core: make the public fmt API completely safe.