docs: S23.22 read the compliance matrix in order, and fix what it turned up

Bdd/Targets/Common/BddTargetEnterpriseId.h

@@ -1,9 +1,10 @@
 #ifndef BDDTARGETENTERPRISEID_H
 #define BDDTARGETENTERPRISEID_H
 
-/* SMI Network Management Private Enterprise OID used by the example apps and
-   asserted verbatim by the BDD scenario. Real deployments substitute their own
-   IANA-assigned OID under 1.3.6.1.4.1. */
-#define BDD_TARGET_ENTERPRISE_ID "1.3.6.1.4.1.99999"
+/* The enterprise number used by the example apps and asserted verbatim by the
+   BDD scenario. RFC 5612 reserves 32473 for use in examples, which is what this
+   is; a real deployment substitutes its own IANA-registered number. RFC 5424
+   §7.2.2 wants the number alone rather than the 1.3.6.1.4.1 arc it sits under. */
+#define BDD_TARGET_ENTERPRISE_ID "32473"
 
 #endif /* BDDTARGETENTERPRISEID_H */

Bdd/features/origin.feature

@@ -15,7 +15,7 @@ Feature: Structured data — origin
   Scenario: Origin enterpriseId appears in structured data
     Given the syslog oracle is running
     When the BDD target sends a syslog message
-    Then the structured data contains enterpriseId "1.3.6.1.4.1.99999"
+    Then the structured data contains enterpriseId "32473"
 
   Scenario: Origin ip parameter appears in structured data
     Given the syslog oracle is running
@@ -30,7 +30,7 @@ Feature: Structured data — origin
     And the structured data contains tzKnown "1"
     And the structured data contains software "SolidSyslogBddTarget"
     And the structured data contains swVersion "0.7.0"
-    And the structured data contains enterpriseId "1.3.6.1.4.1.99999"
+    And the structured data contains enterpriseId "32473"
     And the structured data contains ip "192.0.2.1"
 
   @no_rtc
@@ -42,5 +42,5 @@ Feature: Structured data — origin
     And the structured data contains isSynced "0"
     And the structured data contains software "SolidSyslogBddTarget"
     And the structured data contains swVersion "0.7.0"
-    And the structured data contains enterpriseId "1.3.6.1.4.1.99999"
+    And the structured data contains enterpriseId "32473"
     And the structured data contains ip "192.0.2.1"

Core/Interface/SolidSyslogOriginSd.h

@@ -44,10 +44,14 @@ SOLIDSYSLOG_EXTERN_C_BEGIN
          *  bound, on the same terms as Software above; RFC 5424 §7.2.4 allows 32
          *  characters. */
         const char* SwVersion;
-        /** NULL omits the enterpriseId PARAM. Truncated to 64 bytes, a bound of this
-         *  library's rather than the RFC's. RFC 5424 §7.2.2 requires an IANA-registered
-         *  private enterprise number, which is the caller's to observe; the value's form
-         *  is not checked. */
+        /** NULL omits the enterpriseId PARAM. RFC 5424 §7.2.2 asks for your
+         *  IANA-registered private enterprise number on its own — "32473", or
+         *  "32473.1.2" if you use sub-identifiers below it — rather than the
+         *  1.3.6.1.4.1 arc the number already sits under. Registering one is the
+         *  caller's to do, and the value's form is not checked here. Until you have
+         *  one, RFC 5612 reserves 32473 for examples and testing: use it in a test
+         *  build, not on a device that ships. Truncated to 64 bytes, a bound of this
+         *  library's rather than the RFC's. */
         const char* EnterpriseId;
         SolidSyslogOriginIpCountFunction GetIpCount; /**< Paired with GetIpAt; either NULL omits the ip PARAMs. */
         SolidSyslogOriginIpAtFunction GetIpAt;

