nx_toolcall_idem_candidate_t190.nx

nx_toolcall_idem_lib.nx -- IDEMPOTENCY KEYS ON tools/call (/compare/dataio DI4 `ta_idempotency_key`, 2026-09-05). WHY: every seat's write to the estate crosses ONE transport, and that transport answers "Outcome Unknown" whenever the backend accepted a request and produced no reply inside the edge window. MEASURED the day this landed: nine such replies in one seat session, each adjudicated by hand by re-reading the artifact, and two verb shapes with NO safe retry at all (a self-anchored insert applies twice; an append has no anchor to lose). The field's answer is the IETF Idempotency-Key: the caller names the request, the server records the FIRST outcome under that name, and a retry carrying the same name is REPLAYED, never re-executed. Done sovereign, on the lane every seat already uses: params._idem = "<token>" (a sibling of _cap and _async; absent = the call behaves exactly as before) THE OUTCOME IS RESERVED BEFORE IT IS EXECUTED. A key is claimed with O_EXCL on <dir>/idem_<digest>.claim -- the same primitive the job lane reserves ids with -- so two racing calls under one key cannot both execute: the loser reads IN-FLIGHT. The first APPLIED outcome is then recorded in the estate's append-only ledger (nx_apistack_idempotency: first-write-wins, read whole) as ONE line: lane=async|promote tool=<t> job=<id> the job id is the outcome; the caller polls it like any JOB-STARTED lane=sync|http tool=<t> exit=<ec> bytes=<n> out=<dir>/idem_<digest>.out the bytes are kept so the replay is the same text HONESTY LIMITS, stated: a claim whose holder died before recording (the daemon killed between reserve and record) reads IN-FLIGHT for as long as the claim exists; the reply names the claim's age so the caller can adjudicate the artifact -- today's situation, but confined to that one window instead of every call. A refused or harness-failed run RELEASES its claim: nothing was applied, so a retry must be judged afresh (the same rule nx_fsops_write keeps). Every path is parameterised by (ledger, dir) so the gate drives it on /tmp fixtures; the API passes the consts. license_tier: ORIGINAL No hw writes (Rule 26).