XL-2 from_code_point follow-up: parser decodes (9)

dag/extdeps/bmc/ipmi_master_write_read.dag

@@ -6,7 +6,7 @@ import std.decl_ref { DeclarationRef, WholeDeclaration }
 import v2.std.optional { Present }
 import extdeps.external_authority { ExternalAuthority, ExternalModelScope, ExternalSubjectRef }
 import extdeps.uri { Uri, Https }
-import extdeps.languages.json.parse { json_hex_nibble }
+import extdeps.languages.json.grammar { json_hex_nibble }
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {

dag/extdeps/dns/domain_name.dag

@@ -1,5 +1,6 @@
 module extdeps.dns.domain_name
 
+import std.unicode.scalar { char_text }
 import std.types { NonEmptyStr, String, List, Bool, Int, brand }
 import std.error_primitives { Result, Ok, Err }
 
@@ -71,7 +72,7 @@ fn fold_dns_case_string_at(s: String, i: Int, acc: String) -> String {
     let ch = char_at(s, i)
     let cp = code_point_int(ch: ch)
     let out = if cp >= 65 && cp <= 90 {
-      from_code_point(cp + 32)
+      char_text(c: cp + 32)
     } else {
       ch
     }

dag/extdeps/git/git.dag

@@ -1,5 +1,6 @@
 module extdeps.git
 
+import std.unicode.scalar { char_text }
 import extdeps.exec.program { ProgramIdentity, uncataloged_program }
 
 import extdeps.external_authority { ExternalAuthority }
@@ -136,7 +137,7 @@ type GitDiffNameStatusParseState {
   entries: List<GitDiffStatusEntry>
 }
 
-data git_diff_name_status_field_separator: String = from_code_point(0)
+data git_diff_name_status_field_separator: String = char_text(c: 0)
 
 fn git_diff_change_status_from_token(token: String) -> GitDiffChangeStatus {
   let letter = substring(s: token, start: 0, end: 1)

dag/extdeps/git/object_store.dag

@@ -1,5 +1,6 @@
 module extdeps.git.object_store
 
+import std.unicode.scalar { char_text }
 import std.algebra { Cons, trim }
 
 import std.types { NonEmptyStr, Bytes, Map, brand, range, Bool, Int, List }
@@ -20,6 +21,7 @@ import std.integer { UInt8, NonNegativeInt, PositiveInt, qualified_octet_members
 import std.render_repeat_string_bootstrap { repeat_string }
 import std.measure { ByteSize, byte_size, byte_size_count }
 import std.bytes { bytes_octets, octets_bytes, utf8_encode_bytes }
+import std.encoding { ascii_decode_octets, AsciiDecoded, AsciiNonAscii }
 import std.cache_interface { ContentAddressedByValue, WriteOnce }
 import extdeps.git { GitAuthor, ObjectType, BlobObj, TreeObj, CommitObj, TagObj }
 import extdeps.object_storage { ObjectContainer }
@@ -928,7 +930,7 @@ fn git_store_object_canonical_hash_input(
           ),
           " ",
           to_string(count(payload_octets)),
-          from_code_point(0),
+          char_text(c: 0),
         ],
         "",
       )
@@ -1974,16 +1976,16 @@ type GitLsTreeZDecodeOutcome
   = GitLsTreeZDecoded { entries: List<GitTreeWireEntry> }
   | GitLsTreeZRefused { cause: GitLsTreeZRefusal }
 
+// A git NUL-framed header field is ASCII text through the declared std.encoding ascii_decode_octets
+// route; NUL is ASCII but is the field DELIMITER here, so it is refused by this field's own policy.
 fn git_ascii_field_text(octets: List<UInt8>) -> NonEmptyStr? {
-  if all(octets, octet => octet > 0 && octet < 128) {
-    Present {
-      value: join(
-        octets |> map(octet => from_code_point(octet)),
-        "",
-      ) as NonEmptyStr,
-    }
-  } else {
+  if !all(octets, octet => octet != 0) {
     none
+  } else {
+    match ascii_decode_octets(octets: octets) {
+      AsciiDecoded { text } => Present { value: text as NonEmptyStr }
+      AsciiNonAscii { at: _, octet: _ } => none
+    }
   }
 }
 

