docs(snapstart): stop calling the guard "fail-closed" without qualification

The guard's summary line and a test-section banner called it "strict, fail-closed"
while the detailed doc a dozen lines below correctly explains that the REQUEST side
forwards an undecidable path rather than 403-ing it. Only the configured side fails
closed, and the review bot has now twice read the summary, concluded the request
side returns 403 on doubt, and re-raised it as a contradiction -- quoting doc text
that was already replaced.

The risk is not the confusion itself but the obvious "fix" it invites: turning the
request-side pass-through into a 403 would reinstate the /reports/100%25 false-403
regression that pass-through exists to prevent.

Both labels now state which half does which, the summary points at the reasoning
rather than summarizing it away, and the term is gone from the codebase entirely
(the remaining historical use in a test comment is reworded to "undecidable
branch").

Comment-only; no behavior change.

Author: bnusunny

src/lib.rs

@@ -580,8 +580,15 @@ fn percent_decode_once(input: &str) -> Option<String> {
     String::from_utf8(out).ok()
 }
 
-/// Canonicalize a path into a list of lowercased segments for the strict,
-/// fail-closed SnapStart hook guard.
+/// Canonicalize a path into a list of lowercased segments for the strict SnapStart
+/// hook guard.
+///
+/// "Strict" means the blocked equivalence class is deliberately wide, NOT that every
+/// input is blocked on doubt. The two halves differ and the difference is
+/// load-bearing: the **configured** side fails closed (an unguardable hook path is
+/// rejected at startup by [`hook_target`]), while the **request** side fails open (an
+/// undecidable request path is forwarded, not 403'd). See the `None` discussion below
+/// for why forwarding is safe — do not "tighten" it into a 403 without reading it.
 ///
 /// The guard must block *every* spelling that the downstream app router would
 /// resolve to the configured hook route, so this over-approximates: it
@@ -2665,7 +2672,8 @@ mod tests {
     }
 
     // ---------------------------------------------------------------------
-    // Strict fail-closed SnapStart hook-path guard
+    // SnapStart hook-path guard: configured side fails closed (rejected at
+    // startup), request side fails open (undecidable paths are forwarded).
     // ---------------------------------------------------------------------
 
     /// Build an ALB request for an arbitrary method + raw path.
@@ -2874,7 +2882,7 @@ mod tests {
             assert_ne!(canonicalize_hook_path(distinct).as_ref(), Some(&hook), "{distinct:?}");
         }
         // A validly single-encoded literal percent (`%25` -> `%`) is DECIDABLE and
-        // must not fall into the fail-closed branch (regression: decode-until-stable
+        // must not fall into the undecidable branch (regression: decode-until-stable
         // used to 403 `/reports/100%25`). It canonicalizes to a concrete route.
         assert_eq!(
             canonicalize_hook_path("/reports/100%25"),