Honor bytes after case repair

Reject a case-only correction when its normalized master-seed length conflicts with an explicit --bytes selection.\n\nSecurity: the direct normalization path now applies the same caller constraint as searched candidates and does not disclose the mismatched artifact.\n\nValidated with the full CLI test module, Ruff, formatting, and mypy.

Author: BenWestgate

src/codex32/cli.py

@@ -562,6 +562,12 @@ def _correct(
     interpreted = _case_interpretation(value, immutable, context.profiles, None)
     if interpreted is not None:
         candidate, search_value, erased, immutable = interpreted
+        if (
+            candidate is not None
+            and isinstance(byte_length, int)
+            and len(candidate.artifact.text) != _ms_text_length(byte_length)
+        ):
+            raise _UsageError("--bytes does not match the corrected master-seed backup length.")
     else:
         candidate = None
     capture_layers: list[tuple[int, int]] = []

tests/test_cli.py

@@ -1860,10 +1860,14 @@ def test_correct_suggests_the_majority_case_for_mixed_case_damage() -> None:
     mixed = source[:position] + source[position].upper() + source[position + 1 :]
 
     result = _invoke(["correct"], mixed)
+    wrong_length = _invoke(["correct", "--bytes", "32"], mixed)
 
     assert result.exit_code == 1
     assert source in result.stderr
     assert "No valid correction found" not in result.stderr
+    assert wrong_length.exit_code == 2
+    assert "--bytes does not match" in wrong_length.stderr
+    assert source not in wrong_length.stderr
 
 
 def test_correction_hides_internal_candidate_reparse_failures() -> None: