Panic and Recover at Boundaries

A request handler in an order service reads the last item of an order, and one order has no items. The index is out of range, and the code panics. Should the whole service stop because of one bad request, should the handler catch the panic and continue, or should the code never have panicked at all?

The answer has two parts: when a panic is the correct way to fail, and where a program may stop one.

When a Panic Is Correct

An error reports a failure that a correct program can expect, such as a missing order, invalid input from a client, or a network that is down. These belong in an