Module strict 

Strict JSON decoding: what serde_json will not refuse on its own.

Three refusals, and only the second needs code here:

• Unknown fields — deny_unknown_fields on every contract type. That works because the field sets are closed, and it is why the four field-less requests are empty STRUCT variants rather than unit ones.
• Duplicate keys, at every depth — serde catches a duplicate of a field it KNOWS ({"limit": 1, "limit": 2} on a typed struct is a duplicate field error). It cannot catch one inside a serde_json::Value: a command’s inline payload is free-form, so {"cost": 1, "cost": 2} three levels down silently keeps the last. That is the hole this module closes, and it matters because the log stores the payload verbatim — a reader replaying it would see a value the sender never confirmed.
• Invalid UTF-8 and trailing bytes — the body is bytes; both are refused before parsing rather than lossily repaired.

The cost is one extra pass. parse walks the bytes into a serde_json::Value rejecting duplicates as it goes, then the target type is deserialized from that value.

Functions

decode

Decode one frame body into T, refusing everything ADR 0001 requires.