{"record":{"id":"af6350a38d26eb9f","repo":"JuliusBrussee/caveman","slug":"unsafe-recovery-failure-result-w","errorCode":null,"errorMessage":"unsafe recovery failure result: %w","messagePattern":"unsafe recovery failure result: %w","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"engine/cmd/caveman-engine/main.go","lineNumber":125,"sourceCode":"\tif err := emitCompressResult(input, res, err, os.Stdout, os.Stderr); err != nil {\n\t\tfatal(\"compress: %v\", err)\n\t}\n}\n\ntype compressReport struct {\n\tengine.Result\n\tError string `json:\"error,omitempty\"`\n}\n\n// emitCompressResult preserves the engine's byte-safety contract at the CLI\n// boundary. CCR failures are expected operational conditions: the engine has\n// already returned an accounted pass-through result, so stdout must still get\n// the original bytes. Any contradictory result fails rather than guessing.\nfunc emitCompressResult(input []byte, res engine.Result, compressErr error, stdout, stderr io.Writer) error {\n\tcode := \"\"\n\tif compressErr != nil {\n\t\tif !bytes.Equal(res.Output, input) || !res.PassedThrough() || res.TokensAfter != res.TokensBefore {\n\t\t\treturn fmt.Errorf(\"unsafe recovery failure result: %w\", compressErr)\n\t\t}\n\t\tcode = \"cave_ccr_unavailable\"\n\t\tif errors.Is(compressErr, ccr.ErrBudgetExceeded) {\n\t\t\tcode = \"cave_ccr_budget_exceeded\"\n\t\t}\n\t}\n\tif _, err := stdout.Write(res.Output); err != nil {\n\t\treturn fmt.Errorf(\"write stdout: %w\", err)\n\t}\n\t// Report stays on stderr so stdout remains clean payload bytes.\n\treport, err := json.Marshal(compressReport{Result: res, Error: code})\n\tif err != nil {\n\t\treturn fmt.Errorf(\"encode report: %w\", err)\n\t}\n\tif _, err := fmt.Fprintln(stderr, string(report)); err != nil {\n\t\treturn fmt.Errorf(\"write report: %w\", err)\n\t}\n\treturn nil","sourceCodeStart":107,"sourceCodeEnd":143,"githubUrl":"https://github.com/JuliusBrussee/caveman/blob/3ee70a102609e550bd2e68004bf5990a9341c851/engine/cmd/caveman-engine/main.go#L107-L143","documentation":"emitCompressResult wraps the original compression error with \"unsafe recovery failure result\" when the engine is configured to pass through on CCR (compression) failure but the returned Result does not look like a genuine pass-through: the output differs from the input, PassedThrough() is false, or token counts changed. The engine refuses to emit a contradictory result (claiming recovery while altering bytes) rather than guessing what to print. The wrapped original compressErr is preserved for diagnosis.","triggerScenarios":"runCompress received a non-nil compressErr (e.g. ccr.ErrBudgetExceeded or other CCR failure) but the compress pipeline returned a res whose Output != input, res.PassedThrough() == false, or res.TokensAfter != res.TokensBefore — i.e. a bug or misbehaving compressor produced transformed bytes alongside a failure.","commonSituations":"A new compressor stage mutates output before failing; a change to Result accounting (TokensAfter/TokensBefore) breaks the pass-through invariant; a caller wires a compressor that returns partially-transformed data on error instead of the original input.","solutions":["Inspect the wrapped compressErr to see why CCR failed, then check the compressor that produced res — it must return the untouched input bytes when failing.","Ensure the compressor sets PassedThrough() and leaves TokensAfter == TokensBefore on any error-path result.","If input legitimately changed, fix the compressor to fail closed (return input unchanged) rather than expecting the emitter to accept it."],"exampleFix":"// before: compressor transforms then errors\nout := transform(input) // mutated\nreturn Result{Output: out}, err\n// after: fail closed with original bytes\nreturn Result{Output: input, PassedThrough: true, TokensAfter: n, TokensBefore: n}, err","handlingStrategy":"validation","validationCode":"if compressErr != nil && (!bytes.Equal(res.Output, input) || !res.PassedThrough() || res.TokensAfter != res.TokensBefore) {\n    // refuse to emit; log both compressErr and the offending Result\n}","typeGuard":null,"tryCatchPattern":"if err := emitCompressResult(input, res, compressErr, stdout, stderr); err != nil {\n    var unsafe *emitError\n    if errors.As(err, &unsafe) { log.Fatalf(\"compressor violated pass-through invariant: %v\", err) }\n}","preventionTips":["Always return the untouched input bytes on compressor error paths","Set PassedThrough and equal token counts on every error-path Result","Unit-test the CCR-unavailable path for each compressor"],"tags":["fail-closed","compression","invariant-violation"],"backgroundTag":"internal-invariant-violation","analyzedSha":"3ee70a102609e550bd2e68004bf5990a9341c851","analyzedAt":"2026-09-20T15:53:39.229Z","contentChangedAt":"2026-09-20T15:53:39.229Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}