nx_evclass_route.nx

nx_evclass_route.nx -- route DERIVED oracle rows to the DOMAINS that actually earned them. THE DEFECT THIS CLOSES (measured 2026-08-01): nx_evoracle_sweep correctly derives third-party oracle rows -- RFC 9807, RFC 7748, RFC 9497, FIPS 180-4 -- and writes them ALL to knowledge/status/ evclass_sovereign.conf. But `sovereign` IS NOT A DOMAIN (no sovereign.matrix), while nx_sota_status reads evclass_<domain>.conf per domain. So 7 genuine third-party attestations landed in a file NO CONSUMER READS, and PROVEN stayed 0/41 with the evidence sitting right there. ★★★★★A NEAR-ZERO MATCH MEANS A WRONG JOIN KEY, NOT A MISSING POPULATION. The derivation was never the problem; the rows simply were not addressed to anyone. THE JOIN: every derived row carries `gate=<name>`, and knowledge/compare/<domain>.gates names the gates a domain claims. So gate -> domain is a real, checkable key, not an inference. OUTCOMES ARE NEVER COLLAPSED (the sweep's own law): ROUTED / ALREADY / UNROUTED are counted and named separately -- a row nobody claims and a row already present must never look the same. ⚠These rows remain UNSIGNED. at_verify_row refuses them until an operator-held key exists. This organ supplies ADDRESSING; it does not and cannot supply ATTRIBUTION. nx_evclass_route [srcfile] default knowledge/status/evclass_sovereign.conf license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0