nx_ts_slot_lib.nx

nx_ts_slot_lib.nx -- TS3: THE SLOT-FLIP DECISION CORE (importable, no main). /compare/trafficsafety rung TS3. Two backend SLOTS on two ports behind one small front door that owns the upstream choice and is independent of both. Accept rule taken VERBATIM from trafficsafety.plan: "a flip changes which slot answers with zero failed requests across the flip, a slot that fails its warm-up probe is NEVER flipped to, and the front door's own uptime is unbroken across the whole exercise." IT DOES NOT TOUCH sites.elf OR nx_proxy_route, AND THAT IS A DESIGN DECISION, NOT AN OMISSION. The live front door is what all 69 route rows cross; editing it to gain a deploy-safety property is the one change whose blast radius is every request in the estate. So this ships as a STANDALONE router that fronts one non-critical backend. The pattern is identical and provable; adopting it for the estate's real front door is an operator decision that should be taken against this evidence, not smuggled in beneath it. THE FRONT DOOR IS THE ONLY THING THAT MUST NEVER RESTART, so it is also the only thing that must be replaceable without a gap -- and that is precisely why TS3 depends on TS1. This router takes its own listener from ts_handoff_nodrop, so the component whose restart would be an outage is itself hot-replaceable. A front door that cannot be replaced hitlessly is refused rather than deployed; this one closes that dependency in its own first line of work rather than deferring it. THE UPSTREAM CHOICE IS DATA, NOT A RECOMPILED BRANCH. The active slot lives in a conf file read through rm_conf -- the estate's line-anchored reader, not a second one -- and it is re-read PER CONNECTION. So a flip takes effect on the very next request with no signal, no restart and no reload race, and the router holds no cached routing state that could disagree with the file. A FLIP IS GUARDED BY A WARM-UP PROBE AND THE GUARD FAILS TOWARD DOING NOTHING. ts_slot_flip probes the CANDIDATE before it writes, and on a cold candidate it leaves the active slot exactly where it was and returns a NAMED refusal. A heuristic that gates a destructive action must be wrong in the direction of doing nothing, and flipping traffic onto a dead slot is the destructive action here. SCOPE OF THE PROBE, STATED RATHER THAN IMPLIED: it establishes that the candidate ACCEPTS A CONNECTION AND ANSWERS BYTES. That is liveness, not health. The estate already owns the deeper instrument -- nx_http_probe_lib's hp_run, with thirteen distinct exit codes so a compound health assertion cannot fail without naming WHICH half failed -- and the honest upgrade path is to compose that, never to re-implement a second probe here. license_tier: ORIGINAL No hw writes (Rule 26).