nx_tls13_client_h2run.nx

nx_tls13_client_h2run.nx -- TUTOR-BOOTSTRAP SCAFFOLD (Claude, authored under the R4-H2 HTTP/2-transport-ladder workflow, capstone NBC-FETCH-001), NOT credited as team self-authoring. THE h2-NEGOTIATING TLS 1.3 client handshake orchestrator. It is the byte-for-byte twin of nx_tls13_client_session_run.nx (step 3c.6b) EXCEPT the ClientHello it emits advertises ALPN ["h2"] ONLY (via the new tls13_client_hello_emit2_h2only / tls13_ext_emit_alpn_h2_only). Consequence (RFC 7301 §3.2): the server either selects "h2" -- so a CONNECTED session here means the application-data channel IS HTTP/2, no encrypted-EE ALPN parse needed -- or it MUST abort the handshake with no_application_protocol. This is how a sovereign client makes "TLS ALPN selects h2" a yes/no the caller can branch on. FOUNDED ON (composes, does NOT reinvent -- anti-orphan law; each imported EXACTLY ONCE, the RC6 double-import landmine avoided): - nx_tls13_client_session.nx (the session struct + emit-CH internals + transcript update; it transitively imports nx_tls13_hello.nx where the new h2-only ClientHello emitter and ALPN-h2-only extension live) - the recv_sh / recv_hs / emit_finished / derive_app step organs and nx_tls13_read_record_from_fd -- the SAME set nx_tls13_client_session_run imports, so the handshake body is identical to the proven HTTP/1.1 run. This module deliberately does NOT import nx_tls13_client_session_run.nx (that would double-define _write_n etc.); helper / const names carry an _H2 suffix so a caller may import BOTH this and the http/1.1 run with no symbol clash. BACK-FILL: the team RE-AUTHORS this from the DATA spec (knowledge/specs/2026-06-13-http2-transport-ladder.md) via the emitter-of-emitters (X-AUT-006c/e/f); this hand scaffold is the sanctioned one-time bootstrap only (meter-integrity). license_tier: INDEPENDENT_REDERIVE genealogy_id: international-research-sources/ietf/rfc_8446 + rfc_7301 + rfc_9113 lineage_id: nishi_tls13_client_h2run_r4h2_capstone