fail-closed-case-matching

Fail Closed, Case Match, Never Fall Back

The Rule

Every branch in conditional logic must be an explicit, named case. There are no fallbacks. There are no degraded modes. If the system cannot prove which case applies, it rejects the request.

Why

A fallback is a silent lie. It tells the caller "everything is fine" when the system actually failed to satisfy the original intent. That hides broken infrastructure, creates invisible state drift, and makes debugging harder because the failure never surfaces.

A case match is an explicit contract. Each branch has a name, a reason, and a test. If a new situation arises that does not match any case, the code fails loudly instead of silently routing to a weaker path.

What This Means In Practice

Do: name every branch

if fitsHotplug && fitsHost {
    return Hotplug
}
return LiveMigration

Do not: use else as a catch-all degraded path

// BAD: silent fallback
if canHotplug {
    hotplug()
} else {
    sleepAndRestart() // "just in case"
}

The second branch is not a case match. It is a bucket for "everything else," which means any new failure mode silently routes to sleepAndRestart without anyone noticing.

Do: treat the safe path as its own named case, not a fallback

ColdMigration (sleep, reconfigure, wake) is not a degraded fallback. It is the path the system takes when a primary path encounters an error mid-execution. Everything is pre-allocated before the swap, so the interruption is bounded and deterministic.

It has its own tests, its own invariants, and its own reason code. It is not "what happens when we give up."

Do: return typed errors instead of routing to a weaker mode

// GOOD: fail closed
match action {
    ResizeAction::Hotplug => hotplug(spec),
    ResizeAction::LiveMigration => Err(ResizeError::NotImplemented),
    ResizeAction::ColdMigration => Err(ResizeError::NotImplemented),
}

// BAD: silent fallback
if let Err(_) = hotplug(spec) {
    cold_migrate(spec) // hides the hotplug failure
}