nx_promote.nx

nx_promote.nx -- failover manifest-pointer swap. Per [[feedback-cell-immune-system-ransomware-judo-ddos-by-bit]]: "failover = manifest pointer flip = sub-second. Attacker's win requires PERSISTENCE; ephemeral content-addressed cells deny persistence by design." THE OPERATION: at any moment, a logical service is served by PRIMARY cell A. A backup cell B holds a chromatin replica of A's state. When A is compromised / freezes / OOMs, nx_promote: 1. Pauses A (substrate-level mark; integration layer enforces) 2. Restores B from its chromatin (if not already running) 3. Updates the service manifest pointer: PRIMARY = B 4. Logs the failover event with the trigger reason Caller drives WHEN (immune anomaly, operator request, scheduled drill). Substrate provides WHAT (the manifest-swap primitive). Composes: nx_chromatin -- B's state replica nx_immune -- A's COMPROMISED status triggers automatic promote nx_abortive -- A enters terminal state; B promotes alongside nx_xenocell -- the foreign agent that triggered failover is recorded as displaced_by in the journal entry nx_evict_journal -- failover event logged with reason nx_provenance_chain -- the swap is a transform; chain-logged V1 ships: - struct NxFailoverContract (primary cell_id + backup cell_id + trigger reason + ts of last swap) - swap operation atomic at this layer (caller's integration layer must ensure no in-flight ops at swap point) - is_primary predicate for downstream readers Gap list (V1 honest perf verdict): - sub-second SLA depends on chromatin freshness (V2 measures) - no automatic split-brain detection (two cells both claiming primary) -- caller's coordination layer responsibility - no rollback after failed promote (V2 adds health check post-promote with auto-rollback)