gateway tests: an escaped model is capped by its spelling, not its text

[jaredLunde]

What

The nightly deep run (39149108709) failed prop_model_scanner_reads_the_model_serde_reads after 96,349 cases (PROPS_SEED=1792344194988825270).

• The input. The key model, spelled entirely as \u escapes, with a value whose text is 200 bytes but whose escaped spelling is 520 bytes.
• What the scanner did. It read unknown. That is its documented cap (capture_text, since gateway: fourteen defects fixed ahead of the state-as-types refactor #347): an escaped capture that reaches MAX_CAPTURE (256 bytes) may end in a cut escape, which could decode to a shorter, real name, so it reads as no name.
• What the property expected. The full text, because its oracle compared the decoded length against the cap.

No gateway behavior changes. Either outcome is a catalog miss and unpriced, since neither unknown nor a 200-byte name is a catalog row.

Change (tests only)

• The oracle. It reads the value's raw spelling through serde_json's RawValue, which is independent of the scanner. An escaped spelling at or past the cap must read unknown, and that case is now asserted rather than skipped. A text under the cap whose spelling is also under it must read exactly.
• A fixed test. an_escaped_model_is_capped_by_its_spelling pins the counterexample (20 escaped units read unknown), beside a control spelled under the cap (9 units read exactly). The \u escapes are built at run time so the body carries the escapes, not the characters.

Verification

• cargo fmt --check and clippy -p beyond-ai --tests -D warnings pass (Linux).
• The failing seed, replayed with PROPS_SECS=500 PROPTEST_CASES=100000, passes (287 s). The default 60 s budget never reaches case 96,349.
• The full props_lex suite passes, 8/8.

🤖 Generated with Claude Code

https://claude.ai/code/session_01PCAZXpS7FpjaXdEL6JLS4r