feat(store)!: narrow pub mod wire to the minimal adapter surface (#210)

[joeldsouzax]

Closes #210 — a Tier-1 1.0-API-freeze blocker (milestone "1 — Nexus: Pre-Freeze (1.0 blockers)"), sibling of #208 (which sealed arrayvec). Same theme: shrink the public surface before the freeze makes it permanent.

Why

nexus-store/src/lib.rs does pub mod wire;, re-exporting every pub item in wire.rs — including raw byte-offset constants and the internal FrameHeader / FrameFormatVersion types. Once 1.0 freezes, downstream code could hard-depend on HEADER_FIXED_SIZE == 19, the offset values, or the FrameHeader field set, turning the on-disk byte layout into a public SemVer commitment. That defeats the purpose of the frame_format_version byte (#205), whose whole point is that the frame stays evolvable. Also resolves a CLAUDE.md rule 4 violation ("internal wire-format helpers must be pub(crate), not pub"). An adapter only needs encode_frame/decode_frame + the result/error types — fjall proves it.

This is a visibility-only change. The on-disk bytes are identical before and after.

Keep public (the adapter contract)

encode_frame, decode_frame, EncodedFrame, DecodedFrame, FrameOffsets, WireError, DecodeError, PAYLOAD_ALIGN.

Demoted to pub(crate)

• HEADER_FIXED_SIZE
• all *_OFFSET consts: VERSION_OFFSET, GLOBAL_SEQ_OFFSET, SCHEMA_VERSION_OFFSET, EVENT_TYPE_LEN_OFFSET, META_LEN_OFFSET
• META_LEN_ABSENT
• FrameFormatVersion (+ CURRENT)
• FrameHeader (+ SIZE, the format_version / global_seq / schema_version fields, read_from)

The unused FrameHeader::event_type_len / metadata_len accessor methods are deleted rather than carried as dead pub(crate) code (rule 4 / YAGNI). They were exempt from dead_code only because they were pub; internal code reads the private fields directly, so demotion would have made them dead. DecodedFrame / EncodedFrame stay public and expose no FrameHeader / FrameFormatVersion in any field or method, so nothing public references a demoted type.

fjall consumer fixes

• The only cross-crate use of a demoted item was a #[cfg(test)] re-export EVENT_VALUE_HEADER_SIZE = wire::HEADER_FIXED_SIZE in wire_key.rs, consumed by one scan.rs white-box test (stream_decode_rejects_non_utf8_event_type). Rewrote that test to derive the event-type start offset from the public decode_frame(..).offsets.event_type.start and deleted the re-export. The test still forges invalid UTF-8 in the event-type bytes and asserts the exact FjallError::EnvelopeCorrupt { stream_id: "user-1", version: 7 } — same corruption path, still fails on regression.
• Reworded two fjall intra-doc links ([\wire::HEADER_FIXED_SIZE`], [`wire::META_LEN_ABSENT`]) to plain text so cargo doc(thenexus-doc` gate) stays green once the targets are private.

Verification

• nix flake check (pre-commit hook): all checks ✅ — clippy, doc, nextest, fmt, deny, audit, hakari, toml-fmt.
• Hand-run cargo clippy --all-targets --all-features -p nexus-store -p nexus-fjall: clean apart from two pre-existing range_plus_one lints in wire.rs's #[cfg(test)] module (lines 906, 1220 — untouched by this PR).
• Grep confirms no crate other than nexus-store itself names any demoted wire item.

Breaking change

Several nexus_store::wire::* items (HEADER_FIXED_SIZE, the *_OFFSET constants, META_LEN_ABSENT, FrameFormatVersion, FrameHeader) are no longer reachable from downstream crates.

🤖 Generated with Claude Code