tables: a blob string on a message body carries the content rule (#632)

[rowan-claude]

Closes #632

docs/SPEC-TABLES.md §3.1 states kinds 12 and 33's content rule MET AT A NODE, "A TEXT blob's CONTENT is refused on the same terms", and §3.3 says a form-2 body's content rules are §3's, unchanged in what they reject. A *string blob record carried by a message body was read by BOTH engines without that check, where both apply it at the file site. The two engines were symmetric, so no vector separated them and the corpus could not see it.

Red first

Two gates, one an engine, over blobdemo's Catalog, whose numbering reaches a *string blob through note and a *bytes blob through thumb. test/tables/message_blob_main.cpp is the C++ reference's and TestAStringBlobRecordOnAMessageBodyCarriesTheContentRule is the oracle's. At the first commit both are RED on four rows each: the truncated sequence, the interior zero byte, the overlong encoding and the lead byte 0xFF all load with a silent report.

message blob FAILED: a truncated UTF-8 sequence in a *string blob record is damage, and the batch ends there
message blob FAILED: a zero byte among a *string blob's bytes is damage, and the batch ends there
message blob FAILED: an overlong encoding in a *string blob record is damage, and the batch ends there
message blob FAILED: a lead byte UTF-8 never spells is damage, and the batch ends there

The two silent-report rows stand at that commit and never move: a well-formed blob loads clean, and so do the same ill-formed bytes under the reserved bytes id, because a *bytes blob is bytes and never text.

The fix, one function at the message site

• The C++ emitter, messagevariable.go's PASS TWO, where the record's bytes are already in hand. A blob record aligns before its bytes, so the same pointer goes to the runtime's TableUtf8Valid and to the memcpy under it, and the line is emitted under rootReachesStringBlob, the guard pointers.go emits the file form's under. The check does NOT ride in MessageRecordScan, which is the framing walk LoadMeasure shares: ill-formed content is sizeable, so a measure still answers the region the framing commands and only the decode refuses.
• The Go oracle, messagedecode.go's placement loop, calling textValid under the TString arm alone, which is decodenodes.go's line for the file form.

What differs from the file form is only the recovery: where a file counts the record malformed and reads on with every slot naming it null, a batch ends there. One malformed, the bodies before it stand, nothing after is read (§3.3).

The controls

One blade an engine, each matching exactly one line, each drawn twice.

Against the PAGE: message-blob-accepts-ill-formed in MESSAGE_FORM_CONTROLS, and message-emitter-blob-accepts-ill-formed in the new tables-message-form-blob-negative-control, whose first step is the gate's own true run.

Against EACH OTHER, on two pinned vectors: message_blob_ill_formed_text is blob_str8 re-encoded as a batch of one with the fourth byte of note's payload replaced by 0xFF, and message_blob_zero_byte is that wire with 0x00 there instead. tables-wire-fuzz-message-blob-oracle-negative-control and its leg twin replay both alone and require red on each, with the reports mirrored:

the leg says 0,0,0,0,0,true,read, the oracle says 0,0,0,0,0,false,read
the leg says 0,0,0,0,0,false,read, the oracle says 0,0,0,0,0,true,read

The fuzzer's leg grew one root for them: blobdemo's Catalog is the only root on the roster that can PLACE a text blob record. AssetsTable.cpp was already in CONFORMANCE_SOURCES, so it costs one include and one MESSAGE_VARIABLE row, and the corpus pass runs 45 roots rather than 44.

The page

No new rule and no sentence moved: §3.1 and §3.3 already state it. One HELD BY TEST bullet in §3.3 names the six rows and the three ways a leg goes red.

Results

• go test ./... green
• make tables-wire-fuzz N=20000: 137 seeds over 45 roots, 123311 enumerated + 20000 random = 143311 mutants, 0 divergences, both the plain and the ASan leg
• make tables-message-form-negative-control green, 49 blades including the new one
• make tables-vocab-schema green
• make tables-block-zero-cost: 117 Table sources byte-identical to their pins
• the four new controls green
• make test stops at tables-json-list-walk, which is RED ON MAIN before this branch and unrelated to it: all ten tables/maps units now emit the JSON list half and the gate still calls them list-free. Proven by regenerating tables/maps with main's own emitter through a go build -overlay.

Goldens

Four lines are this branch's, one per emitted message reader whose root reaches a *string blob: blobs/AssetsTable.h twice, maps/DocsTable.h once, arms/GateTable.h once. NO WIRE GOLDEN MOVED. The other re-pinned files were already stale on main from #658 and #662, which moved the emitter without re-pinning tables/maps; the re-pin commit names them.

🤖 Generated with Claude Code