The new jsonStringCostUpTo guard (returns undefined below a 2-byte cap) was uncovered: forged open frames drive the host ledger down to one byte, and a new open entry's first-fragment cap (logBudget - 1 = 0) trips the guard and truncates to the marker, asserted as the merged entry plus the marker.