fix: replace .expect()/.unwrap() with proper error propagation in production code

Remove 31 panic-on-error calls across 10 files, replacing them with
proper Result propagation (?), match+tracing::error patterns for
void-returning functions, and .map_err conversions for AgentError
boundaries.

Files changed:
- agent/channel.rs: 12 fixes (build_system_prompt -> Result<String>,
  render_conversation_context, flush_pending_retrigger, spawn_branch,
  spawn_memory_persistence_branch, spawn_worker_from_state)
- agent/compactor.rs: 2 fixes (prompt render + truncation marker)
- agent/cortex.rs: 2 fixes (bulletin + synthesis prompts)
- agent/cortex_chat.rs: 2 fixes (build_system_prompt -> Result<String>)
- agent/ingestion.rs: 2 fixes (prompt renders -> ?)
- agent/worker.rs: 2 fixes (overflow msg + compact marker)
- api/bindings.rs: 4 fixes (let-else guards in tokio::spawn)
- api/config.rs: 7 fixes (get_or_create_subtable -> Result + 6 callers)
- skills.rs: 2 fixes (render_channel_prompt -> Result<String>)
- tools/spawn_worker.rs: 2 fixes (as_object_mut unwrap -> if-let guard)

Author: PyRo1121

src/agent/channel.rs

@@ -391,7 +391,7 @@ impl Channel {
 
         if messages.len() == 1 {
             // Single message - process normally
-            let message = messages.into_iter().next().unwrap();
+            let message = messages.into_iter().next().ok_or_else(|| anyhow::anyhow!("empty iterator after length check"))?;
             self.handle_message(message).await
         } else {
             // Multiple messages - batch them
@@ -464,8 +464,7 @@ impl Channel {
                 });
             self.conversation_context = Some(
                 prompt_engine
-                    .render_conversation_context(&first.source, server_name, channel_name)
-                    .expect("failed to render conversation context"),
+                    .render_conversation_context(&first.source, server_name, channel_name)?,
             );
         }
 
@@ -557,7 +556,7 @@ impl Channel {
         // Build system prompt with coalesce hint
         let system_prompt = self
             .build_system_prompt_with_coalesce(message_count, elapsed_secs, unique_sender_count)
-            .await;
+            .await?;
 
         {
             let mut reply_target = self.state.reply_target_message_id.write().await;
@@ -594,21 +593,20 @@ impl Channel {
         message_count: usize,
         elapsed_secs: f64,
         unique_senders: usize,
-    ) -> String {
+    ) -> Result<String> {
         let rc = &self.deps.runtime_config;
         let prompt_engine = rc.prompts.load();
 
         let identity_context = rc.identity.load().render();
         let memory_bulletin = rc.memory_bulletin.load();
         let skills = rc.skills.load();
-        let skills_prompt = skills.render_channel_prompt(&prompt_engine);
+        let skills_prompt = skills.render_channel_prompt(&prompt_engine)?;
 
         let browser_enabled = rc.browser_config.load().enabled;
         let web_search_enabled = rc.brave_search_key.load().is_some();
         let opencode_enabled = rc.opencode.load().enabled;
-        let worker_capabilities = prompt_engine
-            .render_worker_capabilities(browser_enabled, web_search_enabled, opencode_enabled)
-            .expect("failed to render worker capabilities");
+        let worker_capabilities =
+            prompt_engine.render_worker_capabilities(browser_enabled, web_search_enabled, opencode_enabled)?;
 
         let status_text = {
             let status = self.state.status_block.read().await;
@@ -625,18 +623,16 @@ impl Channel {
 
         let empty_to_none = |s: String| if s.is_empty() { None } else { Some(s) };
 