dag/extdeps/github/actions.dag

@@ -1,5 +1,6 @@
 module extdeps.github.actions
 
+import std.unicode.scalar { char_text }
 import std.decl_ref { DeclarationRef, decl_ref }
 import extdeps.cron.schedule_model { CronSchedule }
 import extdeps.github.log_annotations {
@@ -342,7 +343,7 @@ fn runner_arch_label(arch: Architecture) -> String {
 // DIFFERENT labels, which surfaces as a loud divergence rather than a silent match.
 fn runner_label_match_key(label: String) -> String {
   join(
-    label |> chars |> map(c => if c >= 65 && c <= 90 { from_code_point(cp: c + 32) } else { from_code_point(cp: c) }),
+    label |> chars |> map(c => if c >= 65 && c <= 90 { char_text(c: c + 32) } else { char_text(c: c) }),
     "",
   )
 }

dag/extdeps/http/form_urlencoded.dag

@@ -4,6 +4,7 @@ import std.types { String, List, Bool, Int }
 import std.integer { UInt8 }
 import std.bytes { utf8_encode_bytes, bytes_octets }
 import std.encoding { utf8_decode_octets }
+import std.coercion { unicode_scalar_fold }
 import v2.std.algebra { any, filter }
 
 // WHATWG URL, application/x-www-form-urlencoded: split pairs before decoding, plus means space,
@@ -47,7 +48,7 @@ fn form_component(wire: String) -> String? {
     FormOctetsRefused => none
     FormOctetsDecoded { octets } => match utf8_decode_octets(octets: octets) {
       Absent => none
-      Present { value: scalars } => Present { value: join(map(scalars, cp => from_code_point(cp: cp)), "") }
+      Present { value: scalars } => Present { value: unicode_scalar_fold(xs: scalars) }
     }
   }
 }

dag/extdeps/languages/json/emit.dag

@@ -1,5 +1,6 @@
 module extdeps.languages.json.emit
 
+import std.unicode.scalar { char_text }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.languages.json.grammar { JsonNumberLexeme, json_int_lexeme, json_number_lexeme }
 import extdeps.numeric.base16 { int_to_upper_hex }
@@ -101,7 +102,7 @@ data json_control_escape_code_points: List<Int> = [
 ]
 
 fn json_escape_replace(s: String, code_point: Int, replacement: String) -> String {
-  join(split(s: s, delimiter: from_code_point(code_point)), replacement)
+  join(split(s: s, delimiter: char_text(c: code_point)), replacement)
 }
 
 fn json_escape_named_replacement(code_point: Int) -> String {

dag/extdeps/languages/json/parse.dag

@@ -12,7 +12,6 @@ import extdeps.languages.json.grammar {
   JsonTextParseResult, JsonTextParseOk, JsonTextParseFail,
   json_text_skip_ws, json_text_parse_string, json_text_parse_number,
   json_number_lexeme_unchecked, is_json_digit_char,
-  json_hex_nibble, json_hex4_at,
 }
 
 // parse_json is the FORWARD reading of RFC 8259: text -> JsonValue, the inverse of
@@ -25,17 +24,12 @@ import extdeps.languages.json.grammar {
 // the escape SET (one native split per string body, RFC 8259 section 7), so an unknown escape or
 // a short \u refuses the parse before a value is built and never reaches the unescaper below -
 // see json_escape_production_note for why that refusal lives at the scan and what it prevents
-// (review 45642). The malformed-\u arm in json_unescape_decode_piece is therefore unreachable for
-// any span this parser accepts; it is retained as a total fallback because json_unescape is
-// exported and a caller could hand it an unvalidated span. \uXXXX IS decoded to its code point,
-// which is what makes the round-trip total against escape_json_string: that emitter maps code
-// points 0-31 other than the six with short escapes to \uXXXX, so a parser that passed \u through
-// would silently corrupt every control character a receipt detail field can carry. Surrogate
-// PAIRS are not recombined - serialize_json never emits one (it escapes only 0-31), so a lone
-// \uXXXX decode is exact over this emitter's output; foreign JSON carrying an astral character as
-// a surrogate pair is outside the declared fragment. A malformed \u (fewer than four hex digits,
-// or a non-hex digit) refuses at the scan, so json_hex4_at's negative arm is likewise unreachable
-// from parse_json and kept only for the exported-caller case.
+// (review 45642). \uXXXX IS decoded to its scalar by the native json_unescape_checked kernel,
+// which recombines a UTF-16 surrogate pair (RFC 8259 section 7) and refuses an unpaired surrogate,
+// so a value this parser builds never carries a surrogate code point. There is no interpreted
+// unescaper beside it: the former json_unescape piece decoder had no consumer and spelled each
+// \u through the total seed from_code_point (gunbc.recurring_failure_mode
+// bare_from_code_point_binds_the_total_seed_builtin), so it was deleted rather than migrated.
 
