QuietSwitch

1 · Arm a switch

The page, the rule, the successor and the number of consecutive misses are all fixed here, by you. Nothing about the firing condition can be chosen later — not by the successor, and not by an administrator: this contract has no owner, so only you can disarm or rearm your switch.

Demo pages: fresh check-instale check-in

The minimum time between two accepted checks. The first check waits this long after arming and every later one waits this long after the previous accepted check, so nobody can hurry a handover by calling check repeatedly or by straddling a boundary. 2 misses therefore take at least 2 full intervals — and a transient outage needs one more, because the first is only noted.

2 · What a check decides

• proof of life the page states a check-in that satisfies the rule: the miss counter resets to zero.
• missed the page exists but does not satisfy the rule — a stale date, a placeholder, an error message.
• outage noted the first unreachable observation is recorded without counting: a two-minute blip is not silence.
• heartbeat unreadable gone or empty. A heartbeat nobody can read is not a heartbeat, so it counts as silence — with the reason recorded.
• fired enough consecutive misses: the successor becomes the holder and the handover note is theirs.

Firing takes something away from the current holder, so the fail-safe direction is the opposite of a monitor: a malformed model answer, a model error or a consensus failure reverts the transaction. Not even a miss is recorded when the pipeline misbehaves — and a check that arrives before the interval has elapsed reverts before the page is even fetched, so the same outage cannot be replayed into extra misses.