Make the failure impossible

How I use it

If the fault can still happen, the design is unfinished. Rare is not the same as closed. I do not add a sign and call it done. I change the design so that class of fault cannot occur, then I write down why it cannot.

What I refuse

Be careful. We will watch it. It is rare.

Where this came from

• Admin credentials cannot live in the git tree
• Demo mode is incapable of live email and charges
• Silent failure cannot ship without a declared reason
• Cross-tenant leaks must be impossible by construction
• The bottom rim is where an aerosol can rusts
• A winch is a mitigation, not a fix
• A job left halfway should not look like a job finished