The shallow clone call just above always results in the kind being
shared so we don't need to assert it here.

we already assert this at the top of the method

We know several things here:

1. self.len <= self.cap, always
2. at <= self.len, asserted at the top of this method
3. after calling shallow_clone, other.cap == self.cap

Therefore, at <= self.len <= other.cap.

This method never moves the cursor backward, only advances it forwards.
I think reflecting that in the name makes things a bit more clear.

I also added explicit safety comments to make it clear why each usage is
sound.

…-at-to-refactor