func main(): i32 { let value = load_value() catch failure { fallback_for(failure.message()) } if value == 42 { return 0 } return 1 } func load_value(): i32! { return error.new("example.unavailable", "the primary value is unavailable") } func fallback_for(message: &str): i32 { return 42 }

use std/fmt.Format use std/io struct Point { x: i32 y: i32 } instance Point { impl Format method &self.try_format_into(output: &+String): void! { output.try_push_str("(")? self.x.try_format_into(output)? output.try_push_str(", ")? self.y.try_format_into(output)? output.try_push_str(")")? return } } func main(): i32! { let point = Point { x: 3, y: 4 } let message = "point = ${point}\n" io.print(&message)? return 0 }

use std/io use std/vec.Vec struct Point { x: i32 y: i32 } instance Point { operator (&self == other: &Self): bool { return self.x == other.x && self.y == other.y } } func main(): i32! { let first = Point { x: 3, y: 4 } let same = Point { x: 3, y: 4 } let other = Point { x: 5, y: 6 } if first != same || first == other { return 1 } let points = Vec [move first, move other] if points[0] != same { return 1 } var values = Vec [1, 2, 3] values[1] = 4 if values[0] + values[1] + values[2] != 8 { return 1 } io.print("equality found the point\n")? return 0 }

struct Buffer { values: [i32; 3] } instance Buffer { operator (&self[index: usize]): &i32 { return &self.values[index] } operator (&+self[index: usize]): &+i32 { return &+self.values[index] } } func at<C>(container: &C, index: usize): i32 where (&C[usize]): &i32 { return container[index] } func main(): i32 { var buffer = Buffer { values: [3, 4, 5] } buffer[1] = 9 if at(&buffer, 1) != 9 { return 1 } return 0 }

v0.34.0 Phase 3 Owned-scalar Integration Review

Result: complete with no open finding (2026-09-04). Owned text, formatting, and hashing now consume the scalar authorities established by the earlier phases.

Closed Product

String.try_push(char) passes the already valid character to the infallible std/internal/utf8.encode_scalar authority and passes the initialized prefix to one private try_push_valid_utf8 transaction. That transaction reserves the complete byte width before any write and publishes String.len only after every byte is stored. String.try_push_utf8 validates untrusted bytes once and then enters the same transaction. String.push(char) changes only the allocation-failure policy by mapping it to the ordinary allocation abort.

char.from_u32 is the sole integer-to-scalar validation boundary. The UTF-8 encoder accepts char, so it cannot duplicate range or surrogate checks. JSON escape decoding constructs char before appending it and delegates encoding and storage to String.try_push.

Format<char> copies the borrowed scalar and delegates directly to String.try_push; it has no encoder. Hash<char> observes the scalar value through the trusted representation bridge and delegates to the existing u32 contribution path; it has no second byte projection or hash algorithm. Equality, ordering, formatting, and hashing therefore share one scalar identity while remaining separate public contracts.

Failure and Authority Review

The invalid allocator integration test constructs an empty String bound to a deliberately rejected allocator, attempts a four-byte character append, observes the stable allocation error, and proves the visible text is still empty. The only logical-length assignment in the scalar transaction is after the complete store loop.

The standard dependency review records the intended character bridge edges from char, hash, scalar iteration, and the UTF-8 encoder. string no longer requires unchecked character access or an impossible-value abort path. No public module exposes unchecked scalar construction, no validation table moved into String or JSON, and no formatting or hashing helper depends on UTF-8 source spelling.

Evidence

the native Unicode integration test executes aborting and recoverable scalar append and verifies the exact mixed-width UTF-8 result;
native Format tests append a four-byte character beside text, booleans, and integer boundaries;
native Hash tests prove a literal and dynamically constructed equal character contribute the same value;
the recoverable-allocation native test proves scalar append failure leaves the String unchanged;
the complete physical standard package and reviewed dependency graph accept the new contracts.