Function nova_rt_bytes_slice 

#[unsafe(no_mangle)]
pub unsafe extern "C" fn nova_rt_bytes_slice(
    b: *const NovaStr,
    start: i64,
    end: i64,
) -> *mut NovaStr

The bytes in start..end, clamped to the buffer and to start <= end.

Deliberately diverges from String::slice, which panics on an out-of-range bound (std/strings/lib.nova) rather than clamping. A Bytes length often comes from disk (fs::read’s result, say), not from a caller who is expected to already know it the way a codepoint index is; aborting the whole process on a bound derived from external input is a worse failure mode than the same defect in a string index a caller chose by hand. The clamp below is two saturating .max/.min integer comparisons, which is what keeps this from ever aborting, unlike a bounds check that panics. This is a recorded, accepted divergence, not an oversight — see the design spec’s dated note — and it does not imply String::slice will ever clamp too.

Safety

b must point to a live NovaStr.