Nice, thanks for the complete answer. It's a highly principled (and perhaps frustrating) design, in keeping with Rust's ethos.

By way of comparison, Swift overflows and returns a length of 0. Oh well.