[siracozmen01]

Problem

Restart in src/segment.c, which muniSegmentIterator_FindBreaksAround calls, guards its first read with position < length. That test is never false: the public function returns before calling Restart when the offset is the length, so the offset is below it, and Align gives the start of the code point that holds the offset, which is at most the offset. Source coverage of every suite at 0c2c23a shows it true 1.78M times and false never. A condition no input can reach reads as if a caller could pass the end of the text here.

Change

Restart reads the code point at the position unconditionally, and its comment says why one is always there.

Verification

• A mutant that removes the condition on main survives every suite, as it must for code with no reachable false branch.
• tools/check.sh pr passes.

Closes #284

[siracozmen01]

Review at 401e27d: ready, once CI goes green. The claim holds for every input.

• One caller. Restart is static, and the only call is in muniSegmentIterator_FindBreaksAround (src/segment.c:650). Feed, the init calls and NextBreak never reach it.
• offset < length on that path. The function returns muni_errorInvalid for offset > cursor->length (line 627). It returns muni_errorState unless the iterator holds its whole text: moreFollows, a pending byte, or a piece not starting at offset 0 (line 637). It returns muni_success for offset == length before Restart (line 642). So Restart runs only with offset < length, which also rules out length == 0.
• The empty last piece. An iterator fed in pieces has cursor->offset != cursor->position once a piece after the first is fed, so FindBreaksAround returns muni_errorState before any read. The end-of-text case, after an empty last piece or not, is the offset == length return. Neither reaches Restart.
• position <= offset. Align returns either offset itself (a stray continuation byte) or a start that only advances while start + size <= offset, so position <= offset < length. CodePointAt then gets at least one byte. Align already read text[offset] before this change, under the same bound.
• The comment states that reason, and the body has Problem, Change and Verification, and no column-0 name( line.

No findings.