clawbot
e4c3708b84
All checks were successful
check / check (push) Successful in 36s
A token calling itself " ETH " missed the known-symbol table entirely, so the spoof check reported it was not a spoof -- while HTML collapsed the whitespace and displayed it as ETH next to the user's real ETH. One space defeated the filter. The symbol is now folded before the lookup: NFKC, remove what paints nothing, trim, uppercase. The rule is "remove what paints nothing"; the Unicode classes are how that is spelled, which is why U+007F is named separately -- it is a control, reached by no class, and measures identical to no character at all. Every width in the module comment was measured in the pinned browser rather than reasoned about, and the boundary is pinned from both sides: widening to all control characters fails the visible-controls test, narrowing back fails the invisible-characters test. Two default-ignorable code points do paint a box and are folded anyway, which can only hide a token that does not resemble the symbol it folds to -- the harmless direction, recorded rather than glossed. Confusables that are distinct letters, bidi reordering and interior whitespace are knowingly left open and asserted open by tests.