A backup that is not a backup is just a second way to fail.

Last week a main line at an East Coast air-traffic center went down. The system switched to the spare. The spare was already dead. A construction crew had cut the fiber. Flights across a whole region stopped for hours. Thousands of planes sat. People missed the day they had paid for.

That is not a tech story. That is a design story.

A spare that shares the same ditch, the same crew, and the same day of failure is not a spare. It is a second copy of the same weak point.

Fragile companies do this all the time. They buy a second vendor and put both on one contract. They add a second site and run it through one switch. They name a deputy and never give that person the authority to stop the work. On a calm Tuesday it looks like care. On a bad Monday it all goes dark together.

An antifragile company treats a spare as a real second path.

It does not live in the same trench. The person who can see the cut can halt the flow. The core that must not fail is walled off from the work you can pause. After the shock, you do not only patch the line. You kill the design that let one shovel stop a region.

If your “backup” dies the same hour as the main line, you do not have a backup. You have a story you tell the board.

Build so the next cut is information, not a ground stop.