Nucleus Alpha 0.3: Pair two LAN computers

Use the full path to the downloaded bin/nucleus in place of nucleus below, unless it is already on PATH.


Use the same build on both computers. Replace the example owner IP with the owner's reachable RFC1918 IPv4 address. Transfer the three pairing documents through a trusted channel, such as a trusted local file transfer or removable drive. They contain enrollment capabilities; the CLI creates them with mode `0600`.

On **A, the fabric owner**:

```bash
nucleus init --name node-a
nucleus identity
nucleus invite --endpoint https://192.168.1.10:9461 --out invite.json
```

On **B**, after receiving `invite.json`:

```bash
nucleus init --name node-b
nucleus identity
nucleus join invite.json --out request.json
```

B is still unjoined. Return `request.json` to A. On **A**, inspect its signed identity and compare the printed node ID with B over the trusted channel before explicitly accepting:

```bash
nucleus inspect request.json
nucleus accept request.json --out grant.json
nucleus members
```

Return `grant.json` to **B**, which explicitly accepts its membership:

```bash
nucleus join --accept grant.json
nucleus identity
nucleus members
```

Both identities now share the same `fabric_id`. Private node keys and the owner's separate CA key never travel in pairing documents. An exact repeated acceptance can reproduce a lost grant; a different request cannot reuse the invitation.

On **A**:

```bash
nucleus run --listen 192.168.1.10:9461
# equivalently: zh fabric --listen 192.168.1.10:9461
```

On **B**:

```bash
nucleus run
# equivalently: zh fabric
```

Each command prints its own authenticated browser URL and tries to open it in a Chromium-compatible browser. Add `--no-open` to print the URL only. The UI always binds `127.0.0.1`, independently of the private node transport.

B makes outbound authenticated connections; it opens no LAN listener. The owner binds only the explicit private IP and port. Public addresses, wildcard addresses, DNS endpoints, proxies, redirects, and unauthenticated node requests are rejected. This is direct encrypted LAN transport; internet reachability, NAT traversal, and an IP overlay are later work.

### Acceptance

1. Both maps show A and B online with real resources.
2. Stop B with Ctrl+C. Within approximately 12 seconds, A marks it offline and removes its measurements from available capacity. The map labels retained samples as cached.
3. Restart B with `nucleus run`. It returns automatically without another invitation.
4. Restart A. Durable membership survives; remote capacity stays unavailable until a fresh authenticated heartbeat arrives.
5. Optionally revoke B on A with `nucleus revoke B_NODE_ID`. It immediately stops contributing capacity and cannot authenticate using its old certificate.

Available inventory is an observation, not a scheduler reservation or a promise of allocatable resources. WSL measurements describe the WSL VM. Two separate installations on one host are useful protocol tests and must not be counted as two physical computers.