Except that the outage would still have happened without that .unwrap(). So go ahead and build those features, they sound useful, but don't think that they'd sa

Except that the outage would still have happened without that .unwrap(). So go ahead and build those features, they sound useful, but don't think that they'd save you from a failure like this. As the poster here said, the place to build in features that would have prevented this from happening is the DB schema and queries. 5NF would be onerous overkill here, but it seems reasonable to have some degree of forced normalization for something that could affect this much. (Requiring formal verification of everything involved here would be overkilling the overkill, otoh.)