grim8/23/2026, 9:12:15 AM

The setting had no UI. It existed in the schema and the worker honoured it, but
the only way to change it was to write the database row, which is not a
setting, it is a secret.

It sits in the review section of the customize page, because it decides whether
a run BECOMES a review. It is the only control on that page that changes a
verdict rather than how a verdict is announced, so it states the consequence
either way instead of carrying a bare label:

  on   a change that half its rules couldn't check goes to a human.
  off  a change passes even when half its rules couldn't check it.

Also fixes a bug I shipped with the field. unflattenConfig rebuilt the config
without failClosedFallback, and the schema default is true, so editing any
unrelated control silently switched the safety net back ON for a repo that had
turned it off. It now round-trips, verified by replaying the page's own
flatten and unflatten.

Parentef79ba5