-        prompt_engine
-            .render_channel_prompt(
-                empty_to_none(identity_context),
-                empty_to_none(memory_bulletin.to_string()),
-                empty_to_none(skills_prompt),
-                worker_capabilities,
-                self.conversation_context.clone(),
-                empty_to_none(status_text),
-                coalesce_hint,
-                available_channels,
-            )
-            .expect("failed to render channel prompt")
+        prompt_engine.render_channel_prompt(
+            empty_to_none(identity_context),
+            empty_to_none(memory_bulletin.to_string()),
+            empty_to_none(skills_prompt),
+            worker_capabilities,
+            self.conversation_context.clone(),
+            empty_to_none(status_text),
+            coalesce_hint,
+            available_channels,
+        )
     }
 
     /// Handle an incoming message by running the channel's LLM agent loop.
@@ -718,12 +714,11 @@ impl Channel {
                 });
             self.conversation_context = Some(
                 prompt_engine
-                    .render_conversation_context(&message.source, server_name, channel_name)
-                    .expect("failed to render conversation context"),
+                    .render_conversation_context(&message.source, server_name, channel_name)?,
             );
         }
 
-        let system_prompt = self.build_system_prompt().await;
+        let system_prompt = self.build_system_prompt().await?;
 
         {
             let mut reply_target = self.state.reply_target_message_id.write().await;
@@ -795,21 +790,20 @@ impl Channel {
     }
 
     /// Assemble the full system prompt using the PromptEngine.
-    async fn build_system_prompt(&self) -> String {
+    async fn build_system_prompt(&self) -> crate::error::Result<String> {
         let rc = &self.deps.runtime_config;
         let prompt_engine = rc.prompts.load();
 
         let identity_context = rc.identity.load().render();
         let memory_bulletin = rc.memory_bulletin.load();
         let skills = rc.skills.load();
-        let skills_prompt = skills.render_channel_prompt(&prompt_engine);
+        let skills_prompt = skills.render_channel_prompt(&prompt_engine)?;
 
         let browser_enabled = rc.browser_config.load().enabled;
         let web_search_enabled = rc.brave_search_key.load().is_some();
         let opencode_enabled = rc.opencode.load().enabled;
         let worker_capabilities = prompt_engine
-            .render_worker_capabilities(browser_enabled, web_search_enabled, opencode_enabled)
-            .expect("failed to render worker capabilities");
+            .render_worker_capabilities(browser_enabled, web_search_enabled, opencode_enabled)?;
 
         let status_text = {
             let status = self.state.status_block.read().await;
@@ -831,7 +825,6 @@ impl Channel {
                 None, // coalesce_hint - only set for batched messages
                 available_channels,
             )
-            .expect("failed to render channel prompt")
     }
 
     /// Register per-turn tools, run the LLM agentic loop, and clean up.
@@ -1177,13 +1170,19 @@ impl Channel {
             "firing debounced retrigger"
         );
 
-        let retrigger_message = self
+        let retrigger_message = match self
             .deps
             .runtime_config
             .prompts
             .load()
             .render_system_retrigger()
-            .expect("failed to render retrigger message");
+        {
+            Ok(message) => message,
+            Err(error) => {
+                tracing::error!(%error, "failed to render retrigger message");
+                return;
+            }
+        };
 
         let synthetic = InboundMessage {
             id: uuid::Uuid::new_v4().to_string(),
@@ -1255,7 +1254,7 @@ pub async fn spawn_branch_from_state(
             &rc.instance_dir.display().to_string(),
             &rc.workspace_dir.display().to_string(),
         )
-        .expect("failed to render branch prompt");
+        .map_err(|e| AgentError::Other(anyhow::anyhow!("{e}")))?;
 
     spawn_branch(
         state,
@@ -1279,10 +1278,10 @@ async fn spawn_memory_persistence_branch(
     let prompt_engine = deps.runtime_config.prompts.load();
     let system_prompt = prompt_engine
         .render_static("memory_persistence")
-        .expect("failed to render memory_persistence prompt");
+        .map_err(|e| AgentError::Other(anyhow::anyhow!("{e}")))?;
     let prompt = prompt_engine
         .render_system_memory_persistence()
-        .expect("failed to render memory persistence prompt");
+        .map_err(|e| AgentError::Other(anyhow::anyhow!("{e}")))?;
 
