Module frame 

The v1 frame codec: [u32 big-endian body_length][u8 frame_kind][body].

body_length includes the kind byte and excludes the four-byte prefix, so the reader knows how much it is about to allocate before it allocates it. Every bound is checked against the announced length, never against what arrived — a peer that claims 4 GiB is refused after four bytes, not after four gigabytes.

The budget is byte-accounted per CONNECTION and per WINDOW, not per frame. A peer that stays inside the frame cap forever cannot outrun its allowance, which is the bound that actually protects a long-lived connection — and because the allowance refills, a long-lived connection is possible at all.

Structs

Budget

One connection’s send and receive allowance, refilling each window.

Frame

One decoded frame. The kind is already known-good; the body is raw bytes that nothing has parsed yet.

Enums

Incoming

The peer closed cleanly between frames, which is not an error.

Functions

read_frame

Read one frame, refusing an illegal length before allocating for it.

write_frame

Write one frame, charging the connection’s egress budget for all of it.