The problem is, what exactly do you do when your program hits a precondition or invariant violation?

There are basically only two possibilities: abort the process, or jump to a top-level handler that logs the error and returns a 500 response (or whatever the equivalent is, for a long-running program that's not a web server). In neither case is there any interesting decision to be made about how the direct caller should handle the error. In return, whenever you subscript an array or otherwise do anything that has preconditions or invariants, you have to add a question mark to every function that can transitively call it and every call site of same, throughout the codebase. This task requires no intelligence—it can be done algorithmically without error—so why require it?

If you could actually prevent precondition and invariant violations at compile time, that would be quite a different proposition, but Pony can't actually do that (because it requires dependent types) and the intermediate solution they've hit on appears to be the worst of all worlds.

Also, it seems perverse to have a syntax for calling fallible functions and propagating failures up the call stack, but then not allow it to be used for exceptional results, which are the kind of failure that's actually worth propagating up the call stack.

You can do this:

  try
    somearray(outofboundindex)?
    // stuff
  else
    errorlog.write("some message")
    error
  end

Pony doesn't force you to deal with errors a specific way. Pony forces you to make a choice so you can't just ignore it.