Error handling

go-like uses identity for Context termination, a branded guard for service failures, structural codes for framework and provider failures, and native AggregateError for multiple failures. Keep those layers distinct; a message is diagnostic text, not a contract.

Match failures in this order

if (error === canceled || error === deadlineExceeded) {
  // Context termination
} else if (isServiceError(error)) {
  // Application service failure
} else if (error instanceof AggregateError) {
  // Inspect error.errors in order
} else if (typeof error === "object" && error !== null && "code" in error) {
  // Match one documented GO_LIKE_* code
} else {
  // Classify by documented origin, or propagate unchanged
}

Import canceled and deadlineExceeded from @go-like/context and isServiceError from @go-like/transport. When working from a Context, compare ctx.err() with the sentinels and use cause(ctx) for an application-supplied cancellation cause.

Do not branch on error.message. Messages are allowed to change and may contain provider text. Do not use instanceof for structural provider errors: different realms, package copies, and frozen object construction make class identity the wrong contract. Match a documented code and validate any fields your policy consumes.

ServiceError.code is application-owned and is not part of the GO_LIKE_* catalog. Recognize it only with isServiceError(error) before interpreting its code, status, or metadata.

TypeError and RangeError are common programmer-error examples, not the complete class. Classify application and invariant failures from their documented origin or boundary. Propagate an unclassified failure unchanged, without automatic retry, conversion, or message matching. Treat an Error as native or upstream only when it is known to come from a documented native or provider boundary; preserve its identity for local, redacted diagnostics and let that provider or runtime's policy decide whether retry is permitted.

Retry and reconcile

Retry is replay authorization, not an error-name reaction.

Failure class	Default policy	Required caller decision
State, closed, already-started, unsupported, validation, authentication, or protocol failure	Do not retry automatically	Fix lifecycle order, input, capability, credentials, or provider data
Transport, HTTP, or provider availability failure	Retry only when the operation is replayable and an explicit policy authorizes it	Bound attempts and backoff; preserve the original failure for diagnostics
Uncertain mutation, lease loss, or post-commit cleanup failure	Reconcile first; never blindly replay	Read authoritative state, determine whether the mutation committed, then repair or issue a new guarded mutation
Conflict, compacted cursor, expired snapshot, or no endpoint	Do not repeat the same request unchanged	Refresh the revision, cursor, snapshot, or discovery state and re-evaluate business intent
Shutdown timeout or unexpected terminal state	Do not restart the same one-shot owner	Observe the real native terminal, reconcile owned resources, then create a new owner only if application policy permits

An HTTP status alone does not prove replay safety. A read may be replayable; a write may require an idempotency key, compare-and-set token, or authoritative readback. GO_LIKE_ETCD_STORE_CLEANUP explicitly means the mutation committed, so replaying it can duplicate work.

Traverse every aggregate failure

AggregateError means more than one failure was retained. Inspect every entry in error.errors in order, recurse into nested aggregates, and record each failure without replacing it with the aggregate message.

Do not assume that errors[0] or cause is primary unless the package explicitly declares that ordering. Examples of declared order are narrow: the Client completed-call path retains response/cleanup semantics documented by the Client, Node Web places the primary lifecycle failure before cleanup failures, and the NATS adapters retain their observed native failure order. Those rules do not define a repository-wide aggregate ABI.

Cause and redaction boundaries

Error.cause is local diagnostic state. Existing Error rejections retain their identity. At the explicitly normalized File Store and HTTP application/native boundaries, a non-Error rejection receives a fixed wrapper message and the original value as standard, non-enumerable Error.cause.

That cause is not written to service wire envelopes or framework-owned completion logs, metrics, or trace fields. Pino, Winston, and OTel adapters omit raw Error, message, stack, cause, body, headers, metadata, URL/path, and payload data. Secret-bearing Config, Registry, Consul Store, etcd Store, and Vault boundaries may replace or omit foreign rejection graphs; do not infer that every provider preserves an upstream cause.

An application-supplied TransportLogger may receive a local wrapper Error in diagnostic fields. The application owns that logger and is responsible for redacting any recursively serialized message, stack, cause, Request, headers, credentials, or payload data.

Typed GO_LIKE_* catalog

Each row corresponds to a structural error type reachable from the shown public package entry point. Shared literals are listed once for each source package that declares its own public type.

