A branch ref makes a fresh opam install resolve whatever main points
at that day; every other pin in the tree names a commit. This is
main's current head, the revision the switch already has installed.

An 0xFFFF_FFFF (or 0x7FFF_FFFF) int literal folds into the bytecode
as an out-of-range constant on a narrow-int target, and wasm_of_ocaml
truncates it with an integer-overflow warning in every wasm build.
Int64.to_int at binding time produces the identical mask on every
backend - the wide mask where int is wide, the all-ones no-op where
the value cannot exceed the width anyway - with no constant left to
warn about. Bound once per module on the packet-hot paths (ip
checksum folding, firewall conntrack keys).

Header.fold_src_change / fold_dst_change adjust a stored Internet checksum
for the source/destination address changing to a new value, reading the
old address words in place (RFC 1624, via Crc.internet_replace16). A NAT
engine folds the same delta into the IP header checksum and the transport
checksum without re-summing the packet -- and without hard-coding the
header's address offsets at the call site.

The IPv6 first 32-bit word is now decoded as three explicit big-endian
bitfields -- version (4 bits, must be 6), traffic class (8), flow label
(20) -- per RFC 8200/2474/3168/6437, in place of one version_flow word
with an XOR range check. Regenerate Ip.3d, the EverParse C validator and
its endianness header from the codec; the agree test matches the C parser
to the OCaml decoder across 512 inputs.