from #9405 (comment)

• on the kmx+ loading side, a pre-scan of all key=to and transform=to strings and make sure there's no illegal unicode - this would be a validation error, not an assert. This would be at runtime.
• an assert in emit_string() on the C++ side to assert that nothing 'got through'

On the developer side:

• on the developer side, kmc should also do the same so we catch it at compile time (done, elsewhere)
• Messaging strategy (for kmc)
  • hint on PUA
  • warn on unassigned
  • error on illegal

Related is the following, which is a Unicode-version dependent check for unassigned codepoints, which is a warning not an error.

• feat(core): warn on unassigned codepoints when loading keyboard 🙀  #9464