> Wouldn't this be better with design by contract by having first() enforce length>0 then turning off assertions if desired for release code?
I would say very much not, but maybe I'm misunderstanding what you mean, or maybe you're misunderstanding the language?
What I'm getting from your suggestion is
pub fn first(&self) -> &T {
debug_assert!(self.len() > 0);
unsafe { &* self.as_ptr() }
}
which is a straight UB in "safe Rust" as soon as you invoke it on an empty slice (or vec), which is completely verboten.
What you could do is have a separate `NonEmpty` vector either by construction or by assertion, for which `first` wouldn't be failible (but other operations would be).
> Also OP should have mentioned not matching none is an error otherwise there's no point
That actually is irrelevant to the story OP is telling. They're talking about null-safety, match-completeness is an orthogonal concern (and one they don't really care for here, they just want to operate on a present value).