Go's philosophy is explicit errors, but some failure modes are truly unrecoverable. When do you deliberately choose panic/recover, and how do you make the decision defensible in review?