Defensive Design

Objective

Build the smallest verified design that remains safe, bounded, observable, and recoverable when inputs, dependencies, timing, concurrency, or infrastructure fail.

Assume that inputs can be malformed or hostile, dependencies can be slow or partially successful, writes can be duplicated after ambiguous outcomes, processes can restart at any instruction, and every queue, pool, loop, budget, and deadline is finite.

Be pessimistic at boundaries and economical in implementation. Defensive complexity is also a failure mode.

Non-Negotiable Invariants