From the verification round on #212, after its Codex review.
Where: scripts/fleet/card_markup.py FIGURE, whose comment says "digits with thousands commas".
The pattern \d[\d,]* accepts a comma anywhere after the first digit and strips commas before comparing. A card typed <b>32,06</b> is read as 3206: it equals figure_at_pin, the MECHS records: and card_records. Every gate passes, and /mechs/ renders "32,06 habitat records". This predates #212 (main's regex was [\d,]+), but #212 rewrote the regex and its comment claims a format it doesn't enforce.
Fix: require thousands grouping, \d{1,3}(?:,\d{3})+|\d+, so a malformed figure is MARKUP. Add a test case.
From the verification round on #212, after its Codex review.
Where:
scripts/fleet/card_markup.pyFIGURE, whose comment says "digits with thousands commas".The pattern
\d[\d,]*accepts a comma anywhere after the first digit and strips commas before comparing. A card typed<b>32,06</b>is read as 3206: it equalsfigure_at_pin, the MECHSrecords:andcard_records. Every gate passes, and/mechs/renders "32,06 habitat records". This predates #212 (main's regex was[\d,]+), but #212 rewrote the regex and its comment claims a format it doesn't enforce.Fix: require thousands grouping,
\d{1,3}(?:,\d{3})+|\d+, so a malformed figure is MARKUP. Add a test case.