nx_sov_endpoint.nx

nx_sov_endpoint.nx -- the ONE place that knows how to reach our own edge. WHY THIS EXISTS. Every caller that talks to the sovereign edge has been hand-writing its own endpoint: `https://nishifamily.com`, or the loopback connect-override `127.0.0.1:8443`, or a bare `:443`. The working answer has been carried between sessions as folklore -- "use 127.0.0.1:8443 for our own domains" -- which is a workaround living in prose, not a fix living in code. When :443 degrades, every one of those call sites fails independently and each one has to be rediscovered by hand. MEASURED 2026-07-31, not recalled. From this laptop, against the live host: :8443 sovereign client 5/5 OK raw TCP 20/20 TLS1.3, LE cert :443 sovereign client 0/5 OK raw TCP 18/20 flaps between serving our real cert and actively refusing The flap is a listener that is NOT one of ours -- `nx_hostctl status` lists no sovereign service on :443 -- so we cannot supervise it and must not depend on it. :8443 is sites.elf, ours, and was stable across every probe. THE RULE THIS ENCODES: 8443 before 443, loopback before the wire. It is policy plus a reason, in data, so that a future edit that reorders these has to confront the measurement rather than quietly restore the folklore. The note string is not decoration -- the gate requires every endpoint to carry one, so the policy cannot be changed silently. This module is deliberately PURE: ordering and URL construction only, no sockets. A resolver that probed the network could not be gated offline, and an ungated resolver on the path to every fetch is worse than folklore. license_tier: ORIGINAL