Function classify_stream_decision 

fn classify_stream_decision(site: Site, kind: ActionKind) -> Support

The two stream-decision sites.

ActionKind::SerializeAfter takes exactly the verdict ActionKind::Open takes at both sites: it defers the first write, which either site can still decide. ActionKind::OpenAfter takes the same at Site::StreamOpen and is refused at Site::StreamHeader, because the peer stream is opened before a byte of the source is read — by the header site there is nothing left to defer, and moving open_uni behind the header decision would erase the published difference between the two reject sites.

The refusal is what keeps the header cell honest, and it is observable: the engine reports ProxyEvent::ActionRefused naming Refusal::WrongSite, and the stream is forwarded unchanged. Admitting it there instead would publish a delay nothing performs — tests/open_after_ordering.rs runs exactly that mutation and records what a caller would get.