Context

@go-like/context has no GO_LIKE_* error code. Compare the exported canceled and deadlineExceeded sentinels by identity; read a custom cancellation cause with cause(ctx).

Transport, HTTP, and Web

Source package	Code	Meaning	Retry policy	Caller action	Security and observability
@go-like/transport/provider	GO_LIKE_TRANSPORT_CLOSED	Operation used a closed transport resource.	No automatic retry.	Stop using the owner; acquire a live client, socket, or listener under explicit call policy.	Optional cause is local only; redact before logging.
@go-like/transport/provider	GO_LIKE_TRANSPORT_STATE	Invalid transport lifecycle transition.	No.	Fix call order or provider state management.	Optional cause is local only.
@go-like/transport/provider	GO_LIKE_TRANSPORT_UNSUPPORTED_CAPABILITY	Selected provider cannot honor an explicitly requested capability.	No.	Remove the option or select a capable provider.	Do not downgrade TLS or another security requirement to make the call pass.
@go-like/transport/provider	GO_LIKE_TRANSPORT_PROTOCOL	Invalid Request or Response, metadata, codec output, or wire behavior.	No automatic retry.	Reject the payload/provider and investigate compatibility.	Cause can contain local validation detail; it is not a wire field.
@go-like/web/node	GO_LIKE_NODE_SERVER_ALREADY_STARTED	One-shot Node Web server was started again.	No.	Reuse the running server or construct a new server after terminal cleanup.	Record lifecycle status, not message text.
@go-like/web/node	GO_LIKE_NODE_SERVER_FORCE_CLOSE	Graceful drain exceeded its deadline and force close began.	Reconcile first.	Observe actual terminal state and active connections; do not claim graceful completion.	timeoutMs and activeConnections are bounded diagnostics.
@go-like/web/node	GO_LIKE_NODE_SERVER_UNEXPECTED_CLOSE	Native Node host closed outside owner shutdown.	No automatic restart.	Treat the server as terminal, investigate the host, then create a new owner if allowed.	Aggregate cleanup failures may follow in observation order.

HTTP status is the Fetch Response status. There is no GO_LIKE_HTTP_STATUS code. A non-2xx JSON body is a ServiceError. GO_LIKE_HTTP_TRANSPORT_UNEXPECTED_EXIT remains a structural source code and is listed with the other unreachable codes below.

Config

Source package	Code	Meaning	Retry policy	Caller action	Security and observability
@go-like/config	GO_LIKE_CONFIG_ALREADY_LOADED	One-shot Config load was called after leaving idle.	No.	Reuse the loaded Config or create a new owner.	Record status; do not branch on message.
@go-like/config	GO_LIKE_CONFIG_SOURCE	Named source failed during load, watch, next, or stop.	Initial load: policy-specific; background reload is internally bounded.	Inspect sourceName and phase; use onReloadError or onTerminalError as appropriate.	Non-Error source rejections are replaced by a fixed local Error; do not expect raw values.
@go-like/config	GO_LIKE_CONFIG_NOT_FOUND	Config is not loaded or the dotted key is absent.	No unchanged retry.	Load Config or supply/handle the missing key.	key is application configuration identity; avoid exposing secrets encoded in names.
@go-like/config	GO_LIKE_CONFIG_VALIDATION	Standard Schema issues, throw, malformed result, or invalid output.	No.	Fix the source, resolver, or schema contract.	Issues use safe framework placeholders; causes remain local.
@go-like/config-consul	GO_LIKE_CONSUL_HTTP	Consul KV query returned a non-success status.	Provider watch retries availability failures; direct policy still requires replay safety.	Inspect status and source health; preserve last-good config when available.	Token is excluded from URL, message, and diagnostics; response body is not retained.
@go-like/config-etcd	GO_LIKE_ETCD_HTTP	etcd range/watch gateway returned a non-success status.	Availability-only provider policy.	Inspect operation/status; allow watch recovery or repair authorization/backend health.	Response contents and token are not retained.
@go-like/config-etcd	GO_LIKE_ETCD_PROTOCOL	etcd range/watch response was malformed.	No.	Reject the snapshot and investigate gateway compatibility/data.	Response contents are not retained.
@go-like/config-etcd	GO_LIKE_ETCD_TRANSPORT	etcd range/watch Fetch boundary failed.	Provider watch may retry; direct replay must be authorized.	Check operation and backend reachability.	Secret-safe wrapper omits foreign rejection graph.
@go-like/config-kubernetes	GO_LIKE_KUBERNETES_CONFIG_HTTP	ConfigMap/Secret get, list, or watch returned a non-success status.	Availability-only provider policy.	Inspect operation/status; let relist policy recover or repair auth/resource identity.	Token and response contents are not public diagnostics.
@go-like/config-kubernetes	GO_LIKE_KUBERNETES_CONFIG_PROTOCOL	Kubernetes configuration response or watch frame was invalid.	No.	Reject the snapshot and investigate API/proxy compatibility.	Do not log Secret values or raw frames.
@go-like/config-kubernetes	GO_LIKE_KUBERNETES_CONFIG_TRANSPORT	Kubernetes configuration Fetch boundary failed.	Provider watch may retry; direct replay must be authorized.	Check operation, API reachability, and watcher recovery.	Secret-safe wrapper omits foreign rejection data.
@go-like/config-vault	GO_LIKE_VAULT_HTTP	Vault KV v2 read returned a non-success status.	Provider retries only documented availability statuses.	Check status, path policy, token, and backend health.	Body, token, namespace, and secret data are not retained.
@go-like/config-vault	GO_LIKE_VAULT_PROTOCOL	Vault KV v2 response was invalid.	No.	Reject the snapshot and investigate mount/version/response shape.	Response and secret contents are not retained.
@go-like/config-vault	GO_LIKE_VAULT_TRANSPORT	Vault Fetch boundary failed.	Provider availability policy only.	Check backend reachability; retain last-good config when available.	Foreign rejection graph is replaced to protect secret-bearing requests.

