nx_https_post_lib.nx

nx_https_post_lib.nx -- URL-LEVEL HTTPS POST WITH A BODY. The primitive that was missing. WHY THIS EXISTS (operator standing order 2026-09-03: "dont build python ... build nishi and nishi estate should have this capability and if it doesnt lets build from the first byte up these capabilities"). Replacing nx_content_put_client.py needs one thing the estate did not have: POST a body to a URL. What existed was a trap and a half-primitive -- nx_https_post_json (nx_https_client.nx) took a URL and a body, issued a **GET**, discarded the body, and returned OK. Corrected to REFUSE by name on 2026-09-03. nx_https_post_complete_xhdr genuinely builds a POST, but takes an ESTABLISHED *Tls13ClientSession and fd -- not a URL. No caller holding only a URL could reach it. The gap was never the POST itself. It was the connect/handshake glue between a URL and that function. IT COMPOSES, IT DOES NOT DUPLICATE. hf_open (nx_https_fetch_lib.nx) already resolves the URL, makes a bounded connect and runs the TLS13 handshake, handing back session/fd/path/host. This file calls it and swaps only the tail: nx_https_post_complete_xhdr where hf_fetch_once calls nx_https_get_complete. There is still exactly ONE connect path in the estate. IT IS A SIBLING RATHER THAN AN EDIT TO nx_https_fetch_lib.nx, measured: that lib has 5 importers and nx_https_post_complete.nx has 5 more. Adding an import to a lib five files depend on, to serve a function none of them call, is blast radius bought for nothing -- the same reasoning that put the RFC 6455 client half beside nx_websocket.nx rather than inside it. IT DOES NOT FOLLOW REDIRECTS, AND THAT IS THE POINT, NOT AN OMISSION. A 301/302 on a POST is historically rewritten by clients into a GET: the method silently changes and the body is dropped. That is EXACTLY the defect this file exists to repair, so following a redirect here would reintroduce it one layer up and call it a feature. hp_should_follow() returns 0 for every status and says why; the caller sees the status and decides. RFC 7231 permits 307/308 to preserve the method, and honouring those is a deliberate future decision with its own gate -- not a default. A POST IS NOT IDEMPOTENT, SO THERE IS NO RETRY HELPER HERE ON PURPOSE. A blind retry of a POST that may have landed double-applies. Callers that need safety must carry their own idempotency key -- which is precisely what nx_content_put's per-chunk sha CAS already does. PROVEN 9/9 GREEN 2026-09-03 by nx_https_post_lib_gate against the PURE request builder: method is POST, body travels verbatim, Content-Length equals body_len, and the GET builder is carried as the control that makes the method claim mean something. exit contract: returns response bytes written to `out`, or a negative HF_ERR_* from the shared set. license_tier: ORIGINAL No hw writes (Rule 26). LIB (no main).