gw-03 — Verification

One command

cd gw-03-api-gateway && bash scripts/verify.sh

Test	Invariant
`TestPhaseOrderingAndShortCircuit`	inbound auth (order 10) short-circuits before routing/endpoint; the access log still fires on the 401
`TestExemptPathSkipsAuth`	exempt paths bypass auth and hit the local endpoint
`TestProxyForwardsToOrigin`	request is proxied; hop-by-hop `Connection` stripped; `X-Forwarded-For` added
`TestLongestPrefixAndHeaderPredicate`	longest-prefix + specificity routing; a header-gated canary route beats the base route of equal prefix
`TestPanicBecomes502`	a panicking filter yields 502 (not a dropped connection) and outbound still runs
`TestProxyTimeoutIs504`	a slow origin yields 504 at the per-request deadline
`TestProxyDeadOriginIs502`	a dead origin (connection refused) yields 502
`TestHotReloadNoDrops`	concurrent route-table swaps under load drop zero lookups (lock-free atomic swap)

All under -race — the hot-reload test specifically stresses the atomic-pointer swap against concurrent readers.

No real event-loop semantics. Go's netpoller hides the loop; the "never block the loop" discipline (GUIDE §4) matters when you port this to Java/Netty.
No pooling/resilience/security yet. Those plug into the Transport and inbound seams (gw-04/06/07).
Body is buffered, not streamed. Streaming is an exercise (GUIDE §7).
Routing is static in the CLI. Dynamic control-plane push is gw-08.