nx_fetch_any.nx

nx_fetch_any.nx -- EAT THE FETCH DEBT (operator 2026-07-14): the ONE intelligent fetch DISPATCHER the researcher / census / adversary / critic route through, so they "use and switch and be intelligent about" the ~200 fetch organs "as we gather information so we dont get errors and return nothing without informing the user." Rule-15 DRY: this does NOT add a new fetcher -- it COMPOSES the proven primitives into ONE classify->cascade->always-inform entry point. THE TWO SILENT FAILURES THIS KILLS (both proven live this session): * SILENT-EMPTY : a handshake/host failure returned 0 and the researcher banked NOTHING, with no record. * SILENT-BAD : nx_https_fetch_follow_best returns a Cloudflare 403 CHALLENGE PAGE with n>0, and the old rf_fetch_bank banked that challenge HTML as if it were real research (garbage in the corpus). THE CONTRACT (what "informing the user" means mechanically): nx_fetch_any ALWAYS writes a human-readable per-strategy attempts log into `att` (never left empty), and returns the byte count of a VERIFIED-REAL page (2xx, non-challenge, >= FA_MIN_BYTES) or 0. On 0 the caller MUST surface `att` (rf_fetch_bank banks it as <name>.fail) -- absence becomes DATA, never silence. THE CASCADE (each rung a real, existing, gated primitive): S1 nx_https_fetch_follow_best -- sovereign TLS-1.3 (2 hellos) -> TLS-1.2, redirects, cookie-jar+age-gate S2 nx_https_get_spoof -- real Firefox UA + browser Accept (+ cf_clearance cookie when supplied); beats UA-gating and Cloudflare walls the raw sovereign JA3 does not. (v2 rungs, wired next: nx_http_fetch plaintext:80 for HTTP-only hosts; nx_browser_fetch meta-refresh/JS.) 100% sovereign (own TLS, nx_cc->nxasm, no curl/wget/gcc). license_tier: ORIGINAL