Parse malformed UTF-8 in MatchResult::from_str without panicking (#114)

[joaquinbejar]

Summary

MatchResult::from_str advanced byte offsets one at a time and sliced with
s[pos..] / s[i..]; a multibyte Unicode scalar before the next delimiter
landed an offset inside the scalar and panicked on a non-char-boundary slice.
FromStr accepts untrusted text and promises Result — it must never unwind.
The scanner now works on s.as_bytes() and slices only at ASCII-delimiter
positions, which are always char boundaries.

Stack

• Stack: orders: Reduce every supported order variant after a partial fill #118 → execution: Parse malformed UTF-8 without panicking #114 → execution: Validate MatchResult invariants during decoding #116 → price-level: Reject quantity overflow before mutating level state #111 → price-level: Reject duplicate order IDs atomically #113 → price-level: Enforce level admission and trade topology invariants #120 → price-level: Resequence quantity increases without exposing an absent order #119 → price-level: Apply UpdateQuantity to the live maker state #115 → price-level: Make execution-statistics failures non-partial and observable #117 → price-level: Make PostOnly and FOK decisions atomic with the sweep #112 (this is 2/10)
• Base branch: stack/1-118-reduce-all-variants
• Stacked on: Resize every matchable order variant on partial fill (#118) #121 — the diff vs main is cumulative; review against the base branch.

Changes

• Byte-safe scanning throughout the FromStr impl: find_next_field, the
  field-name scan, and both bracket scanners (trades, filled-order ids).
  Structural delimiters (=, ;, [, ]) and literal prefixes are ASCII,
  and every byte of a multibyte scalar is ≥ 0x80, so a byte comparison never
  mistakes an interior byte for a delimiter.
• Every direct index is bounds-guarded (audited by architect review);
  malformed input returns the existing InvalidFormat / InvalidFieldValue /
  MissingField errors deterministically. No unsafe, no new deps, no lossy
  normalization, structural validation unchanged.
• Canonical ASCII Display output round-trips unchanged.

Testing

• Regression: 2/3/4-byte scalars in field names, values, trade bracket
  data, filled-order-id lists; unterminated multibyte brackets — all Err,
  no panic (old scanner body panics on these)
• Two co-located proptest properties (1024 cases each): arbitrary UTF-8
  and delimiter-dense structural fuzz never panic
• Display → FromStr round-trip with populated trades + filled ids
• Pre-push checks clean locally

454 tests passed; 0 failed (435 lib + 9 + 1 + 9 doctests).

Checklist

• Code follows rules/global_rules.md and CLAUDE.md
• No .unwrap() / .expect() / unchecked indexing in production code
• Existing hand-written PriceLevelError variants reused — no new variants
• No new production unsafe, no new dependencies (proptest already a dev-dep)
• Module boundaries respected (execution untouched upward)
• Public surface: no signature changes

Note: the filled_order_ids branch's tolerance of trailing content after ]
is pre-existing and out of scope here — it gets tightened in #116 (next in the
stack), which routes FromStr through the invariant validator.

Closes #114

• Blocks: Validate MatchResult invariants during decoding (#116) #123

[joaquinbejar]

The UTF 8 scanner now handles multibyte input without panicking and the focused parser suite passes. One binding safety rule is still violated by the new direct indexing, so the intended effective verdict is REQUEST_CHANGES. GitHub does not accept that event from the PR author, so this review is submitted as COMMENT.

[joaquinbejar]

Thanks for the review. The indexing rule violation is fixed in 8b48449, the whole scanner is .get() based now.

[codecov-commenter]

Codecov Report

❌ Patch coverage is 58.64662% with 55 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
src/orders/order_type.rs	48.23%	44 Missing ⚠️
src/execution/match_result.rs	77.08%	11 Missing ⚠️

❌ Your patch status has failed because the patch coverage (58.64%) is below the target coverage (75.00%). You can increase the patch coverage or adjust the target coverage.

Files with missing lines	Coverage Δ
src/orders/update.rs	93.84% <ø> (ø)
src/price_level/level.rs	93.12% <ø> (ø)
src/execution/match_result.rs	89.61% <77.08%> (+9.79%)	⬆️
src/orders/order_type.rs	47.72% <48.23%> (-0.08%)	⬇️

... and 1 file with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[joaquinbejar]

The UTF 8 scanner now uses guarded accesses throughout, the prior warning is resolved, focused parser validation and CI pass, and I found no new issues. The intended effective verdict is APPROVE. GitHub does not accept an approval from the PR author, so this review is submitted as COMMENT.