array bounds safety per @sprater review