Rust Errors

An error type is a contract about what can go wrong and what the caller does about it: which failures panic, which become a Result, which shape the error takes, how much context survives the call stack. Making the failure impossible is /type-driven-design; whether shape changes break callers, /rust-api-design.

The panic policy

unwrap and expect are assertions about invariants, not error handling. Acceptable: in tests, in main for a startup precondition, and after a check the compiler cannot see — where expect names the invariant and carries the values. Unacceptable: in library code on any input-derived value, or anywhere the justification is "this can't fail" without saying why.

Not every failure is a Result. A broken internal invariant with no caller-recoverable path should panic — the program is already in a state the type system promised it would not reach. Input validation is the opposite: whatever the input, the caller can respond, so it is always a Result.