     spawn_branch(
         state,
@@ -1413,7 +1412,7 @@ pub async fn spawn_worker_from_state(
             &rc.instance_dir.display().to_string(),
             &rc.workspace_dir.display().to_string(),
         )
-        .expect("failed to render worker prompt");
+        .map_err(|e| AgentError::Other(anyhow::anyhow!("{e}")))?;
     let skills = rc.skills.load();
     let browser_config = (**rc.browser_config.load()).clone();
     let brave_search_key = (**rc.brave_search_key.load()).clone();

src/agent/compactor.rs

@@ -108,9 +108,15 @@ impl Compactor {
         let channel_id = self.channel_id.clone();
         let deps = self.deps.clone();
         let prompt_engine = deps.runtime_config.prompts.load();
-        let compactor_prompt = prompt_engine
-            .render_static("compactor")
-            .expect("failed to render compactor prompt");
+        let compactor_prompt = match prompt_engine.render_static("compactor") {
+            Ok(p) => p,
+            Err(error) => {
+                tracing::error!(%error, "failed to render compactor prompt");
+                let mut flag = is_compacting.write().await;
+                *flag = false;
+                return;
+            }
+        };
 
         tokio::spawn(async move {
             let result = run_compaction(&deps, &compactor_prompt, &history, fraction).await;
@@ -155,9 +161,7 @@ impl Compactor {
 
         // Insert a marker at the beginning
         let prompt_engine = self.deps.runtime_config.prompts.load();
-        let marker = prompt_engine
-            .render_system_truncation(remove_count)
-            .expect("failed to render truncation message");
+        let marker = prompt_engine.render_system_truncation(remove_count)?;
         history.insert(0, Message::from(marker));
 
         tracing::warn!(

src/agent/cortex.rs

@@ -456,9 +456,13 @@ pub async fn generate_bulletin(deps: &AgentDeps, logger: &CortexLogger) -> bool
     // Phase 2: LLM synthesis of raw sections into a cohesive bulletin
     let cortex_config = **deps.runtime_config.cortex.load();
     let prompt_engine = deps.runtime_config.prompts.load();
-    let bulletin_prompt = prompt_engine
-        .render_static("cortex_bulletin")
-        .expect("failed to render cortex bulletin prompt");
+    let bulletin_prompt = match prompt_engine.render_static("cortex_bulletin") {
+        Ok(p) => p,
+        Err(error) => {
+            tracing::error!(%error, "failed to render cortex bulletin prompt");
+            return false;
+        }
+    };
 
     let routing = deps.runtime_config.routing.load();
     let model_name = routing.resolve(ProcessType::Branch, None).to_string();
@@ -468,9 +472,15 @@ pub async fn generate_bulletin(deps: &AgentDeps, logger: &CortexLogger) -> bool
     // No tools needed — the LLM just synthesizes the pre-gathered data
     let agent = AgentBuilder::new(model).preamble(&bulletin_prompt).build();
 
-    let synthesis_prompt = prompt_engine
+    let synthesis_prompt = match prompt_engine
         .render_system_cortex_synthesis(cortex_config.bulletin_max_words, &raw_sections)
-        .expect("failed to render cortex synthesis prompt");
+    {
+        Ok(p) => p,
+        Err(error) => {
+            tracing::error!(%error, "failed to render cortex synthesis prompt");
+            return false;
+        }
+    };
 
     match agent.prompt(&synthesis_prompt).await {
         Ok(bulletin) => {

src/agent/cortex_chat.rs

@@ -241,7 +241,7 @@ impl CortexChatSession {
             .await?;
 
         // Build the system prompt
-        let system_prompt = self.build_system_prompt(channel_context_id).await;
+        let system_prompt = self.build_system_prompt(channel_context_id).await?;
 
         // Load chat history and convert to Rig messages
         let chat_messages = self.store.load_history(thread_id, 100).await?;
@@ -313,7 +313,7 @@ impl CortexChatSession {
         Ok(event_rx)
     }
 
