These are possibly situations where I’d resort to a panic on the extra branch rather than complicate the return type.

Providing a proof of program correctness is pretty challenging even in languages that support it. In most cases careful checking of invariants at runtime (where not possible at compile time) and crashing loudly and early is sufficient for reliable-enough software.