Both sides kept: the payload check (depth, one value) runs before the mark scope opens
and before the held read-only check; the load gate covers slot-held stores.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
Single-file, redb and load_soa refuse a tail at load through check_record_payload,
indexed or not; depth beats a tail is pinned; the dead end guard is gone.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
One private payload check (depth, then one value) behind decode_payload and
raw-envelope/batch admission; refuses a tail by count, never walks or quotes it.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>