sequenceDiagram
    autonumber
    actor Engine as Outreach Probe
    participant Guard as safe_get()
    participant DNS as DNS Resolver
    participant Target as External Server

    Engine->>Guard: safe_get(URL)
    Guard->>DNS: Resolve Hostname
    DNS-->>Guard: Resolved IP

    alt IP is Private / Loopback / Metadata
        Guard-->>Engine: Raise BlockedURLError
    else IP is Public
        Guard->>Target: GET (Range: bytes=0-0, allow_redirects=False)
        alt Response is 30x Redirect
            Target-->>Guard: 30x Redirect Location
            Guard->>DNS: Resolve Redirect Hostname
            DNS-->>Guard: Redirect IP
            Note over Guard: Re-verify public IP per hop
        else Response is 200 OK
            Target-->>Guard: Stream First Byte
            Guard-->>Engine: 200 OK Status
        end
    end