nx_sov_endpoint_gate.nx

nx_sov_endpoint_gate.nx -- proves the endpoint policy matches the measurement. T1 is the whole point: every 8443 endpoint must rank ahead of every 443 one. That ordering is not taste, it is the 2026-07-31 measurement (8443: 5/5 from our client; 443: 0/5, flapping between our real cert and actively refusing). A future edit that restores :443 to the front has to make this gate RED first, which is the point of writing the policy down as code. T5 requires every endpoint to carry a non-empty note. A silent reordering is the failure mode this module exists to prevent, so an endpoint with no stated reason is itself a defect. T6/T7 are the non-vacuity controls: a bad index must be REFUSED, not served a plausible default URL, and the degraded-port judgement must actually discriminate rather than answering the same thing for every port. license_tier: ORIGINAL