Why use panic here instead of handling the error, if it ended up breaking half the internet?
https://blog.cloudflare.com/18-november-2025-outage/
I was reading the postmortem about the recent outage where a Rust service had a hard limit of 200 machine-learning features. The code preallocated memory for up to 200 features, and if a file with more than 200 features arrived, it hit an unwrap() and panicked, which then caused a wave of 5xx errors and took down a huge chunk of the internet.
What I don’t understand is: why design this as a panic instead of a normal error path?
Why not handle the case “> 200 features” by allocating the required memory (maybe with some upper bound), logging the unexpected input, and/or rejecting just that request, instead of crashing the whole worker and cascading the failure?
In other words, what are the solid engineering reasons to treat this as an unrecoverable invariant violation rather than a recoverable error, especially when this choice ended up affecting so much of the internet?