diff --git a/include/crm/pengine/common.h b/include/crm/pengine/common.h
index 3a770b7..2737b2e 100644
--- a/include/crm/pengine/common.h
+++ b/include/crm/pengine/common.h
@@ -22,18 +22,29 @@ extern "C" {
 extern gboolean was_processing_error;
 extern gboolean was_processing_warning;
 
-/* order is significant here
- * items listed in order of accending severeness
- * more severe actions take precedent over lower ones
+/* The order is (partially) significant here; the values from action_fail_ignore
+ * through action_fail_fence are in order of increasing severity.
+ *
+ * @COMPAT The values should be ordered and numbered per the "TODO" comments
+ *         below, so all values are in order of severity and there is room for
+ *         future additions, but that would break API compatibility.
+ * @TODO   For now, we just use a function to compare the values specially, but
+ *         at the next compatibility break, we should arrange things properly.
  */
 enum action_fail_response {
-    action_fail_ignore,
-    action_fail_recover,
-    action_fail_migrate,        /* recover by moving it somewhere else */
-    action_fail_block,
-    action_fail_stop,
-    action_fail_standby,
-    action_fail_fence,
+    action_fail_ignore,     // @TODO = 10
+    // @TODO action_fail_demote = 20,
+    action_fail_recover,    // @TODO = 30
+    // @TODO action_fail_reset_remote = 40,
+    // @TODO action_fail_restart_container = 50,
+    action_fail_migrate,    // @TODO = 60
+    action_fail_block,      // @TODO = 70
+    action_fail_stop,       // @TODO = 80
+    action_fail_standby,    // @TODO = 90
+    action_fail_fence,      // @TODO = 100
+
+    // @COMPAT Values below here are out of order for API compatibility
+
     action_fail_restart_container,
 
     /* This is reserved for internal use for remote node connection resources.
@@ -44,6 +55,7 @@ enum action_fail_response {
      */
     action_fail_reset_remote,
 
+    action_fail_demote,
 };
 
 /* the "done" action must be the "pre" action +1 */
diff --git a/lib/pengine/unpack.c b/lib/pengine/unpack.c
index 3c6606b..f688881 100644
--- a/lib/pengine/unpack.c
+++ b/lib/pengine/unpack.c
@@ -2770,6 +2770,78 @@ last_change_str(xmlNode *xml_op)
     return ((when_s && *when_s)? when_s : "unknown time");
 }
 
+/*!
+ * \internal
+ * \brief Compare two on-fail values
+ *
+ * \param[in] first   One on-fail value to compare
+ * \param[in] second  The other on-fail value to compare
+ *
+ * \return A negative number if second is more severe than first, zero if they
+ *         are equal, or a positive number if first is more severe than second.
+ * \note This is only needed until the action_fail_response values can be
+ *       renumbered at the next API compatibility break.
+ */
+static int
+cmp_on_fail(enum action_fail_response first, enum action_fail_response second)
+{
+    switch (first) {
+        case action_fail_reset_remote:
+            switch (second) {
+                case action_fail_ignore:
+                case action_fail_recover:
+                    return 1;
+                case action_fail_reset_remote:
+                    return 0;
+                default:
+                    return -1;
+            }
+            break;
+
+        case action_fail_restart_container:
+            switch (second) {
+                case action_fail_ignore:
+                case action_fail_recover:
+                case action_fail_reset_remote:
+                    return 1;
+                case action_fail_restart_container:
+                    return 0;
+                default:
+                    return -1;
+            }
+            break;
+
+        default:
+            break;
+    }
+    switch (second) {
+        case action_fail_reset_remote:
+            switch (first) {
+                case action_fail_ignore:
+                case action_fail_recover:
+                    return -1;
+                default:
+                    return 1;
+            }
+            break;
+
+        case action_fail_restart_container:
+            switch (first) {
+                case action_fail_ignore:
+                case action_fail_recover:
+                case action_fail_reset_remote:
+                    return -1;
+                default:
+                    return 1;
+            }
+            break;
+
+        default:
+            break;
+    }
+    return first - second;
+}
+
 static void
 unpack_rsc_op_failure(pe_resource_t * rsc, pe_node_t * node, int rc, xmlNode * xml_op, xmlNode ** last_failure,
                       enum action_fail_response * on_fail, pe_working_set_t * data_set)
@@ -2829,10 +2901,7 @@ unpack_rsc_op_failure(pe_resource_t * rsc, pe_node_t * node, int rc, xmlNode * x
     }
 
     action = custom_action(rsc, strdup(key), task, NULL, TRUE, FALSE, data_set);
-    if ((action->on_fail <= action_fail_fence && *on_fail < action->on_fail) ||
-        (action->on_fail == action_fail_reset_remote && *on_fail <= action_fail_recover) ||
-        (action->on_fail == action_fail_restart_container && *on_fail <= action_fail_recover) ||
-        (*on_fail == action_fail_restart_container && action->on_fail >= action_fail_migrate)) {
+    if (cmp_on_fail(*on_fail, action->on_fail) < 0) {
         pe_rsc_trace(rsc, "on-fail %s -> %s for %s (%s)", fail2text(*on_fail),
                      fail2text(action->on_fail), action->uuid, key);
         *on_fail = action->on_fail;
@@ -3675,7 +3744,8 @@ unpack_rsc_op(pe_resource_t *rsc, pe_node_t *node, xmlNode *xml_op,
 
                 record_failed_op(xml_op, node, rsc, data_set);
 
-                if (failure_strategy == action_fail_restart_container && *on_fail <= action_fail_recover) {
+                if ((failure_strategy == action_fail_restart_container)
+                    && cmp_on_fail(*on_fail, action_fail_recover) <= 0) {
                     *on_fail = failure_strategy;
                 }