std/utf8

Decode one scalar. A malformed sequence consumes its lead byte and yields U+FFFD so callers can continue scanning without splitting valid text.

Validate every byte without allocating or decoding ordinary ASCII scalars. Multibyte windows borrow at most four bytes, keeping Decode's absolute 32-bit offset independent of the size of the complete string.

Copy valid UTF-8 byte-for-byte into a separate bounded destination. Invalid input follows Decode: consume only the malformed lead byte and append one UTF-8 replacement character. Stop before a source sequence or replacement would be split; report the bytes written and whether all input was consumed.

Decode a whole byte string with Python UTF-8 errors='replace' consumption: replace each maximal valid prefix of an ill-formed sequence once. A valid but truncated E2 82 is one replacement; forbidden ED A0 80 is three. The result has independent immutable storage and is always valid UTF-8. Decode and Copy retain their consume-one-malformed-lead contracts.