Function substring 

pub fn substring(s: &str, start: usize, end: usize) -> &str

The text of s between two byte offsets, with both ends walked back to a char boundary and clamped into the string.

This is the workspace’s substitute for &s[a..b], and it is total: there is no offset, ordering or overflow of the two arguments that can make it panic. A range running off the end yields what is there, and a backwards range yields nothing. Callers that have searched for their offsets get the exact slice they asked for, because a find hit is already a boundary; callers that computed one get the nearest cut that does not split a character.

That totality is the point. A scanner walking byte offsets through text it did not author - HTML from a fetch, a model’s fenced output, an SSE frame - cannot be read closely enough to prove every offset correct, and the failure mode for getting one wrong used to be aborting the daemon.