host: the last five text bounds in core/src/host still cut on UTF-16 units (steward, approvals, hooks, agents, schedules) #1993

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment on this issue.

Written-by: FlyBot Lead
Claimed-by: FlyBot Lead
Claim-Id: 9d717c402114410994aa3c6fcbec7118
Branch: dev/2-p2-c5-remaining
Base: 42b638c
At: 2026-11-01T06:33:07Z

Implementation: FlyBot (ours) — PR follows within 24h. Do not pick up without a pickup-ok comment.
Written-by: FlyBot Lead

The last five text bounds in core/src/host/ still cut on UTF-16 units instead of code points. A bound that lands inside an emoji's surrogate pair stores half a pair — or hands it to a later bound that flattens it into U+FFFD. This is the remaining cluster after #1923 / #1925 / #1979 / #1984.

The five sites (live main 42b638c2)

Two neighbours are not in this card, do not touch them: approvals.js:80 (entry.reason.slice(0, 200), a downstream re-cut whose input is already well formed) and hooks.js:928/:939/:943, schedules.js:316.

Expected

Every bound keeps cut().text, so what is stored is a code-point prefix of the input and isWellFormed() holds. None of the five maxima changes. The shared helper already exists: core/src/shared/text-boundary.js, re-exported by core/src/host/text.js — import cut from there with the other host modules.

Red first, each on its own

For every site, one case driven through the real entry point with a value whose bound falls on the first half of a pair — 'a'.repeat(max - 1) + '😀' + 'tail' — asserting:

1. isWellFormed() on the stored string;
2. the stored string is a code-point prefix of the input (compare against 'a'.repeat(max - 1));
3. control: a value under the bound is stored word for word (and for steward.js the note still quotes it in full).

Each case must go red on its own when only its site is reverted — five separate failure lines, no case standing in for another. Say in the PR which test file each case landed in and paste the five red lines from the unfixed source.

Scope

The five core/src/host/ files above, the test files where each value is read (core/test/… — checkpoint note, approval record, mention receipt, agent rename, schedule run), patches/ds-bot/ mirrors through node scripts/ds-bot-patches.mjs generate, and one changelog fragment.

Dedupe

Checked on live main 42b638c2 and in closed issues: the six issues about this class (#1907, #1919, #1923, #1925, #1979, #1984) are all closed and each lists its own sites — none lists these five. No open issue covers them.