-    async fn build_system_prompt(&self, channel_context_id: Option<&str>) -> String {
+    async fn build_system_prompt(&self, channel_context_id: Option<&str>) -> crate::error::Result<String> {
         let runtime_config = &self.deps.runtime_config;
         let prompt_engine = runtime_config.prompts.load();
 
@@ -323,9 +323,8 @@ impl CortexChatSession {
         let browser_enabled = runtime_config.browser_config.load().enabled;
         let web_search_enabled = runtime_config.brave_search_key.load().is_some();
         let opencode_enabled = runtime_config.opencode.load().enabled;
-        let worker_capabilities = prompt_engine
-            .render_worker_capabilities(browser_enabled, web_search_enabled, opencode_enabled)
-            .expect("failed to render worker capabilities");
+        let worker_capabilities =
+            prompt_engine.render_worker_capabilities(browser_enabled, web_search_enabled, opencode_enabled)?;
 
         // Load channel transcript if a channel context is active
         let channel_transcript = if let Some(channel_id) = channel_context_id {
@@ -336,14 +335,12 @@ impl CortexChatSession {
 
         let empty_to_none = |s: String| if s.is_empty() { None } else { Some(s) };
 
-        prompt_engine
-            .render_cortex_chat_prompt(
-                empty_to_none(identity_context),
-                empty_to_none(memory_bulletin.to_string()),
-                channel_transcript,
-                worker_capabilities,
-            )
-            .expect("failed to render cortex chat prompt")
+        prompt_engine.render_cortex_chat_prompt(
+            empty_to_none(identity_context),
+            empty_to_none(memory_bulletin.to_string()),
+            channel_transcript,
+            worker_capabilities,
+        )
     }
 
     /// Load the last 50 messages from a channel as a formatted transcript.

src/agent/ingestion.rs

@@ -460,9 +460,7 @@ async fn process_chunk(
     deps: &AgentDeps,
 ) -> anyhow::Result<()> {
     let prompt_engine = deps.runtime_config.prompts.load();
-    let ingestion_prompt = prompt_engine
-        .render_static("ingestion")
-        .expect("failed to render ingestion prompt");
+    let ingestion_prompt = prompt_engine.render_static("ingestion")?;
 
     let routing = deps.runtime_config.routing.load();
     let model_name = routing.resolve(ProcessType::Branch, None).to_string();
@@ -484,9 +482,8 @@ async fn process_chunk(
         .tool_server_handle(tool_server)
         .build();
 
-    let user_prompt = prompt_engine
-        .render_system_ingestion_chunk(filename, chunk_number, total_chunks, chunk)
-        .expect("failed to render ingestion chunk prompt");
+    let user_prompt =
+        prompt_engine.render_system_ingestion_chunk(filename, chunk_number, total_chunks, chunk)?;
 
     let mut history = Vec::new();
     match agent.prompt(&user_prompt).with_history(&mut history).await {

src/agent/worker.rs

@@ -357,9 +357,8 @@ impl Worker {
                             self.hook.send_status("compacting (overflow recovery)");
                             self.force_compact_history(&mut history).await;
                             let prompt_engine = self.deps.runtime_config.prompts.load();
-                            let overflow_msg = prompt_engine
-                                .render_system_worker_overflow()
-                                .expect("failed to render worker overflow message");
+                            let overflow_msg =
+                                prompt_engine.render_system_worker_overflow()?;
                             follow_up_prompt = format!("{follow_up}\n\n{overflow_msg}");
                         }
                         Err(error) => {
@@ -449,9 +448,13 @@ impl Worker {
 
         let recap = build_worker_recap(&removed);
         let prompt_engine = self.deps.runtime_config.prompts.load();
-        let marker = prompt_engine
-            .render_system_worker_compact(remove_count, &recap)
-            .expect("failed to render worker compact message");
+        let marker = match prompt_engine.render_system_worker_compact(remove_count, &recap) {
+            Ok(m) => m,
+            Err(error) => {
+                tracing::error!(%error, "failed to render worker compact marker");
+                return;
+            }
+        };
         history.insert(0, rig::message::Message::from(marker));
 
         tracing::info!(