nx_tls12_reconnect_stress_gate.nx

nx_tls12_reconnect_stress_gate.nx -- LIVE stress proof for the sovereign TLS 1.3 -> 1.2 reconnect path (rung 1 read-correctness + rung 3 retry). The renewal transport (nx_acme_req) tries TLS 1.3, sees api.porkbun.com refuse it, GRACEFULLY tears down the 1.3 socket, reconnects, and completes over the sovereign TLS 1.2 client -- now wrapped in a BOUNDED reconnect- retry so a transient first-flight failure / garbled ServerHello on the rapid reconnect self-heals instead of failing the renewal. This gate drives that EXACT production path against the READ-ONLY Porkbun ping endpoint N times in rapid succession (the condition under which the intermittent 0xC02B cipher garble / -4 READ_FLIGHT was reported), and asserts EVERY handshake completes and the ping returns HTTP 200 SUCCESS. A garbled/unsupported ServerHello FAILS CLOSED (no session) -> the ping would NOT be 200, so 200-every-time IS the zero-garble end-to-end proof. (The record framer's byte-level immunity to fragmentation is proven deterministically + offline in nx_tls12_frag_read_gate.) READ-ONLY: ping returns your IP; NO DNS record is created or modified, NO Let's Encrypt challenge is triggered. Row 0 is a harmless LE 1.3 GET that proves the 1.3 path is still intact through the same transport. Creds: run ./_offc/nx_secret_cli.elf get porkbun first (writes /tmp/nxsecret.out: line1=apikey, line2=secretapikey; a UTF-8 BOM is stripped). expect_exit: 0 license_tier: ORIGINAL