Proxy detected (Direct), but no TLS handshake or forwarded TLS headers reach the gateway. JA3/JA4, TLS version, and HTTP/2 frame fingerprint contributors will write empty signals. The behavioural detectors still classify correctly, but headless-library bots are harder to catch. Read the recipe to enable header forwarding.