nx_http_client_gate.nx

nx_http_client_gate.nx -- THE REQUEST BUILDER EVERY ESTATE FETCH CROSSES HAD NO GATE AT ALL. Measured 2026-09-03 with nx_catalog: nx_http_client_gate and nx_httpclient_gate both ABSENT -- "no source, no binary, nothing promoted". nx_http_client.nx is imported by nx_https_get_complete, which is imported by nx_https_get, which is what nx_research_fetch and every sovereign fetch ride. An unguarded builder on that path is the widest ungated surface in the fetch lane. WHAT IT PROVES. On 2026-09-03 hc_put_hints was added so the request carries the Chrome client hints and fetch-metadata that match the Chrome-JA3 ClientHello we ALREADY pay for (nx_tls13_chrome_session). The measured cause: fab.com (Cloudflare) answers 403 to the UA-alone profile and 200 to the full profile OVER THE SAME TLS STACK. So the risk this gate exists to hold down is NOT "did we add the headers" -- it is the COHERENCE of the identity we present: * a Chrome UA whose version disagrees with its own sec-ch-ua version is a MISMATCH, and a mismatch is the exact signal anti-bot scoring hunts. T5 compares the two NUMBERS and emits both, so the bar is readable from outside instead of living in a tooth name. * HC_UA_BOT must NEVER acquire Chrome hints. An honest crawler identity that ships sec-ch-ua is no longer honest, and that is a promise to site operators, not a preference. T6/T7 are neg-controls. * a caller that declared its OWN User-Agent must not be contradicted (the 2026-08-25 duplicate-header lesson: THE CALLER WINS). T8 is the neg-control for that. NON-VACUITY. T1-T4 alone would pass for an implementation that emitted the header block to EVERY identity -- which is precisely the honesty regression. The three neg-controls are what make the forward teeth mean anything, and they are named neg-control- so nx_gatelaw_gate's L2 census can see them (a control nobody can find is a control nobody maintains). BITE-PROVEN 2026-09-03 (laptop, admission refused the NAS build): removing the hc_put_hints call site takes it 16/16 GREEN exit 0 -> 11/16 RED exit 1 with exactly the 5 forward teeth failing and all three neg-controls still passing (they assert ABSENCE, which the mutant preserves -- correct discrimination, not vacuity). Restore verified byte-identical, sha256 1952206f85deae97667635964936a64fcabfc5328c47b00bd365805694d4c75e. license_tier: ORIGINAL expect_exit: 0