Module protocol 

The portable wire protocol: frames, envelopes, text conversion and duration/timestamp domains (W04–W08 in formal/guides/CONTRACTS.md), and the built-in confirmed-mismatch difference over JSON values.

Structs

CompressionConfig

Write-side compression policy.

CompressionReadResult

What decompress_payload produced from a stored payload.

CompressionWriteResult

What compress_payload chose to store, and why.

MismatchJsonDiff

The capped built-in difference list and its uncut length.

Enums

ProtocolError

Wire-level failures that are errors rather than misses.

Constants

MARKER_ESCAPED_RAW

Envelope byte 0x00: the rest is raw serializer output whose own first byte would have collided with a marker.

MARKER_ZSTD_BINARY

Envelope byte 0x02: the rest is one zstd frame of binary bytes.

MARKER_ZSTD_UTF8

Envelope byte 0x01: the rest is one zstd frame of UTF-8 text.

Functions

ceil_supported_cache_ttl_ms

Round a write TTL up to whole milliseconds and check the 365-day domain.

compress_payload

Compress when the payload meets the threshold and the marked result is strictly smaller than the escaped raw form.

decode_frame

Classify one raw read with the protocol’s precedence: absent value, unsupported frame, tracked marker validity and zero stamp, fence, payload encoding, then a hit.

decompress_payload

Reverse of compress_payload, applied to every read.

diff_shadow_mismatch_json

The built-in difference computation over two JSON values.

encode_frame

Encode a frame: version byte, big-endian uint64 stamp, encoding tag, payload. Text payloads receive replacement UTF-8 conversion first.

escape_raw_payload

Prefix raw binary output whose first byte would collide with the envelope.

normalize_read_result

The core trust boundary above wire decoding: drop fences on untracked keys or outside the safe domain, and demote a fenced claim without a fence.

parse_watermark

Parse a watermark bulk string. None input is absent (a valid zero baseline); Some(Err) is malformed; Some(Ok(value)) is a valid stamp.

read_result_from_untrusted_json

Interpret an untrusted JSON-shaped semantic reply from a custom adapter. Unknown shapes become unclassified misses; frame-shaped objects ignore stray miss metadata.

replacement_utf8

Decode bytes as UTF-8 with one U+FFFD per maximal ill-formed subpart and no BOM removal (the WHATWG decoder with replacement error handling).

validate_timestamp_ms

A nonnegative safe-integer timestamp.