One common source of the decomposed form: file names from macOS. HFS+ stored names decomposed, so when an import key is derived from a file or folder name created on a Mac, it can arrive as "Jose\u0301" while the same name typed into a browser form is usually precomposed. Same NFC step fixes it, but it helps to know where the second variant comes from when you go looking.
On the length section: if the display-name limit is also checked in the browser, JavaScript's string.length counts UTF-16 units too, so client and server can agree with each other and still disagree with the user. Intl.Segmenter with granularity "grapheme" gives the client the same unit as StringInfo.