Function resolve_passthrough 

pub fn resolve_passthrough(
    sni: Option<&str>,
    routes: &[SniRoute],
    gateway: &Gateway,
    pick: Option<EndpointPicker<'_>>,
) -> PassthroughAction

Resolve a passthrough SNI route against the gateway config.

Routing rule (v1, documented): the SNI server name is matched exactly against the sni_routes entries of the listener. A hit forwards to an endpoint of the referenced upstream. Endpoint selection is delegated to pick: the caller supplies a resolver that maps an upstream NAME to a load-balanced (address, port) (DW-011; the dataplane caller builds it from the CURRENT registry, so passthrough picks follow config reloads too — see dwara-bin’s listener). The pick carries no hash key — a byte splice has no per-request client-IP semantics to weight beyond stickiness, so ip_hash degrades to its smooth-RR fallback. Without a resolver (callers without a dataplane) the FIRST configured endpoint is used. No match, no SNI, or a non-TLS client closes the connection.