Registry

Source package	Code	Meaning	Retry policy	Caller action	Security and observability
@go-like/registry	GO_LIKE_REGISTRY_STATE	Registry operation is invalid in the current provider state.	No.	Fix lifecycle order or replace the provider owner.	Record operation and state, not message.
@go-like/registry	GO_LIKE_WATCHER_STOPPED	next was called after watcher stop.	No.	Stop using it; create a fresh watcher and obtain a complete snapshot.	Do not retain an old snapshot as proof of current reachability.
@go-like/registry	GO_LIKE_WATCHER_OVERFLOW	Raw watch-event buffer overflowed and events were lost.	Reconcile, not blind retry.	Discard incremental state and rebuild from a complete provider snapshot.	bufferSize is safe; lost events mean the old view is not authoritative.
@go-like/registry	GO_LIKE_REGISTRY_PROTOCOL	Provider record is malformed or conflicts and fails closed.	No.	Reject the snapshot/record and repair provider data or ownership.	Do not log untrusted raw provider payloads.
@go-like/registry	GO_LIKE_UNSUPPORTED_REGISTRY_CAPABILITY	Requested operation is outside provider capabilities.	No.	Choose a capable provider or remove the unsupported request.	Never fake lease, watch, or registration guarantees.
@go-like/registry	GO_LIKE_NO_AVAILABLE_ENDPOINT	Discovery, filters, or selection produced no usable endpoint.	Refresh/re-evaluate; do not spin.	Obtain a new complete snapshot, relax only intentional filters, or fail closed.	Empty snapshot is authoritative; do not log sensitive metadata.
@go-like/registry-consul	GO_LIKE_CONSUL_HTTP	Consul register, heartbeat, deregister, readback, get, or watch returned non-success.	Availability retries only; mutations require provider readback/reconciliation.	Inspect operation/status and registration diagnostics.	Request, token, and response body are not retained.
@go-like/registry-consul	GO_LIKE_CONSUL_TRANSPORT	Consul Fetch boundary failed.	Replayable availability operations only.	Check operation and backend; reconcile registration ownership after mutation failure.	Secret-safe cause excludes secret-bearing Request data.
@go-like/registry-etcd	GO_LIKE_ETCD_HTTP	etcd lease, transaction, range, or watch operation returned non-success.	Availability retries only; mutations require reconciliation.	Inspect operation/status and rebuild watcher or registration state.	Status-only; token and response body are not retained.
@go-like/registry-etcd	GO_LIKE_ETCD_TRANSPORT	etcd Registry Fetch boundary failed.	Replayable availability operations only.	Check operation/backend and reconcile lease or transaction outcome.	Secret-safe cause excludes request credentials.
@go-like/registry-kubernetes	GO_LIKE_KUBERNETES_HTTP	EndpointSlice API operation returned non-success.	Availability retries only; mutation conflicts require reconciliation.	Inspect operation/status, relist, or repair RBAC/ownership.	Status-only; token and response body are not retained.
@go-like/registry-kubernetes	GO_LIKE_KUBERNETES_TRANSPORT	Kubernetes Registry Fetch boundary failed.	Replayable availability operations only.	Check operation/API reachability and reconcile managed EndpointSlices.	Secret-safe cause excludes request credentials.
@go-like/registry-zookeeper	GO_LIKE_ZOOKEEPER_OPERATION	Native ZooKeeper operation failed.	Only when the exported retryable field is true and policy permits.	Inspect operation/nativeCode, then reconnect or reconcile ephemeral state.	Error is secret-safe; avoid logging auth payloads or node data.
@go-like/registry-zookeeper	GO_LIKE_ZOOKEEPER_AUTHENTICATION	ZooKeeper authentication reached a terminal failure.	No.	Repair credentials/ACL configuration and replace the session owner.	Do not log credentials.

