binary: the unit goes in the name, and a short window stops being silent

[alii]

binary.slice indexed in BITS while byte_size answered in BYTES, so a byte-indexed caller got a short window and no error until offset+len passed 8*size. slice_bytes existed and was byte-indexed, but returned a bare Binary and collapsed every out-of-range case to <<>>. Two silences — and fixing either alone steers callers straight into the other, which is why they are one change.

Fixes T-208 and T-214.

slice is deleted, not renamed

T-208 suggested renaming it to slice_bits and adding a byte-indexed slice alongside. That is the worst option available: every existing binary.slice call keeps compiling and silently means something eight times different.

Deleting the name is what produces a compiler error on the old spelling — the property this project accepts as proof. It cost two call sites, because almost nobody used the bit form: 24 of 26 in-tree slice calls were already slice_bytes.

slice_bits / slice_bytes / drop_bytes each carry the unit in the name. slice_bytes returns Result(Binary, Nil).

Unit types were rejected with an argument, not on cost

Scarlet can express pub type Bytes { Bytes(Int) } — Radix is that shape. It cannot make it pay.

A newtype at the leaf checks nothing: for the type to protect anything it must reach the source of the quantity, and every source is a bare Int (byte_size, bit_size, byte_at, index_of -> Option(Int)). Leave those and the caller writes Bytes(byte_size(b) - i - 1) — the ×8 mistake lives inside that wrapping expression exactly as before. Wrap the sources too and you need +, - and comparison on Bytes, and Scarlet has no operator overloading. Every site touched here does arithmetic on the offset.

Filed as T-286, including the residual hole: nothing stops a bit count being passed to slice_bytes.

drop_bytes takes a position, not a length

slice_bytes(b, i + 1, byte_size(b) - i - 1) was 7 of the 24 call sites, and that arithmetic is itself where an off-by-one lives. drop_bytes(b, at) is total honestly: there is no requested size for the answer to fall short of, so past the end the remainder genuinely is <<>>.

No take_bytes sibling, deliberately — clamping a requested length is a short read, which is the silence this PR removes.

Plants, both directions, watched

plant	result
re-add slice as a bit-indexed alias	new test FAILS rc=101, expected 'al check' to REJECT
restore T-214's silence wearing a Result (Err(Nil) → Ok(<<>>))	FAILS rc=101 on the Err(Nil) assertions

Before/after on the T-214 case, with the in-range control on the same code path:

BEFORE                    AFTER
<<>>       (4, 2)         Err(Nil)      <- one byte over, was silent
<<2, 3>>   (1, 2)         Ok(<<2, 3>>)  <- non-zero control, window unchanged

One assertion was tightened after being written: check_rejects(…, "slice") would have passed on a diagnostic about slice_bits, since bare slice is a substring.

Gates

fmt 0 · clippy -- -D warnings 0 · test --workspace 0 · gen-editor-syntax --check 0 · SCARLET_GC_STRESS=1 cargo test --workspace 0.

dylint, hawk and ts-corpus are red — and identically red on stashed master. The boundary experiment was run rather than argued from the file list: dylint is the HeadFlags finding (T-278/T-279, in flight), hawk is 3 unnecessary_restricted_visibility in vm/mailbox.rs and vm/supervision.rs, ts-corpus is 2 parse errors in examples/supervision.scrl and examples/chat.scrl. None of those files are in this diff, and every .scrl file that is parses clean under tree-sitter.

One golden moved, four lines of 67

wire_format.stdout — the T-214 fix itself (past the end: <<>> → Err(Nil)) plus three new demo lines. Not a type-id shift, so line-for-line rather than a shift proof. The field name: block restructured into a match produces byte-identical output.

Known residual

Four call sites now carry an Err(Nil) arm argued unreachable in a comment rather than by a type — http.path, http.read_body, http_client's head_bytes, and drop_bytes' own tail. In each the bound comes from index_of or byte_size(buf) - consumed. That is exactly the shape T-286 would close.

A split_at_bytes(b, at) (Binary, Binary) primitive would collapse the index_of + prefix + suffix idiom at ~6 sites and remove three of those four arms. Not built — a third new name is outside what T-208 asked for.