norecover

Documentation

Overview

Package norecover is a nogo analyzer that enforces the panic→error boundary discipline (RFC-134, audit P2). `recover()` is the mechanism by which a panic becomes a returned error at a public/goroutine boundary; an *undisciplined* new recover() is how a real error path gets silently swallowed (or rows dropped via a keep=false default arm). This analyzer makes adding one a conscious act: every recover() must live in a file on the allowlist below — the deliberate boundary layer classified in docs/panic-audit.md §2 — with a permitted per-file count.

A recover() in any other file, or one MORE than a file's allowance, is a nogo build error. Removing a recover never reddens the build (the gate fires on *more*, never *fewer*), so legitimately deleting a boundary needs no allowlist edit; adding one does. Test files are exempt — tests recover freely.

Index

• Variables

Variables

var Allowlist = map[string]int{

	"pkg/fdbgo/client/panicbackstop.go": 1,
	"pkg/fdbgo/client/database.go":      2,
	"pkg/fdbgo/client/grv.go":           1,
	"pkg/fdbgo/transport/conn.go":       2,
	"pkg/fdbgo/fdb/panic.go":            1,
	"pkg/fdbgo/fdb/transaction.go":      1,

	"pkg/fdbgo/libfdbc/backend.go": 1,

	"pkg/relational/core/parser/parser.go":               4,
	"pkg/relational/core/embedded/connection.go":         2,
	"pkg/relational/core/embedded/cascades_generator.go": 1,

	"pkg/recordlayer/merge_cursor.go": 1,

	"pkg/recordlayer/query/plan/cascades/values/required_bindings.go": 1,

	"cmd/fdb-stacktester/directory_ops.go": 1,

	"pkg/relational/conformance/explaindiff/explaindiff.go": 1,

	"cmd/dst-hunt/main.go": 1,
}

allowlist maps a repo-relative file path (matched as a suffix of the compiled file's path) to the number of recover() calls permitted in it. These are the deliberate panic→error boundary sites documented in docs/panic-audit.md §2. Keep the two in sync: this map is the executable allowlist; the doc is its rationale. Counts are the analyzer's own AST count of builtin recover() calls per file (NOT a grep of the text — a `recover` in a comment/string is not a call and is not counted), verified by building each package with an empty allowlist and reading the diagnostics. Exported so the docs/panic-audit.md §2 table can be gated against it (a sync test fails CI if the doc and this allowlist diverge — RFC-134 "keep panic-audit.md current").

var Analyzer = newAnalyzer(Allowlist)

Analyzer is the nogo entry point, bound to the production allowlist above.