Store and Cache

Source package	Code	Meaning	Retry policy	Caller action	Security and observability
@go-like/store	GO_LIKE_STORE_CONFLICT	ifAbsent or revision condition did not match.	No unchanged retry.	Read current record, re-evaluate business intent, then issue a new guarded mutation.	Revisions are provider-opaque; do not treat them as timestamps.
@go-like/store-file	GO_LIKE_FILE_STORE_STATE	File Store operation is outside the admitted lock lifecycle.	No.	Fix start/stop order or create a new Store owner.	Record operation/state only; filesystem causes stay local.
@go-like/store-file	GO_LIKE_FILE_STORE_CORRUPTION	Snapshot failed encoding, JSON, schema, checksum, or record validation.	No.	Quarantine/restore using an operator-approved recovery; do not overwrite automatically.	Reason is secret-safe; snapshot contents are not exposed.
@go-like/store-file	GO_LIKE_FILE_STORE_LOCKED	Directory lock is already held or stale but unverified.	No automatic lock stealing.	Prove no live owner before an operator removes a stale lock.	Do not infer ownership from PID alone.
@go-like/store-consul	GO_LIKE_CONSUL_STORE_HTTP	Consul Store operation returned a non-success status.	Reads may use bounded availability policy; mutations reconcile first.	Inspect operation/status and authoritative KV/session state.	Token and response body are not retained.
@go-like/store-consul	GO_LIKE_CONSUL_STORE_TRANSPORT	Consul Store Fetch boundary failed.	Reads only when authorized; mutations reconcile first.	Check backend and exact KV/session readback.	Secret-bearing rejection graphs may be replaced; cause is local.
@go-like/store-consul	GO_LIKE_CONSUL_STORE_PROTOCOL	Managed KV or Consul response was malformed.	No.	Reject the data and repair the isolated provider root.	Response and stored value contents are not retained in the error.
@go-like/store-consul	GO_LIKE_CONSUL_STORE_UNCERTAIN	Exact readback could not prove a mutation or session outcome.	Never blindly replay.	Reconcile exact KV/session identity before deciding the next guarded operation.	Cause is local; redact it and all credentials.
@go-like/store-consul	GO_LIKE_CONSUL_STORE_UNSUPPORTED_COMBINATION	Requested TTL/CAS combination cannot be atomic in the supported Consul API.	No.	Change the storage design or option combination before I/O.	Do not emulate atomicity with read-then-write.
@go-like/store-etcd	GO_LIKE_ETCD_STORE_HTTP	etcd Store gateway returned HTTP/gRPC failure.	Reads may use bounded availability policy; mutations reconcile first.	Inspect operation/status/grpcCode and authoritative state.	Response body, Fetch rejection, and token are not retained.
@go-like/store-etcd	GO_LIKE_ETCD_STORE_TRANSPORT	etcd Store Fetch boundary failed.	Reads only when authorized; mutations reconcile first.	Check backend and exact transaction/readback state.	Secret-safe error omits foreign rejection graph.
@go-like/store-etcd	GO_LIKE_ETCD_STORE_PROTOCOL	etcd gateway data was malformed.	No.	Reject the data and investigate gateway/provider compatibility.	Response contents are not retained.
@go-like/store-etcd	GO_LIKE_ETCD_STORE_COMPACTED	Pagination revision was removed by compaction.	Do not continue the old cursor.	Restart listing from the first page and re-evaluate snapshot intent.	Revision is opaque provider state.
@go-like/store-etcd	GO_LIKE_ETCD_STORE_LEASE_LOST	Granted TTL lease disappeared before write commit.	Reconcile first.	Read the key/lease state, then issue a new guarded write only if needed.	Do not treat lease loss as proof that no write occurred.
@go-like/store-etcd	GO_LIKE_ETCD_STORE_UNCERTAIN	Exact readback could not prove write/delete outcome.	Never blindly replay.	Reconcile the exact key and operation marker before another mutation.	Cause is local and may describe provider failure; redact it.
@go-like/store-etcd	GO_LIKE_ETCD_STORE_CLEANUP	Mutation committed but obsolete lease cleanup failed.	Do not replay the mutation.	Accept/reconcile committed data, then repair lease cleanup separately.	committed: true is authoritative; cause is local.
@go-like/store-vault	GO_LIKE_VAULT_STORE_HTTP	Vault Store operation returned a non-success status.	Reads may use bounded availability policy; mutations reconcile first.	Inspect operation/status and exact KV version state.	Body, token, namespace, and secret data are not retained.
@go-like/store-vault	GO_LIKE_VAULT_STORE_PROTOCOL	Vault response or managed envelope was malformed.	No.	Reject the data and repair mount/provider content.	Response and secret contents are not retained.
@go-like/store-vault	GO_LIKE_VAULT_STORE_TRANSPORT	Vault Store Fetch boundary failed.	Reads only when authorized; mutations reconcile first.	Check backend and exact KV version/readback state.	Foreign rejection graph is replaced for secret-bearing requests.
@go-like/store-vault	GO_LIKE_VAULT_STORE_UNCERTAIN	Exact readback could not prove write/delete outcome.	Never blindly replay.	Reconcile exact KV version before another mutation.	Cause is a safe local wrapper; redact it.
@go-like/store-vault	GO_LIKE_VAULT_STORE_SNAPSHOT	Process-local list cursor is invalid, expired, or over capacity.	Do not reuse the cursor.	Restart listing and tolerate a new Vault snapshot.	Cursor is process-local and must not be persisted as durable state.
@go-like/cache-redis	GO_LIKE_CACHE_REDIS_OPERATION	Redis connect, command, or close boundary failed.	Cache operation may fall back; replay only disposable cache work.	Use the authoritative data path and observe/cache-repair separately.	Cause is local and may contain Redis detail; redact credentials and keys.
@go-like/cache-redis	GO_LIKE_CACHE_REDIS_PROTOCOL	Redis value is not a canonical go-like Cache carrier.	No.	Treat as miss/corruption per application policy and repair or evict safely.	Do not log cached payload contents.

