# Error Handling Discipline

- Fail fast and loud: raise on invalid input, never continue on garbage.
- Wrap external I/O at the boundary; map failures to typed errors with context.
- Never swallow exceptions silently; log with enough detail to reproduce.
- Put a timeout on every remote or blocking call; no outbound request may
  block indefinitely.
- Guard failing dependencies with circuit breakers: stop calling a downstream
  that keeps failing and probe for recovery instead of hammering it.
- Retry only idempotent operations, with bounded attempts and backoff.
- Owner addition: exit codes are API — document 0/1/2 semantics in the README.