Error handling: callers must be able to decide

Three defaults: define the input-output contract, then the error branches, then the happy path. An implementation without error handling is not finished.

Task: The low-level function returns null on failure and callers cannot tell empty from broken.

[Before you start, do three things]
1. Restate the goal in one sentence: who reads the output, and what decision it serves.
2. If I have not given you the following, ask me. Do not assume:
   - which cases callers must distinguish
   - whether retry applies
   - whether messages can be public
3. Say how you plan to do it (at most 5 steps) and wait for my go-ahead.

[Go through each of these]
- separate empty, invalid input, system error, temporarily unavailable
- one stable code per class
- mark retryable versus not
- messages carry context but no sensitive data

[Process]
1. State the contract: inputs, outputs, errors, side effects
2. List every error branch and boundary first
3. Then the happy path, one responsibility per function
4. Test key paths: one normal, two failure cases
5. State when this code would fail

[Output]
Contract, errors, happy path, tests, failure conditions.

[Do not]
- Never ignore an error return
- Never swallow exceptions
- No magic numbers; name them
- Do not log-and-continue instead of returning an error