[maxmad64bis]

Summary

• The proxy reachability probe classified every response under 500 as ok
  (src/lib/proxyHealth/scheduler.ts). A 401/403/429 from the probe target — the shape a
  destination uses to refuse a banned or rate-limited egress IP — was therefore reported as a
  healthy proxy. The proxy did relay, so it is not failing; but it is not serving that
  destination either, and ok hid exactly that.
• Adds a blocked outcome for 401/403/429, produced by a shared pure classifyProbeStatus().
  The sweep and the "Test All" endpoint (/api/settings/proxies/auto-test) were deriving the
  same status < 500 rule independently; they now share one definition.
• The sweep log gains a blocked by target count next to alive / inconclusive.

Behaviour is deliberately unchanged.

• blocked is neutral in decideProxyHealthAction, exactly like inconclusive: no failure
  count, no status write. One target refusing an IP does not make the proxy dead, and the
  removal policy stays operator-owned ([BUG] Massive issue with proxies since 3.8.44 - IP leak #6246 policy C/D).
• On /api/settings/proxies/auto-test, alive keeps its exact prior meaning (any status under
  500). The refusal is surfaced as a separate optional blockedByTarget field, so nothing
  changes for the opt-in status write behind PROXY_HEALTH_AUTO_DEACTIVATE.

No migration, no feature flag, no UI string, no i18n churn.

Related Issues

• Related to feat(backend): rate-limit-resilient, configurable proxy health-check probe target #8411 (proxy probe semantics)
• Related to [BUG] Massive issue with proxies since 3.8.44 - IP leak #6246 (probe outcomes are advisory; the operator owns proxy status)

Validation

• Change type: routing / proxy health (+ API field)
• Focused tests and category gates from the golden path
• npm run lint
• Reconciled with the current active release base; focused checks rerun afterward
• Production-code changes include a new or updated automated test in this PR

$ node --import tsx/esm --test tests/unit/proxy-health-blocked-outcome.test.ts
# tests 8   # pass 8   # fail 0

$ node --import tsx/esm --test tests/unit/proxy-health-6246.test.ts                  # pass 7  # fail 0
$ node --import tsx/esm --test tests/unit/proxy-health-decide-action-6246.test.ts    # pass 6  # fail 0
$ node --import tsx/esm --test tests/unit/proxy-health-auto-disable-decision.test.ts # pass 7  # fail 0
$ node --import tsx/esm --test tests/unit/proxy-batch-routes-5918.test.ts            # pass 5  # fail 0

$ npm run lint                       # rc=0 (cold cache)
$ npm run check:cycles               # OK — no cycles across 419 files
$ npm run typecheck:core 2>&1 | grep "error TS"
open-sse/services/compression/engines/omniglyphAdapter.ts(126,54): error TS2339: ...   # 1, pre-existing on base

The single typecheck error is already tracked on the base and lives in a file this PR does not
touch.

⚠️ base-red inherited: #9985

Tests Added Or Updated

• tests/unit/proxy-health-blocked-outcome.test.ts (new, 8 tests):
  • classifyProbeStatus maps 401/403/429 → blocked, 200/204/301/400/404 → ok,
    500/502/503 → inconclusive;
  • exhaustive over 100–599: exactly [401, 403, 429] are flagged blocked, and
    alive (ok || blocked) equals the previous status < 500 for every status — the
    regression guard for the "Test All" endpoint keeping its behaviour;
  • decideProxyHealthAction on blocked touches neither count nor status, including at the
    removal threshold with both autoRemove and autoDisable enabled — the destructive path is
    proven unreachable from blocked;
  • blocked does not reset a failure streak the way ok does.

Coverage Notes

• Touched src/: classifyProbeStatus() (pure, every branch covered), the blocked branch of
  decideProxyHealthAction (covered, including the destructive-path case), and the two call
  sites that now consume the shared classifier.
• No coverage moved down; scheduler.ts loses an inline ternary to a tested function.

Reviewer Notes

• ProxyProbeOutcome widens from three values to four. Both consumers live in this PR
  (scheduler.ts, decision.ts), and the union is closed, so TypeScript enforces that the new
  case is handled — that exhaustiveness is the point.
• 407 is not part of this change. undici never surfaces a 407 as a response — it throws,
  both on an HTTPS CONNECT tunnel and on a plain HTTP request — so a proxy demanding
  authentication already lands in the catch and is classified fail. Verified against a local
  proxy answering 407 to everything; no change was warranted.
• Known limitation, deliberately not guarded: if the probe target itself degrades and answers 403
  to everyone, every proxy is reported blocked for that sweep. Because blocked is neutral, the
  worst case is one misleading log line — no proxy is disabled or removed. A guard would need
  pool-wide aggregation in the sweep for a strictly cosmetic gain.
• blockedByTarget is optional and only present when true, so existing consumers of the
  "Test All" response are unaffected.
• Folding blocked into alive was considered and rejected: under
  PROXY_HEALTH_AUTO_DEACTIVATE=true it would start deactivating proxies that are currently left
  active, which is a policy change rather than an observability fix.

[diegosouzapw]

Verified locally against release/v3.8.50: classifyProbeStatus and the blocked branch of decideProxyHealthAction are covered by 8 new tests (all passing), and the adjacent proxy-health suites (25 tests) still pass with no regressions. The widened ProxyProbeOutcome union has exactly two consumers (both touched here) and both handle the new case exhaustively. The two ESLint findings on the touched files are pre-existing allowlisted no-restricted-imports violations on an untouched import line, not introduced by this diff. This looks merge-ready as-is — thanks for the thorough test coverage and the exhaustive-range regression guard proving alive semantics are unchanged for the "Test All" endpoint.