Prefer decodeOrder, which says WHY a row could not be read instead of
handing back a placeholder. A row that fails an identity check has no honest
Order form, because OrderSide has no unknown member and so the
placeholder cannot say "side unreadable". It marks the whole record instead,
with status: 'unknown', which is inert in every consumer: they all gate on
status === 'working' before drawing or acting on a row. The broker's own
word is passed through rather than replaced, because showing FOO is honest
and showing BUY is exactly the fail-open this replaced.
getOrders does not use this: it quarantines such rows outright.
Total row mapper, kept for the published surface.
Prefer
decodeOrder, which says WHY a row could not be read instead of handing back a placeholder. A row that fails an identity check has no honestOrderform, becauseOrderSidehas no unknown member and so the placeholder cannot say "side unreadable". It marks the whole record instead, withstatus: 'unknown', which is inert in every consumer: they all gate onstatus === 'working'before drawing or acting on a row. The broker's own word is passed through rather than replaced, because showingFOOis honest and showingBUYis exactly the fail-open this replaced.getOrdersdoes not use this: it quarantines such rows outright.