Broker and worker lifecycle

Source package	Code	Meaning	Retry policy	Caller action	Security and observability
@go-like/bullmq	GO_LIKE_BULLMQ_ALREADY_STARTED	One-shot Worker server was started again.	No.	Reuse the owner or construct a new server after real terminal cleanup.	Record queueName/status; job policy remains BullMQ-owned.
@go-like/bullmq	GO_LIKE_BULLMQ_UNEXPECTED_EXIT	Worker run/closed terminal occurred outside owner stop.	No automatic restart.	Reconcile Worker, jobs, Queue, and Redis state before replacement.	Native cause is local; application owns redaction and Worker error observation.
@go-like/bullmq	GO_LIKE_BULLMQ_WORKER_SHUTDOWN_TIMEOUT	Worker exceeded pause/close boundary; native cancellation was requested.	Do not restart yet.	Keep observing the real Worker terminal and reconcile active jobs.	Timeout does not prove closure or job failure.
@go-like/nats	GO_LIKE_NATS_CORE_ALREADY_STARTED	One-shot Core Subscription server was started again.	No.	Reuse it or create a new server after native terminal.	Connection and message data remain application-owned.
@go-like/nats	GO_LIKE_NATS_CORE_UNEXPECTED_EXIT	Subscription closed before owner stop.	No automatic restart.	Reconcile subscription/connection state before replacing it.	Native cause is local and may appear in an ordered aggregate.
@go-like/nats	GO_LIKE_NATS_CORE_DRAIN_TIMEOUT	Drain timed out and unsubscribe was requested.	Do not restart yet.	Observe closed; reconcile delivery/subscription state.	forced: true does not prove native terminal.
@go-like/nats/jetstream	GO_LIKE_NATS_JETSTREAM_ALREADY_STARTED	One-shot ConsumerMessages server was started again.	No.	Reuse it or create a new server after native terminal.	Durable consumer and settlement remain application-owned.
@go-like/nats/jetstream	GO_LIKE_NATS_JETSTREAM_UNEXPECTED_EXIT	ConsumerMessages closed before owner stop.	No automatic restart.	Reconcile delivery, consumer, and connection state before replacement.	Native cause is local and may appear in an ordered aggregate.
@go-like/nats/jetstream	GO_LIKE_NATS_JETSTREAM_CLOSE_TIMEOUT	Close timed out and native stop was requested.	Do not restart yet.	Observe closed() and reconcile unacked delivery state.	forced: true does not prove iterator or consumer terminal.

