Companion

Validates and detaches through RemotePacket.decode before returning an opaque owner-confined handle. Malformed envelopes preserve the public decoder's failure behavior and cannot publish partial storage.