Python's validate_icon accepted emoji: (not str.isspace(), category
Cf) while the generated JS isEmojiPayload rejects it via \s, so the backend
could store a key the admin and panel silently fall back on. An exhaustive
code-point sweep shows U+FEFF is the only divergence; add it to the
forbidden set. ZWJ U+200D stays valid.
Add tools/icons/emoji-payload-cases.json, a shared verdict table asserted
by both tests/test_core_icons.py (validate_icon) and the admin Vitest
suite (resolveIcon), so any future divergence fails one of the suites.
Task: 8286a894-133f-4582-90fb-88f47eef6628 (review finding NQ-ICON-01)
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
overseerandClaude Opus 5.5
23d21977c6