nx_acme_dns01_propagation.nx

nx_acme_dns01_propagation.nx -- real DNS-01 TXT propagation poll. Replaces the fixed sys_sleep_ms(360000) "hope it propagated" wait in nx_acme_dns01_issue with an ACTIVE poll: after the _acme-challenge TXT records are created at Porkbun, query DNS until the expected value(s) are VISIBLE, then trigger immediately -- bounded by a ~6 min ceiling so a propagation stall never hangs the renewal (it falls through to trigger, matching the old behaviour's worst case). WHY query the AUTHORITATIVE nameserver, not just 1.1.1.1: The same name _acme-challenge.<domain> is reused every renewal with a NEW value; a public recursive resolver can serve the PREVIOUS run's cached TXT RRset (TTL 600s) and report "visible" against stale data, or cache a negative answer. The authoritative Porkbun NS always serves the live zone -- exactly what Let's Encrypt's own validators resolve. So we: 1. look up the zone's NS set (recursive resolver), 2. resolve one NS hostname -> IP, 3. query the TXT DIRECTLY at that authoritative IP. If NS discovery fails we fall back to a public resolver (still bounded). Sovereign UDP (sys_socket SOCK_DGRAM / sendto / recvfrom) + nx_dns wire codec + nx_dns_txt parsers. No third-party resolver library. license_tier: ORIGINAL (composes nx_dns RFC 1035 + the shipped A-resolver) genealogy_id: international-research-sources/ietf/rfc_1035 + rfc_8555 §8.4