nx_tls13_sh_probe_test.nx

nx_tls13_sh_probe_test.nx -- ServerHello DIAGNOSTIC PROBE. The browser's arbitrary-host gap (RUN verdict -5 = RECV_SH_FAIL) swallows the INNER recv_sh cause. This probe surfaces it, per host, from a data-driven host table: HOST <name> CT= first record content type (22 handshake / 21 alert) AD= alert description byte (only when CT=21) PV= tls13_server_hello_parse verdict (only when != OK) LV= legacy_version (771 = 0x0303) CS= chosen cipher (4865=AES128GCM 4866=AES256GCM 4867=CHACHA) SV= supported_versions value (772 = 0x0304 TLS1.3; 0 = absent = server negotiated TLS 1.2 path) GR= key_share group (29 x25519 / 23 secp256r1 / -1 absent) HR= 1 if SH.random == the RFC 8446 HelloRetryRequest sentinel RV= inner nx_tls13_client_session_recv_sh verdict (1 = OK) Exit 0 always -- this is a DIAGNOSIS instrument, not a gate; the browser gate consumes its findings. Bounded reads, 5s socket timeout (KNOWN_LESSONS bounded-parsing discipline). expect_exit: 0 license_tier: ORIGINAL