nx_portdup.nx

nx_portdup.nx -- detect the WRONG-ANSWER MACHINE: two daemons LISTENING on one port (seq1785450532). WHAT IT CATCHES, and why nothing else did. On 2026-07-30 both nx_mgmt_api AND nx_opaque_login were LISTENING on 127.0.0.1:18098 at the same time. The kernel hands each connection to whichever accepts first, so a VALID control-plane route answered `404 no such route` on some requests and worked on others. Every component was individually healthy -- correct binary, correct source, listener present, health OK -- so the fault was filed for MONTHS as a "transport flake" and blamed on the edge. It was two listeners. The banked fd-scrub note predicted the successor would fail to BIND (EADDRINUSE); the reality is worse, because BOTH hold the socket and there is NO ERROR ANYWHERE to find. WHY A DEDICATED TOOTH: liveness ("is it up?") and health ("does it answer?") are both TRUE during this fault -- the squatter answers, just wrongly. Only the SHAPE of the listen table shows it, and nothing in the ecosystem looked at that shape. FALSE-POSITIVE DISCIPLINE (this is why it is a watch list, not a sweep of every port): DSM legitimately runs SO_REUSEPORT worker pools -- :443, :5000, :5001 each show EIGHT holders by design, and the sovereign edge deliberately co-binds :443 alongside DSM's nginx (a known, accepted arrangement). Flagging those would train the operator to ignore this tooth, so it reports ONLY on ports declared as single-owner in knowledge/portdup_watch.conf. A port not on the list is never judged. nx_portdup check [watchconf] -- exit 1 if any WATCHED port has more than one LISTEN holder nx_portdup list [watchconf] -- holder count for every watched port (no verdict) license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0