nx_cert_loader.nx

nx_cert_loader.nx -- the DATA bridge from the cert REGISTRY (paths) to the TLS handshake (BYTES). The reconciled daemon (R3-transport) does, per connection: MSG_PEEK ClientHello -> SNI host -> cl_load(registry, sni) -> the DER chain bytes + the key bytes -> nx_tls13_server_session_run(cfd, rnd, priv, chain, chain_len, key). This composes the gated cert matcher (nx_cert_registry / cr_match) + reads the matched chain + key files. Returns 1 + fills the (ptr,len) out-boxes, or 0 (then the daemon falls back to its built-in default cert -- fail-safe, never crash the handshake). license_tier: ORIGINAL