nx_hostctl.nx

nx_hostctl.nx -- the PURE-NISHI host control plane (operator: "no .sh or any non nishi stuff in the mix... pure enterprise S-class hosting and deployment"). Retires nishi_supervisor.sh. Two subcommands, argv-driven, all via sovereign syscalls -- NO shell, NO cp/mv/pkill: supervise : fork/execve the sites daemon, record its PID, wait4; respawn on death (crash OR deploy-kill). deploy : atomically publish the staged *.new artifacts (sys_renameat), +x the new binary (nx_chmod), then nx_kill the running daemon -> supervise respawns the NEW binary. Brief restart only (FD-passing/SCM_RIGHTS is the future zero-downtime rung). CONTENT hot-update needs NO deploy: the router serves the doc-root file per request, so pushing index.html is live next request. selftest : LOCAL Engineer gate of the deploy primitives (atomic rename + pidfile + kill) -- no NAS. license_tier: ORIGINAL SUPERVISION UPGRADE 2026-06-16 (closes hosting_research gaps #5 health-probe + #4 restart-loop-guard): cmd_supervise no longer trusts PID-liveness alone. For PLAINTEXT daemons it BLACK-BOX health-probes the port (nx_health_probe) and restarts a HUNG daemon (process up + bound but not serving) -- the failure systemd PID-liveness and a LISTEN check both miss. Every restart (crash OR hang) is gated by the crash-loop guard (nx_restart_guard) so a daemon that keeps dying/wedging backs off instead of spinning. The TLS daemon (sites.elf:8443) stays PID-only -- a plaintext GET to a TLS port would false-HUNG; a TLS-aware serving probe is the next rung (noted, not faked).