nx_proxy_route.nx

nx_proxy_route.nx -- SOVEREIGN data-driven PROXY route table (pure Nishi, no TLS, no crypto). The DYNAMIC-routing analog of nx_host_router's static docroot table: a config file maps (host, path-prefix) -> (backend_port, mode) so an app/site route is a CONFIG ROW, not a recompiled `sd2_contains(" /gallery")` branch in the TLS daemon. This closes the nx_host_router gap for DYNAMIC routes -> "migrate a bunch of sites" becomes add-a-row, zero recompile. SOTA basis: reverse-proxy / API-gateway route tables reloadable without rebuild (knowledge/fetched/plat_reverse_proxy.raw, plat_api_mgmt.raw); see knowledge/research/2026-06-29-platform-sclass-exceed-standard.md. license_tier: ORIGINAL Config line: "<host|*> <path-prefix> <backend_port> <mode>" (hash = comment, blank lines ok) host exact (case-insensitive) or '*' wildcard; exact host wins over '*' path-prefix request-line path prefix, boundary-safe (/gen matches /gen,/gen/,/gen?x NOT /generated) backend_port loopback 127.0.0.1:<port> to reverse-proxy to mode buffered | stream | gated -- THE WORDS ARE THE VOCABULARY. The integers below are the internal encoding handed to the daemon and are NOT accepted conf spellings. Match rule: among all rows whose host+prefix match, LONGEST prefix wins; tie -> exact host beats '*'. FAIL-CLOSED MODE PARSE -- 2026-08-21, /compare/trafficsafety ITEM 1. pr_mode used to `return PR_MODE_BUFFERED` for ANY token it did not recognise, so a mistyped `gated` silently became the PERMISSIVE mode with no diagnostic, in the table that fronts every request. `gated` is the FAIL-CLOSED variant (302 /login when the backend is down); `buffered` is the permissive one -- so the old default was wrong in the dangerous direction by construction. NOW: the three documented words resolve to themselves, an OMITTED token keeps the documented default (buffered), and ANY other token resolves to PR_MODE_GATED -- fail closed. WHY NOT A HARD REFUSAL AT REQUEST TIME, decided from the call sites and not from taste. pr_lookup has exactly one production caller (nx_sites_daemon_v2) and its 0 return does not mean "refuse", it means "no route" -- the daemon then falls through to the legacy static cascade, which is precisely the path that answered a machine client with the HOMEPAGE as a 200 and triggered a retry storm (seq1294, both edge outages). Refusing a row at request time would therefore make the failure LESS safe, not more, and would brick every route in a conf holding one typo. The refusal belongs at LOAD time: pr_conf_scan enumerates every offending row with its line number so the loader ANNOUNCES a worklist once per (re)load, instead of emitting one wrong answer per request forever.