fix(api): align claim bounds across runtime snapshots

client/src/cmbuyer_client/core/validation.py

@@ -25,6 +25,10 @@ MAX_TITLE_CODE_POINTS = 120
 MAX_SKU_TEXT_CODE_POINTS = 80
 MAX_GOODS_ID_ASCII_CHARACTERS = 32
 MAX_MONEY_ASCII_CHARACTERS = 32
+# Go strings.TrimSpace uses Unicode White_Space plus the six ASCII space
+# characters below, but unlike Python str.strip it does not include U+001C--
+# U+001F. Keep the wire contract independent of either runtime's defaults.
+GO_UNICODE_WHITE_SPACE = "\t\n\v\f\r \u0085\u00a0\u1680\u2000\u2001\u2002\u2003\u2004\u2005\u2006\u2007\u2008\u2009\u200a\u2028\u2029\u202f\u205f\u3000"
 
 
 def require_string(value: object, reason: str, *, maximum: int = 4096) -> str:
@@ -35,6 +39,20 @@ def require_string(value: object, reason: str, *, maximum: int = 4096) -> str:
     return value
 
 
+def require_persisted_text(value: object, reason: str, *, maximum: int) -> str:
+    """Validate text stored by Go after TrimSpace, without Python trim drift."""
+
+    text = require_string(value, reason, maximum=maximum)
+    if text.strip(GO_UNICODE_WHITE_SPACE) != text:
+        raise ValidationError(reason)
+    # Python str.strip treats these C0 separators as whitespace while Go does
+    # not. Reject them anywhere on both ends instead of assigning them two
+    # runtime-dependent meanings.
+    if any(0x1C <= ord(character) <= 0x1F for character in text):
+        raise ValidationError(reason)
+    return text
+
+
 def require_uuid4(value: object, reason: str = "invalid_uuid") -> str:
     text = require_string(value, reason, maximum=36)
     if UUID4_RE.fullmatch(text) is None: