Function parse_session_bundle_wire 

pub fn parse_session_bundle_wire(
    value: &CheckedJson,
) -> Result<SessionTrustBundle, SessionBundleError>

Parse a session bundle from its on-the-wire JSON.

Accepts the spec transport envelope {"session_bundle": {<body incl. signature>}} and, for internal callers that never wrap, a bare body. This function is where RFC-AITP-0010’s two DISTINCT failure classes are told apart, by WHERE a violation occurs:

• Wrapper-level (§3): when a {"session_bundle": …} wrapper is present, its member set MUST be exactly {session_bundle}. Any sibling member — notably the pre-erratum shape where signature sat OUTSIDE the wrapped body — is a wire-FORM defect: SessionBundleError::WireFormInvalid, which the error-code mapping surfaces as SESSION_BUNDLE_INVALID.
• Body-level (§5): once the wrapper shape (if any) is confirmed valid, the inner body’s member set is checked against SESSION_BUNDLE_MEMBERS. A member outside that set is not a wire defect — the wrapper/no-wrapper shape was correct — but an unknown member of the signed artifact itself: SessionBundleError::UnknownField, the core UNKNOWN_FIELD code (RFC-AITP-0001 §7), even though the session-bundle artifact is itself draft. This check runs before any cryptographic work, including the coordinator key resolution used to verify the outer signature (RFC-AITP-0010 §5 step 5) — a bundle with an unknown body member is rejected without ever deriving that key.
• Once both member-set checks pass, the value is typed-deserialized. A residual #[serde(deny_unknown_fields)] error at that point can only come from a NESTED closed object (a participants[] entry); from_serde_error recovers the offending field name so it, too, reports SessionBundleError::UnknownField rather than a generic parse failure.

The bare-body path (no wrapper, used by internal callers) applies the SAME body-level member-set check as the wrapped form, so the two entry points never disagree about what a valid body looks like.