docs(vortex-onpair): simplify decode buffer padding comments

The previous comments described try_decode_into's safe, buffer-derived
bound and fast-path internals, which are implementation-specific and would
not hold if the decode path switches to unsafe decode_into. Keep only the
durable point: pad the output for the decoder's per-token over-copy and
verify the exact size afterward.

Signed-off-by: Francesco Gargiulo <francesco@spiraldb.com>
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: gargiulofrancesco

encodings/experimental/onpair/src/canonical.rs

@@ -95,10 +95,8 @@ pub(crate) fn onpair_decode_views(
         CompactDictionaryView::validate(array.dict_bytes().as_slice(), dict_offsets.as_slice())
             .map_err(|e| vortex_err!(InvalidArgument: "Invalid OnPair dictionary: {e}"))?;
 
-    // `try_decode_into` derives its write bound from the buffer itself, so it
-    // is sound even when the file-borne `uncompressed_lengths` understate the
-    // real decoded size; the extra DECODE_PADDING merely keeps it on the
-    // all-over-copy fast path.
+    // Pad the output with DECODE_PADDING to absorb the decoder's fixed
+    // per-token over-copy; the exact decoded size is checked below.
     let mut out_bytes = ByteBufferMut::with_capacity(total_size + onpair::DECODE_PADDING);
     let written = onpair::try_decode_into(codes.as_slice(), dict, out_bytes.spare_capacity_mut())
         .map_err(|_| {

encodings/experimental/onpair/src/ops.rs

@@ -46,10 +46,8 @@ impl OperationsVTable<OnPair> for OnPair {
             .as_primitive()
             .as_::<usize>()
             .ok_or_else(|| vortex_err!("OnPair uncompressed_lengths[{index}] is null"))?;
-        // `try_decode_into` derives its write bound from the buffer itself, so
-        // it is sound even when the file-borne `uncompressed_lengths` child
-        // understates the row's real decoded size; the extra DECODE_PADDING
-        // merely keeps it on the all-over-copy fast path.
+        // Pad the row buffer with DECODE_PADDING to absorb the decoder's fixed
+        // per-token over-copy; the exact decoded size is checked below.
         let mut buf: Vec<u8> = Vec::with_capacity(len + onpair::DECODE_PADDING);
         let written = onpair::try_decode_into(codes.as_slice(), dict, buf.spare_capacity_mut())
             .map_err(|_| {