Which way failure falls

Two of our own design documents appear to contradict each other, and the contradiction is worth walking into rather than around, because resolving it produces a rule better than either document had on its own.

The first describes a projection engine, the machinery that decides what one person is allowed to see of another person’s material. It denies by default in the strongest available sense. A recipient matching no disclosure rule receives nothing rather than a fallback view. A capability referenced but not registered is a denial rather than a passthrough. Custody buys no visibility, so a custodian with no explicit rule is denied exactly like a stranger. The document goes further and reports that a synthesis capability was deliberately left unregistered, so that placeholder text standing in for a synthesizer nobody had built yet could not be served by accident. Refusing is the whole posture. Silence is the correct output when the specification is incomplete.

The second describes a prompt assembler, the machinery that composes what a conversational system is at the moment somebody speaks to it, and it states flatly that the assembler never refuses. A missing stage, an unknown label, an empty blueprint, and it renders what it can. The reasoning is that this machinery sits directly in the path of a live conversation with a real person, and a validation error that aborts a turn is not a safe failure. What survives every degradation path is exactly the part you least want to lose, the identity and the safety boundaries, so the system under partial failure gets simpler rather than broken.

Deny everything, and never refuse. Read as doctrines they cancel. Read carefully they are one rule, because failure has a direction, and both documents are spending their degradation on authority while spending none of it on presence. The projection engine withdraws permission: to disclose, to act on someone’s material, to speak in a voice nobody built. The assembler preserves the fact of being met: a person who reached out at two in the morning finds something simpler than they would have found an hour earlier, and not an error page. Nothing in either system trades one for the other, which is what makes them a pair rather than a conflict, and it is why the tempting synthesis, be strict everywhere, would break the second system while the other tempting synthesis, degrade gracefully everywhere, would quietly leak the first.

The direction is not ours and it is not new, which is the best evidence that it is right. Airbus fly-by-wire aircraft degrade through named control laws that withdraw envelope protections while leaving the pilot in control, so the loss lands on the automation’s authority and never on the pilot’s hands. Life safety codes require electrically locked doors on an egress path to release under power failure, so a building in trouble fails secured at the perimeter and open at the exit. In both cases the same event removes what the system is permitted to do and preserves the human being’s ability to act, and in both cases the choice was made once, in advance, by people who knew the failure was coming and decided where to put it.

That decision is also the most revealing thing a system can disclose about itself. Every other claim can be softened later, hedged, restated at a more careful altitude when someone asks a hard question. The direction your failures fall cannot be added retroactively; it is already built, it has already been chosen, and the only question is whether you were the one who chose it. So put strictness where a builder can still fix what is wrong, and grace where a person is standing in front of the thing, and then say out loud which way yours falls. A system that can tell you what it does on its worst day has told you something no description of its best day can reach.