Nothing happening and everything working produce the same observation.
This is the premise underneath a family of rules in this record, and it was never stated because each rule looks self-evidently right on its own. Written down, it explains why they are the same rule wearing four coats, and it predicts where the fifth will be.
| the silent thing | what it looks like from outside |
|---|---|
| a tool that no-ops on an input it can’t handle | a tool that ran and found nothing to do |
| a guard nobody has ever fired | a guard that has never had cause to fire |
| a hand list missing one entry | a hand list that is complete |
| a default nobody chose | a default someone chose |
| a measurement of nothing | a measurement of no change |
Every row is a real bug shape, and every one passes review, because review looks at the output and the output is correct-looking. That is the whole mechanism: these failures are not hard to fix, they are hard to see, and the thing that hides them is the same thing in each case — the failing path emits nothing, and nothing is what success emits too.
What follows from it
Each of these already exists here as its own principle, and each stays its own principle because the remedies differ. What they share is this diagnosis:
- DP-001 — a refusal that says nothing reads as a broken tool. Remedy: the refusal explains itself.
- DP-003 — rung three is the polarity rule, and fail-stale is singled out as the never-acceptable one precisely because it is the silent polarity. Remedy: derive, or guard the property, or choose a polarity that is not silence.
- DP-006 — provisioned is not working; an unfired guard reports what a working one reports. Remedy: sabotage it once, and record that you did.
- DP-010 — the silent position of a switch is the one that ships, so it should be the position whose failure is visible. Remedy: guards default on, disclosures default off.
Four different remedies for one diagnosis, which is why folding them together would lose more than it saved: a merged principle’s advice section would be a disjunction, and a reader arriving with a concrete problem would have to guess which arm applies.
The corollary
A test can have this shape too, and then the safety net has the bug. An assertion that cannot fail passes exactly as loudly as one that can, so a suite can grow a hole that reports itself green — the same defect one level up, where it is least likely to be looked for. The strata-g record states this as its own principle, arrived at independently (SG-DP-022): before believing a comparison, require a non-zero count of whatever was counted, and perturb something the measurement should detect to confirm the reading moves.
That is the general form of the remedy, and it is worth stating as an instruction rather than an observation: for any silent path, either make it emit, or make the emitting case the only reachable one. Counting the deviations is the second-best option and is what DP-010 settles for; it works because a count of zero is itself a signal.