Reply

What one outbound call came back as: a closed set the caller matches exhaustively.

Four arms and no more. Denied (401/403) is first-class because it is the arm with a different action attached — refresh a token, surface a login — so the compiler asks every caller what happens when credentials die, which is the whole point of matching a total function over this enum rather than a PartialFunction that swallows what it does not name. Unreachable is separate from Failed because "the server answered badly" and "no HTTP happened at all" recover differently. Nothing here throws for an ordinary failure; a Reply is a value, whatever happened.