stzAppBackend

(no comment in the source: the name reads as a sentence) initno extension

Materialise every dataset of the model as a real sqlite table (seeded with the model's rows), expose each for REST CRUD, and bind the host. nPortNum 0 = ephemeral. After this, the state is LIVE: it no longer lives in the model, it lives in the database the parts share.no extension

LEAVING THE LOOPBACK REQUIRES A KEY. On 127.0.0.1 the callers are this machine; on a real interface they are whoever can route to the port, and an unauthenticated MBaaS floor would take a POST from any of them. So a non-loopback bind without SetSigningKey() is REFUSED here rather than quietly exposed -- governed by construction, not by a later audit finding.no extension

The interface this backend is bound to (host mode).no extension

Serve the backend to whoever connects, for nMs. This is what a HOSTING process runs after Start(): the loop that answers remote parts. (A local backend never needs it -- it pumps one event per crossing instead.)no extension

Attach to a backend ALREADY RUNNING somewhere else. No database and no server are created here -- this object becomes a pure client, and every part-scoped call below goes over the wire instead of over the loopback.no extension

The shared secret that authenticates the crossing. Set it on BOTH sides: the HOST uses it to require a signature, the CLIENT to produce one. It is the same secret, so this one call serves both roles -- which is also why a real deployment must deliver it out of band (env, vault, stzSecretStore), never in the model file or the command line.QCSXTZZZIBWU

(no comment in the source: the name reads as a sentence) is signedin the section remote mode: a backend in another hostno extension

(no comment in the source: the name reads as a sentence) set max skewin the section remote mode: a backend in another hostQCSXTZZZIBWU

The HTTP status of the last crossing, either mode (0 = it never completed). 401 here means the far side refused the signature.no extension

(no comment in the source: the name reads as a sentence) is remotein the section remote mode: a backend in another hostno extension

(no comment in the source: the name reads as a sentence) endpointin the section remote mode: a backend in another hostno extension

Is the far backend actually answering? (stzAppServer serves /health with no route declared, so this needs nothing from the model.)no extension

Launch this model as a backend PROCESS of its own and return its endpoint. The child gets the serialised model + port + TTL on its command line, and self-terminates when the TTL expires (so a forgotten host cannot outlive the run). The spawning reactor is owned by THIS object, so the child's lifetime is tied to something the caller holds.no extension

The secret is handed over in the ENVIRONMENT (STZ_BACKEND_SECRET), not in argv -- see _GenerateHostScript.no extension

THE SECRET IS NEVER IN THE COMMAND. argv is world-readable in the remote process table, so the launch line only NAMES the environment variable; the value must already be in the remote environment (deploy it from a vault or stzSecretStore out of band). A backend that leaks its own key while starting has authenticated nothing.no extension

A legible account of what a remote launch would do, and what it needs.no extension

Point this client at a different address for the SAME backend -- e.g. a host bound to 0.0.0.0 that another machine reaches at a routable IP.QCSXTZZZIBWU

Wait until the spawned host answers /health (it must load stzBase and bind first). Returns TRUE once it does.no extension

(no comment in the source: the name reads as a sentence) stopin the section remote mode: a backend in another hostno extension

(no comment in the source: the name reads as a sentence) is livein the section remote mode: a backend in another hostno extension

(no comment in the source: the name reads as a sentence) portin the section remote mode: a backend in another hostno extension

(no comment in the source: the name reads as a sentence) namein the section remote mode: a backend in another hostno extension

A part WRITES: a real HTTP POST to the running backend, which the MBaaS floor turns into a sqlite INSERT. Returns TRUE on 201. paFields: [ [ "dish", "Couscous" ], [ "qty", 2 ] ]no extension

A part READS: a real HTTP GET. Returns [ [ cell, cell ], ... ].no extension

the parts' view of the live stateno extension

The part's dashboard, computed over LIVE rows fetched from the running backend -- the SAME aggregation the static model runs (stzTable SumCol / MaxColumn: the part's declared :PivotTable), but over state another part may have written a moment ago. Returns [ rows, total, topDish, topRev ].no extension

Bind the acting actor: cross-part WRITES then require an effectful one (an LLMActor reads the whole solution and commits none of it). Reads are sensing and stay open. Unbound = ungoverned (dev).QCSXTZZZIBWU

governance + cross-part auditno extension

[ [ part, verb, dataset, status, durMs ], ... ] -- every crossing, in order, WITH its cost (perf P3): the ledger now answers not just what crossed and how it ended, but what it took.no extension

The duration of the last crossing (ms, monotonic clock) -- the marshalling cost of one Create/Rows/RowCount, either mode.no extension

governance + cross-part auditno extension

Mean crossing cost over the whole ledger (refusals, at 0 ms, excluded -- they never crossed).no extension

governance + cross-part auditno extension

the crossings a given part madeno extension

governance + cross-part auditno extension

a legible account of the live backend (a list of lines, per the plane's Explain() convention).no extension

governance + cross-part auditno extension

Cells carry their TYPE (n/s) rather than being sniffed on the way back in: a price must stay a NUMBER for the revenue maths, and "looks numeric" is exactly how "007" silently becomes 7 -- a defect this library already paid for once in the CSV reader. Fields are percent-escaped .no extension