Function encode 

pub fn encode(
    flags: u8,
    collection: &str,
    doc_id: &str,
    timestamp_ms: i64,
    body: &[u8],
    buf: &mut [u8],
) -> Result<usize, MessageError>

Encode a Document envelope into buf. Returns the number of bytes written, or an error if any field exceeds its width, the buffer is too small, or the flags / tombstone-vs-body invariants are violated.

buf is the payload region — callers should already have written the 16-byte peat-lite header (with [MessageType::Document]) into the preceding bytes via super::header::encode_header.

Validity contracts enforced

• collection: non-empty, ≤ MAX_COLLECTION_LEN bytes, must not contain NUL bytes (NUL would create routing-key ambiguity downstream where consumers may treat "markers\0" and "markers" as different OR the same depending on path).
• doc_id: ≤ MAX_DOC_ID_LEN bytes; empty signals publisher-delegates-id.
• body: ≤ MAX_BODY_LEN bytes; MUST be empty when flags & DOC_FLAG_TOMBSTONE != 0. The encoder rejects tombstone-with-body to prevent publisher contract violations that downstream consumers might race write-then-delete against.
• flags: only bits in DOC_FLAGS_MASK may be set. Reserved bits 2–7 plus the encrypted bit (today not implemented) all produce MessageError::InvalidFlags.