 data extdeps_external_authority_anchor: ExternalAuthority = ExternalAuthority {
   uri: Uri {
@@ -48,111 +42,11 @@ type JsonParse =
     JsonParsed { value: JsonValue, next: Int }
   | JsonParseFail { at: Int }
 
-// THE UNESCAPER MOVES IN ESCAPE-SIZED STEPS, NOT PER CHARACTER (measured 2026-09-23 on
-// corpus-scale shards: even with the span unescape, the per-character next-escape scan put the
-// parse at roughly fourteen interpreter-minutes per megabyte, which is the 104 MB envelope's
-// wall). One native split on the backslash resolves the whole escape structure — the pieces'
-// boundaries ARE the parity answer, so `\\` and `\u` sequences cannot be misparsed the way
-// sequential replacement passes would misparse them — and each piece decodes in one interpreted
-// step. The decoded pieces stay in document order (the recursion carries the first piece
-// first) and the join is one native pass; neither side copies an accumulator per escape.
-// THE FIRST PIECE IS LITERAL BY CONSTRUCTION (it precedes the first backslash); the rest are
-// escapes. The split is walked once, head by head, and each decoded piece is carried in
-// document order.
-fn json_unescape_decoded_pieces(pieces: List<String>) -> List<String> {
-  match pieces.first() {
-    Absent => []
-    Present { value: head } =>
-      concat(
-        [head],
-        json_unescape_decode_rest(pieces: json_unescape_drop_first(xs: pieces), literal_next: false),
-      )
-  }
-}
-
-// THE WALK CARRIES THE PARITY ANSWER: an empty piece is a \\ pair, and the piece after a pair
-// is LITERAL — its head was never an escape letter, because the backslash that would have made
-// it one is the pair's second half. (Without the flag, `\\b` decodes the b as \b and `\q`
-// refuses a valid document.) The flag lasts exactly one piece.
-// ONE PASS, THE PARITY AND THE DECODED PIECES IN THE ACCUMULATOR: the recursive walk
-// re-dropped the tail at every level (and the drop concatenated at the end, copying per
-// element), the square of a string's escape count — the read's long pole at the project
-// envelope's ~3.45M escapes. The fold visits each piece once, prepends, and reverses once;
-// the state machine is the recursion's, so the decoded bytes are unchanged.
-type JsonUnescapeDecodeAcc { literal_next: Bool, decoded_rev: List<String> }
-
-fn json_unescape_decode_rest(pieces: List<String>, literal_next: Bool) -> List<String> {
-  let acc = fold(
-    pieces,
-    init: JsonUnescapeDecodeAcc { literal_next: literal_next, decoded_rev: [] },
-    f: fn(a, piece) {
-      if a.literal_next {
-        JsonUnescapeDecodeAcc { literal_next: false, decoded_rev: concat([piece], a.decoded_rev) }
-      } else if piece == "" {
-        JsonUnescapeDecodeAcc { literal_next: true, decoded_rev: concat(["\\"], a.decoded_rev) }
-      } else {
-        JsonUnescapeDecodeAcc {
-          literal_next: false,
-          decoded_rev: concat([json_unescape_decode_piece(piece: piece)], a.decoded_rev),
-        }
-      }
-    },
-  )
-  reverse(acc.decoded_rev)
-}
-
-type JsonUnescapeDropAcc { skipped: Bool, kept: List<String> }
-
-fn json_unescape_drop_first(xs: List<String>) -> List<String> {
-  let result = fold(xs, init: JsonUnescapeDropAcc { skipped: false, kept: [] }, f: fn(acc, x) {
-    if acc.skipped { JsonUnescapeDropAcc { skipped: true, kept: concat([x], acc.kept) } } else { JsonUnescapeDropAcc { skipped: true, kept: [] } }
-  })
-  reverse(result.kept)
-}
-
-// AN EMPTY PIECE IS THE ESCAPED BACKSLASH; any other piece's head is its escape letter, with \u
-// carrying exactly four hex digits. The malformed-\u arm is the exported-caller fallback (the
-// grammar refuses before value building, so a short or non-hex \u never reaches this builder
-// from the parser): it drops the backslash and rescans the remainder as literal text, the
-// total-fallback semantics, piece-local.
-fn json_unescape_decode_piece(piece: String) -> String {
-  if piece == "" {
-    "\\"
-  } else {
-    let c = char_at(s: piece, pos: 0)
-    if c == "u" {
-      let cp = json_hex4_at(s: piece, i: 1)
-      if cp < 0 {
-        concat("u", json_unescape(s: substring(s: piece, start: 1, end: piece.length())))
-      } else {
-        concat(from_code_point(cp: cp), substring(s: piece, start: 5, end: piece.length()))
-      }
-    } else {
-      let u = if c == "n" { from_code_point(cp: 10) }
-        else if c == "t" { from_code_point(cp: 9) }
-        else if c == "r" { from_code_point(cp: 13) }
-        else if c == "b" { from_code_point(cp: 8) }
-        else if c == "f" { from_code_point(cp: 12) }
-        else { c }
-      concat(u, substring(s: piece, start: 1, end: piece.length()))
-    }
-  }
-}
-
-fn json_unescape(s: String) -> String {
-  if string_contains(s: s, pattern: "\\") {
-    join(json_unescape_decoded_pieces(pieces: split(s: s, delimiter: "\\")), "")
-  } else {
-    s
-  }
-}
-
 // THE VALUE IS THE NATIVE json_unescape_checked DECODE: the span was validated by the grammar
 // production one call ago, so the kernel's refusal arm is unreachable here — it is matched
 // anyway, because a total path outlives the argument for why it is dead. This replaces the
 // interpreted piece decode (one interpreted step per escape over the project envelope's ~3.45M
-// escapes, the read's measured wall) with the same bytes at native speed; json_unescape below
-// stays as the exported-caller authority, malformed-\u fallback included.
+// escapes, the read's measured wall) with the same bytes at native speed.
 fn parse_json_string_at(s: String, i: Int) -> JsonParse {
   match json_text_parse_string(s: s, i: i) {
     JsonTextParseFail { end: e } => JsonParseFail { at: e }

