nx_https_post_lib_gate.nx

nx_https_post_lib_gate.nx -- THE GATE FOR URL-LEVEL HTTPS POST, 2026-09-03. SUBJECT: hp_should_follow in-process, and the PURE request builder the POST path composes (nx_http_client_build_request_post_xhdr), against its GET sibling as the negative control. WHY IT GATES THE BUILDER AND NOT A LIVE POST. A gate that opens a socket is a gate that fails when the network does, and its RED would indict this code for someone else's outage. The builder is a PURE function -- buffers in, request bytes out -- so every claim that matters about method, body and framing is decidable with no network at all. What the builder cannot tell us (that the connect glue wires the right session) is stated as a limit rather than faked: hp_post_once is COMPOSITION of hf_open, which nx_https_fetch_lib_gate already proves, plus one call. T1 AND T5 ARE THE PAIR THAT CARRIES THIS FILE. The defect that motivated the whole lib was a function named post_json that emitted a GET. T1 asserts the first four bytes are literally POST. On its own that is weak -- a builder that emitted POST for everything would pass it. T5 hands the SAME arguments to the GET builder and requires the result NOT to start with POST, so T1 can only pass on a builder that actually distinguishes the two methods. T3 IS THE BODY-LOSS TOOTH. The old defect did not merely use the wrong verb; it DROPPED THE BODY and still reported success. T3 parses Content-Length back out of the generated request and requires it to equal body_len, and T2 requires the body bytes to appear verbatim. A builder that framed a POST and silently sent nothing would pass T1 and fail both of these. Teeth, in order: T1 the generated request's method is POST. T2 the body appears VERBATIM in the generated request. T3 Content-Length parsed back from the request equals body_len (the body-loss tooth). T4 the Content-Type given is present in the request. T5 NEG-CONTROL: the GET builder on the same arguments does NOT emit POST (so T1 discriminates). T6 an empty body still frames a valid POST carrying Content-Length 0. T7 ANTI-VACUITY: the request grows by exactly the extra body bytes at fixed header width. T8 a redirect status is NOT followed on POST -- following one rewrites the method to GET and drops the body, which is the very defect this lib repairs. T9 hp_should_follow is not a stub that refuses only redirects: 200 is refused too, so the function means "this lib never follows", not "this lib has an opinion about 3xx". MEASURED 9/9 GREEN 2026-09-03. license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0