The From<NonZeroU32> for Error implementation doesn't do any checking of its inputs; for example, it doesn't verify that an "internal" error code isn't being used, nor does it verify that any internal error code is actually a valid/known one.

I propose:

• Replace all internal uses of it; See Enforce OS errors are in the allowed range. #441 for some progress here.
• Add pub const fn Error::new_custom(value: u16) -> Error
• Add pub const fn Error::new_os(u32) -> Error with range checking, as done in Enforce OS errors are in the allowed range. #441, though Enforce OS errors are in the allowed range. #441 doesn't make it pub.
• Mark the impl From<NonZeroU32> for Error as #[deprecated] now.
• In a future SemVer-breaking release, remove the implementation.

This way, internal errors will eventually only be able to be constructed from within the crate.