nx_deploy_leash.nx

nx_deploy_leash.nx -- DEPLOYMENTS ON A LEASH (operator 2026-07-16: "owners take accountability... models loaded into resources and the owner walks away... someone should have our deployments on a leash, not just let them wander loose -- part of the RACI"). Every long-lived deployment (model seat, serve daemon, heavy holder) REGISTERS: accountable owner + purpose + pid + renewal TTL + its own STOP-PATH (a declared graceful kill-switch -- reclaim is never a blind kill). The leash is RENEWAL-BASED liveness of the OWNER'S USE (nx_watch beats on every use), NOT process liveness -- a seat daemon stays alive forever, so pid-checks can never catch walk-away. SOTA norm this matches: K8s lease renewal / SLURM walltime / Ray actor liveness -- resources held AGAINST RENEWAL. register <name> <owner> <purpose> <pid> <renew_ttl_ms> <stop_path> (also starts the leash clock) beat = nx_watch beat leash <name> (consumers beat on every USE; no new plumbing) walk supervisor's rounds: HEALTHY / ABANDONED(alive+stale-beat -> touch stop_path, mark RECLAIMED) / DEAD(pid gone). Exit = worst seen (0 none/healthy, 2 dead, 3 abandoned). status same scan, print-only (no reclaim actions). Store: knowledge/store/leash key d:<name> = "name|owner|purpose|pid|ttl_ms|stop_path|reg_us" (latest-wins), d:ids index under flock. Beat clock: knowledge/store/watch_leash via nx_watch. RACI: supervisor R (walks the leash) · pm A (owns the box) · conductor C · every workstream I. license_tier: ORIGINAL