Normalizes a caller-supplied reinvoke depth to a safe cap seed.
The runaway-loop cap is a signed comparison over a persisted-verbatim seed, and the remote Submit
operation is the one seam where the seed is caller-supplied rather than computed by the engine —
a negative value would BUY hops (-1000 turns a 5-hop cap into 1005). Clamped rather than
refused so a stale client sending zero-adjacent noise keeps working, and no accepted value can
ever weaken the cap. Exported pure because a boundary rule that cannot be tested directly is a
boundary nobody will notice moving.
Normalizes a caller-supplied reinvoke depth to a safe cap seed.
The runaway-loop cap is a signed comparison over a persisted-verbatim seed, and the remote Submit operation is the one seam where the seed is caller-supplied rather than computed by the engine — a negative value would BUY hops (
-1000turns a 5-hop cap into 1005). Clamped rather than refused so a stale client sending zero-adjacent noise keeps working, and no accepted value can ever weaken the cap. Exported pure because a boundary rule that cannot be tested directly is a boundary nobody will notice moving.