Bounded framing for untrusted peer JSON. No record or chain verification. The request-response layer owns timeouts, including waiting for stream EOF.