nx_recycler_bounds.nx

nx_recycler_bounds.nx -- a hardening primitive RECYCLED FROM Heartbleed (CVE-2014-0160; the real intake artifact is knowledge/fetched/recyc_heartbleed.raw). Heartbleed's root: OpenSSL copied a CALLER-CLAIMED payload length into the response without clamping it to the bytes actually received -> it read ~64KB of adjacent process memory past the real record. The fix-by-construction (what they lacked): NEVER trust a claimed length -- clamp to min(claimed, available, capacity). This is the reusable bounds primitive the Nishi Recycler extracted from their garbage; every sovereign parser (TLS/HTTP/X509) should move untrusted length-prefixed bytes through it. ORIGINAL