Apply target access before service authentication: inherit, bypass, or block. Keep route selection and auth decisions on the same snapshot; reject stale or unavailable required middleware.
Validation: full auth/proxy race tests and scoped lint passed. Runtime regression tests remain with this layer.
