reflect: add DynamicMessage::try_from_message and BridgeError - #414

Addresses items 1 and 2 of #413. Item 3, a reflection path that does not re-encode, remains a separate design topic.

Summary

• Adds DynamicMessage::try_from_message(msg, pool), which resolves the descriptor through M::FULL_NAME and returns a structured BridgeError instead of panicking when the type is missing or the encoded bytes do not match the pool schema.
• Adds DynamicMessage::try_from_message_with_index(msg, pool, idx) for callers that already hold a MessageIndex, returning the underlying DecodeError and mapping over-limit encoding to DecodeError::MessageTooLarge.
• Keeps from_message source-compatible while sharing one bridge decode path across the fallible and panicking entry points.
• Re-exports the non-exhaustive BridgeError from buffa_descriptor::reflect and the crate root, with Display and std::error::Error::source() support.
• Documents the pool-identity invariant of the explicit-index APIs: MessageIndex carries no pool identity, so a foreign index may panic when out of range or silently select a different descriptor at the same position.

Value

The new name-resolving entry point gives runtime-schema users a practical, diagnosable bridge from generated messages to DynamicMessage. Missing types and incompatible descriptors become ordinary errors that can be propagated or logged with the generated type name, while existing generated reflection bridges keep their current API.

The bridge uses encoded-length-scaled memory bounds for bytes the process has just encoded from an already-materialized message, matching the existing generated ReflectMessage::to_dynamic policy. This prevents valid large repeated, packed, or map fields from failing against the fixed default while keeping the second representation bounded; the recursion limit and protobuf 2 GiB size limit remain in force.

Compatibility and boundaries

• from_message is not deprecated; generated reflection code and checked-in WKT output still use it. Its signature and decode-failure panic contract remain, while valid large self-encoded messages no longer hit the fixed default memory budget.
• The name-resolving try_from_message is recommended whenever MessageName is available because the index is obtained from the same pool.
• The explicit-index forms require the caller to keep the pool and index associated. The current MessageIndex representation cannot validate that association without a broader API change.
• Wire-compatible schema drift can still decode successfully, as required by protobuf wire compatibility; only missing types and actual decode failures are reported.
• Element-memory and unknown-field budgets scale with encoded length and retain their existing default floors. The recursion limit remains enabled.
• The final bounded policy follows reflect: stop to_dynamic panicking on views that decoded cleanly #341 exactly (encoded_len * 128 for element memory and encoded_len for unknown fields, each floored at its default); no usize::MAX escape hatch remains.

Tests

Ten colocated bridge tests cover:

• by-name resolution and parity with the explicit-index path;
• MessageNotFound, Decode, Display, and Error::source() behavior;
• schema mismatch through both fallible entry points;
• unchanged from_message decode-failure panic behavior;
• a large self-encoded message that exceeds the fixed default but succeeds under the scaled finite budget;
• scaling, default floors, and finite memory-budget values;
• two-pool out-of-range index panic;
• empty-encoding deferred descriptor panic;
• same-position foreign index silently selecting the target pool's different descriptor, contrasted with the safe name-resolving path.

Verification

Windows 11, pinned Rust 1.95.0, protoc 33.5.

• cargo fmt --all --check: clean.
• cargo clippy --workspace --all-targets -- -D warnings: clean.
• RUSTDOCFLAGS=-D warnings cargo doc --workspace --all-features --no-deps: clean.
• cargo test --workspace -- --skip systemtime_roundtrip_post_epoch: clean.
• The skipped test is an unchanged Windows baseline failure: SystemTime rounds 123456789 ns to 123456700 ns at 100 ns resolution.
• Full bridge module: 10 passed.
• docs/guide.md passes markdownlint. Repository-wide markdownlint has one unchanged baseline finding: AGENTS.md lacks a trailing newline.

Changelog

Includes separate Added and Fixed fragments under .changes/unreleased/, updates the reflection guide with the fallible bridge example and bounded-memory policy, and corrects the existing #341 fragment's wording from "lifted" to the finite scaled-and-floored behavior its code already implements.