Fail-closed is not a switch: six places where it quietly becomes fail-open — NullRun