fix: reject invalid metric text

ingest.py

@@ -52,6 +52,7 @@ def _config(value):
                 raise ValueError(
                     "config string values must have at most 512 characters"
                 )
+            item.encode("utf-8")
         elif not _number(item) or item < 0:
             raise ValueError("config counts must be finite nonnegative numbers")
     return value or None
@@ -86,6 +87,7 @@ def validate(payload):
         for key, value in metrics.items():
             if not isinstance(key, str) or not 1 <= len(key) <= 128:
                 raise ValueError("metric names must contain 1 to 128 characters")
+            key.encode("utf-8")
             if not _number(value):
                 raise ValueError("metrics must contain only finite numbers")
         entry_config = _config(entry.get("config"))

test_ingest.py

@@ -97,6 +97,18 @@ def test_nonfinite_and_oversized_payload_rejected(client):
     )
 
 
+@pytest.mark.parametrize(
+    "updates",
+    [
+        {"metrics": {"\ud800": 0.2}},
+        {"config": {"model": "\ud800"}},
+    ],
+)
+def test_unpaired_surrogates_rejected(client, updates):
+    response = client.post("/ingest", content=json.dumps(batch(**updates)))
+    assert response.status_code == 400
+
+
 def test_retry_is_idempotent_and_cannot_overwrite_metric(client):
     from trackio.sqlite_storage import SQLiteStorage