Function preflight_response 

pub fn preflight_response(
    cors: &Cors,
    origins: &CompiledCorsOrigins,
    headers: &HeaderMap,
) -> Response<Full<Bytes>>

Build the gateway-answered preflight response (DW-027): always 204; CORS headers only when the preflight validates against the policy. origins is the policy’s snapshot-compiled origin set (normalized once at compile time, not per request).

Caching correctness: the response varies by Origin and, when echoing requested values, by the two request-marker headers — all three are listed in Vary unconditionally so a shared cache cannot serve one origin’s preflight answer to another.