nx_apistack_idempotency.nx

Retained idempotency evidence. Sequential replay is not an exactly-once transaction: mutation and journal commit remain separate. Missing or malformed evidence is not NEW. THE READ LOCK IS SHARED (2026-09-16, debt 1789503583). A reader used to take LOCK_EX|LOCK_NB, so a concurrent reader, or the recorder inside its one append+fsync, made every keyed tools/call fail closed as EVIDENCE_UNAVAILABLE and the tools API could not be re-shipped from this tree. Readers now take LOCK_SH and wait: a recorder holds LOCK_EX for exactly one append and one fsync, and flock releases on death, so the wait is bounded by one write and is never held by another reader. Blocking is chosen over a retry budget on purpose: a budget is a magic number that fails closed under exactly the load that makes the wait long, and the old immediate refusal WAS the defect. MALFORMED ROWS ARE QUARANTINED, NOT POISONOUS (same day). One row with a CR, a NUL, two TABs, no TAB, or a torn tail used to refuse the whole ledger for every key. A malformed row is now skipped and COUNTED (r.quarantined, with the first bad line in r.first_bad_line, both handed out by id_lookup_q) -- EXCEPT when its key field is the key being looked up: evidence about the sought key that cannot be read is not NEW, so that one lookup still fails closed (EBADMSG) exactly as before. A torn last row (no trailing newline) is a torn append and is judged by the same rule.