strings: preserve UTF-8 and boundary invariants

lib/strings/sub_test.ww

@@ -7,6 +7,7 @@ package strings_test;
 
 import strings;
 import encoding.utf8;
+import test;
 
 // ref/hare/strings/sub.ha:44 (@test fn sub), :79 (@test fn bytesub). Hare's
 // 2-arg `sub(s, start)` rows are omitted: ww has no default-parameter
@@ -29,6 +30,11 @@ import encoding.utf8;
 	assert(!(!streq(strings.sub("héllo", 0, 5), "héllo")));
 };
 
+@test fn sub_negative_aborts() void = {
+	test.expectabort();
+	strings.sub("abc", -1, 0);
+};
+
 // Match-shape mirrors Hare's `bytesub(...)!` at ref/hare/strings/sub.ha:
 // 80-86. Inlined at each call site (rather than a helper that takes
 // `(str | utf8.invalid)` by value) because the union-by-value path
@@ -94,3 +100,7 @@ import encoding.utf8;
 	};
 };
 
+@test fn bytesub_negative_aborts() void = {
+	test.expectabort();
+	strings.bytesub("abc", -1, 0);
+};