nx_swarm_beat.nx

nx_swarm_beat.nx -- SWARM FABRIC fleet-beat store (SF-R1b): every worker reports its beacon NODE row here; the hub reads back a fresh fleet snapshot. This is deliberately its OWN small organ per [[feedback-no-risky-inplace-mgmt-api-deploy]] (NEVER bolt telemetry onto mgmt/hostctl) -- NAS-side it runs via the pinned tools/call lane; nx_node_beacon (v2) emits the row, this organ stores it, a later mgmt train may READ the snapshot (read-only swap of the hardcoded workers literal). nx_swarm_beat put <log> <snap> "<NODE row>" -- validate row; flock'd append to <log> (fa_append, the R0b torn-write floor); atomically replace-by-name in <snap> (whole-file rewrite, tmp+renameat) nx_swarm_beat put "<NODE row>" -- NAS tools/call form: default paths swarm_beats.log + node_rows.snap in CWD (tools daemon CWD = nishihost) nx_swarm_beat show <snap> <window_sec> -- print FRESH/STALE per row (ts vs wall clock; the window comes from the CALLER/conf -- no baked freshness constant, rule 11) nx_swarm_beat show <window_sec> -- default snap node_rows.snap PATH LAW (least-authority BY CONSTRUCTION -- a leaked cap must not clobber nishihost binaries): CLI paths must end .log/.snap, contain no "..", and be either bare basenames (land in CWD) or live under /tmp/ (local tests). Everything else -> REFUSED before any io. nx_swarm_beat [gate] -- self-gate: put/replace/show + neg-controls + the fabricated-liveness liar-killer (an ancient or future-forged ts can NEVER read FRESH) Row contract (v2 positional, additive -- emitted by nx_node_beacon): NODE <name> <cpu> <load> <ncpu> <lpc> <memu> <mema> <memt> <conns> <ts_us> <temp_mc> <batt_pct> v1 HONEST LIMIT: two DIFFERENT nodes putting at the same instant can lose one snap rewrite (last-writer-wins whole-file); periodic beats self-heal next cycle and the LOG never loses a row (flock'd). Serialize the rewrite under a lock file = v1.1 if beats ever collide in practice. license_tier: ORIGINAL expect_exit:0