Business Adjacent · Flight Log · FL-031
·factory·locked
Faults must be impossible, not merely rare
Signal
"Probably safe" fails at platform scale. Unlikely times volume becomes certain.
Wrong turn
Add monitoring and hope after a near-miss instead of closing the category.
Correction
Prefer construction over checklist. Drop silent defaults. Throw at the boundary. Derive gates from live schema and code so the unrecognized fails closed.
Tesla's local-compute framing is the template: the right design does not make a remote hack improbable. It removes the remote attack surface as a category.
The same standard applies to tenant scope, session flicker, silent catch blocks, and hand-maintained truth. If a fault can still happen when everyone is careful, the architecture is unfinished.
This LOCK is how Continuous Mode stays honest: velocity only compounds when the factory refuses to ship open categories of failure.