fix(CommandPalette): cut search highlights on grapheme clusters, not code points

[IgorShevchik]

Linked issue

Closes #364.

Now targets main — #369 has landed (531921ad), so this is a single commit and CI runs on it for the first time. #362 and #375 are covered by @arsalan507's #379, not here — the overlapping work was dropped. This PR will need a rebase once #379 lands, since the grapheme snap subsumes its surrogate snap.

Authorship — please read before reviewing. This branch, its three review rounds and every revision were produced by a single Claude Code session. Nothing here has had an independent reader. The measurements are reproducible but unaudited, and self-review does not substitute for review: each round found real defects in what the previous round had signed off, which is evidence that the process is not converging on its own. This is not only about the v-html-adjacent parts — the correctness argument, the benchmark methodology and the invariant text all carry the same caveat.

Type of change

• Documentation (updates to the documentation or readme)
• Bug fix (a non-breaking change that fixes an issue)
• Enhancement (improving an existing functionality)
• New feature (a non-breaking change that adds functionality)
• Chore (updates to the build process or auxiliary tools and libraries)
• Breaking change (fix or feature that would cause existing functionality to change)

Description

Code points are not what a reader sees. A flag is two regional indicators, a family emoji several joined by ZWJ, कि a consonant plus a vowel sign. Cutting inside one produces a different character rather than a broken one — 🇺🇸 truncated by a single code point re-pairs into 🇸🇺, a different country, with nothing to signal the loss. That is worse than a �, which at least looks wrong.

Both boundaries snap off the straddled cluster: mark insertion in generateHighlightedText, truncation in truncateHTMLFromStart.

Chosen on measurement.

approach	cost	correct?
segment the whole string	455 µs at 979 chars, 52 ms at 100k	yes, unusable
fixed ±64 window	constant 3.2 µs	no
Segments.containing()	see below	yes

The window is worth knowing about, because it is the obvious optimisation and looks ideal. A run of flags is longer than the window, so segmentation starts mid-run and re-pairs the indicators — reproducing the exact bug being fixed, 28 disagreements in 1044 probes.

So containing() ships, behind three guards:

• A < U+0300 screen, keeping ASCII and Latin-1 off the segmenter. It does nothing for Cyrillic (U+0430) or CJK — both above the floor. For a product localised into Russian this covers markup and Latin identifiers, not body text. perf(search): the grapheme-snap fast path skips Cyrillic and CJK — every boundary reaches the segmenter #376 tracks widening it.
• One segmenter view per value, built lazily: 8.1 ms → 0.6 ms over 1600 boundaries.
• An 8192-character ceiling, past which only the surrogate snap applies and every multi-code-point cluster loses protection — not just flags. Note it measures the marked-up string, so the threshold arrives 13 characters earlier than a reading of value.length suggests.

pnpm run bench (test/bench/search.bench.ts): ASCII baseline, Cyrillic and CJK 2.3×, emoji 2.0×, an all-flag run 6.1×.

The snap was the easy half

Every defect review found was in the bookkeeping around it, not in the segmentation — and each one reached the user as duplicated or vanished text rather than as an error, because substring() swaps a range it finds reversed and clamps one it finds out of range instead of throwing.

Four, in the order they were found:

defect	symptom	found in
a region the clamps left empty still emitted its tags	bare <mark></mark>, highlight lost	round 1
a region past the end of the value bypassed that guard — the comparison did not clamp where substring() did	same empty mark, frozen cursor swallowing every later region, and a trailing mark that drove truncation into eating the text before it	round 2
a region nested inside an earlier one ends behind the cursor	[[0,5],[1,2]] on abcdefgh gave <mark>abcdef</mark>defdefgh — the overlap emitted three times	round 3
a non-integer bound	NaN compares false against every guard including end > start, then lands in the cursor, where substring(NaN) reads as substring(0) and repeats the whole value	round 3

All four are guarded, each by a test verified to fail with its guard removed. Both round-3 defects are reachable through CommandPaletteGroup.postFilter, which lets a caller supply its own matches — Fuse itself always emits sorted, merged, integer-bounded regions.

indices are now filtered to integer bounds and sorted before use. The sort's tie-break puts the longest of an equal-start pair first, so the outer region is marked whole instead of being split across two <mark>s.

One clamp went the other way. Mutation testing showed Math.min(…, value.length) on start was unreachable — start can only exceed the value by exceeding end, which is checked — so it was removed rather than left as an untested guard.

Coverage

Every constant and branch was verified by removing it and watching a named test fail. That is what closed the two gaps this PR previously listed as known-and-unfixed:

• The CRLF carve-out had no fixture. It is the only cluster rule Intl.Segmenter never sees, because the < U+0300 screen answers that boundary first — so all three of its mutations passed the whole file.
• The four surrogate range constants were pinned in one direction only. Every fixture held a real pair, which catches a range being narrowed and not one being widened; widening needs two units that are not a pair, i.e. malformed UTF-16, which reaches highlight() through any label built from a byte-truncated field. All four widening mutations passed.

One mutation still survives by design: removing the < U+0300 screen entirely. It is a performance guard and changes no output — the bench is what measures it.

Remaining caveat

The bench is advisory: no assertions, not in CI.

Notes

truncateHTMLFromStart counts retained code units and slices once, because the snap needs an index to move. Verified equivalent over 400,078 fuzzed inputs, including strings beginning with ....

A fixture trap is recorded in the tests: UAX #29 glues a run of bare emoji modifiers into a single cluster, so '\u{1F3FF}'.repeat(20) is one character, not twenty.

Checklist

• I have linked an issue or discussion.
• I have updated the documentation accordingly.

Full suite green on the rebase — 6304 passed, 6 skipped, 270 files. Each new case was verified failing against the unpatched version first. eslint ., vue-tsc --noEmit and pnpm build clean.