nx_tls13_transcript384_gate.nx

nx_tls13_transcript384_gate.nx -- proves the dual-hash transcript (R9, 2026-08-05). WHY: TLS 1.3 picks the transcript hash FROM THE CIPHER SUITE, known only at ServerHello. A single streaming SHA-256 therefore can never serve 0x1302 (AES-256-GCM-SHA384), which is nginx's DEFAULT preference -- so those hosts were unreachable and the crawler then RETIRED them. The transcript now runs BOTH hashes from the first byte. HONEST PROVING METHOD: no invented goldens. The SHA-384 transcript is proven by DEFINITIONAL IDENTITY against sha384_digest -- which is itself NIST-KAT'd in nx_sha384_kat_test.nx. Feeding the same bytes to the streaming transcript and to the one-shot digest MUST agree bit-for-bit. The SHA-256 half is proven UNCHANGED against sha256_digest, which is the regression control: this change must be invisible to every existing caller (client, server and mTLS all share this object). license_tier: ORIGINAL No hw writes (Rule 26). expect_exit: 0