pyexpat, sys: state why the two name unwraps are the strict encode

`parser_create3` and `sys_audit` both take their name argument through
`str_utf8_w`, which refuses a lone surrogate, where `space.text_w` upstream does
not. Neither site said why.

For pyexpat the reason is a reader: both stored names come back out through
`w_str_get_value`, which panics on a lone surrogate --
`declared_or_forced_encoding` for the encoding, `namespace_separator` for the
separator. The refusal at the door is what keeps those reads from aborting the
process. The `namespace_separator` arm carried no comment at all; the encoding
arm's pointed at the separator arm rather than at the reader.

For `sys.audit` nothing stores the event, so the encode exists only for the
error it raises; the doc comment now says so.

Comment-only.

Assisted-by: Claude

Author: youknowone

pyre/pyre-interpreter/src/module/pyexpat/mod.rs

@@ -1764,14 +1764,20 @@ fn parser_create3(
         if unsafe { !is_str(encoding) } {
             return Err(parser_create_not_str("encoding", encoding));
         }
-        // The name reaches the expat setup as a `&str`, the same view the
-        // sibling `namespace_separator` arm takes below: a value with no UTF-8
-        // spelling is refused here rather than at that read.
+        // Both stored names are read back through `w_str_get_value`, which
+        // panics on a lone surrogate — `declared_or_forced_encoding` for this
+        // one, `namespace_separator` for the other. A name with no UTF-8
+        // spelling is refused here so that read cannot abort the process;
+        // `space.text_w` has no such reader behind it and so does not need the
+        // refusal.
         crate::baseobjspace::str_utf8_w(encoding)?;
         crate::baseobjspace::setdictvalue_native(parser, "_pyre_forced_encoding", encoding);
     }
     if unsafe { is_none(namespace_separator) } {
     } else if unsafe { is_str(namespace_separator) } {
+        // `namespace_separator` reads this back through `w_str_get_value`, so
+        // the refusal the encoding arm makes applies here too; the length check
+        // below then runs on a value that has a `&str` view.
         let value = crate::baseobjspace::str_utf8_w(namespace_separator)?;
         if value.chars().count() > 1 {
             return Err(crate::PyError::value_error(

pyre/pyre-interpreter/src/module/sys/vm.rs

@@ -2460,6 +2460,10 @@ pub fn register_module(ns: pyre_object::PyObjectRef) {
 /// event name has to be a `str` with a UTF-8 spelling, and the parameters are
 /// positional-only, so every stdlib `sys.audit(...)` call reports a bad event
 /// name at the call rather than carrying it to whichever hook reads it.
+///
+/// The unwrap is `str_utf8_w` and not a surrogate-tolerant read even though
+/// nothing stores the event: the encode is there for the error it raises, so an
+/// event name holding a lone surrogate is a `UnicodeEncodeError` at the call.
 fn sys_audit(args: &[PyObjectRef]) -> crate::PyResult {
     let (positional, kwargs) = crate::builtins::split_builtin_kwargs(args);
     if crate::builtins::has_real_kwargs(kwargs) {