Cut the face-room human line on a code point boundary - #2642

Verdict: PASS at 0fe3ef1
Written-by: Reviewer
Attestation: 0fe3ef1 role=Reviewer

Ran at this tip:

$ cd /data/dsh/bot/workspace/tmp2642/tip/plugins/social && TZ=UTC FLYBOT_CORE=/data/dsh/bot/workspace/tmp2642/tip/core DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node --import ./test/resolve.mjs --test test/face-text-bounds.test.js
$ TZ=UTC FLYBOT_CORE=/data/dsh/bot/workspace/tmp2642/tip/core DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node --import ./test/resolve.mjs --test "test/*.test.js"
$ cp /data/dsh/bot/workspace/tmp2642/face-rooms.base.js /data/dsh/bot/workspace/tmp2642/red/plugins/social/src/face-rooms.js && cd /data/dsh/bot/workspace/tmp2642/red/plugins/social && TZ=UTC FLYBOT_CORE=/data/dsh/bot/workspace/tmp2642/red/core DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node --import ./test/resolve.mjs --test test/face-text-bounds.test.js
$ cd /data/dsh/bot/workspace/tmp2642/tip && node .github/scripts/changelog.mjs check && DSH_HARNESS=/data/dsh/bot/workspace/d2607/repo/core/dev/harness node scripts/lint-plugins.mjs && node .github/scripts/check-mojibake.mjs --check
$ cd /data/dsh/bot/workspace/tmp2642 && node probe.mjs
# tests 596  # pass 596  # fail 0

Affected file alone: 12 tests / 12 pass / 0 fail at the tip; with the one source line back on the base blob: 9 pass / 3 fail (exit 1). Full social suite at the tip: 596 pass / 0 fail (exit 0).

1. Red first. Tip tarball of 0fe3ef16d3af, social test file: 12/12 green. Red copy = the same tip tree with plugins/social/src/face-rooms.js replaced by the base blob from dafedecec44f and the new tests kept: not ok 9, not ok 10, not ok 12 — 9 pass / 3 fail, exit 1. Not ok 9's message is not well formed: "aaaa…" (the lone d83d from .slice), not ok 12 is the EF BF BD byte assertion. Restoring the tip line returns 12/12, so the three new cases are pinned on the fix, not on the harness. My first full-suite run showed 1 fail, but that was my environment (DSH_HARNESS pointed at one checkout while the tip's own core/ was resolved); re-run with FLYBOT_CORE=<tip>/core gives 596/596, matching the PR body's 596.

2. Semantics (plugins/social/src/face-rooms.js:328). cutCodePoints is the file's own helper at :28 — String(value ?? '').toWellFormed(), then Array.from(text).slice(0, max).join('') — so the budget is code points and a kept prefix ends on a code point. String(payload.text ?? '') is unchanged, so null/undefined/no text still encode "" and 42 still encodes "42"; the probe over {who:'Tester'}, {text:null}, {text:42}, {} and {who:null} gives byte-identical text/who/keys on base and tip, and FLYBOT-FACE-HUMAN\n plus {v:1,who,text} are untouched. At the bound, 'a'.repeat(17_999)+'🙂': base = 18 000 units / not well formed / lone surrogate; tip = 18 000 code points / well formed / emoji whole. '🙂'.repeat(18_000): base 9 000 code points, tip 18 000. The 18 000 is now the same code-point budget social.js:1880 already applies to the outgoing room-share line. One deliberate side effect worth naming: an input that already contains a lone surrogate now comes out as U+FFFD (via toWellFormed) instead of being carried into the JSON — still well formed, and carrying it was the corruption path.

3. Scope. Whole-file diff dafedecec44f:plugins/social/src/face-rooms.js → tip is exactly one line (328c328, .slice(0, 18_000) → cutCodePoints(…, 18_000)). PR files: 4 — source, test/face-text-bounds.test.js, docs/subsystems/social.md, changelog.d/2641.fixed.md — and nothing else. The other five cutCodePoints sites in the file (:86 name, :207/:232 line, :511 platform, :620 platform text) are byte-identical, and cleanFaceName on the who line (:327) is untouched.

4. Test quality. Four new cases, all with real assertions: the boundary case asserts the exact restored string (fails on the base blob), the cap case asserts Array.from(stored).length === 18_000 and exact content (base gives 9 000), the short line asserts pass-through equality, and the last asserts Buffer.from(text,'utf8') contains no EF BF BD. They route through the file's shapes() helper, which itself asserts typeof === 'string', value.isWellFormed(), no \p{Surrogate} and no U+FFFD — so isWellFormed() is checked, not implied. Nit only, not a blocker: no case goes past the cap on code points (test 2 sits exactly at 18 000), so the checkpoint's "a forced cut" is a little generous; the bug(social): the face-room human line is cut at UTF-16 unit 18 000 and stores half an emoji #2641 reproduction itself is pinned.

5. Checkpoint. Block 1 285 chars (≤1 500); pr 2642, claim Dev, issue 2641; summary 515 chars / 5 sentences; files 4, all four in the diff; checks.ran lists five real commands, result green, at = 0fe3ef16d3af64440fc6365fef3acbfbb34c2fef (40 chars); next 23 chars. Body carries Written-by: Dev, Fixes #2641, Owner: Dev, Reviewer: Reviewer in its first four lines (different Bots), and the agent-pr label is set.

6. Checks at the tip. All runs at 0fe3ef16d3af except enqueue-guard: tests-ok, ubuntu-latest · Node 24 · DSH 0.2.0-rc.2, plugins (social), plugins (tree), plugins (timeline), plugins (workflow), package, merge-gate, reviewed tip, risk tier, agent-audience, policy-sign = success; enqueue-guard = failure with do not enqueue #2642: no Verifier report names the tip 0fe3ef16d3af — the expected red this PASS clears. Locally at the tip: changelog.mjs check 8 fragments well formed, lint-plugins 0 errors / 16 warnings, check-mojibake --check 0 U+FFFD in 1 536 files.

Tier: risk-rules.json lists plugins/social/src/** under T3, so this needs the PASS above before the queue; the PR is mergeable (mergeable: true).

Not run: full npm run verify (the core suite, build-client --check and the ds-bot patch check have no file in this diff), and check-arch-docs (needs git); docs/subsystems/social.md is updated in the PR instead of a Docs-not-needed: trailer.