ASIL-B E2E-protected publish pattern always produces payloads exceeding kLINMaxDataLen, and no publish path validates length #17

What's wrong

SAFETY_MANUAL.md documents the canonical ASIL-B E2E-protected publish pattern as Protector::protect() output fed directly into Bus::do_publish() / slave::Node::set_response(). But Protector::protect() always prepends a fixed kHeaderSize header to the payload, so its output is always >= kHeaderSize + payload_len. Since kHeaderSize (10) already exceeds kLINMaxDataLen (8), every payload produced by the documented safety pattern exceeds the LIN frame's maximum data length — even for a zero-byte payload.

None of the actual publish paths validate this:

• Bus::do_publish() (src/virtual/bus.cpp:34-52) only checks id > kLINMaxID, never checks data.size().
• slave::Node::set_response() (src/slave/node.cpp:20-39) likewise only checks id.
• master::Node has no length validation either.

The only function that checks data.size() > kLINMaxDataLen is lin::validate_frame() (src/lin.cpp:57-66), and it is never called from any of these publish paths — its only callers repo-wide are cli/main.cpp:79 and the unit tests.

Evidence

• include/lin/safety/e2e.hpp:33 — kHeaderSize = 10
• include/lin/lin.hpp:36 — kLINMaxDataLen = 8
• SAFETY_MANUAL.md:102-119 (§4.2) — documents exactly this protect() → publish pattern as the ASIL-B-conformant approach
• src/virtual/bus.cpp:34-52 — do_publish(), id-only check
• src/slave/node.cpp:20-39 — set_response(), id-only check
• src/lin.cpp:57-66 — validate_frame(), the only length check, never wired into the publish paths

Why it matters

The documented safety-critical pattern in SAFETY_MANUAL.md is unimplementable as written without silently violating the LIN protocol's own frame-size limit. Any application following the safety manual's guidance will construct out-of-spec frames that either get silently truncated/corrupted downstream or desync the bus, defeating the purpose of the ASIL-B E2E protection it's meant to provide.

Suggested fix direction

Either (a) call lin::validate_frame() (or an equivalent length check) from do_publish() and set_response() so oversized frames are rejected with a clear error instead of silently accepted, or (b) fix SAFETY_MANUAL.md's example so the documented pattern only protects payloads small enough that kHeaderSize + payload_len <= kLINMaxDataLen (i.e. payloads of at most kLINMaxDataLen - kHeaderSize bytes, which is currently negative — meaning the pattern needs a fundamentally different header/payload budget, not just a smaller example).