nx_proxy_route_gate.nx source

1// nx_proxy_route_gate.nx -- sovereign gate for the data-driven proxy route table (nx_proxy_route.nx). 2// Proves the boundary guard (/gen != /generated), longest-prefix wins, exact-host beats '*', 3// wildcard fallback, mode parsing, and that unknown host/path return MISS (0). 4// 5// 2026-08-21 (/compare/trafficsafety ITEM 1) -- THE FAIL-CLOSED MODE PARSE. 6// pr_mode used to return the PERMISSIVE mode for any token it did not recognise, so a mistyped 7// `gated` downgraded a fail-closed route with no diagnostic. Two families of tooth are required 8// and NEITHER alone is evidence: 9// * NEG-CONTROLS -- an unrecognised token must resolve to PR_MODE_GATED, never PR_MODE_BUFFERED. 10// * POSITIVE CONTROLS -- every documented word, AND the legal omitted token, must still resolve 11// to itself. A GUARD THAT REFUSES EVERYTHING PASSES EVERY NEGATIVE TEST, so the positive half 12// is what makes the negative half mean anything. 13// The R-teeth below are the UNCHANGED originals and are load-bearing for a second reason: the row 14// tokenizer was extracted out of pr_lookup into pr_row_toks so the matcher and the validator share 15// ONE walker, and those teeth are the equivalence proof that the extraction changed no behaviour. 16// expect_exit: 0 license_tier: ORIGINAL 17import "nx_syscalls.nx" 18import "nx_gate_emit_lib.nx" 19import "nx_proxy_route.nx" 20import "nx_gate_verdict.nx" 21 22const PG_NUM_SCRATCH: i64 = 24 23const PG_ASCII_ZERO: i64 = 48 24const PG_B10: i64 = 10 25const PG_FIX_BYTES: i64 = 512 26const PG_LINES_CAP: i64 = 8 27const PG_LINES_BYTES: i64 = 64 28const PG_BOX_BYTES: i64 = 8 29// per-route timeout fixture (search L2a): the search backend port, the two declared timeouts, and the validator counts 30const PG_FIX_PORT_SEARCH: i64 = 18456 31const PG_FIX_TMO_SEARCH: i64 = 45 32const PG_FIX_TMO_API: i64 = 30 33const PG_FIX_TMO_BAD_ROWS: i64 = 2 34const PG_FIX_TMO_ROWS: i64 = 3 35const PG_FIX_LINE_ONE: i64 = 1 36const PG_FIX_LINE_TWO: i64 = 2 37// Placeholder bytes used to BUILD the tab/CRLF fixture at runtime. Only the newline escape is 38// relied on, so the two bytes that cannot be typed safely are substituted in instead of assumed -- 39// a fixture you cannot build is a tooth you cannot run. 40const PG_MARK_TAB: i64 = 124 41const PG_MARK_CR: i64 = 126 42const PG_BYTE_TAB: i64 = 9 43const PG_BYTE_CR: i64 = 13 44// A token LENGTH of zero is what "the mode column was omitted" means on the wire. Named because the 45// teeth using it prove the parser consults the LENGTH and not the bytes behind the pointer. 46const PG_TOK_OMITTED: i64 = 0 47// Facts about the planted fixtures. Separate names from PR_ROW_TOKS even where the value coincides: 48// one constant serving two unrelated purposes can never be tuned for either. 49const PG_VOCAB_SPELLINGS: i64 = 4 50const PG_BAD_ROWS: i64 = 5 51const PG_BAD_OFFENDERS: i64 = 2 52const PG_BAD_LINE_A: i64 = 3 53const PG_BAD_LINE_B: i64 = 6 54const PG_CLEAN_ROWS: i64 = 4 55const PG_CAP_ONE: i64 = 1 56const PG_FIX_PORT_A: i64 = 9001 57// The R-tooth fixture's backend ports, named rather than left as bare integers -- rule 11 applies 58// to a test's expected values too, and nx_magic flagged exactly these seven. 