The carriage grows in base64 groups of three bytes, so the frame is not
injective in the payload: payload_bytes_for_frame returns the largest payload
whose frame fits, and the tests say so. The slack of the not-wildly-above check
covers the real nonce being shorter than the worst one.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>