the plane, because a consumer can only SKIP a bad row after the fact. MAX-AGE IS NOT A NUMBER TO GUESS. It is expected-interval + grace, and the caller derives it from the interval it registered on the clock. interval + interval/4 is the recommended shape: it absorbs scheduler jitter while still catching the FIRST missed fire, because a single miss puts age at two intervals which is already past the bound. This organ does not invent it -- it refuses a non-positive one and records what it was given. TWO GUARDS THIS ORGAN HAS THAT ITS CLOCK-PLANE SIBLING DOES NOT, both earned from the same law -- A DETECTOR WITH FALSE POSITIVES IS WORSE THAN NONE, BECAUSE IT TEACHES EVERYONE TO IGNORE IT: 1. the heartbeat file must EXIST, and 2. the ts-marker must be FINDABLE IN IT RIGHT NOW. A watch declared over a missing file, or over a marker that never appears, reports STALE from the moment it is written and never stops. That is not a dead-man's switch, it is a stuck alarm, and it is worse than no watch at all because it trains the reader to skip the whole board. ONE SUBJECT PER ROW: a duplicate name is refused. Two rows for one job means the check reports whichever it happened to read, which is a race wearing a registry's clothes. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0