[Proxicon]

After #117 moved incident-create JSON reading into the handler, an authenticated ordinary request with no body reached ReadFromJsonAsync without a JSON Content-Type and threw an unhandled exception. The previous required-body binding returned 400. Check the server's request-body detection feature before reading ordinary JSON to preserve that behavior.

Follow-up to #116/#117. The receiver protocol, registered-source authorization, atomic receipt/effect behavior and frozen contract files are unchanged. Existing non-JSON 415 behavior is retained.

The actual authenticated SQLite and PostgreSQL acceptance cases now send empty and non-JSON ordinary requests and assert 400/415 with no incident/receipt/effects, then verify normal ordinary create and keyed replay. Both provider cases failed with the unhandled exception before the fix.

Validation: Release solution build passes; 72 receiver/ordinary-create/OpenAPI cases passed, zero failures or skips, including the expanded cases on both real providers. Layout, disclosure and diff checks pass; Slopwatch finds zero issues in the changed receiver tests. Current-head CI will be recorded before merge. All existing gates remain enabled. The full receiver implementation is merged in #117 at 7bd137f5a4bec66459961331746e0893e7d39bcb, with all 17 PR checks and all 17 main checks green. The unchanged four-file contract mirror is merged in NetRatel #163, after all 21 checks passed.

The exact-head receiver job passed 52 cases with zero failures/skips (11 SQLite, 11 PostgreSQL, 30 conformance/key). Artifact SHA-256: 1bbb83bf657f58cdd80163291dd67a1bcf079fd6fa467e6a03b8162dbe35ec8a. Self-review is anchored to exact head 6dccaccd06d7341f6ce4c648400c23558d9e7680.

No release or deployment is performed. The subsequent compatible prerelease must include this fix as well as #117; NetRatel automatic delivery remains capability-gated until the deployed receiver reports the verified contract.

Final deployment handoff: receiver #117 plus compatibility follow-up #118 are merged at fccae98. All 17 checks passed on each reviewed PR head and on this final main merge. Main validation and managed PostgreSQL validation are green. Main receiver acceptance: 52 passed, zero failed/skipped (11 SQLite, 11 PostgreSQL, 30 conformance/key); full suite: 1,713 passed, zero failed, six existing skips. Use this final merge SHA for the subsequent compatible build. No release, production deployment, live ticket or tag/latest promotion was produced.

[Proxicon]

Self-review of 6dccacc: the body-detection check runs only after the keyed/machine branch, and returns the former required-body 400 before calling ReadFromJsonAsync. Existing route metadata retains non-JSON 415 behavior. Current authentication/IncidentAccess, valid ordinary JSON creation, keyed authorization/receipts and contract files are unchanged.

The expanded authenticated HTTP tests reproduced the empty-body exception on both file-backed SQLite and PostgreSQL before the fix. After the fix, the Release solution build and all 72 receiver/ordinary-create/OpenAPI cases pass with zero skips; empty/non-JSON requests create no incident, receipt, SLA or effects. Layout/disclosure/diff pass, and the modified receiver tests have zero Slopwatch findings. The inherited assignment-notification empty catch is unchanged.

No outstanding substantive finding in this focused diff. Merge remains gated on this exact head's full CI. The final deployment handoff must use the resulting main SHA including this compatibility fix, not just the earlier #117 merge.