dag/extdeps/languages/rust/emit.dag

@@ -287,7 +287,6 @@ data rt_function_registry: List<RuntimeFunction> = [
   { name: "scan_to_eol",        bridge_name: "scan_to_eol",      passes_by_ref: true,  wraps_result: false },
   { name: "scan_string_end",    bridge_name: "scan_string_end",  passes_by_ref: true,  wraps_result: false },
   { name: "code_point",         bridge_name: "code_point",       passes_by_ref: false, wraps_result: false },
-  { name: "from_code_point",    bridge_name: "from_code_point",  passes_by_ref: false, wraps_result: false },
   { name: "lookup",             bridge_name: "lookup",           passes_by_ref: true,  wraps_result: false },
   { name: "get",                bridge_name: "list_get_optional", passes_by_ref: true, wraps_result: false },
   { name: "index_by",           bridge_name: "rc_index_by",      passes_by_ref: false, wraps_result: false },

dag/extdeps/languages/toml/emit.dag

@@ -1,5 +1,6 @@
 module extdeps.languages.toml.emit
 
+import std.unicode.scalar { char_text }
 import std.types { Bool, String, List, Int }
 import v2.std.collection { list_at_optional }
 import v2.std.algebra { list_head, skip, HeadFound, HeadAbsent }
@@ -77,7 +78,7 @@ fn toml_escape_remaining_control(point: Int) -> String {
   if (point < 32) || (point == 127) {
     concat("\\u00", concat(toml_hex_nibble(n: point / 16), toml_hex_nibble(n: point - ((point / 16) * 16))))
   } else {
-    from_code_point(point)
+    char_text(c: point)
   }
 }
 
@@ -152,7 +153,7 @@ fn toml_comment_lines(text: String) -> List<String> {
 // rather than merely verbose.
 fn toml_comment_char(point: Int) -> String {
   if point == 9 {
-    from_code_point(point)
+    char_text(c: point)
   } else {
     toml_escape_remaining_control(point: point)
   }

dag/extdeps/languages/yaml/emit.dag

@@ -1,5 +1,6 @@
 module extdeps.languages.yaml.emit
 
+import std.unicode.scalar { char_text }
 import extdeps.external_authority { ExternalAuthority }
 import extdeps.uri { Uri, Https }
 import std.algebra { trim }
@@ -324,7 +325,7 @@ fn yaml_emitted_text(text: String) -> YamlEmitResult {
   if yaml_contains_refused_character(text: text) {
     let cp = yaml_first_refused_character(text: text)
     YamlEmitRefused {
-      path: join(["line ", to_string(yaml_line_containing(lines: yaml_source_lines(src: text), pattern: from_code_point(cp: cp), index: 0)), " of the emitted text"], ""),
+      path: join(["line ", to_string(yaml_line_containing(lines: yaml_source_lines(src: text), pattern: char_text(c: cp), index: 0)), " of the emitted text"], ""),
       reason: yaml_refused_character_reason(cp: cp),
     }
   } else {