pub const MAX_FRAME_LEN: usize = _; // 16_777_216usize
Hard cap on a single frame body (16 MiB). A length prefix larger than this is rejected before any allocation, so a garbage/hostile length can’t OOM the host.