59const PG_FIX_PORT_GALLERY: i64 = 18190 60const PG_FIX_PORT_GEN: i64 = 18794 61const PG_FIX_PORT_TORRENT: i64 = 18793 62const PG_FIX_PORT_API: i64 = 9000 63const PG_FIX_PORT_APIV2: i64 = 9002 64const PG_FIX_PORT_WILD: i64 = 8000 65const PG_FIX_PORT_EXACT: i64 = 8001 66const PG_FIX_PORT_TAB: i64 = 9100 67const PG_FIX_PORT_CRLF: i64 = 9101 68 69func g_putn(v: i64) -> i64 { 70 if v == 0 { sys_write(1, "0" as *u8, 1); return 0 } 71 var m: i64 = v 72 if m < 0 { sys_write(1, "-" as *u8, 1); m = 0 - m } 73 let d: *u8 = sys_mmap(PG_NUM_SCRATCH); var k: i64 = 0 74 while m > 0 { d[k] = ((PG_ASCII_ZERO + (m - (m / PG_B10) * PG_B10)) as u8); m = m / PG_B10; k = k + 1 } 75 var j: i64 = k - 1 76 while j >= 0 { sys_write(1, ((d as i64)+j) as *u8, 1); j = j - 1 } 77 return 0 78} 79 80func g_len(s: *u8) -> i64 { var n: i64 = 0; while s[n] != (0 as u8) { n = n + 1 } return n } 81 82// ASSERT-EQUALS on the SHARED base class. The counter is gv_ctr, so declared == executed by 83// construction; a tooth that silently stops running lowers both numbers instead of reading GREEN. 84// It still PRINTS got vs want on failure: a gate that reports a boolean cannot say why, and both 85// vacuous teeth this estate has caught were caught by the diagnostic dump, never by the vector. 86func gq(label: *u8, got: i64, want: i64, ctr: *i64) -> i64 { 87 var c: i64 = 0 88 if got == want { c = 1 } 89 let r: i64 = gv_check(label, c, ctr) 90 if c == 0 { 91 g_puts(" got=" as *u8); g_putn(got) 92 g_puts(" want=" as *u8); g_putn(want) 93 g_puts("\n" as *u8) 94 } 95 return r 96} 97 98// Copy a template into a buffer, substituting the two untypeable bytes. Returns the length. 99func g_fixbytes(src: *u8, dst: *u8) -> i64 { 100 var n: i64 = 0 101 while src[n] != (0 as u8) { 102 var c: i64 = src[n] as i64 103 if c == PG_MARK_TAB { c = PG_BYTE_TAB } 104 if c == PG_MARK_CR { c = PG_BYTE_CR } 105 dst[n] = c as u8 106 n = n + 1 107 } 108 return n 109} 110 111func main() -> i64 { 112 let ctr: *i64 = gv_ctr() 113 gv_head("nx_proxy_route_gate -- route matching, and the FAIL-CLOSED mode parse" as *u8) 114 115 let cfg: *u8 = "# proxy route fixture\nnishifamily.com /gallery 18190 stream\nnishifamily.com /gen 18794 buffered\nnishifamily.com /torrent 18793 stream\nnishifamily.com /api 9000 buffered\nnishifamily.com /api/v2 9002 gated\n* /shared 8000 buffered\nnishifamily.com /shared 8001 buffered\n" as *u8 116 let cfgn: i64 = g_len(cfg) 117 let port: *i64 = (sys_mmap(PG_BOX_BYTES)) as *i64 118 let mode: *i64 = (sys_mmap(PG_BOX_BYTES)) as *i64 119 let nf: *u8 = "nishifamily.com" as *u8 120 let nfl: i64 = g_len(nf) 121 var r: i64 = 0 122 123 // ---- R-TEETH: the original matcher contract, the same assertions as before the change. These 124 // are the equivalence proof for the pr_row_toks extraction -- if the shared tokenizer parsed a 125 // row even slightly differently from the inline walk it replaced, these are what would say so. 126 r = pr_lookup(cfg, cfgn, nf, nfl, "/gallery" as *u8, g_len("/gallery" as *u8), port, mode) 127 gq("R1a gallery hit" as *u8, r, 1, ctr) 128 gq("R1b gallery port" as *u8, port[0], PG_FIX_PORT_GALLERY, ctr) 129 gq("R1c gallery mode=stream" as *u8, mode[0], PR_MODE_STREAM, ctr) 130 131 r = pr_lookup(cfg, cfgn, nf, nfl, "/gen/api/generate" as *u8, g_len("/gen/api/generate" as *u8), port, mode) 132 gq("R2a gen subpath hit" as *u8, r, 1, ctr) 133 gq("R2b gen subpath port" as *u8, port[0], PG_FIX_PORT_GEN, ctr) 134 135 r = pr_lookup(cfg, cfgn, nf, nfl, "/generated" as *u8, g_len("/generated" as *u8), port, mode) 136 gq("R3 neg-control-boundary /generated is NOT /gen" as *u8, r, 0, ctr) 137 138 r = pr_lookup(cfg, cfgn, nf, nfl, "/api/v2/x" as *u8, g_len("/api/v2/x" as *u8), port, mode) 139 gq("R4a longest-prefix port" as *u8, port[0], PG_FIX_PORT_APIV2, ctr) 140 gq("R4b longest-prefix mode=gated" as *u8, mode[0], PR_MODE_GATED, ctr) 141 142 r = pr_lookup(cfg, cfgn, nf, nfl, "/api/foo" as *u8, g_len("/api/foo" as *u8), port, mode) 143 gq("R5 /api/foo resolves to /api not /api/v2" as *u8, port[0], PG_FIX_PORT_API, ctr) 144 145 r = pr_lookup(cfg, cfgn, nf, nfl, "/shared" as *u8, g_len("/shared" as *u8), port, mode) 146 gq("R6 exact host beats wildcard at equal prefix" as *u8, port[0], PG_FIX_PORT_EXACT, ctr) 147 148 let oc: *u8 = "other.com" as *u8 149 r = pr_lookup(cfg, cfgn, oc, g_len(oc), "/shared" as *u8, g_len("/shared" as *u8), port, mode) 150 gq("R7 wildcard fallback for another host" as *u8, port[0], PG_FIX_PORT_WILD, ctr) 151 152 let ev: *u8 = "evil.com" as *u8 153 r = pr_lookup(cfg, cfgn, ev, g_len(ev), "/gallery" as *u8, g_len("/gallery" as *u8), port, mode) 154 gq("R8 neg-control-host unknown host gets no route" as *u8, r, 0, ctr) 155 156 r = pr_lookup(cfg, cfgn, nf, nfl, "/nothere" as *u8, g_len("/nothere" as *u8), port, mode) 157 gq("R9 neg-control-path unknown path gets no route" as *u8, r, 0, ctr) 158 159 r = pr_lookup(cfg, cfgn, nf, nfl, "/torrent" as *u8, g_len("/torrent" as *u8), port, mode) 160 gq("R10a torrent port" as *u8, port[0], PG_FIX_PORT_TORRENT, ctr) 161 gq("R10b torrent mode=stream" as *u8, mode[0], PR_MODE_STREAM, ctr) 162 163 // ---- POSITIVE CONTROLS. Without these a pr_mode that returned GATED for EVERYTHING would score 164 // a perfect run on the neg-controls below. 165 gq("T01 pos-control word buffered resolves to buffered" as *u8, pr_mode("buffered" as *u8, g_len("buffered" as *u8)), PR_MODE_BUFFERED, ctr) 166 gq("T02 pos-control word stream resolves to stream" as *u8, pr_mode("stream" as *u8, g_len("stream" as *u8)), PR_MODE_STREAM, ctr) 167 gq("T03 pos-control word gated resolves to gated" as *u8, pr_mode("gated" as *u8, g_len("gated" as *u8)), PR_MODE_GATED, ctr) 168 gq("T04 pos-control an OMITTED mode keeps the documented default buffered" as *u8, pr_mode("gated" as *u8, PG_TOK_OMITTED), PR_MODE_BUFFERED, ctr) 169 170 // ---- NEG-CONTROLS. The defect this rung exists for: an unrecognised token must fail CLOSED. 171 // Each asserts WHICH value was produced, not merely that something happened -- a refusal test 172 // that only asks "was it refused?" is blind by construction. 173 gq("T05 neg-control-typo a mistyped gated fails CLOSED" as *u8, pr_mode("gatd" as *u8, g_len("gatd" as *u8)), PR_MODE_GATED, ctr) 174 gq("T06 neg-control-live-witness the conf token 0 fails CLOSED" as *u8, pr_mode("0" as *u8, g_len("0" as *u8)), PR_MODE_GATED, ctr) 175 gq("T07 neg-control-vocab an undocumented word fails CLOSED" as *u8, pr_mode("open" as *u8, g_len("open" as *u8)), PR_MODE_GATED, ctr) 176 // The pre-fix behaviour stated directly: NONE of the three may land on the permissive value. 