Failure-Path Review

Happy paths verify themselves: development exercises them, demos exercise them, the first day in production exercises them. Failure paths run only when things go wrong — which is rare, unobserved, and usually concurrent with an incident — so they rot silently. A multi-package review of five broker/durable integrations found exactly this split: every happy path sound, and a defect list consisting entirely of poison handling, redelivery, shutdown, and recovery. Review the unhappy paths as their own deliberate pass, because nothing else will.

The review targets any system that processes work it didn't synchronously receive: message consumers, queue workers, background loops, schedulers, relays, durable workflows.

The passes

Full sweep in references/review-passes.md, with the checklist form in references/review-checklist.md. What they all share: failure code only runs when things go wrong, so it is the code least likely to have been executed even once before it matters.

The seven questions each pass is an instance of: