v0.22.0 Phase 1 Lexical and Unicode Review

Scope

This review closes the v0.22.0 lexical and Unicode foundation: exact Number, one JSON byte cursor, strict number scanning, exact i64/u64 projection, escape and surrogate decoding, scalar UTF-8 encoding, typed input/allocation failure, and current-context recoverable allocation. Container Value parsing and generation remain outside Phase 1.

Authority Review

• Cursor.byte_offset is the only JSON input position. Number and string logic query or advance that cursor and retain no parallel offset authority.
• NumberShape is the sole normalized decimal summary. Integer projections consume it and the retained exact token; they do not repeat lexical validation or convert through floating point.
• Attempt<T> alone classifies lexical input and allocation failure. Public wrappers apply aborting or recoverable policy without comparing public error-code strings.
• Offset-bearing error construction receives the operation's TryAllocator. Error paths cannot silently allocate in the current context during an explicit recoverable operation.
• ScalarEncoding alone owns scalar-to-UTF-8 bytes and publishes only its initialized prefix. JSON owns escape and surrogate syntax but does not duplicate UTF-8 encoding tables.
• Runtime selection recognizes only the general U8Truncate numeric role. No compiler, target, editor, or protocol layer recognizes std/json, Number, JSON tokens, or JSON error codes.

Encapsulation and Cleanup Review

Number exposes only its exact text and integer projections. Its owned String and normalized shape remain private and are absent from hover and completion. JSON does not inspect String, allocator, or UTF-8 representation fields. The UTF-8 encoder constructs its own fixed buffer and derives a borrowed initialized-prefix view through existing pointer contracts.

Number parsing owns either one completed Number or no owned result. String decoding owns one partially built String inside one function. Every failure returns through ordinary move/drop semantics; there is no initialized-byte table, cleanup count, secondary token tree, or recovery-side ownership mirror.

The review removed two invalid shortcuts before closure:

1. 1. an initially added public String.try_push_scalar expansion was unnecessary; initialized UTF-8 projection belongs to the internal encoder and the existing String API remains unchanged;
2. interpolated JSON error messages initially used the current allocator; the typed error factory now preserves the selected allocator even while constructing a failure.

Primitive Boundary Review

The public numeric specification already required u8.checked(u64) and u8.truncate(u64), but the standard implementation was absent. Phase 1 completes that existing contract through one private u8_truncate_raw declaration and one source-independent runtime role. Target validation owns its signature; ARM64 selection validates the one-register input/output ABI and preserves the low byte already present in the return register. JSON calls only the public numeric contract.

Qualification Evidence

• cargo test --workspace --quiet passes across the complete compiler workspace.
• Native standard tests execute six Phase 1 cases covering checked/truncating conversion, every UTF-8 scalar boundary, exact number spelling, signed and unsigned limits, invalid number grammar, ASCII escapes, Unicode escapes, surrogate pairs, and malformed sequences.
• The complete bundled standard library crosses semantic checking and target validation with the closed primitive registry.
• Language-server integration proves Number hover and completion expose its public contract and do not expose NumberShape or stored String fields, including syntax-recovery completion.
• The reviewed standard dependency graph includes every new JSON and UTF-8 edge exactly and rejects an unexpected or stale dependency.
• cargo fmt --all -- --check, git diff --check, documentation generation, and documentation link validation pass.

Result

Phase 1 is complete. Review found no retained compatibility spelling, JSON-specific compiler knowledge, duplicate lexical authority, representation leak, caller-order dependency, or unresolved public choice. Phase 2 may build the owning DOM parser exclusively through the contracts closed here.