fix: keep the images found around a document that fails

[MPV]

The N1 finding from the hardening review. fix:, so it also bumps the version.

Problem

ProcessReader returned nil on the first document it couldn't process, throwing away everything already collected. Run against master (e4ba37d) with a file whose middle document is malformed:

$ kir kir_test.TestFailure.PartialStream.input.yaml
error: yaml: line 9: did not find expected ',' or ']'
$ echo $?
1

The valid Pods either side of the bad one are gone. The exit code is honest, so this isn't silent — but the loss is total where partial was available, and the operator's only visible result is an error and no images.

It matters most where a whole cluster arrives as one input. kubectl get pod -A -o yaml | kir - is a single stream, so one unparseable object costs every image in the dump.

Change

$ kir kir_test.TestFailure.PartialStream.input.yaml
error: yaml: line 9: did not find expected ',' or ']'
before-the-break:1.0
after-the-break:1.0
$ echo $?
1

Failures are collected per document instead of aborting: documents after a bad one are still read, every failure is reported rather than only the first, and the images found come back alongside the joined error. cmd prints them even when an input reported an error, and unwraps the joined error so stderr stays one error: line per failure.

One distinction the fix respects: a reader.Read() failure means the stream can no longer be split into documents, so there's nothing further to read and it stops — but still returns what it found. Only per-document decode failures continue. I checked which layer actually raises the error in this case, and it's ProcessData, so the documents after the bad one really are recoverable rather than theoretically so.

Why this isn't a new decision

ADR 0008 already promises kir "processes every input, prints every image it finds, logs each failure to stderr, and returns a non-zero exit code if any input failed." It said that about inputs; a stream is a batch of documents, and the same reasoning applies one level down. The ADR now says so explicitly rather than leaving it to be inferred — no new ADR, per AGENTS.md.

Tests

Both fail on unmodified code — verified by reverting yamlparser.go and cmd.go and re-running:

• An approvals golden, TestFailure/PartialStream: this input is ordinary text, not bytes a fixture would normalise, so per AGENTS.md it belongs in approvals/ rather than in Go source. It pins the whole triple — both images on stdout, one error on stderr, exit 1. Reverting gives received does not match approved. The existing BadYAML case can't pin this: its entire file is unparseable, so it passes whether or not partial results survive.
• yamlparser unit tests: one asserting the images either side of a bad document survive (reverting gives images = [], want [before-the-break after-the-break]), one asserting a stream with two bad documents reports two failures rather than one.

Every pre-existing golden passes untouched — the change doesn't shift BadYAML, whose output is identical because there was nothing to salvage.

Checklist

gofmt -l . empty · go vet ./... clean · go test ./... and -race green · go mod tidy no drift · no new dependencies.

Merge order

Both this and #102 change printImages' call sites in cmd.go, so whichever lands second needs a rebase — happy to do it. #102 first would be my suggestion, since it's the one already reviewed.

---

Generated by Claude Code