fix: enforce utf8 resolution limits

central/app/blocker_resolution.py

@@ -28,10 +28,10 @@ def validate_resolution_input(payload):
         return None, "value must be a string"
     if not isinstance(payload.get("reason"), str):
         return None, "reason must be a string"
-    if len(payload["value"]) > MAX_VALUE_LENGTH:
-        return None, f"value must be at most {MAX_VALUE_LENGTH} characters"
-    if len(payload["reason"]) > MAX_REASON_LENGTH:
-        return None, f"reason must be at most {MAX_REASON_LENGTH} characters"
+    if len(payload["value"].encode("utf-8")) > MAX_VALUE_LENGTH:
+        return None, f"value must be at most {MAX_VALUE_LENGTH} UTF-8 bytes"
+    if len(payload["reason"].encode("utf-8")) > MAX_REASON_LENGTH:
+        return None, f"reason must be at most {MAX_REASON_LENGTH} UTF-8 bytes"
 
     normalized, error = validate_entry(payload)
     if error:

central/tests/test_blocker_resolution_panel.py

@@ -161,6 +161,14 @@ def test_resolution_input_rejects_oversized_and_non_string_fields_cleanly():
         assert error
 
 
+def test_resolution_input_rejects_multibyte_utf8_at_ascii_character_limits():
+    base = {"scope": "PRODUCT", "scope_key": "P-001", "key": "service_cfop", "value": "5102", "reason": "reviewed"}
+    for field, value in (("value", "é" * 512), ("reason", "é" * 2000)):
+        normalized, error = validate_resolution_input({**base, field: value})
+        assert normalized is None
+        assert error and "bytes" in error
+
+
 def test_boundary_length_audit_keeps_required_fields_instead_of_truncating_context():
     session_factory = setup_db()
     blocker_id, admin_id, _ = _seed_blocker(session_factory)