02 FIX2 Blocker Matrix Recheck

T1 10 FIXED + 2 ROUTED is rejected. Authority/version/checksum are partial; arbitrary approver/provenance are disguised hardcode; fingerprint/signoff/hardcode guard remain open; v6 regex removal is disconnected from writer; PUBLIC/Directus routing is not safely contained; capability proof is disguised hardcode. Invalid BLOCK governance is ignored/fail-open.