From d29b51be64ba1218a0b50da5c0140a7a8c78daf8 Mon Sep 17 00:00:00 2001
From: Undline <103777919+Undline@users.noreply.github.com>
Date: Mon, 6 Apr 2026 20:10:56 -0400
Subject: [PATCH] codex fix

---
 src/modulr_core/operations/handlers.py |  8 +++++-
 tests/test_operations.py               | 40 ++++++++++++++++++++++++++
 2 files changed, 47 insertions(+), 1 deletion(-)

diff --git a/src/modulr_core/operations/handlers.py b/src/modulr_core/operations/handlers.py
index 9506a7a..83b9b0e 100644
--- a/src/modulr_core/operations/handlers.py
+++ b/src/modulr_core/operations/handlers.py
@@ -278,7 +278,13 @@ def _health_activity_nonneg_points(
                 f"{base}.{field}[{i}] must be a finite number",
                 code=ErrorCode.PAYLOAD_INVALID,
             )
-        fv = float(p)
+        try:
+            fv = float(p)
+        except (OverflowError, ValueError):
+            raise WireValidationError(
+                f"{base}.{field}[{i}] must be a representable finite number",
+                code=ErrorCode.PAYLOAD_INVALID,
+            ) from None
         if fv < 0:
             raise WireValidationError(
                 f"{base}.{field}[{i}] must be non-negative",
diff --git a/tests/test_operations.py b/tests/test_operations.py
index 982c374..bc8b17e 100644
--- a/tests/test_operations.py
+++ b/tests/test_operations.py
@@ -1833,6 +1833,46 @@ def test_report_module_state_rejects_negative_jobs_point() -> None:
     assert ei.value.code is ErrorCode.PAYLOAD_INVALID
 
 
+def test_report_module_state_rejects_health_point_int_overflow_to_float() -> None:
+    """Huge JSON integers must not become float(OverflowError) → 500."""
+    pk = Ed25519PrivateKey.generate()
+    conn = _conn()
+    sender_pub = pk.public_key().public_bytes(
+        encoding=Encoding.Raw,
+        format=PublicFormat.Raw,
+    )
+    reg = make_validated_inbound(
+        pk,
+        "register_module",
+        {
+            "module_name": "modulr.storage",
+            "module_version": MODULE_VERSION,
+            "route": {},
+            "signing_public_key": sender_pub.hex(),
+        },
+        "rms-of1",
+    )
+    dispatch_operation(reg, settings=_settings(), conn=conn, clock=lambda: 1.0)
+    bad = json.loads(_valid_report_module_state_detail())
+    jp = list(bad["health_activity_24h"]["jobs_points"])
+    jp[0] = 10**400
+    bad["health_activity_24h"] = {**bad["health_activity_24h"], "jobs_points": jp}
+    detail = json.dumps(bad, separators=(",", ":"), sort_keys=True)
+    req = make_validated_inbound(
+        pk,
+        "report_module_state",
+        {
+            "module_id": "modulr.storage",
+            "state_phase": "running",
+            "detail": detail,
+        },
+        "rms-of2",
+    )
+    with pytest.raises(WireValidationError) as ei:
+        dispatch_operation(req, settings=_settings(), conn=conn, clock=lambda: 2.0)
+    assert ei.value.code is ErrorCode.PAYLOAD_INVALID
+
+
 def test_report_module_state_strips_unknown_health_keys_with_warning() -> None:
     pk = Ed25519PrivateKey.generate()
     conn = _conn()