Finish the wonderland: System told truthfully, in eight tabs instead of ten

Claude-Session: https://claude.ai/code/session_01Ms2FbjQy31TVf3CEvQhGM8

tests/quickshell/settings-sync-contract

@@ -20,6 +20,14 @@
 #      including every numeric enum -- were accepted unchecked, and numeric
 #      enums were then refused outright once that was noticed.
 #   5. Import is a merge. Settings the file does not mention are left alone.
+#   6. The preview says what would change, in a shape a diff list can render.
+#      "12 settings would change" is a number, not an answer; the page now
+#      shows the rows, so `changes` carries {key, from, to} with both sides
+#      already turned into text. Doing that stringification in the helper
+#      rather than in QML is what makes the cap enforceable: a value long
+#      enough to be something other than a setting is truncated once, here,
+#      instead of being handed whole to a Text element and to anybody reading
+#      over a shoulder.
 #
 # Runs entirely against a temporary config home. The real settings store is read
 # for the export and never written.
@@ -128,6 +136,60 @@ for key in ("gapsIn", "colorScheme", "vrrPolicy", "blurEnabled", "displays", "so
         raise SystemExit(f'{key} was refused and queued for application anyway')
 PY
 
+# ── 6. The preview renders as a diff, and cannot render a secret whole ──────
+
+python3 - "$bundle" "$work/oversized.json" <<'PY'
+import json, sys
+bundle = json.load(open(sys.argv[1]))
+# A real, free-text, non-path string setting, so this exercises a value that
+# genuinely travels rather than one the validator would refuse for its own
+# reasons. 4000 characters is not a location; it is somebody's paste buffer.
+bundle["settings"]["weatherLocation"] = "Bearer sk-fixture-secret-" + ("x" * 4000)
+json.dump(bundle, open(sys.argv[2], "w"))
+PY
+
+"$helper" preview "$work/oversized.json" >"$work/oversized-preview.json" \
+    || fail 'preview failed on a bundle carrying an oversized value'
+python3 - "$work/preview.json" "$work/oversized-preview.json" <<'PY' || fail 'the preview does not describe changes in a shape a diff list can render safely'
+import json
+import sys
+
+CAP = 200
+
+for path in sys.argv[1:]:
+    plan = json.load(open(path))
+
+    if "changes" not in plan:
+        raise SystemExit('the preview does not say what would change')
+    if "changeCount" not in plan:
+        raise SystemExit('the preview lists changes without saying how many there are, '
+                         'so a capped list reads as the whole truth')
+
+    count = plan["changeCount"]
+    if not isinstance(count, int) or count < 0:
+        raise SystemExit('changeCount is not a count')
+    if count != len(plan["apply"]):
+        raise SystemExit(f'changeCount says {count} but {len(plan["apply"])} would be applied')
+    if len(plan["changes"]) > count:
+        raise SystemExit('the rendered list is longer than the number of changes')
+
+    for entry in plan["changes"]:
+        if set(entry) != {"key", "from", "to"}:
+            raise SystemExit(f'a change carries {sorted(entry)}, expected key/from/to')
+        for side in ("key", "from", "to"):
+            if not isinstance(entry[side], str):
+                raise SystemExit(f'{entry["key"]}.{side} is {type(entry[side]).__name__}, '
+                                 'not text a row can render')
+            if len(entry[side]) > CAP:
+                raise SystemExit(f'{entry["key"]}.{side} is {len(entry[side])} characters; '
+                                 'an uncapped value reaches the screen whole')
+
+oversized = json.load(open(sys.argv[2]))
+rendered = json.dumps(oversized["changes"])
+if "x" * (CAP + 1) in rendered:
+    raise SystemExit('an oversized value was reproduced in full in the change list')
+PY
+
 # A clean bundle must arrive intact. Refusing valid settings is the failure this
 # contract exists to catch as much as accepting invalid ones -- fixing the enum
 # check the first time turned every numeric enum into a rejection.