“Building in resilience is also known as defensive design: a system shouldn’t break wholly if a single part of it fails or isn’t supported.”