nx_h2_serve.nx

nx_h2_serve.nx -- TUTOR-BOOTSTRAP SCAFFOLD (Claude, authored under the B1 rung(5) connection-driver LIFT of the R4-H2 HTTP/2-transport ladder), NOT credited as team self-authoring (back-fill via the emitter-of-emitters once the daemon-from-spec organ exists -- X-AUT-006c/e/f). THE REUSABLE ALPN-h2 SERVER CONNECTION-DRIVER organ (single responsibility: SERVE ONE already-accepted h2 connection over OUR sovereign TLS 1.3). This is the VERBATIM LIFT of _h2_serve_curl_daemon.nx's PROVEN hcd_run_server (renamed h2_serve_connection, the param scfd -> ss_fd) -- it is NOT a rewrite (BL-012 compose-not-duplicate): the loop already serves an EXTERNAL curl --http2 GET at http_version=2 response_code=200 byte-exact body (knowledge/status/ h2_nx_h2_serve_curl.log). The daemon scaffold now SHRINKS to import this organ and call the lifted driver in a counted accept loop. WHY A NEW ORGAN (rule 9 single-responsibility + rule 15 DRY, not nx_h2_server): nx_h2_server.nx is the PURE in-memory FRAMER (h2_decode_request / h2_server_send_response); its own header (lines 33-35) says it deliberately does NOT import the tls13 record/session transport because "the in-memory gate needs only the framing". The connection DRIVER is a DIFFERENT responsibility: it owns the live TLS-over-socket transport loop (send our SETTINGS -> read-record loop accumulating frames -> ACK client SETTINGS -> parse HEADERS -> respond HEADERS 0x88 + DATA + GOAWAY -> shutdown(SHUT_WR) + drain). Folding transport into nx_h2_server would force its framing gate to import the whole tls13 server-session stack and collapse "framing AND live-serving" into one organ (the 'and' split-test fails). So this organ COMPOSES nx_h2_server for framing + the tls server transport stones. DRIVER CONTRACT (verbatim -- NO new return semantics): h2_serve_connection(ss_fd, srand, sxpriv, cert_der, cert_len, ed_priv, body, blen) -> i64 The session is established INSIDE via nx_tls13_server_session_run_h2_ed25519(ss_fd, ...) (handshake inputs are caller args; the established *Tls13ServerSession is NOT a caller arg -- the caller hands an already-ACCEPTED fd + the per-connection handshake entropy, single-responsibility). Returns 0 on a clean serve (handshake h2 + parsed GET + wrote :status 200 + graceful FIN), or the SAME honest negative codes the proven driver returns: handshake <=0 propagated; -50/-51 record/recv; -53 non-GET; -57/-58 send; -60..-65 settings/ack/ budget; -100 bad preface.