nx_edge_refusal_lib.nx source
↩ module page · 42 lines · 3022 B
1// nx_edge_refusal_lib.nx -- THE ONE RULER FOR "may this edge refusal advise a retry?", extracted 2026-09-04
2// so it can be GATED. The decision shipped the day before as three lines inline in nx_sites_daemon_v2's
3// request loop, which made it correct and UNTESTABLE at the same time: a gate cannot import a top-level
4// programme, so the only way to exercise it was to stand up a backend that accepts and then stays silent.
5// ★A GUARD THAT HAS ONLY EVER BEEN ABSENT IS UNVERIFIED. One ruler, two consumers -- the daemon that emits
6// the refusal and the gate that proves it -- so the two cannot disagree about what an unsafe method is.
7//
8// THE DEFECT IT ENCODES, MEASURED 2026-09-03. sd2_proxy_to returns <0 when the backend could not be
9// CONNECTED to and 0 when the backend ACCEPTED the request and sent nothing inside the edge window. For an
10// UNSAFE method that second case is not an unavailability at all: the request was taken, so the write may
11// already have committed and the outcome is UNKNOWN. The edge nonetheless answered "Service Unavailable"
12// with Retry-After, which is advice to perform the one action this estate has measured as corrupting --
13// an insert edit is not idempotent, so a blind retry double-applies. FOUR SPECIMENS IN ONE SESSION, all
14// of which had ALREADY LANDED: a build that produced a 94320 B artifact, the promote that installed it, a
15// debt add that committed, and an append that grew its file by exactly one row.
16//
17// THE DISCRIMINATOR IS THE REQUEST LINE'S FIRST BYTE, and it is exact rather than a header scan: no SAFE
18// method begins with P or D. GET, HEAD, OPTIONS and TRACE start G, H, O, T. POST, PUT and PATCH all start
19// P; DELETE starts D. CONNECT starts C and is unsafe too, but a proxy CONNECT never reaches this path, so
20// it is deliberately NOT claimed here -- naming a case this code cannot see would be a false assurance.
21// license_tier: ORIGINAL. Pure decision functions: no syscalls, no writes, no hw access (Rule 26).
22
23const ER_METH_P: i64 = 80
24const ER_METH_D: i64 = 68
25const ER_PROXY_ACCEPTED_THEN_SILENT: i64 = 0
26
27// 1 iff the request line names an UNSAFE method, i.e. one whose replay can change server state.
28// Takes the plaintext request buffer; the method is its first token, so only byte 0 is consulted.
29func er_unsafe_method(plain: *u8) -> i64 {
30 if plain[0] == (ER_METH_P as u8) { return 1 }
31 if plain[0] == (ER_METH_D as u8) { return 1 }
32 return 0
33}
34
35// 1 iff this refusal must NOT advise a retry: the backend ACCEPTED an unsafe request and then said nothing,
36// so the outcome is UNKNOWN rather than unavailable. pbr is sd2_proxy_to's return: <0 could-not-connect,
37// 0 accepted-then-silent, >0 a real body. Only the 0 case can leave a write in an unknown state, so the
38// connect and deadline arms are excluded by the equality rather than by a second test that could drift.
39func er_read_after_accept(plain: *u8, pbr: i64) -> i64 {
40 if pbr != ER_PROXY_ACCEPTED_THEN_SILENT { return 0 }
41 return er_unsafe_method(plain)
42}