code: func (e *engineImpl) ProcessPubSubPush(c context.Context, body []byte) error {
  	var pushBody struct {
  		Message pubsub.PubsubMessage `json:"message"`
  	}
  	if err := json.Unmarshal(body, &pushBody); err != nil {
  		return err
  	}
  	// Retry once after a slight adhoc delay (to let datastore transactions land)
  	// instead of returning an error to PubSub immediately. We don't want errors
  	// tagged with tq.Retry to engage PubSub flow control, since they are
  	// semi-expected and it is also expected that an immediate retry helps. This
  	// is still best effort only and on another error we let the PubSub retry
  	// mechanism to handle it.
  	err := e.handlePubSubMessage(c, &pushBody.Message)
  	if err == nil || !tq.Retry.In(err) {
  		return err
  	}
  	logging.Warningf(c, "Attempting a quick retry after 1s: %s", err)
  	clock.Sleep(c, time.Second)
  	return e.handlePubSubMessage(c, &pushBody.Message)
  }
docs: // ProcessPubSubPush is called whenever incoming PubSub message is received.
  //
  // Part of the internal interface, doesn't check ACLs.