nx_tls13_read_record_from_fd.nx

nx_tls13_read_record_from_fd.nx -- read ONE TLS record from a file descriptor into a caller-supplied buffer. Step 3c.6a of the nx_https_client wiring arc. This is the network-IO helper that step 3c.6b (the top-level handshake-run orchestrator) uses every time it needs the server's next record. TLS record framing (RFC 8446 §5.1): [0] ContentType (1 byte) [1..2] legacy_record_version (2 bytes, big-endian) [3..4] length (2 bytes, big-endian) [5..] fragment / ciphertext (length bytes) Total record size = 5 + length. This primitive: 1. Reads 5 bytes from fd (looping sys_read to handle partial reads from TCP -- a typical kernel ships TCP data in MTU-sized chunks) 2. Parses the 2-byte length field 3. Validates length <= out_cap - 5 and length <= TLS spec max (2^14 + 256 = 16640 per RFC 8446 §5.2) 4. Reads `length` more bytes from fd into out_buf[5..5+length] 5. Returns 5 + length on success On failure: returns NEGATIVE -NX_TLS13_READ_REC_* code. Public API: nx_tls13_read_record_from_fd(fd, out_buf, out_cap) -> POSITIVE total bytes written | NEGATIVE -verdict nx_tls13_read_rec_verdict_is_valid(v) -> 0|1 Sealed verdict: NX_TLS13_READ_REC_OK positive rc = bytes written NX_TLS13_READ_REC_EOF fd closed before 5-byte header NX_TLS13_READ_REC_PAYLOAD_EOF fd closed mid-payload NX_TLS13_READ_REC_BUF_OVERFLOW length exceeds out_cap NX_TLS13_READ_REC_TOO_LONG length exceeds RFC §5.2 max