nx_edge_refusal_lib.nx

nx_edge_refusal_lib.nx -- THE ONE RULER FOR "may this edge refusal advise a retry?", extracted 2026-09-04 so it can be GATED. The decision shipped the day before as three lines inline in nx_sites_daemon_v2's request loop, which made it correct and UNTESTABLE at the same time: a gate cannot import a top-level programme, so the only way to exercise it was to stand up a backend that accepts and then stays silent. ★A GUARD THAT HAS ONLY EVER BEEN ABSENT IS UNVERIFIED. One ruler, two consumers -- the daemon that emits the refusal and the gate that proves it -- so the two cannot disagree about what an unsafe method is. THE DEFECT IT ENCODES, MEASURED 2026-09-03. sd2_proxy_to returns <0 when the backend could not be CONNECTED to and 0 when the backend ACCEPTED the request and sent nothing inside the edge window. For an UNSAFE method that second case is not an unavailability at all: the request was taken, so the write may already have committed and the outcome is UNKNOWN. The edge nonetheless answered "Service Unavailable" with Retry-After, which is advice to perform the one action this estate has measured as corrupting -- an insert edit is not idempotent, so a blind retry double-applies. FOUR SPECIMENS IN ONE SESSION, all of which had ALREADY LANDED: a build that produced a 94320 B artifact, the promote that installed it, a debt add that committed, and an append that grew its file by exactly one row. THE DISCRIMINATOR IS THE REQUEST LINE'S FIRST BYTE, and it is exact rather than a header scan: no SAFE method begins with P or D. GET, HEAD, OPTIONS and TRACE start G, H, O, T. POST, PUT and PATCH all start P; DELETE starts D. CONNECT starts C and is unsafe too, but a proxy CONNECT never reaches this path, so it is deliberately NOT claimed here -- naming a case this code cannot see would be a false assurance. license_tier: ORIGINAL. Pure decision functions: no syscalls, no writes, no hw access (Rule 26).