Observability lifecycle

Source package	Code	Meaning	Retry policy	Caller action	Security and observability
@go-like/otel	GO_LIKE_OTEL_ALREADY_STARTED	One-shot OTel provider server was started again.	No.	Reuse the owner or create a new adapter after provider terminal.	Framework spans/metrics do not record raw Error fields.
@go-like/otel	GO_LIKE_OTEL_SHUTDOWN_TIMEOUT	Provider shutdown exceeded the owner wait boundary.	Reconcile first.	Continue observing provider shutdown; do not claim terminal.	Only bounded error type/code fields enter framework telemetry.
@go-like/pino	GO_LIKE_PINO_ALREADY_STARTED	One-shot destination server was started again.	No.	Reuse it or create a new owner after destination close.	Request wrapper omits raw Error/message/stack/cause and payload fields.
@go-like/pino	GO_LIKE_PINO_DRAIN_TIMEOUT	Destination drain exceeded its boundary; force may be unavailable.	Do not restart yet.	Observe real close and inspect forceSupported.	Timeout does not prove records flushed or destination closed.
@go-like/pino	GO_LIKE_PINO_DESTINATION_CLOSED	Destination closed outside the accepted owner shutdown.	No automatic restart.	Stop writing, reconcile final logs, then replace the destination owner.	Preserve native logger redaction configuration.
@go-like/winston	GO_LIKE_WINSTON_ALREADY_STARTED	One-shot Winston server was started again.	No.	Reuse it or create a new owner after terminal.	Request wrapper omits raw Error/message/stack/cause and payload fields.
@go-like/winston	GO_LIKE_WINSTON_LOGGER_FINISHED	Logger reached finish before owner stop.	No automatic restart.	Treat adapter as terminal and replace only after reconciling transports.	Finished is a lifecycle signal, not proof every external sink is durable.
@go-like/winston	GO_LIKE_WINSTON_LOGGER_CLOSED	Logger emitted unexpected close.	No automatic restart.	Treat adapter as terminal and inspect application-owned transports.	Do not log raw errors or transport payloads through framework wrappers.

Non-contract source diagnostics

Source	Code	Status	Meaning	Retry or reconcile policy	Caller rule	Security and observability
@go-like/transport-http source	GO_LIKE_HTTP_TRANSPORT_UNEXPECTED_EXIT	Structural type exists in source but is unreachable from every declared package entry point.	Runtime host or serve loop ended without an upstream Error, before readiness or while running.	Do not restart automatically; reconcile listener/host terminal state before policy permits replacement.	Do not use it as a stable branch condition; package consumers cannot import its named type.	source and phase are safe, bounded diagnostics.
@go-like/cache-redis runtime source	GO_LIKE_CACHE_REDIS_STATE	Private state/admission diagnostic with no public structural type promise.	A Redis cache operation was rejected by private lifecycle state or admission logic.	Do not infer replay safety from this literal; handle the Cache operation under its documented public API.	Do not use it as a stable branch condition. Handle the Cache operation generically or through a documented public code.	Redact Redis credentials, keys, and provider data.

Source declarations and runtime literals are inventory facts, not public contracts merely because an inventory command finds them. A stable code requires a deliberate structural type and package-entry export decision.