Cut peer-supplied face-room text on code points, not UTF-16 units - #2601

Verdict: PASS at 35e2819
Written-by: Reviewer
Attestation: 35e2819 role=Reviewer

Ran at this tip:

$ cd plugins/social && node --test test/face-text-bounds.test.js
# tests 8  # pass 8  # fail 0
$ cp ../base/plugins/social/src/face-rooms.js src/face-rooms.js && node --test test/face-text-bounds.test.js   (red first: base source in the tip tree)
# tests 8  # pass 0  # fail 8
$ cd plugins/social && node --test test/face-rooms.test.js
# tests 38  # pass 38  # fail 0
$ cd plugins/social && node --import ./test/resolve.mjs --test test/social.test.js
# tests 458  # pass 458  # fail 0
$ node .github/scripts/changelog.mjs check
$ node .github/scripts/check-mojibake.mjs --check

Not run: npm run verify — the host exhausted threads on an earlier attempt; bounded runs above instead.

Review notes:

• Tier: T3, from .github/scripts/risk-gate.mjs --pr 2601 run here: risk-tier: T3; basis: plugins/social/src/face-rooms.js=T3, plugins/social/test/face-text-bounds.test.js=T2, changelog.d/2438.fixed.md=T1.
• Red first is a hard requirement and holds: with the tip's new test file and the base face-rooms.js blob, 8/8 fail (not well formed / lone surrogate); at the tip the same file is 8/8 green.
• Scope matches the body and checkpoint exactly — diff -rq between the base tarball and the tip tarball lists only plugins/social/src/face-rooms.js (17+/11-), the new plugins/social/test/face-text-bounds.test.js, and changelog.d/2438.fixed.md. No core, no generated files, no patches.
• The five caps (cleanFaceName 60, cleanFaceRole 80, the two 200-unit error details, the viewFaceEvent fallback 200) all route through one module-local cutCodePoints that calls toWellFormed() and Array.from(...).slice(...), so a cut lands on a code point and the caps count code points. One factual note on the brief: the change does not import core/src/shared/text-boundary.js — a peer plugin cannot reach into core (@flybot/social fails to import when installed: face-rooms.js reaches into core/src/shared via a repo-relative path #155), so the rule is repeated locally exactly as social.js's cutCodePoints already does; the behaviour asked for is the same and the two copies agree (toWellFormed + Array.from, the latter also guards non-finite max, which is dead here because every caller passes a literal).
• Checks at this tip: 19 runs, all completed. tests-ok, merge-gate, Node 24, package, all four plugin jobs, mock, judge, policy-sign and reviewed tip success; the only failure is enqueue-guard, which is red because this PASS did not exist when it ran — no other failure.
• changelog.mjs check reports 9 well-formed fragments and check-mojibake.mjs --check reports 0 occurrences of U+FFFD over 1528 text files, so the change adds no mojibake and its fragment is shaped right.
• Not run locally: npm run verify (thread exhaustion on this host when two run at once, as the brief noted) and the core/patches checks — no core or generated file is in this diff, and CI tests-ok at this exact tip ran them green.