fix(orders): narrow the return-reason escape so a plain arrow survives

`sed 's/--*>/-->/g; s/-->/ /g'` rewrote `->` (ONE dash) into `-->` and then
blanked it, so a reason written the way this repo writes prose - "premise ->
dead" - silently lost its arrow. The intent was only to stop a literal `-->`
from closing the trailer's HTML comment early. Replaced with a single
expression matching two-or-more dashes, `s/---*>/ /g`.

Same over-broad-escaping class as the `$`-pattern bug in
pre-state-line-guard.mjs, and invisible for the same reason: the fixture
reason had no arrow. Two checks added - a plain arrow must survive, a literal
`-->` must still be neutralised - so the escape now has both a known-positive
and a known-negative. orders 97 -> 99.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0134iB7ipXGgEpv9imYoVmr2
This commit is contained in:
Kjell Tore Guttormsen 2026-08-17 21:24:37 +02:00
commit 6b26b8e94b
4 changed files with 25 additions and 6 deletions

View file

@ -82,8 +82,15 @@ sanitize_field() { printf '%s' "$1" | tr '\r\n' ' ' | tr -d '\000-\037'; }
COMMIT="$(sanitize_field "$COMMIT")"
REASON="$(sanitize_field "$REASON")"
# The trailer is an HTML comment, so a '-->' inside a reason would close it
# early and leave the rest as body prose.
REASON="$(printf '%s' "$REASON" | sed 's/--*>/-->/g; s/-->/ /g')"
# early and leave the rest as body prose. ONE expression, not a round trip
# through '-->': a `s/--*>/-->/g; s/-->/ /g` pair also rewrites a plain `->`
# into `-->` and then blanks it, so a reason written the way this repo writes
# prose ("premise -> dead") would silently lose its arrow. Same over-broad
# escaping class as the `$`-pattern bug the state-line guard already paid for.
# `---*>` is TWO-or-more dashes then '>', not `--*>` which is ONE-or-more and
# therefore eats a plain `->` as well - the same over-broad match, one character
# narrower, and the selftest carries an arrow fixture that catches it.
REASON="$(printf '%s' "$REASON" | sed 's/---*>/ /g')"
ORDERS="$COORD/$REPO/orders"
CLAIMED="$ORDERS/claimed"