refactor(edge): shorter rules, one lead-in

templates/backend/edge.md

@@ -2,56 +2,46 @@
 [ID: backend-edge]
 [DEPENDS ON: templates/backend/http.md, templates/security/security.md, templates/backend/observability.md]
 
-Rules for the edge tier — the reverse proxy, load balancer, or gateway
-that sits in front of the application (nginx, Envoy, Caddy, HAProxy, a
-cloud ALB, or a CDN). Compose this template on demand for a service
-exposed to untrusted networks — it is not part of any stack chain by
-default.
-
-The edge is infrastructure, not a service: it terminates TLS, routes,
-and shields the application tier. Keep business logic out of it — that
-belongs in the application layer. API-gateway routing inside a service
-mesh is covered by `microservices.md`.
+Rules for the reverse proxy, load balancer or gateway in front of an
+application exposed to untrusted networks. The edge terminates TLS, routes
+and shields the application; keep business logic out of it.
 
 ## TLS termination
 
-- Terminate TLS at the edge and redirect all plain HTTP to HTTPS — the
-  application MUST NOT be reachable over cleartext
+- Terminate TLS at the edge and redirect plain HTTP to HTTPS
+- Never let the application be reachable over cleartext (MUST NOT)
 - Serve only TLS 1.2+; disable legacy protocol and cipher versions
 - Set HSTS (`Strict-Transport-Security`) at the edge so browsers refuse
   to downgrade
-- Re-encrypt to upstreams (mTLS or TLS) when traffic crosses an
-  untrusted segment; plaintext to upstreams is acceptable only on a
-  trusted private network
+- Re-encrypt to upstreams (mTLS or TLS) across an untrusted segment; send
+  plaintext only on a trusted private network
 
 ## Forwarded headers and client identity
 
 - Forward the originating client over `Forwarded` (RFC 7239) or the
   de-facto `X-Forwarded-For` / `X-Forwarded-Proto` / `X-Forwarded-Host`
 - Strip inbound forwarded headers from external callers before
   appending your own — never trust a client-supplied `X-Forwarded-For`
-- Configure the application's trusted-proxy list so it reads the real
-  client IP only from hops you control — an over-broad trust list lets
-  callers spoof their address and defeat IP rate limits
+- Limit the application's trusted-proxy list to hops you control; an
+  over-broad list lets callers spoof their IP and dodge rate limits
 - Propagate or originate a correlation/request ID at the edge so a
   request is traceable end to end (see `observability.md`)
 
 ## Routing and upstreams
 
 - Route by host and path to upstream pools; keep routing declarative,
   not code
-- Gate traffic on upstream health checks — remove failing instances
-  from rotation and add them back only after they pass readiness
+- Remove a failing instance from rotation by health check; add it back
+  only after it passes readiness
 - Balance across instances (round-robin or least-connections) and
   spread upstreams across availability zones
 - Drain connections on deploy — stop sending new requests to an
   instance before it shuts down so in-flight work completes
 
 ## Limits, timeouts, and buffering
 
-- Set explicit connect, read, and write timeouts to every upstream —
-  an unbounded proxy timeout turns one slow upstream into edge
-  exhaustion
+- Set connect, read and write timeouts on every upstream; an unbounded
+  one lets a slow upstream exhaust the edge
 - Cap request body size at the edge to reject oversized payloads before
   they reach the application
 - Bound concurrent connections and enforce per-client rate limits at

tests/baselines/template-quality.txt

@@ -7,7 +7,7 @@ templates/backend/auth.md 98.4
 templates/backend/caching.md 100.0
 templates/backend/concurrency.md 94.8
 templates/backend/database.md 92.0
-templates/backend/edge.md 89.7
+templates/backend/edge.md 97.9
 templates/backend/errors.md 91.7
 templates/backend/features.md 92.2
 templates/backend/grpc.md 96.1