Degradation paths must be predefined

What it is

Predefined degradation decides, before a channel fails, where a message goes when audio is unavailable, who owns it, and how fast it must arrive—rather than improvising at runtime once silent mode is on. It turns degradation from exception handling into ordinary design.

Why it happens

Improvising tends toward "just don't send it," because the default state lacks any statement of the message's importance. Defining it up front forces consequence level and required channels to be declared when events are modeled, making degradation an enumerable mapping: when one channel is unavailable, try the next in a fixed order until delivery or an explicit record of non-delivery. A second, quieter benefit: because the substitute path was exercised during development, it is actually available during real failures.

Studying it

Fault injection studies degradation: force silence, disconnect the network, disable haptics, blank the screen, then log each critical event's final destination and delivery latency to find silent losses. Auditing non-delivered events on real devices complements this, since real channel combinations are far richer than any test matrix.

Where it stops holding

Predefinition is not exhaustive enumeration. Channel combinations shift with device, OS version, and third-party accessories, so rules need to cover common cases and keep a safe default—such as the least environment-dependent channel, or handoff to a person. Excessively complex rules cost more to maintain than they return, in which case shrink the set of events declared critical.

Applying it

• Declare priority, required channel, and fallback order per critical event as machine-readable rules, not prose.
• State the termination condition—delivered, acknowledged, or explicitly recorded as undelivered—so retries cannot loop forever.
• Record that degradation happened and which channel finally carried it, for later audit.
• Verification: run fault injection channel by channel and diff the declared event list against actual deliveries; any silent loss is a defect.

Related

• Within the group: D2.05.1 Critical information must move to another channel when sound is muted · D2.05.2 Vibration cannot carry as much information as sound
• Adjacent: D2.11 Muting and category control for sound · D5.08 Fallback when fusion fails
• Search terms: graceful degradation · fault injection · alert routing