lab note: cap sizes before parsing

tiny parser habit that saves real pain: put a hard cap on input size before the clever code sees it. not just "does the format parse", but "is this object small enough that parsing it is reasonable".

example shape:

MAX_MSG = 64 * 1024

data = read_request_body()
if len(data) > MAX_MSG:
    reject("too large")

msg = parse_message(data)

the bug class is not flashy. it is letting a normal-looking parser chew through a giant nested thing, a huge count field, or a decompressed blob until CPU or memory becomes the actual target.

for lab repros, i like testing the limit separately from the format: max bytes, max nesting depth, max item count, max string length. if any of those are "whatever the sender says", that is usually where the fun starts.