fix(parser): never panic on malformed/truncated .twasm (reinforce v0)

The error path in expect() sliced self.src[pos..pos+20], panicking with an
out-of-bounds (or non-UTF-8-boundary) slice when a parse error occurred near
end-of-input. peek_word() had the same self.src[start..] hazard. A malformed
.twasm must be a clean Err diagnostic, never a crash.

- expect/peek_word now use self.src.get(..) and a length-clamped error window.
- regression test parser_never_panics_on_malformed_input feeds char-boundary
  truncations of all six examples + adversarial fragments (unbalanced
  delimiters, UTF-8, partial type forms); previously 6 inputs panicked, now 0.

32/32 codegen tests pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

crates/typed-wasm-codegen/src/parser.rs

@@ -83,7 +83,9 @@ impl<'a> Parser<'a> {
 
     fn peek_word(&mut self, word: &str) -> bool {
         let start = self.pos;
-        if self.src[start..].starts_with(word) {
+        // Panic-safe: `get` returns None on an out-of-range / non-char-boundary
+        // index instead of panicking on malformed or truncated input.
+        if self.src.get(start..).map_or(false, |rest| rest.starts_with(word)) {
             let next_char = self.src.as_bytes().get(start + word.len());
             if next_char.is_none() || !next_char.unwrap().is_ascii_alphabetic() {
                 return true;
@@ -132,15 +134,18 @@ impl<'a> Parser<'a> {
 
     fn expect(&mut self, s: &str) -> Result<(), String> {
         self.skip_whitespace();
-        if self.src[self.pos..].starts_with(s) {
+        if self.src.get(self.pos..).map_or(false, |rest| rest.starts_with(s)) {
             self.pos += s.len();
             Ok(())
         } else {
+            // Panic-safe error context: clamp to the end of input and fall back
+            // if the window straddles a UTF-8 boundary, so malformed/truncated
+            // input yields an Err, never an out-of-bounds slice panic.
+            let end = (self.pos + 20).min(self.src.len());
+            let found = self.src.get(self.pos..end).unwrap_or("<end-of-input>");
             Err(format!(
                 "Expected '{}' at position {}, found '{}'",
-                s,
-                self.pos,
-                &self.src[self.pos..self.pos + 20]
+                s, self.pos, found
             ))
         }
     }

crates/typed-wasm-codegen/tests/corpus.rs

@@ -176,6 +176,37 @@ fn parsed_example_corpus_round_trips() {
     }
 }
 
+/// Reinforce: a malformed or truncated `.twasm` must yield `Ok`/`Err`, never a
+/// panic. Feeds char-boundary truncations of every example plus adversarial
+/// fragments (unbalanced delimiters, UTF-8, partial type forms) through the
+/// parser; the test fails if any input panics (out-of-bounds slice, etc.).
+#[test]
+fn parser_never_panics_on_malformed_input() {
+    let examples: [&str; 6] = [
+        include_str!("../../../examples/01-single-module.twasm"),
+        include_str!("../../../examples/02-multi-module.twasm"),
+        include_str!("../../../examples/03-ownership-linearity.twasm"),
+        include_str!("../../../examples/04-ecs-game.twasm"),
+        include_str!("../../../examples/05-tropical-cost.twasm"),
+        include_str!("../../../examples/06-epistemic-sync.twasm"),
+    ];
+    for src in examples {
+        for cut in (0..src.len()).step_by(7) {
+            if src.is_char_boundary(cut) {
+                let _ = parser::parse_module(&src[..cut]); // must not panic
+            }
+        }
+    }
+    for frag in [
+        "", "region", "region X", "region X {", "region X { f: ",
+        "region X { f: i32", "fn", "fn f(", "fn f(&mut region<",
+        "fn f() -> ", "import region", "import region X from \"",
+        "opt<ptr<", "区域 region", "{{{{{", "<<<<<", "region X { invariant {",
+    ] {
+        let _ = parser::parse_module(frag); // must not panic
+    }
+}
+
 #[test]
 fn generated_corpus_round_trips() {
     for seed in 0..512u64 {