Cumulative Value nodes decoded so far in the current top-level decode,
shared by every array and map in the datum and bounded by
MAX_VALUE_NODES. Reset to 0 at each top-level entry (see
DecodeDepthGuard::enter) so the budget composes across nesting
instead of resetting per collection. Charged via charge_value_nodes.
Cap on recursive GeneralDeserializer::deserialize calls. Avro records
may reference themselves ({"name":"X","type":"record","fields":[ {"name":"x","type":"X"}]}), so a malicious file plus matching wire
bytes can recurse forever and overflow the stack.
Sanity cap on the number of Value nodes one top-level decode may
materialize across every array and map in the datum. Arrays and maps apply
it per block (a fast reject for an absurd single-block count) and against the
shared cumulative budget threaded through the whole decode (see
charge_value_nodes / DECODE_NODES).
Charges nodes against the per-datum DECODE_NODES budget shared by every
array and map in a single top-level decode, rejecting once the cumulative
total exceeds MAX_VALUE_NODES. kind ("array" / "map") only labels
the error.