Next.js: T-header lookalikes inside JSON can leave stale record lengths #1442

Report

Aram identified this pre-existing case while reviewing #1222:
#1222 (comment)

TCHUNK_PATTERN in crates/trusted-server-core/src/integrations/nextjs/rsc.rs matches a T-header lookalike inside a JSON string. That false match can swallow a later real T header, leaving its declared length stale after URL rewriting.

His decoded input shape:

0:["see 1:T41,"]
2:T2e,{"u":"http://www.googletagmanager.com/gtm.js"}3:"xxxx…"

The real T body becomes {"u":"/integrations/google_tag_manager/gtm.js"}, but its header remains 2:T2e,, declaring 46 bytes for a 47-byte body. The trailing row above is schematic, not a complete executable fixture.

Aram also reproduced the same scan failure for origin-host rewriting on main, with 39 declared bytes and 37 actual bytes. GTM Flight rewriting in #1222 extends the affected URL set. This issue records his reproduction; it has not been independently rerun during the review-thread follow-up.

Expected behavior

Discover T headers only at valid Flight row boundaries, without treating header-like text inside row content as a new record. Preserve original record boundaries before transformations and recompute decoded lengths afterward.

Verification

Add regressions for header-like text inside JSON followed by a real T row, covering origin and GTM rewrites, single and combined payloads, and fragment boundaries. Assert decoded body lengths and unchanged surrounding rows.