const MAX_RECORD_LEN: usize = 16_640;
Max TLS record length per RFC (2^14 + 256 headroom); a larger declared length is treated as malformed.