177 var permissive: i64 = 0 178 if pr_mode("gatd" as *u8, g_len("gatd" as *u8)) == PR_MODE_BUFFERED { permissive = permissive + 1 } 179 if pr_mode("0" as *u8, g_len("0" as *u8)) == PR_MODE_BUFFERED { permissive = permissive + 1 } 180 if pr_mode("open" as *u8, g_len("open" as *u8)) == PR_MODE_BUFFERED { permissive = permissive + 1 } 181 gq("T08 neg-control-permissive no unknown token may yield BUFFERED" as *u8, permissive, 0, ctr) 182 183 // ---- VOCABULARY DISCRIMINATION. pr_mode alone cannot say "recognised as buffered" versus 184 // "fell back", which is exactly what a validator needs. 185 var known: i64 = 0 186 known = known + pr_mode_known("buffered" as *u8, g_len("buffered" as *u8)) 187 known = known + pr_mode_known("stream" as *u8, g_len("stream" as *u8)) 188 known = known + pr_mode_known("gated" as *u8, g_len("gated" as *u8)) 189 known = known + pr_mode_known("gated" as *u8, PG_TOK_OMITTED) 190 gq("T09 all four documented spellings are RECOGNISED" as *u8, known, PG_VOCAB_SPELLINGS, ctr) 191 gq("T10 neg-control-unknown a typo is reported UNRECOGNISED" as *u8, pr_mode_known("gatd" as *u8, g_len("gatd" as *u8)), 0, ctr) 192 gv_bite("T11 vocabulary detector fires on the typo and stays silent on the word" as *u8, 193 1 - pr_mode_known("gatd" as *u8, g_len("gatd" as *u8)), 194 1 - pr_mode_known("gated" as *u8, g_len("gated" as *u8)), ctr) 195 196 // ---- THE LOAD-TIME ANNOUNCE. Two offenders planted on KNOWN lines 3 and 6, one legal omitted 197 // mode on line 7, and a comment and a blank line so the line counter has to survive both. 198 let bad: *u8 = "# fixture with two planted bad mode tokens\nnishifamily.com /a 9001 buffered\nnishifamily.com /b 9002 gatd\n\nnishifamily.com /c 9003 stream\nnishifamily.com /d 9004 0\nnishifamily.com /e 9005\n" as *u8 199 let badn: i64 = g_len(bad) 200 let lines: *i64 = (sys_mmap(PG_LINES_BYTES)) as *i64 201 let listed: *i64 = (sys_mmap(PG_BOX_BYTES)) as *i64 202 let rows: *i64 = (sys_mmap(PG_BOX_BYTES)) as *i64 203 let nbad: i64 = pr_conf_scan(bad, badn, lines, PG_LINES_CAP, listed, rows) 204 // ANTI-VACUITY FIRST. A scan verdict over zero rows is not a verdict, so the denominator is 205 // asserted BEFORE the outcome, and asserted arithmetically rather than read off a printout. 206 gq("T12 anti-vacuity the scan actually examined the planted rows" as *u8, rows[0], PG_BAD_ROWS, ctr) 207 gq("T13 scan counts exactly the planted offenders" as *u8, nbad, PG_BAD_OFFENDERS, ctr) 208 gq("T14 scan NAMES the first offender by line" as *u8, lines[0], PG_BAD_LINE_A, ctr) 209 gq("T15 scan NAMES the second offender by line" as *u8, lines[1], PG_BAD_LINE_B, ctr) 210 gq("T16 listed equals counted so no cap was reached in silence" as *u8, listed[0], nbad, ctr) 211 212 // A scanner that flagged everything would pass every tooth above. 