Module text 

Cutting a &str at a byte offset without splitting a character.

Rust panics on &s[..n] when n lands inside a multi-byte character, and this workspace slices strings at fixed byte budgets in a lot of places: script-tool I/O caps, ACP frame chunking, region seed truncation, dashboard column fitting, log previews. Every one of those had grown its own while !s.is_char_boundary(end) { end -= 1 } loop with its own comment explaining why - and two sites (lev test’s response preview and lev setup’s key redactor) never grew one at all and panicked on any emoji.

That failure has happened for real: a byte cut-off through a flag emoji inside a Rhai host function double-panicked and aborted the whole daemon. Keeping the walk-back in one tested place means a new truncation site cannot forget it. The workspace denies clippy::string_slice with no exceptions, so reaching for a raw &s[..n] instead of these helpers is a compile error.

substring and split_at_boundary are the general replacements, and both are total: no combination of offsets makes either panic. That matters more than it sounds. The proof obligation on &s[a..b] is real but it is discharged by reading, and the sites that need it most are byte-offset scanners walking text nobody in this repo wrote - fetched HTML, a model’s fenced output, an SSE frame off the wire. Those are exactly the places where a careful reading is least likely to be right, and where being wrong took the daemon down. Clamping is a worse answer than a correct index and a much better one than an abort.

Functions

ceil_char_boundary

Smallest byte index >= min that is a char boundary in s.

estimate_tokens

The workspace’s one generic token estimate: bytes divided by four, rounded up.

floor_char_boundary

Largest byte index <= max that is a char boundary in s.

interpolate

Substitute {name} placeholders in a template.

snippet_around

A window of s around the byte offset at, reaching radius bytes either side, with … marking each end that was cut.

split_at_boundary

s cut in two at mid, walked back to a char boundary.

substring

The text of s between two byte offsets, with both ends walked back to a char boundary and clamped into the string.

truncate_at_boundary

&s[..max], backed off to the nearest char boundary at or before max.