Error catalog

Every stable code with its cause and its fix — the same table the gate prints.

E_AMBIGUOUS_SEGMENT — Two dynamic names for the same segment
One level of the URL is named slug_ in one route and id_ in another, and the router cannot be both.
E_API_SURFACE — The public API surface changed
api/current.txt does not match the exported symbols the guarded packages declare — something was added, changed or removed without the file following.
E_AUDIT — A critical audit rule failed
trilha audit found a configuration that is unsafe to ship — a secret in the source, a cleartext provider URL.
E_BAD_SEGMENT — The folder name is not a valid segment
A folder under app/ uses a name Go cannot import — brackets, spaces, or a parameter suffix in the wrong place.
E_BILLING_WEBHOOK_UNSIGNED — The billing webhook refused an event
An event reached /webhooks/billing without a valid HMAC over timestamp.body, with a timestamp more than five minutes away from now, or with no billing-webhook connection to check it against. Every one of these is the same 401 on purpose: saying which part failed tells a stranger how close they got.
E_CATCHALL_NOT_LEAF — A catch-all is not the last segment
A `name__` folder has children, but a catch-all swallows everything below it — children would be unreachable.
E_CORS_ON_PAGE — CORS on a page
A page declares CORS, but CORS is for APIs: a browser never fetches an HTML page from another origin.
E_CSP_NONCE — An inline script or style has no nonce
The page writes a <script> or <style> inline without the nonce the Content-Security-Policy announces. The browser refuses to run it, so the page passes a test that only reads the HTML and breaks on the screen.
E_CTX_BUDGET — The context pack exceeded its budget
trilha ctx had to cut sections to fit the requested token budget.
E_DUPLICATE_PARAM — The same parameter twice in one pattern
A pattern uses a parameter name two times, so the router cannot tell which segment a value belongs to.
E_DUPLICATE_ROUTE — Two files serve the same pattern
Two routes answer the same method and path, and only one of them can win — the second is a bug waiting for traffic.
E_GEN_STALE — trilha_gen.go is out of date
The routes in app/ moved and the generated file was not regenerated, so a route can 404 with no one explaining why.
E_GOFMT — File is not gofmt'd
gofmt found formatting that differs from the standard.
E_HIDDEN_ROUTE — A route is hidden by an earlier pattern
A more general pattern registered first answers what this one was written for, so this route never runs.
E_I18N — A translation is missing keys
A locale's catalog lacks keys the default locale uses, so its readers fall back to another language.
E_NOTIFY_RATE — A notification channel hit its limit
The notifier refused to send because the channel already sent its allowance to this recipient in the current hour; the notification waits in the outbox as limited.
E_NO_APP — No app/ directory
The command ran where there is no project: no app/ folder, no routes to read.
E_NO_ERROR_FUNC — error.go has no Error function
The custom error page declares no Error handler.
E_NO_LAYOUT_FUNC — layout.go has no Layout function
The scanner found layout.go but no Layout function, so the tree's wrapper is missing.
E_NO_METHOD — route.go has no exported HTTP method
route.go declares no GET, POST, PUT, PATCH or DELETE, so the folder is a URL that answers nothing.
E_NO_MIDDLEWARE_FUNC — middleware.go has no Middleware function
The scanner found middleware.go but no Middleware function, so nothing runs before the subtree.
E_NO_NOT_FOUND_FUNC — not_found.go has no NotFound function
The custom 404 file declares no NotFound handler.
E_NO_PAGE_FUNC — page.go has no Page function
The scanner found page.go but no `func Page(c *trilha.Ctx) (h.Node, error)` in it, so the route has nothing to answer with.
E_NO_SETUP_FUNC — setup.go has no Setup function
The file named setup.go declares no Setup, so the bootstrapping it holds never runs.
E_OFFLINE_ON_API — Offline handling on an API
An API route declares the offline fallback, which answers with the cached page — an API must answer with its status.
E_OPENAPI — The OpenAPI document is stale
The openapi.json the app serves no longer matches the routes the scanner found.
E_PAGE_AND_ROUTE — A folder has page.go and route.go
The folder answers both as a page and as an API, and the router cannot serve two answers for one URL.
E_PARSE — The file could not be parsed
A Go file under app/ has a syntax error, so the scanner stopped.
E_REDIRECT_ABSOLUTE — Redirect tried to leave the site
Redirect accepts only local paths so request data cannot become an open redirect.
E_SEARCH_KIND — Search kind was not declared
A document was sent to Search.Put with a kind that is absent from the search configuration.
E_SECRET_SHORT — Signing secret is too short
A production server was started with a signing secret shorter than 32 bytes.
E_TEST — A test failed
The suite ran and at least one test did not pass — the file and line in the failure are where it said so.
E_UNROUTABLE_METHOD — The method name is not routable
HEAD, TRACE and CONNECT are not taken from files — HEAD is answered by GET, and the others are not for apps.
E_UNUSED_METHOD_MIDDLEWARE — Middleware<Method> guards no method
The folder declares a per-method middleware for a method the routes below never export.
E_VERSION_FROZEN — Published version cannot be changed
A write targeted the published version instead of a draft.
E_VET — go vet reported a problem
go vet found a suspicious construct — a lock copied by value, an unreachable branch, a format string's cousin.
E_VET_PRINTF — Printf format and arguments disagree
The printf analyzer found a format verb that does not match its argument — a %d handed a string, or a value with no verb at all.
E_VULN_ — A dependency has a known vulnerability
govulncheck found a vulnerability that this project's code actually reaches.