Function validate_source_span_for_body 

pub fn validate_source_span_for_body(
    span: &SourceSpan,
    body: &str,
) -> Result<()>

v0.7.0 Form 4 / Cluster-A — body-aware SourceSpan validation.

Stricter superset of validate_source_span: in addition to the start < end invariant, this also requires:

1. span.end <= body.len() — the half-open interval [start, end) must lie entirely within the body, so body[span.start..span.end] cannot panic on out-of-bounds.
2. Both span.start and span.end fall on UTF-8 char boundaries in body. Slicing on a non-boundary panics, which would break every downstream consumer (forensic export, CLI display, etc.).

Call this from validators that have the source body in hand (e.g. the atomisation writer, the citation validator on a known parent). Validators that only have the span (the bare-bones validate_source_span above) keep their lighter contract.

Errors

Returns when start >= end, when end > body.len(), or when either endpoint lands mid-codepoint.