fix(admin): measure the panel in columns, not code units (#401)

[edgehero]

Closes #401.

Every width promise in the admin panel was a UTF-16 code-unit count. clip, pad, styler.cell,
divider, clipPlain, visibleLen, both frame builders' top rules, the line editor's window and the
model-visible runs table all sized themselves with .length, so a framed pane this module reported as
exactly 80 columns came out at 90 in the terminal for a CJK job id, and ragged the other way for a
combining mark.

content	this module said	the renderer draws
a CJK job id	5	10
fullwidth latin	3	6
Hangul	5	10
combining marks	5	3

One table, in panel.mjs, and the styler comes to it

The issue asked whether the two renderers keep one width rule or deliberately stop sharing one. They keep
one. Importing pi-tui's visibleWidth into style.mjs was the alternative, and that module is
overlay-only and already depends on pi, but panel.mjs owns clip and the monochrome renderer, its
purity pin forbids it reaching the world at all, and the two renderers draw the same geometry. A width
rule that holds in the framed pane and not in the plain one is the shape that holds on one branch of an
if, which #403 had just been about.

That shape then turned up inside this fix. With only frame's top rule pinned, a mutation reverting
box's top rule to .length survived the whole suite. Both are pinned now.

The correction that matters: the table is transcribed from the renderer

The first version of this table was written out of UAX #11 by hand and checked against ten strings. It
passed, and it under-counted 139,820 code points: CJK Extension B through H, Tangut, the Kana
supplement, the Hangul Jamo extensions and every emoji block added since Unicode 13. CJK Extension B is
exactly the repository name this issue is about, so the fix carried the defect it was fixing. In two
classes (an astral character, and a character followed by U+FE0F) it was worse than the .length it
replaced, which had been right there by accident because such a sequence is two code units and two
columns.

The renderer draws these panes, so the renderer is the authority, not the standard. WIDE is its own
double-width set transcribed from the pin; the zero rule is \p{M} plus \p{Cf} plus the fillers; and
one piece of state handles U+FE0F, which asks for the emoji form of the character before it and cannot be
answered by a per-character table at all.

Mc is no longer excepted. The first version reasoned from Unicode that a spacing mark occupies a column.
The renderer says otherwise, and between a standard and the thing actually painting the characters, the
painter wins.

The bolt is two sweeps

Ten examples cannot see a 139,820-code-point hole. The test walks every code point there is, and every
character followed by U+FE0F and by a keycap, requiring that the table never measure narrower than the
renderer and that every place it measures wider is a declared departure.

A second adversarial pass is why the pair sweep is real rather than claimed. The first repair's commit,
docblock and spec row all said "plus every character-with-U+FE0F pair"; the test had a six-entry list, and
the hole was one selector further along. A keycap (twelve bases plus U+FE0F plus U+20E3, drawn as one
key) measured 1 against the renderer's 2. That is an under-count, so it is fixed rather than stated.

That pass also found the structural half. The first repair put the U+FE0F state inside columnsOf alone,
and sliceColumns and the line editor call that function one character at a time, where a base is 1 and
its selector is 0, so the cut spent a budget of 2 on a glyph drawn 3 wide and the pane overflowed. One
generator now yields {text, cols} steps: the count sums them, the cut takes whole ones, and they cannot
disagree.

The direction is the whole property, and "over-counting is harmless" would be too kind. Both directions
rag a frame, differently. An over-count pads a body line as though it were wider than it is, so the line
comes out short and the right border sits left of the one above it, contained by the pane. An under-count
runs the line past the pane and past the terminal, where it wraps and takes the border with it.

The oracle's version is asserted, not just its presence: pi depends on pi-tui by a range, so a resolve
that is not the lockfile's would answer any 0.80.x, and a table pinned to the wrong renderer is not
pinned.

What is left is a class, not one shape

The table sums steps, so every run the renderer collapses into one glyph comes out wider than it draws: an
emoji ZWJ sequence (6 against 2), and also a skin-tone modifier, a regional-indicator flag pair, a Hangul
jamo cluster and a Devanagari cluster. Saying the ZWJ sequence was the only one was the other claim the
second pass refuted. All of them over-count, so all of them draw short inside the border rather than
through it, and terminals disagree with each other on all of them. The issue also asked whether a grapheme-aware cut should replace the
UTF-16 slice: sliceColumns walks code points, so a cut never lands inside a wide character and never
leaves half a pair, and a grapheme-aware count is what the ZWJ residual would need.

