nx_replyreserve_lib.nx

nx_replyreserve_lib.nx -- KILL THE reply_reserve_ms MAGIC NUMBER BY MEASURING IT (lane E, 2026-08-25). Function side; the CLI is nx_replyreserve.nx and the gate composes THIS in-process on planted buffers. THE NUMBER. knowledge/edge_window.conf carries `reply_reserve_ms 1000` and says so honestly in its own prose: "1000 is INHERITED from the compiled pair (TEA_EXEC_TIMEOUT_SYNC_MS = TEA_EDGE_WINDOW_MS - 1000), not measured", and it instructs the next reader to "RATCHET this row from the measured reply_ms p99 once samples exist, and replace this paragraph with the number and the date you measured it." This organ is that instruction made mechanical. NOT A SECOND RULER. The quantile machinery is nx_loadceil_lib (lc_recommend_kv), the calibrator that already kills the build-admission load ceiling the same way. This file adds only what is specific to the reply reserve: which key, which filter, the derivation, the refusals, and the conf rewrite. THE DERIVATION, and why each step exists rather than being a number someone liked: scaled = quantile(q) * margin_permil / 1000 -- headroom for load the sample did not see. floor 1 = never below the worst reply ACTUALLY WITNESSED. A reserve smaller than a reply we have already measured is a reserve that has already failed once. floor 2 = never below replyreserve-floor-ms. Every sample so far reads 0 or 1 ms, i.e. AT OR BELOW the stamp resolution -- "0" here means "under 1 ms", not "no time". Deriving 0 from that would be an artifact of the instrument, not a measurement, and 0 makes tea_sync_promote_ms degenerate. refuse = a derived reserve <=0, >= the window, or above replyreserve-max-permil-of-window is REFUSED and the current value is KEPT. Beyond that envelope the reserve is no longer protecting the reply, it is materially shortening the inline budget -- an operator decision, not a calibrator's. This mirrors tea_sync_promote_ms, which already fails safe when the reserve swallows the window (d <= 0 -> d = w). The cost asymmetry is why the safe direction is UP: over-reserving spends R ms of a 15000 ms window; under-reserving truncates a reply mid-write, which is the defect the sync lane was rebuilt to remove. ABSTAIN LOUDLY. Below replyreserve-min-samples it returns INSUFFICIENT and changes nothing. That is the live state on the day this shipped (8 samples), and the abstention prints its own numbers -- an axis that goes quiet is indistinguishable from an axis that is fine. license_tier: ORIGINAL