# Silent Failures Cost More Than Loud Ones ## Claim A defect that produces wrong behaviour without signalling costs more in total than one that crashes, because detection time dominates repair time. <!-- atomicity: 1 idea ✓ --> ## Evidence **Source**: [[3. Resources/Readwise/Articles/WordPress 7.1 Is Coming. Are Your Custom Blocks Ready]] — Ryan Welcher on the iframed post editor > [!quote] > No error, just wrong, which is worse than an error. The iframed editor is an unusually clean demonstration because *every* failure mode it introduces is silent, and they are silent for different reasons. `window.innerWidth` returns the admin window's width — a real number, plausibly sized, simply not the one you asked for. A click-outside listener never fires, because DOM events do not cross an iframe boundary; nothing errors, the dropdown just stays open. A stylesheet loads with HTTP 200 and applies to nothing. A CSS selector matches zero elements. A third-party library's `document.querySelectorAll` finds nothing and enhances nothing. None of these throws. Each produces a system that runs, returns, and is wrong. The economics follow directly. A crash is expensive at the moment it happens and cheap to find — it announces its location and its time. A silent defect is cheap at the moment it happens and expensive to find, because discovery requires someone to notice that a correct-looking result is incorrect, and then to search a space with no marker in it. Repair is usually the same work in both cases; Welcher's fix for most of these is a two-line diff. What differs is everything before the repair. ## Scope & conditions - **Holds** where the wrong output is plausible enough to pass casual inspection, and where the affected path is exercised by users rather than by tests. - **Breaks** where the loud failure is catastrophic and irreversible — data loss, security compromise, a destructive migration. Crashing later can be far worse than being quietly wrong now, and the ordering matters more than the volume. - **Breaks** where silence is cheaply detectable by monitoring or invariants, which converts it into a loud failure at the cost of building the detector. - **Weakens** where the silent failure is self-limiting — a cosmetic style that fails to apply is silent and nearly free. - **Sharpens** with fluency: the more polished the wrong output, the longer detection takes. ## Links - [[3. Resources/Permanent Notes/Fluency Makes Small Errors Harder to Catch Than Large Ones]] — because extends: fluency is the mechanism that makes a wrong result survive inspection, so it is the same cost curve applied to generated prose rather than to code. - [[3. Resources/Permanent Notes/The Maker Should Not Grade Its Own Homework]] — because applies-in: independent checking exists largely to surface what silence hides; a maker checking its own output has no signal to react to. - [[3. Resources/Permanent Notes/A Nondeterministic Check Breaks the Loops Stop Condition]] — because contrasts on how a check fails: a flaky checker is loud but unreliable, a silent defect is reliable but invisible. Both break unattended operation, differently. - [[3. Resources/Permanent Notes/A Defense Experts Fail Is Not a Defense for Users]] — because extends: malicious AUR updates are the security instance — they run correctly from the user's point of view, which is exactly the property that made them survive review. - [[3. Resources/Permanent Notes/Declaring Readiness Is Not Becoming Ready]] — because extends: a self-declared compatibility flag is a silent failure in governance form, since nothing signals when the declaration is false. - [[AI & the Future of Knowledge Work MOC]] — because applies-in. - [[3. Resources/Permanent Notes/A Developer Who Goes Quiet Is Telling You the Explanation Failed]] — extended by: read silent drop-off as a failed explanation before lack of interest (Murray). ## Implications - Review and testing budgets should be allocated by *detectability*, not by apparent complexity. The subsystem that cannot fail loudly deserves the disproportionate attention. - It is a strong argument for invariants, assertions, and type boundaries whose entire purpose is converting silence into noise — their value is not correctness but *announcement*. - For migrations specifically, the practical rule is that a breaking change which throws is a smaller problem than one which degrades, and should be preferred where the platform gets to choose. - The organizational tell is a bug report closed as "cannot reproduce." That phrase frequently marks a silent, context-dependent failure rather than a mistaken reporter. ## Open Questions - Is the cost difference measurable — mean time to detection for silent versus loud defects, holding severity constant? - At what point does converting silence into noise become counterproductive, given alert fatigue is itself a detection failure? - Does the rise of generated code shift the balance, if generated defects are systematically more plausible than hand-written ones? ## Source - [[3. Resources/Readwise/Articles/WordPress 7.1 Is Coming. Are Your Custom Blocks Ready]] — six silent failure modes from a single root cause, and the two-line fixes