213 let clean: *u8 = "# clean fixture\nnishifamily.com /a 9001 buffered\nnishifamily.com /b 9002 gated\nnishifamily.com /c 9003 stream\nnishifamily.com /d 9004\n" as *u8 214 let cleann: i64 = g_len(clean) 215 let ncl: i64 = pr_conf_scan(clean, cleann, lines, PG_LINES_CAP, listed, rows) 216 gq("T17 anti-vacuity the clean fixture was examined too" as *u8, rows[0], PG_CLEAN_ROWS, ctr) 217 gq("T18 neg-control-clean a fully documented conf scores ZERO offenders" as *u8, ncl, 0, ctr) 218 219 // A full array must be visible as a PREFIX OF ITS OWN COUNT, never a smaller number that reads 220 // like better news. 221 let ncap: i64 = pr_conf_scan(bad, badn, lines, PG_CAP_ONE, listed, rows) 222 gq("T19 a capped worklist still returns the TRUE count" as *u8, ncap, PG_BAD_OFFENDERS, ctr) 223 gq("T20 and declares how few of them it listed" as *u8, listed[0], PG_CAP_ONE, ctr) 224 225 // ---- END TO END. The daemon does not call pr_mode; it calls pr_lookup. The fail-closed value 226 // has to survive the whole match, not just the token test. 227 r = pr_lookup(bad, badn, nf, nfl, "/b" as *u8, g_len("/b" as *u8), port, mode) 228 gq("T21a end-to-end a typo row still ROUTES" as *u8, r, 1, ctr) 229 gq("T21b end-to-end and it routes FAIL-CLOSED" as *u8, mode[0], PR_MODE_GATED, ctr) 230 r = pr_lookup(bad, badn, nf, nfl, "/a" as *u8, g_len("/a" as *u8), port, mode) 231 gq("T22a pos-control a good row beside it keeps its port" as *u8, port[0], PG_FIX_PORT_A, ctr) 232 gq("T22b pos-control a good row beside it keeps its mode" as *u8, mode[0], PR_MODE_BUFFERED, ctr) 233 r = pr_lookup(bad, badn, nf, nfl, "/e" as *u8, g_len("/e" as *u8), port, mode) 234 gq("T23 pos-control an omitted mode still means buffered end to end" as *u8, mode[0], PR_MODE_BUFFERED, ctr) 235 236 // ---- TOKENIZER SHAPES the extraction had to preserve: tab separators and CRLF line endings. 237 let tmpl: *u8 = "nishifamily.com|/tabbed|9100|gated~\nnishifamily.com /crlf 9101 stream~\n" as *u8 238 let fix: *u8 = sys_mmap(PG_FIX_BYTES) 239 let fixn: i64 = g_fixbytes(tmpl, fix) 240 gq("T24 anti-vacuity the substituted fixture is non-empty" as *u8, fixn, g_len(tmpl), ctr) 241 r = pr_lookup(fix, fixn, nf, nfl, "/tabbed" as *u8, g_len("/tabbed" as *u8), port, mode) 242 gq("T25a tab-separated row still parses port" as *u8, port[0], PG_FIX_PORT_TAB, ctr) 243 gq("T25b tab-separated row still parses mode" as *u8, mode[0], PR_MODE_GATED, ctr) 244 r = pr_lookup(fix, fixn, nf, nfl, "/crlf" as *u8, g_len("/crlf" as *u8), port, mode) 245 gq("T26a CRLF row still parses port" as *u8, port[0], PG_FIX_PORT_CRLF, ctr) 246 gq("T26b CRLF row still parses mode" as *u8, mode[0], PR_MODE_STREAM, ctr) 247 248 // ---- THE LIVE ROUTE TABLE. Everything above is a fixture. This is the production table that 249 // fronts every request, measured over its FULL population by the same walker the daemon uses, 250 // because a table this small still gets read by eye and an eye is not a census. The conf lives 251 // at the serving root and gate runs are CWD-anchored to buildroot, so both plausible paths are 252 // tried and a genuine absence becomes a PRECONDITION -- "I could not look" must never score as 253 // "I looked and it is clean". 