Record layer protocol in the net crate for framing and encrypting TLS records. ContentType enum (ChangeCipherSpec, Alert, Handshake, ApplicationData). Plaintext record read/write with header framing and size enforcement. Encrypted record support via RecordCryptoState with per-record nonce construction (XOR base IV with sequence number), inner content type hiding, and AEAD using AES-128-GCM, AES-256-GCM, or ChaCha20-Poly1305. Alert protocol with close_notify and fatal error handling. RecordLayer type combining plaintext and encrypted modes with runtime crypto state switching. 36 tests covering content types, alert encode/decode, nonce construction, plaintext record I/O, encrypted roundtrips for all cipher suites, sequence numbering, tamper detection, record overflow, and RecordLayer integration with plaintext-to-encrypted transitions. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>