nx_tls13_client_session_run.nx

nx_tls13_client_session_run.nx -- step 3c.6b of the nx_https_client wiring arc. THE top-level TLS 1.3 client handshake orchestrator. Takes a connected TCP fd (from step 2 nx_https_url_connect) + an SNI hostname + caller-supplied entropy + a TrustValidationContext, and drives the full handshake to CONNECTED state. After this primitive returns OK, the returned session can be used by step 4 (nx_https_get_complete) to send + receive application data records. Pipeline: 1. session = session_new(client_random, x25519_priv) (3c.1) 2. emit_ch(session, sni, ch_buf, ch_cap) (3c.1) 3. write_n(fd, ch_buf, ch_len) 4. read_record_from_fd(fd, sh_record, max) (3c.6a) 5. recv_sh(session, sh_record_body, sh_body_len) (3c.2) -- the ServerHello arrives as a TLSPlaintext record so we strip the 5-byte header and pass the handshake bytes 6. Loop until session.state == WAIT_CLIENT_FIN: 6a. read_record_from_fd(fd, hs_record, max) 6b. handle: either ChangeCipherSpec (skip; legacy compat) OR encrypted handshake -- recv_hs(session, record, val_ctx) (3c.3) 7. emit_finished(session, cf_buf, cf_cap) → 58-byte encrypted record (3c.4) 8. write_n(fd, cf_buf, cf_len) 9. derive_app(session) (3c.5) Public API: nx_tls13_client_session_run( fd, sni, sni_len, client_random, x25519_priv, val_ctx ) -> *Tls13ClientSession on success, NULL on failure nx_tls13_run_last_verdict() -> i64 -- last error verdict nx_tls13_run_verdict_is_valid(v) -> 0|1 Sealed verdict (latched in a module-private static when