By: Michael Lynch <git@mtlynch.io>
Expose only policy-relevant error identities The codebase had accumulated exported sentinel errors for many constructors and parsers even when no production caller changed behavior based on their identity. At the same time, upload handlers inconsistently mapped equivalent limits and sometimes exposed decoder, multipart, filename, or validation details in HTTP responses. Litestream v0.5.14 in files litestream.go, server.go, and cmd/litestream/restore.go uses typed or sentinel errors when a caller needs a concrete recovery or response policy, then classifies them at the boundary that owns that policy. Its restore command checks specific identities with errors.Is rather than making every error part of a repository-wide taxonomy. Apply that decision rule locally: preserve identity only when production control flow requires it. Keep the image-resolution and video-duration limit identities, preserve them through wrapping, and classify them in the upload handler as stable 413 responses. Return fixed 400 messages for malformed or unreadable media and keep implementation detail out of client responses. Remove validation sentinels that existed only to support unit-test errors.Is assertions, and update those tests to assert error presence while retaining result checks. Conversion, storage, database, and other unexpected failures remain ordinary wrapped errors. The implementation challenge was avoiding the opposite form of overengineering. A generic AppError or status-bearing domain error would couple unrelated packages to HTTP policy, while removing every sentinel would lose the limits that handlers genuinely distinguish. The change therefore required auditing production errors.Is call sites and migrating a broad set of tests without weakening user-visible route coverage. No external blockers were encountered. Focused tests, the full Go checks, and every flake target passed before the amendment.