Module snapshot 

Config compile pipeline: validate -> compile -> publish (feature analysis section 9.2).

The pipeline is split into a pure half and an effectful half:

• validate checks semantic integrity that the schema deliberately deferred (reference resolution, duplicate names, port conflicts, credential well-formedness). It returns ALL issues, never fail-fast.
• compile turns a validated Gateway into a Compiled value: compiled route structures plus a content hash. This is where schema-valid config can still fail (invalid regex, conflicting route templates).
• ConfigState::compile_and_publish stamps a monotonic generation id and atomically installs the result behind an ArcSwap. Rollback semantics are “atomic not-publish”: on ANY validation or compile failure the swap never happens and the currently-published snapshot remains untouched.

Route matching model (v1):

• exact routes are mounted in a matchit radix router; path parameters like /users/{id} are supported by the router itself.
• regex routes are compiled into a shared regex::RegexSet; the first matching pattern (declaration order) wins.
• prefix routes are kept in an ordered list and matched by longest-prefix at lookup time. matchit is exact-template matching, so prefix semantics are modeled explicitly rather than by mounting a trailing catch-all; that keeps parameter capture out of prefix routes.
• Lookup precedence: exact, then regex, then longest prefix.

Content hash: a fast non-cryptographic DefaultHasher (SipHash-1-3) over the normalized YAML serialization of the gateway. Its purpose is change detection / generation identity, NOT cryptographic integrity; it is not suitable for adversarial settings. The same hashing step backs a public per-entity variant (entity_content_hash) so tooling can compare single entities the way the gateway compares whole generations.

Structs

Compiled

Output of the pure compile step: everything a Snapshot needs except its generation id, which is assigned at publish time.

CompiledSubstitution

A precompiled path_rewrite.regex.substitution (PERF-04, #206).

ConfigState

Holds the currently published Snapshot behind an ArcSwap and owns the monotonic generation counter. Shared across the dataplane (read) and the config source / hot reload (write, DW-006). May carry the process’s crate::events::EventBus (DW-044): every publish outcome emits one event (config_published / config_rejected) onto it, which is why the bus sits in a domain BELOW this one.

RouteTable

Snapshot

Immutable, fully compiled configuration generation, cheap to share.

SnapshotInfo

Identity of a successfully published snapshot, for logs/metrics.

ValidationIssue

One semantic-validation finding. Operators get every issue at once, not a fail-fast first error.

Enums

CompileError

Error produced by the compile pipeline. Validation failures carry every issue; compile failures name the route and pattern at fault.

Functions

compile

Pure compile: validated Gateway -> Compiled. Fails with CompileError::Validation on semantic issues, or with CompileError::InvalidRegex / CompileError::RouteConflict when schema-valid config still cannot compile.

entity_content_hash

Per-entity content hash: the entity’s normalized YAML serialization (stable field order, defaulted-empty fields omitted — the same normalization gateway_to_yaml applies to a whole Gateway) through the same DefaultHasher as the snapshot content hash. Two entities of one kind hash equal exactly when their normalized serializations are equal, so source key order and omitted defaults do not affect the result. Same caveats as SnapshotInfo::content_hash: a per-process change-detection token, not stable across Rust versions, not a content digest.

validate