254 let lbox: *i64 = (sys_mmap(PG_BOX_BYTES)) as *i64 255 lbox[0] = 0 256 var live: *u8 = sys_read_file("proxy_routes.conf" as *u8, lbox) 257 if (live as i64) == 0 { lbox[0] = 0; live = sys_read_file("../proxy_routes.conf" as *u8, lbox) } 258 var liven: i64 = 0 259 if (live as i64) != 0 { liven = lbox[0] } 260 var live_present: i64 = 0 261 if liven > 0 { live_present = 1 } 262 if gv_need("the live proxy_routes.conf is readable from this working directory" as *u8, live_present, ctr) == 1 { 263 let nlive: i64 = pr_conf_scan(live, liven, lines, PG_LINES_CAP, listed, rows) 264 g_puts(" live table rows examined=" as *u8); g_putn(rows[0]); g_puts("\n" as *u8) 265 var live_has_rows: i64 = 0 266 if rows[0] > 0 { live_has_rows = 1 } 267 gq("T27 anti-vacuity the LIVE table actually contains routable rows" as *u8, live_has_rows, 1, ctr) 268 gq("T28 neg-control-live every mode token in the LIVE table is documented vocabulary" as *u8, nlive, 0, ctr) 269 if nlive > 0 { 270 g_puts(" OFFENDING LINES -- a count without a worklist is not actionable:\n" as *u8) 271 var q: i64 = 0 272 while q < listed[0] { g_puts(" line " as *u8); g_putn(lines[q]); g_puts("\n" as *u8); q = q + 1 } 273 if listed[0] < nlive { g_puts(" <== THIS LIST IS A PREFIX OF ITS OWN COUNT\n" as *u8) } 274 } 275 } 276 277 // ---- PER-ROUTE TIMEOUT (search L2a, 2026-09-02): an optional 5th token timeout=<s>; absent = 0; unknown = bad row ---- 278 let tcfg: *u8 = "nishifamily.com /search 18456 buffered timeout=45\nnishifamily.com /doc 18456 buffered\nnishifamily.com /api/search 18456 buffered TIMEOUT=30\n" as *u8 279 let tcfgn: i64 = g_len(tcfg) 280 let tmo: *i64 = (sys_mmap(PG_BOX_BYTES)) as *i64 281 r = pr_lookup_tmo(tcfg, tcfgn, nf, nfl, "/search" as *u8, g_len("/search" as *u8), port, mode, tmo) 282 gq("T1a timeout row routes" as *u8, r, 1, ctr) 283 gq("T1b timeout row port" as *u8, port[0], PG_FIX_PORT_SEARCH, ctr) 284 gq("T1c timeout row mode buffered" as *u8, mode[0], PR_MODE_BUFFERED, ctr) 285 gq("T1d timeout=45 parsed as 45 seconds" as *u8, tmo[0], PG_FIX_TMO_SEARCH, ctr) 286 r = pr_lookup_tmo(tcfg, tcfgn, nf, nfl, "/doc" as *u8, g_len("/doc" as *u8), port, mode, tmo) 287 gq("T2a row without the field routes" as *u8, r, 1, ctr) 288 gq("T2b absent field reads 0 = caller default" as *u8, tmo[0], 0, ctr) 289 r = pr_lookup_tmo(tcfg, tcfgn, nf, nfl, "/api/search" as *u8, g_len("/api/search" as *u8), port, mode, tmo) 290 gq("T3 key is case-insensitive TIMEOUT=30 reads 30" as *u8, tmo[0], PG_FIX_TMO_API, ctr) 291 r = pr_lookup(tcfg, tcfgn, nf, nfl, "/search" as *u8, g_len("/search" as *u8), port, mode) 292 gq("T4a the old pr_lookup still routes a 5-token row" as *u8, r, 1, ctr) 293 gq("T4b and still answers the port" as *u8, port[0], PG_FIX_PORT_SEARCH, ctr) 294 let bcfg: *u8 = "nishifamily.com /a 1 buffered timeout=abc\nnishifamily.com /b 2 buffered bogus\nnishifamily.com /c 3 buffered timeout=45\n" as *u8 295 let bcfgn: i64 = g_len(bcfg) 296 let tb: i64 = pr_conf_scan(bcfg, bcfgn, lines, PG_LINES_CAP, listed, rows) 297 gq("T5a neg-control-validator counts the two malformed 5th tokens" as *u8, tb, PG_FIX_TMO_BAD_ROWS, ctr) 298 gq("T5b validator still counts all three rows" as *u8, rows[0], PG_FIX_TMO_ROWS, ctr) 299 gq("T5c the first bad line is 1" as *u8, lines[0], PG_FIX_LINE_ONE, ctr) 300 gq("T5d the second bad line is 2" as *u8, lines[1], PG_FIX_LINE_TWO, ctr) 301 r = pr_lookup_tmo(bcfg, bcfgn, nf, nfl, "/a" as *u8, g_len("/a" as *u8), port, mode, tmo) 302 gq("T6 neg-control-a malformed timeout routes with 0 = default, never a guess" as *u8, tmo[0], 0, ctr) 303 let rc: i64 = gv_verdict("PROXY-ROUTE-GATE" as *u8, ctr, "each tooth states its own strength above" as *u8) 304 sys_exit(rc) 305 return rc 306}