milestone 1 review: claims span the run, explain's chain is opt-in and its own, overrides keyed by clean path, splice and enum guards

1 files changed, 9 insertions, 3 deletions

diff --git a/internal/config/print.go b/internal/config/print.go
index 5c3d467..a2244d0 100644
--- a/internal/config/print.go
+++ b/internal/config/print.go
@@ -3,6 +3,7 @@
 package config
 
 import (
+	"fmt"
 	"strings"
 
 	"krino/internal/sexp"
@@ -59,12 +60,17 @@ func PrintExclude(x *Exclude) string {
 
 // Splice replaces the bytes of the form between start and end - a form's
 // Pos and End - with text, and returns the new file contents. Every other
-// byte of src, comments and layout included, is kept exactly.
-func Splice(src []byte, start, end sexp.Pos, text string) []byte {
+// byte of src, comments and layout included, is kept exactly. Offsets that
+// do not belong to src - a form parsed from text that has since changed -
+// are an error, not a panic (plan 13 review F6).
+func Splice(src []byte, start, end sexp.Pos, text string) ([]byte, error) {
+	if start.Offset < 0 || end.Offset < start.Offset || end.Offset > len(src) {
+		return nil, fmt.Errorf("config: splice %d:%d is not inside %d bytes", start.Offset, end.Offset, len(src))
+	}
 	out := make([]byte, 0, len(src)-(end.Offset-start.Offset)+len(text))
 	out = append(out, src[:start.Offset]...)
 	out = append(out, text...)
-	return append(out, src[end.Offset:]...)
+	return append(out, src[end.Offset:]...), nil
 }
 
 // printAction renders one action form.