nx_evclass_route.nx

nx_evclass_route.nx -- route DERIVED oracle rows to the DOMAINS that actually earned them. THE DEFECT THIS CLOSES (measured 2026-08-01): nx_evoracle_sweep correctly derives third-party oracle rows -- RFC 9807, RFC 7748, RFC 9497, FIPS 180-4 -- and writes them ALL to knowledge/status/ evclass_sovereign.conf. But `sovereign` IS NOT A DOMAIN (no sovereign.matrix), while nx_sota_status reads evclass_<domain>.conf per domain. So 7 genuine third-party attestations landed in a file NO CONSUMER READS, and PROVEN stayed 0/41 with the evidence sitting right there. ★★★★★A NEAR-ZERO MATCH MEANS A WRONG JOIN KEY, NOT A MISSING POPULATION. The derivation was never the problem; the rows simply were not addressed to anyone. THE JOIN: every derived row carries `gate=<name>`, and knowledge/compare/<domain>.gates names the gates a domain claims. So gate -> domain is a real, checkable key, not an inference. OUTCOMES ARE NEVER COLLAPSED (the sweep's own law): ROUTED / ALREADY / UNROUTED are counted and named separately -- a row nobody claims and a row already present must never look the same. ⛔CORRECTED 2026-09-03 -- THIS LINE USED TO SAY the rows remain UNSIGNED because at_verify_row refuses them "until an operator-held key exists", and that this organ cannot supply ATTRIBUTION. IT IS WRONG FOR THE TWO CLASSES THIS ORGAN ACTUALLY ROUTES. It was inherited verbatim from nx_evoracle_sweep's header, which was true when IT was written and stopped being true hours later when an agent created knowledge/attest_keys.conf and registered two role=machine keys -- sanctioned there in its own words because for EV_CLASS_ORACLE "independence comes from the REFERENCE, not the signer". PROVEN END TO END 2026-09-03, not argued: a derived oracle row signed with the registered machine key (pub=08fc04ab..4fa8) returned at_verify_row -> OK (rc=0) against the LIVE registry, and nx_attest_ceremony's gate is 10/10 with T6 oracle+machine=OK and T9 experiential+machine=OK. Only T4, class=human, refuses a machine key -- correct, and never to be loosened. ⇒ A RENEWED ORACLE OR EXPERIENTIAL ROW MAY AND SHOULD BE MACHINE-SIGNED. Withholding the signature is what kept PROVEN at 0 while this organ's own header recorded 45 domains holding fresh evidence. ★★★★★★THE COMMENT WAS THE BUG: nothing in the code was wrong, and a stale sentence copied between two organs became an estate-wide belief that only the operator could unblock the honesty ratio. nx_evclass_route [srcfile] default knowledge/status/evclass_sovereign.conf license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0