transport: the framer's head piece states its declared body length (declared_len), for 1.5.5's pre-body download cap

[MattJackson]

Why (ARCHITECT ruling, 1.5.5 parity)

1.5.5's plugins.fetch downloader refused an honest over-cap declared length before reading any body byte: "GET {url}: declared Content-Length {len} exceeds the {cap}-byte plugins.fetch download cap" (v1.5.5 source; the same text sits in predev's crates/busbar-kernel/src/preflight.rs today). In 1.6.0 the download moves onto the host connector (#805, crates/busbar-core-connector/src/fetch.rs), and the connector cannot see the declared length:

• the head field block never carries it: crates/busbar-contract/src/abi/transport/fields.rs:14-16 says the framer drops it because the pieces carry the body the framer already unframed;
• busbar_contract::conn::Piece had no length field.

fields.rs:14-16 stays true. The declared length is not a field and never enters the block. It travels as its own typed value on the head piece, the way code and retry_after_secs already do.

The change

A neutral declared_len: "the body length the message's head declared on the wire, if it stated one". It is a statement, not a count of delivered bytes.

• Transport ABI abi::transport::FramePiece appends declared_len: u64 at offset 40 (size 40 -> 48). It is present under the new flag PIECE_HAS_DECLARED_LEN = 128, the HAS-flag encoding code/retry_after_secs use (absent = flag clear, value 0). This is a pre-release layout change and the transport ABI version is unchanged (ARCHITECT). tests/golden/abi-layout.golden, tests/layout_golden.rs and include/busbar_plugin.h are updated together (#define, struct field, size and offset asserts, in the generator's format). check_framer admits the bit only on a field block; anywhere else it is framer.piece.declared_len_not_fields.
• SDK sdk_hyper::Piece gains declared_len: Option<u64>, and fill sets the flag and value, so a Rust framer states it.
• Connection table conn::Piece gains declared_len: Option<u64>. Its mechanical lowering abi::host::conn::WirePiece appends declared_len at offset 72 (72 -> 80) under WirePiece flag PIECE_HAS_DECLARED_LEN = 4, so a plugin reading the table sees it too.
• Connector carries it from the framer's piece (Got) into the table's piece untouched, with no interpretation. Every other piece literal in the workspace names it absent.

RED

• busbar-core-connector connector_tests::a_framers_declared_body_length_reaches_the_tables_head_piece: a TestDoor framer (new fields / declared_len knobs), driven over a real loopback far end through the connector's table, states 2^40 on its head field block. The table's Fields piece carries declared_len == Some(2^40). A framer stating none yields None.
• conn_lowering_tests::every_operation_crosses_the_lowering: it crosses the WirePiece lowering both ways (Some/None).
• sdk_hyper fill_states_a_heads_declared_length_where_it_declared_one.
• transport_check_tests::a_declared_length_rides_a_field_block_only.
• The layout golden and the header stay in sync (layout_golden, abi-header).

No skip, no #[ignore].

Next

#805's fetch.rs consumes Piece::declared_len to refuse an over-cap download before the first body byte. No oracle cell covers the over-cap refusal; the url cell is egress.fetch|plugins|url.

Why every transport plugin repins past this (row 81)

FramePiece grows 40 -> 48 bytes and WirePiece 72 -> 80. Both are array-element / out structs, so the stride changes. No check crosses the host/plugin boundary for them: FramePiece has no size field and each side only asserts its own build (const _: () = assert!(size_of::<FramePiece>() == ..)); WirePiece.size is written by the host and validated by no plugin; the loader (plugin-loader dispatch/load.rs table::<K>) checks only the ops table's slots/size. A transport framer built at an older pin and dropped in would therefore mis-stride the piece arrays while passing the unchanged ABI version check. Pre-tag, appends are guarded by the layout golden without a version bump (BUSBAR-1.6.0.md l.1211; R9), so the guard is row 81: every roster transport plugin (tcp, stdio, webrtc; http/ws/grpc with their door changes) is repinned past this commit.