I was thinking along the lines of how Rust does it, where (as far as I know) there is no safe way to convert a i32 to u32, but it has try_from which can fail, yet for u32 -> u64 they have from which cannot. There is no need to have special knowledge that a function could fail at runtime, unlike Swift, which has a combination of these functions. It seems like it could be a good fit alongside the strict memory safety proposal potentially.