fix(codec): 解码映射失败产出 CODEC_ERROR，落实退避重试与可重放白名单

src/test/kotlin/com/gzzn/omms/msgexchange/codec/JacksonXmlCodecTest.kt

@@ -94,6 +94,26 @@ class JacksonXmlCodecTest {
         assertTrue(err.failure.detail.contains("empty-or-non-xml"))
     }
 
+    @Test
+    fun `body shape beyond binding capability is CODEC_ERROR while meta violations stay MALFORMED`() {
+        val meta = "<META><SNDR>AODB</SNDR><SEQN>1</SEQN><DTTM>20021010090311</DTTM><TYPE>SCHD</TYPE><STYP>DNLD</STYP></META>"
+        val recsAsText = "<MSG>$meta<SCHD><RECS>not-a-number</RECS></SCHD></MSG>"
+        val bodyErr = codec.decode(recsAsText) as DecodeResult.Err
+        assertEquals(com.gzzn.omms.msgexchange.domain.ErrorClass.CODEC_ERROR, bodyErr.failure.errorClass)
+        assertTrue(bodyErr.failure.detail.startsWith("xml-mapping"))
+
+        val badSeqn = "<MSG><META><SNDR>AODB</SNDR><SEQN>abc</SEQN><DTTM>20021010090311</DTTM><TYPE>SCHD</TYPE><STYP>DNLD</STYP></META></MSG>"
+        val metaErr = codec.decode(badSeqn) as DecodeResult.Err
+        assertEquals(com.gzzn.omms.msgexchange.domain.ErrorClass.MALFORMED, metaErr.failure.errorClass)
+    }
+
+    @Test
+    fun `broken token stream stays MALFORMED`() {
+        val err = codec.decode("<MSG><META>") as DecodeResult.Err
+        assertEquals(com.gzzn.omms.msgexchange.domain.ErrorClass.MALFORMED, err.failure.errorClass)
+        assertTrue(err.failure.detail.startsWith("xml-parse"))
+    }
+
     @Test
     fun `SIS documented attributes and mixed DELY text become typed payload`() {
         val raw = """