The wire,
drawn to scale.

The head has no length field. It ends at the first empty line, which is why a reader scans for four octets rather than jumping to an offset — and why the octet count it returns matters: everything after it is body, or the next message on a kept-alive connection.

Fields are bytes. Deciding that "v7" is a quoted string is the next layer's problem, and a decision that can fail.

The size is hex and counts the data, not the CRLF that follows it. A chunk extension may sit after the size behind a semicolon, and a reader that treats it as part of the number reads the wrong body.

The last chunk carries zero octets and is followed by the trailers — fields that belong to the message but arrive after its body.

Every frame starts with the same nine octets, so a reader can skip a type it does not know by trusting the length — which is the point of putting the length first.

Flags mean different things per type: the same bit is END_STREAM on a DATA frame and END_HEADERS on a HEADERS one. The type and the flag are read together or not at all. The reserved bit is not spare: a receiver that sees it set treats the frame as a connection error.

The first two bits say how many bits the value has, and the value is written in as few octets as its own size allows. The encoding is self-describing, so a reader never needs the field's type to parse it.

QUIC and HTTP/3 use the same integer, which is why it lives in moonvar rather than here.

The mask is not encryption and is not meant to be: it exists so that a client cannot be tricked into sending octets a proxy would read as a request. That is also why a server must not mask, and why a client that does not mask is refused.

RSV1 belongs to the extension, which is the next plate.

The window is not reset between messages unless the terms say server_no_context_takeover or client_no_context_takeover. A match in message 2 may reach into message 1, which is where most of the ratio comes from.

That is also why a message cannot be decompressed on its own: the stream, not the message, is the unit the compressor works in.

The largest of the two ages wins: what the origin said, and what the trip added. That max is why a response dated in the future is not newborn — the delay still counts.

Freshness is age ≤ lifetime, not <. A response is stale once its age is greater than the lifetime, so the second it turns exactly is still fresh; move the sliders to the boundary and watch the verdict change.

303 is the only one that rewrites for every method: it exists to turn a submission into a fetch. 307 and 308 exist for the opposite reason, and a client whose body cannot be replayed must refuse them rather than send an empty one.

Credentials are a separate decision from the method: Authorization and Cookie are dropped when the origin changes, compared by scheme, host and the effective port.

An alternative is authoritative for the origin, not for itself: a connection to it still presents the origin's name in TLS and its Host. That is what makes it a redirection rather than a different site.

clear as the whole value forgets every alternative the origin ever advertised. A member this reader cannot parse is dropped rather than failing the field: the others are still what the origin said.