moshcode site <name> --proxy <port> validated the port with /^\d+$/. That accepts 0 and out-of-range numbers, and both then fail silently:

• --proxy 0 passes the regex, but 0 is falsy downstream, so servePlan builds a static root server, not a reverse proxy. It reports the site as live.
• --proxy 99999 passes the regex and writes proxy_pass http://127.0.0.1:99999; — a port that cannot exist. It also reports the site as live.

Every other port in the codebase is validated as 1-65535 (console --port, dns --port, dns --parking-port, all with the message needs a decimal integer from 1 to 65535). --proxy was the odd one out.

Before (unmodified main)

Driving the exported serveCommand with a stubbed writer:

--proxy 3000   exit=0  config=PROXY→3000                | blue.eggs → 127.0.0.1:3000
--proxy 0      exit=0  config=STATIC (no proxy_pass)     | blue.eggs → /srv/blue.eggs
--proxy 99999  exit=0  config=PROXY→99999                | blue.eggs → 127.0.0.1:99999

After

--proxy 3000   exit=0  config=PROXY→3000        (unchanged)
--proxy 0      exit=1  refused, nothing written
--proxy 99999  exit=1  refused, nothing written

Change

• src/serve.mjs: validate --proxy as an integer in 1-65535, with the same message style the rest of the CLI uses.
• test/serve.test.mjs: a regression test that 0, 99999, 70000, -1, abc and empty are refused with exit 1 and no config written, plus a control asserting a real port still installs the reverse proxy unchanged.

Full suite: 1214 tests, 1001 pass, 0 fail (1000→1001, one new test). No other files touched.