nx_proxy_route_gate.nx

nx_proxy_route_gate.nx -- sovereign gate for the data-driven proxy route table (nx_proxy_route.nx). Proves the boundary guard (/gen != /generated), longest-prefix wins, exact-host beats '*', wildcard fallback, mode parsing, and that unknown host/path return MISS (0). 2026-08-21 (/compare/trafficsafety ITEM 1) -- THE FAIL-CLOSED MODE PARSE. pr_mode used to return the PERMISSIVE mode for any token it did not recognise, so a mistyped `gated` downgraded a fail-closed route with no diagnostic. Two families of tooth are required and NEITHER alone is evidence: * NEG-CONTROLS -- an unrecognised token must resolve to PR_MODE_GATED, never PR_MODE_BUFFERED. * POSITIVE CONTROLS -- every documented word, AND the legal omitted token, must still resolve to itself. A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST, so the positive half is what makes the negative half mean anything. The R-teeth below are the UNCHANGED originals and are load-bearing for a second reason: the row tokenizer was extracted out of pr_lookup into pr_row_toks so the matcher and the validator share ONE walker, and those teeth are the equivalence proof that the extraction changed no behaviour. expect_exit: 0 license_tier: ORIGINAL