nx_tls13_client_session_recv_hs.nx

nx_tls13_client_session_recv_hs.nx -- step 3c.3 of the nx_https_client wiring arc. Consumes ONE encrypted TLS record (the caller has already read it from fd into a buffer, including the 5-byte TLSCiphertext header) and walks the dispatch loop: 1. Decrypt record with session.server_hs_traffic_key + IV + session.server_seq via shipped nx_tls13_record_decrypt -> produces inner plaintext + real ContentType 2. Increment session.server_seq for next record 3. Reject record if ContentType != 22 (HANDSHAKE) 4. Walk the inner plaintext extracting handshake messages (each is [type:1][length:3][body:length]) 5. For each handshake message: - Call shipped tls13_client_dispatch_with_validation (which enforces cert validation at WAIT_CERT via the bridge shipped in c5ddbf81) - Update session.state from out_new_state - If dispatcher returned non-OK -> bail with mapped verdict 6. Return OK after processing all messages in the record Caller invokes this once per record received from fd. After multiple calls the session reaches CONNECTED state (server Finished verified), at which point step 3c.4 emits the client Finished. Public API: nx_tls13_client_session_recv_hs( session, record_bytes, record_len, val_ctx ) -> verdict nx_tls13_recv_hs_verdict_is_valid(v) -> 0|1 Sealed verdict enum: NX_TLS13_RECV_HS_OK record processed (may be partial handshake progress; check session.state) NX_TLS13_RECV_HS_BAD_STATE session not in WAIT_EE..WAIT_SF NX_TLS13_RECV_HS_RECORD_FAIL record decrypt verdict non-OK NX_TLS13_RECV_HS_WRONG_CT decrypted ContentType != 22