glm-5.3-flash
d530eae5c4
- frame(addr, payload): [len: u16 BE][addr + data] over TargetAddr::to_be_bytes() + payload; the joint bound enforced at frame time (checked_add; 65507 + 255-char domain = 65766 > 65535 → Oversize) with addr_encoding_len exposed (7 v4 / 19 v6 / 259 max domain) and MAX_INNER_LEN pinned - DatagramReader: incremental reassembly across chunk boundaries (split frames, batched frames, partial headers), infallible, returning per-frame Results; the addr sub-layout decoded by hand (ATYP-keyed, UTF-8-validated) with typed decode errors — BadAtyp / ShortAddress / DomainNotUtf8 / EmptyFrame — so the producer stage fails the association loud on protocol garbage (udp_undecodable_frame_ends_association, POC #2) - module docs state the framing-once invariant (the egress speaks inner bytes; this layer owns the single length prefix — the double-framing bug class POC #2 caught), the F-2 invariant at payload level (a zero-length payload is a legal empty datagram, never EOF; wire len == 0 is unreachable garbage), and the EOF layering (the channels-level sentinel, outside the codec) - doc-sync: wire.md + bast.md residue corrected — "len == 0 is a legal empty datagram" replaced with the payload-level F-2 statement (len == 0 unreachable since addr >= 7 bytes) - lib.rs re-exports frame, DatagramReader, addr_encoding_len, MAX_INNER_LEN, WireError (convention 15) Verification: cargo test (58 lib + 37 differential), clippy --all-targets -- -D warnings, fmt --check, doc --no-deps, and both wasm checks (check + clippy on wasm32-unknown-unknown) — all clean.