A violation of The Sensor.
A Silent Fallback is code that swallows a failure and hands back a fake success. The error happens, and then it disappears, replaced by a default, a None, or a shrug. The caller is told everything is fine. Everything is not fine.
The tell: try/except: pass. A retry that returns None when it runs out of attempts, so three failures look exactly like one. A default value that quietly stands in for missing data. A rate limiter that “fails open” when its store is unreachable, turning an outage into a thundering herd.
The reason it is so corrosive is that it destroys the very signal the Sensor depends on. A loud failure is a gift: it tells you where to look. A silent one converts a sharp, locatable error into a diffuse, untraceable wrongness that surfaces somewhere else entirely, hours later, far from the cause.
The discipline is blunt: do not swallow failures. Raise, or return an explicit, named failure the caller has to handle. If you must absorb something, log it loudly, with context, and say in a comment why.
A small but typical example is a config default like os.environ.get("SERVICE_URL", "http://localhost:8090"). Missing configuration does not fail here. It silently becomes a guess that happens to work on exactly one machine, and breaks everywhere else with no error pointing back to the cause.