nx_tls12_frag_read_gate.nx

nx_tls12_frag_read_gate.nx -- DETERMINISTIC partial-read proof for the TLS 1.2 record reader + ServerHello parser. The intermittent "cipher reads 0xC02B instead of 0xC02F" garble was hypothesised to be an INCOMPLETE record read: the 5-byte header says length N but fewer bytes have arrived, so tls12_parse_server_hello runs on a short/shifted buffer. A live host (WSL2/CDN) often delivers the whole flight in one big segment, so the partial-read code path is never exercised live. This gate forces MAXIMAL fragmentation deterministically: a forked child writes a known-good ServerHello record ONE BYTE AT A TIME down a pipe; the parent reads it back through nx_tls13_read_record_from_fd (the exact framer the 1.2 session uses) and parses the cipher. If the record reader truly loops to completion, the reassembled cipher MUST be 0xC02F under any fragmentation. A short-buffer parse would yield a garbled value -> RED. This proves (or refutes) the read mechanism. expect_exit: 0 license_tier: ORIGINAL