nx_intake_keep.nx

nx_intake_keep.nx -- keep the public intake route ALIVE, without touching the supervisor. THE PROBLEM. nx_site_intake_serve answers :8033 and every contact form on every generated site depends on it -- the meal pages literally suppress their forms when it stops answering. But it is NOT in nx_hostctl's guard list, and that list is COMPILED IN, so adding it means rebuilding and deploying the supervisor. WHY NOT JUST DEPLOY THE SUPERVISOR. Measured, not assumed: hostctl's source is unchanged since 2026-07-31, yet a fresh build differs from the live binary by +26,232 bytes -- so the delta is the TOOLCHAIN, not the source. Rebuilding the supervisor means shipping whatever nx_cc has become, and nx_cc had an escaped gate mutant land in it on 2026-08-06. A defect in a page is a page; a defect in the thing that respawns every daemon is the host. That trade is bad at any blast radius, so this takes the other road. THE OTHER ROAD. The tickless clock is ALREADY supervised by hostctl and dispatches from a DATA registry (knowledge/store/clockjobs-, added via nx_store_put, read-only to the clock). So supervision becomes a row, not a recompile -- the same "new capability is data" move the rest of this lane runs on. FAIL-SAFE BY CONSTRUCTION: it spawns ONLY when the port refuses a connection, so a healthy daemon is never disturbed and two keepers racing cannot produce two servers (the loser's bind fails and it exits). INSTRUMENTED SO A HEALTHY RUN IS STILL VISIBLE: spawns append to a log (rare, meaningful), while every successful check REWRITES a heartbeat file. A log alone would show zero rows on a healthy system and zero rows on a dead keeper -- indistinguishable. The heartbeat is what separates "nothing to do" from "not running". license_tier: ORIGINAL No hw writes (Rule 26).