Repaired with it, as the same defect class

• the line editor windowed and padded by code units, so a CJK value measured half what the terminal draws
  and a window edge put a bare low surrogate into the live trigger editor
• renderRuns, the model-visible table behind /dispatch runs, sized its columns by .length, so one
  CJK character in a local:<basename> target shifted every later column of that row
• a cut to zero returned a floating combining mark, and a cut through a ZWJ sequence left the joiner
  dangling in front of the ellipsis
• the cut carried a lone surrogate the input already held, where the old slice-then-repair had dropped it
• two hostile-string caps in the graph model could split a surrogate pair
• the line editor's edit side had the same defect as its render side, and it is the sharper one:
  cursor moved one code unit at a time, so two lefts put it between the halves of an astral pair and
  the next backspace deleted one half, leaving the other in value(), the string that gets saved

Also corrected: three comments and two live spec sentences that overclaimed, the docblock's measurement
table (its numbers were doubled and named two different strings), a dead import with the stale comment
above it, and a clause that was dead because every code point with that property is already in the wide
set.

Checked

Thirty-four mutations, every one red, zero survivors, including every one that survived an earlier commit:
ranges of the wide set one code point at a time, both halves of the zero rule, the U+FE0F and keycap
clauses, the lone-surrogate skip, the dangling-joiner strip, the zero-budget guard, all four divider
measurements, clipPlain, padVisible's strict comparison, both halves of the model-visible table, the
line editor's window, cursor snap and all four edit movements, and both graph caps. The sweep's own scope
is pinned too, by asserting how many code points it walked: narrowing its loop bound to the BMP, which is
where the original hole was, had left the suite green.

Two guard-weakening mutations remain unkillable and are stated in the test rather than chased: loosening an
assertion is unobservable while the thing it guards against is absent. Both are shown live by mutating the
source instead.

Full suite in the CI posture: 4215 tests, 0 fail, 1 skipped. Same under the +399 day clock shift. The
temp-dir, dated-fixture, test-count and revision-row guards all pass, and a run under a fresh TMPDIR
leaves nothing behind.

DES-ADMIN-VIA-PI-EXTENSION amended, and the two other live sentences stating the old claim are corrected
with it. DES-PANEL-SEPARATE-FROM-RECEIVER UNCHANGED, checked. The bidi and zero-width residual is
UNCHANGED and still open as #402: those code points sit outside a control-byte class defined by what a
terminal interprets, and they are a reader-deception question rather than a width one.

No version moved: root and worker 1.10.3, receiver 1.5.0, admin 1.10.2.

Carried from earlier in this round: receiver/src/start.mjs imports @edgehero/pi-dispatch/watch-closer,
which the published worker 1.10.3 does not export, so the next release PR must move the receiver's worker
range to the version that ships it.

The review rounds, and what they cost

Three adversarial rounds each confirmed a defect, which is this project's cap, so the fourth pass decided
merge-with-follow-ups rather than starting another cycle. Worth recording, because the pattern is the
finding:

• Round 1 refuted the first table. It was written out of UAX 2026-07-16-github-trigger-on-pluggable-app-free-auth-plan.md #11 by hand and checked against ten strings,
  and it under-counted 139,820 code points, including the CJK Extension B that this issue is about. In
  two classes it was worse than the .length it replaced.
• Round 2 refuted the repair. A keycap measured 1 against the renderer's 2, and the U+FE0F state lived
  inside the count while the cut and the editor called it one character at a time, so the cut overflowed.
  It also found the line editor's edit side creating half a character in the value that gets saved.
• Round 3 refuted that repair, in the function introduced to prevent exactly this: dropping an orphan step
  spliced its neighbours together, so a cut to one column emitted two. A 24-column pane drew at 43.
• The final pass verified the fix at scale and found one more leader of the same class, with a one-line
  containment, which is applied here rather than filed.

Each round's defect was in the previous round's repair, never in the original diagnosis. The structural
answer that ended it was to stop patching sites: one stepper that the count, the cut and the editor all
walk, and one rule about where half a character is removed.

Filed rather than fixed, under the cap: #417 (the renderer counts a cluster's base twice when the cluster
begins with a non-printing character, an under-count that amplifies) and #418 (two HTML views still size
and cut by code unit). Both are named in the spec entry. #402's text is corrected where this change made
it false.