graceful degradation is an invariant, not a vibe

This site aggregates my other projects as live data, and every source sits behind a connector with one rule: if anything fails (missing config, dead upstream, bad data), return placeholder data, never crash. That’s why CI builds with zero secrets and the site renders even when a source is down.

Then an audit of my own code found two connectors breaking the rule. Both did fallible setup before the try: one awaited a Google Drive token on its first line, the other constructed a database client, which throws synchronously on a malformed connection string. The catch guarded the query, not the setup. One transient auth blip and the page whose whole promise was “never crash” would have crashed.

The fix was moving two lines. The lesson is the bug class: “this function never throws” is a claim about its first fallible expression, so the try has to start there. Tests now mock the token to reject and the client to throw, and assert sample data comes back.

None of this contradicts failing loud on bad config at startup. A failure policy is chosen per edge: config breaks in front of the person deploying, read paths break in front of a visitor.