Function object_replace_payload 

fn object_replace_payload(cx: &CapCtx) -> Support

The object site’s ReplacePayload rule: the replacement must be the declared payload length, and the object must not carry a status.

The status guard is evaluated first: an object with a status has no payload slot to splice into, so its length is not the interesting fact.