shadowdaoandClaude Opus 5
f43a1ef872
Review found the 512KB cap on buildReportPayload only ever measured on the includeCanvas+canvasState branch -- opt-out and null-canvas paths returned early without checking size at all, and an oversized non-canvas field (description straight from a user's textarea) could slip through with a canvas_state_omitted: 'size' marker that falsely claimed the drop had fixed things. - Truncate description to 5000 chars (matches the server-side validator's future limit), silently: unlike canvas_state, a truncated free-text description is exactly what it looks like, not a misleadingly-plausible partial structure. - Route every return path through finalize(), which measures the actual candidate payload and throws rather than returning an oversized body -- so 'size' can never be attached to a payload that's still over cap. - Keep the opt-out early return structurally separate so canvas_state is never populated from input on that path, regardless of the cap check. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
