Repair copy_frame so it copies at most announced bytes of src into dst, never writes past cap, and treats announced as a claim from the caller instead of a fact.

• dst holds cap bytes in total, terminator included. src is NUL-terminated. announced is how many bytes the caller says the frame measures.
• Copying stops at the first of three limits: announced bytes copied, the terminator of src, cap - 1 bytes written. The one that arrives first ends the copy.
• Terminate dst whenever cap is at least 1, truncated copies included. A caller that reads dst after a failure must still find a string there.
• An announced equal to cap does not fit. cap counts the terminator, so the longest frame dst can hold measures cap - 1 bytes.
• A cap of 0 leaves no room for the terminator itself. Write nothing at all and return -1.
• Never compare announced + 1 against cap. A caller is free to announce SIZE_MAX, that sum wraps to 0, and your capacity test turns into a green light.
• Return 0 only when all announced bytes reached dst and dst was terminated. Return -1 in every other case: src ended before announced bytes, cap forced a truncation, or cap was 0.
• The starter builds without a single diagnostic, then copies announced bytes and terminates at dst[announced]. It never looks at cap, and it never looks for the terminator of src.
• Grademe allocates dst on the heap at exactly cap bytes, and src at exactly its real length plus one, so one byte past either block is out of bounds. Every test is replayed under a memory checker and that cell is the real verdict: an overflow of a single byte can leave the text output green while the memory cell goes red.

Repair copy_frame so it copies at most announced bytes of src into dst, never writes past cap, and treats announced as a claim from the caller instead of a fact.

• dst holds cap bytes in total, terminator included. src is NUL-terminated. announced is how many bytes the caller says the frame measures.
• Copying stops at the first of three limits: announced bytes copied, the terminator of src, cap - 1 bytes written. The one that arrives first ends the copy.
• Terminate dst whenever cap is at least 1, truncated copies included. A caller that reads dst after a failure must still find a string there.
• An announced equal to cap does not fit. cap counts the terminator, so the longest frame dst can hold measures cap - 1 bytes.
• A cap of 0 leaves no room for the terminator itself. Write nothing at all and return -1.
• Never compare announced + 1 against cap. A caller is free to announce SIZE_MAX, that sum wraps to 0, and your capacity test turns into a green light.
• Return 0 only when all announced bytes reached dst and dst was terminated. Return -1 in every other case: src ended before announced bytes, cap forced a truncation, or cap was 0.
• The starter builds without a single diagnostic, then copies announced bytes and terminates at dst[announced]. It never looks at cap, and it never looks for the terminator of src.
• Grademe allocates dst on the heap at exactly cap bytes, and src at exactly its real length plus one, so one byte past either block is out of bounds. Every test is replayed under a memory checker and that cell is the real verdict: an overflow of a single byte can leave the text output green while the memory cell goes red.