🚀 go-pugleaf

I'm trying to figure out what is the best course of action when an error
occurs during a msg_receive.  There are basically two sorts of possible
errors.  First, there might be a kernel resource shortage.  When the
kernel tries to move some port rights from the message to the receiving
task, or move some out-of-line memory into the receiver's address space,
it could find itself unable to allocate a necessary data structure. 
Mach doesn't have resource quotas on the VM or IPC data structures, but
if it did, exceeding them would cause a similar situation.  Second,
there might be a more abstract resource problem.  The receiver's address
space might not have room for the out-of-line memory (quite possible for
some applications), or there might not be an available name for a new
port right (not bloody likely).

I would like to hear from writers of serious, robust applications what
kind of error recovery they would find useful.

Thanks,
Rich