id(web): world-surface presenter accepts cells the Rust wire validator rejects — symbol width/grapheme and continuation-symbol checks missing #724

Summary

The web world-screen presenter (renderWorldSurface) accepts wire cells that the Rust validator for the same wire model rejects, and renders them with a grid span that does not match the glyph — or silently drops a glyph entirely. The two validators for one wire format have diverged.

Evidence (verified this run on current main)

Rust canonical validator — pkgs/id/src/world_presentation.rs, ScreenSurface::render_ansi (lines ~334–365):

• a columns == 0 continuation cell must have an empty symbol (!cell.symbol.is_empty() → reject)
• a columns == 1|2 cell must contain exactly one grapheme (cell.symbol.graphemes(true).count() != 1 → reject)
• the grapheme's UnicodeWidthStr::width must equal columns
• the continuation of a wide glyph must also have an empty symbol

TypeScript presenter — pkgs/id/web/src/world-surface.ts, renderWorldSurface (lines ~57–147):

• only checks cell.symbol.length > 16 (UTF-16 units) and rejects control characters
• never checks grapheme count, never checks symbol width against columns, never checks a continuation cell's symbol is empty

Probe run with vitest against current main (temporary test, since removed):

• {symbol:"界", columns:1} → returns true, rendered as gridColumn: 1 / span 1 — a width-2 glyph squeezed into one column (Rust: width 2 ≠ 1, reject)
• {symbol:"x", columns:2} + continuation {symbol:"Z", columns:0} → returns true, rendered text is just x — the Z glyph is silently dropped (Rust: narrow glyph in 2 columns and non-empty continuation both reject)
• {symbol:"ab", columns:1} → returns true (two graphemes in one cell; Rust rejects)
• {symbol:"", columns:1} → returns true (zero graphemes; Rust rejects)

Existing tests: pkgs/id/web/src/world-surface.test.ts covers bounds, control characters and mismatched wide-cell styles, but no symbol/width or continuation-symbol cases.

Why it matters

The presenter is the browser's safety/validity boundary for guest-supplied screen data ("Render a validated cell grid… return false on invalid wire data"). Accepting cells the producer's own validator would never emit means a malformed or hostile surface can misalign the whole grid (wide glyph in a 1-column span, narrow glyph spanning 2) or lose glyphs with no error — and the divergence will keep growing as either side is edited, since nothing pins them to the same rules.

Acceptance criteria

• renderWorldSurface returns false (leaving the existing view untouched, as today) for:
  • a columns == 1|2 cell whose symbol is not exactly one grapheme
  • a cell whose symbol's terminal width does not equal columns (e.g. 界 with columns:1, x with columns:2, "" with columns:1)
  • a columns == 0 continuation cell with a non-empty symbol
• Width measurement matches Rust's unicode-width semantics for the tested cases (at minimum: ASCII = 1, CJK/wide = 2, combining/ZWJ grapheme clusters handled as one grapheme); the chosen approach (small table, Intl APIs, or a dependency) is documented in the file header
• New cases added to world-surface.test.ts mirroring the Rust-side invariants; existing 3 presenter tests still pass