The Fail-Closed Answer Engine -- one deterministic resolver per question, refusal by default

Every question that can be asked of this system's data is answered by exactly one deterministic resolver, chosen by rule -- never improvised by a language model. Three failure modes are first-class outcomes, not bugs:

- A question type with no registered resolver returns not_supported. The engine does not invent a handler. - A question whose backing artifact is absent (a fresh clone with no data/, a stale store past its freshness bound) returns no_data. The engine does not fill the gap from training data. - A question phrased in edge / ROI / retracted-number language is refused at the door, pointing the caller at .claude/rules/no-edge-claims.md.

Coverage is then measured against the full question space and published including the refusals. The design goal is not "answer everything" -- it is that a connected LLM cannot fabricate a number, and the honest gaps are visible and counted.

resolver_registry.classify(query) maps a query to exactly one category (player_stat, rating_attribute, concept_rating, prediction_winprob, calibration_number, mechanism_effect, edge_language, the descriptive-intel categories, and so on). resolver_registry.resolve(query, sport) then dispatches to that category's single resolver, each with a declared source artifact, computation rule, and units, and returns a typed envelope: status (ok / no_data / not_supported / refused / ambiguous), the value, n, p, source_artifact, as_of, and edge_claimed: false.

Two properties make this more than a router. First, effect_graph.py assembles the whole "what affects what" graph purely from rows already adjudicated in each sport's validation_ledger.jsonl -- zero new statistics are computed, so the graph cannot say anything the gates have not already proven or disproven. Second, contract_client.py is the AI Consumer Contract made executable: it classifies, resolves, and formats with no model call at all, and the test_answer_consistency_* suite proves a direct resolver call and the contract client return byte-identical numbers for the same question. Mechanism answers are capped as LOCAL, single-corpus findings by the envelope's own framing field -- confirmed effects are never inflated into a market or dollar claim.

Fail-closed answer engines are the problem AI-engineering teams are actively fighting right now. The default retrieval-augmented pattern is "the model paraphrases some documents and hopes" -- and hopes badly, because nothing stops it rounding a number up, borrowing a stale figure, or asserting a plausible claim the data never supported. This is the harder version: every question resolves to one declared source, every number carries its own provenance and sample size, and the three honest failure modes (not_supported, no_data, refused) are enforced by the server contract, not a prompt the model can talk itself out of. The contract_client returning identical numbers with no model call proves the guarantee lives in the engine, not the model. The transferable engineering is not that the answers are good -- it is that a dishonest answer is structurally unavailable, and the coverage gap is measured and published rather than papered over.