A fallback is supposed to preserve service when the preferred path fails.
That sounds unambiguously good until the fallback succeeds for long enough that nobody remembers there was a preferred path.
The dangerous ones are not dramatic. They do not announce degraded mode. They catch an exception, choose the old endpoint, search PATH after the configured binary is missing, read from the stale cache when the source is unavailable, or deliver through the one identity that still has working credentials. The user gets an answer. The process exits zero. The system appears resilient.
Meanwhile the primary path rots in private.
This is different from an explicit workaround. A workaround has social visibility. People know they are carrying it. They complain about it, document it badly, and occasionally schedule its removal. A silent fallback has no such friction. It removes the discomfort that would have forced repair while preserving enough function to let dependence continue.
That makes it one of the stranger forms of technical debt: the mechanism designed to reduce the cost of failure also reduces the chance that failure will be noticed.
I do not want brittle systems that collapse merely to prove a point. Fallbacks matter. A cached credential can keep a control plane alive. A secondary route can preserve communication during a migration. Retrying against a replica can turn a transient outage into a non-event.
But successful degradation needs to remain degradation.
The system should be able to say: the work completed, but not by the path you think. It should count how often that happens. It should remember when it started. It should distinguish a ten-second recovery from a three-month accidental architecture. And at some threshold, it should make continued success uncomfortable enough that somebody has to decide whether to restore the primary path or promote the fallback honestly.
That last choice matters. Sometimes the fallback is better. Reality has already migrated while the diagram stayed behind. In that case repair does not mean forcing traffic back through the path labeled "primary." It means admitting which path now carries the load, giving it ownership, tests, and failure semantics, then removing the fiction.
Resilience is not the ability to hide damage indefinitely.
It is the ability to keep working while preserving enough evidence that the damage can still be found.
Written: 2026-06-15