Core/Source/SolidSyslogOriginSdPrivate.h

@@ -13,8 +13,7 @@ enum
 {
     ORIGIN_SOFTWARE_MAX = 48,
     ORIGIN_SWVERSION_MAX = 32,
-    ORIGIN_ENTERPRISE_ID_MAX = 64,
-    ORIGIN_IP_MAX = 64
+    ORIGIN_ENTERPRISE_ID_MAX = 64
 };
 
 struct SolidSyslogOriginSd

Tests/SolidSyslogOriginSdTest.cpp

@@ -52,7 +52,7 @@ static size_t FakeIpCount(void* context)
 static void FakeIpAt(struct SolidSyslogSdValue* value, void* context, size_t index)
 {
     fakeIpContext = context;
-    SolidSyslogSdValue_BoundedString(value, fakeIps.at(index), 64); // ORIGIN_IP_MAX
+    SolidSyslogSdValue_BoundedString(value, fakeIps.at(index), 64); // the fake integrator's own bound
 }
 
 #define CHECK_ENTERPRISE_ID(expected)                                                           \
@@ -343,10 +343,10 @@ TEST(SolidSyslogOriginSd, FormatIncludesEnterpriseIdFromConfig)
 
 TEST(SolidSyslogOriginSd, FormatIncludesDifferentEnterpriseIdFromConfig)
 {
-    useEnterpriseId("1.3.6.1.4.1.99999");
+    useEnterpriseId("32473");
     resetFormatter();
     format();
-    CHECK_ENTERPRISE_ID("1.3.6.1.4.1.99999");
+    CHECK_ENTERPRISE_ID("32473");
 }
 
 TEST(SolidSyslogOriginSd, EnterpriseIdAtMaxLength)
@@ -450,7 +450,7 @@ TEST(SolidSyslogOriginSd, FormatPassesIpContextToIpCount)
 
 TEST(SolidSyslogOriginSd, IpAtMaxLength)
 {
-    const std::string maxIp = repeated('a', 64); /* ORIGIN_IP_MAX */
+    const std::string maxIp = repeated('a', 64); /* the bound this fake applies */
     const std::string expected = R"([origin software="TestSoftware" swVersion="9.8.7" ip=")" + maxIp + R"("])";
 
     useIps({maxIp.c_str()});

docs/platforms/posix/index.md

@@ -26,6 +26,20 @@ a separate role filled by a different platform — the
 [platform × capability matrix](../index.md) shows which — layered over this
 stream rather than replacing it.
 
+### An over-large record is trimmed to the path, not lost
+
+Once the socket is connected the datagram asks the kernel for the path MTU and
+reports what is left after the IPv4 and UDP headers. Before that, or where the
+kernel does not answer, it reports the IPv6-safe payload of 1232 bytes, which is
+the conservative answer the
+[Datagram](../../api/structSolidSyslogDatagram.md) contract asks for.
+
+A send that exceeds the path is reported as oversize rather than as a failure, so
+the sender trims the record to the payload just reported — on a UTF-8 codepoint
+boundary — and sends it again. A record longer than the path therefore arrives
+truncated rather than being dropped, and the truncation is visible to the
+collector as a short message rather than as a gap.
+
 ### The store file is owner-only; its directory is yours
 
 Files are created readable and writable by the owning user alone. That protects

docs/platforms/windows/index.md

@@ -26,6 +26,20 @@ peer authentication. TLS is a separate role filled by a different platform — t
 [platform × capability matrix](../index.md) shows which — layered over this
 stream rather than replacing it.
 
+### An over-large record is trimmed to the path, not lost
+
+Once the socket is connected the datagram asks Winsock for the path MTU and
+reports what is left after the IPv4 and UDP headers. Before that, or where
+Winsock does not answer, it reports the IPv6-safe payload of 1232 bytes, which is
+the conservative answer the
+[Datagram](../../api/structSolidSyslogDatagram.md) contract asks for.
+
+A send that exceeds the path is reported as oversize rather than as a failure, so
+the sender trims the record to the payload just reported — on a UTF-8 codepoint
+boundary — and sends it again. A record longer than the path therefore arrives
+truncated rather than being dropped, and the truncation is visible to the
+collector as a short message rather than as a gap.
+
 ### Winsock initialisation is yours
 
 `WSAStartup` must be called once at process start, before any sender is created,