fix(simulation): PR #176 review round — all 12 findings + 2 recommendations addressed

H1 demux: ShapeProbe defensive multi-shape rejection (union frames now Err, not first-match; +2 tests) and doc claim made honest. H2/T1 SystemIndex.reset_test_state() folded into SimBridge.reset_test_state() (load() inline per autoload rule) + has_pending_request() accessor. H3 no-op tests now assert the replay flag both directions. H4 retry test actually ingests a failure and asserts the retry semantic. H5 error fixture uses the normalized status string. H6 bridge_tcp e2e sends all five frame shapes over real TCP (star-map + city-names buffers asserted). H7 positive replay-on-CONNECTED test via the test_local_bridge test-mode-flip precedent (stub bridge captures + decodes the request bytes). H8/T2 stale PLACEHOLDER doc replaced with the confirmed contract. H9 is_capital doc matches the COALESCE reality. T-r1 demux ceiling written down (next shape = tagged envelope). T-r2 AtlasLayerResponse governance ceiling comment. Lead item: the four cargo-fmt-formatted files from the gate round are now committed (layer_proxy/plugin/bridge-mod/main). H10 note for the record: the 13 snapshot_*.msgpack fixtures in commit 845737617 were regenerated because they were stale against their own generator (pre-existing version-key removal) — verified harmless, no client reads that key.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

client/tests/test_system_index.gd

@@ -99,14 +99,23 @@ func test_ingest_ignores_non_ready_status() -> void:
 
 
 func test_request_refresh_retries_after_a_failed_ingest() -> void:
-	# request_refresh() is a no-op in test mode either way (SimBridge has no
-	# live connection), so this only proves the _requested/_loaded bookkeeping
-	# doesn't get stuck: a failed ingest must clear _requested so a later
-	# request_refresh() is willing to ask again (not just silently no-op
-	# forever because a prior request was already "in flight").
-	SystemIndex.ingest({"status": "Ready", "nodes": [{"system_id": "GJ 1"}]})
-	assert_bool(SystemIndex.is_loaded()).is_true()
-	SystemIndex.request_refresh()  # no-op — already loaded
+	# The retry semantic itself (review H4): a failed ingest must clear the
+	# in-flight flag so a later request_refresh() actually asks again — not
+	# silently no-op forever because a prior request was "in flight".
+	SystemIndex.reset_test_state()
+	SystemIndex.request_refresh()
+	assert_bool(SystemIndex.has_pending_request()).is_true()
+	assert_bool(SystemIndex.is_loaded()).is_false()
+	# A failed fetch arrives: stays unloaded, and the in-flight flag clears...
+	SystemIndex.ingest({"status": "Error", "error": "db unavailable", "nodes": []})
+	assert_bool(SystemIndex.has_pending_request()).override_failure_message(
+		"a failed ingest must clear _requested so a later refresh can retry"
+	).is_false()
+	assert_bool(SystemIndex.is_loaded()).is_false()
+	# ...so a retry genuinely re-requests instead of no-opping.
+	SystemIndex.request_refresh()
+	assert_bool(SystemIndex.has_pending_request()).is_true()
+	SystemIndex.reset_test_state()
 
 
 func test_request_refresh_does_not_crash_when_already_loaded() -> void: