Handle a degraded construction¶

bus, err := messaging.New(backend, settings)

Both return values can be meaningful at once. The bus is complete and correct for everything that was applied; the error is the complete list of what was not.

The conservative path costs you nothing¶

bus, err := messaging.New(backend, settings)
if err != nil {
    return err
}

This is correct and is what most services should do. The degraded path is available only to callers who look for it, so nothing is made worse for anybody by its existing.

The degraded path¶

bus, err := messaging.New(backend, settings)
if bus == nil {
    return err // fatal: nothing usable was built
}

if err != nil {
    log.Warn("messaging started with settings the backend could not apply", "detail", err)
}

The test is bus == nil, not err != nil. A nil bus means a fatal problem; a non-nil bus with an error means it is running with less than you asked for.

What degrades, and what is fatal¶

The line is ownership, not severity.

Overflow is the one setting that degrades; every other capability mismatch above is fatal, because a delivery guarantee, a pattern language or a lease is a promise this module makes to a handler's author, and downgrading one silently changes what that handler is entitled to assume without telling them. A backend declining an overflow policy changes only what happens at a full queue, which is visible and countable either way. See what happens at a full queue.

Two properties worth relying on¶

A degraded setting is not applied at all — not substituted, clamped or approximated. Asking for ShedOldest on a backend that cannot do it gets that backend's native behaviour, because delivering a value nobody requested while reporting success for that field is worse than saying plainly that it was dropped.

The error names every problem, not the first. Three unsupported settings produce one error naming all three, rather than one round trip at a time.

An unreachable backend is not a construction failure¶

Construction does not connect, deliberately, so that a briefly unavailable cluster does not stop your application booting. Unreachability shows up exactly once, where you are already looking: Ready() does not close and your own timeout fires.