Silent failure cannot ship without a declared reason
Context
Empty catch blocks swallowed production errors. One sync failure ran more than a day with no operator signal.
What went wrong
Code review and hope do not scale. A single-line regex gate also missed multi-line empty catches, so green deploys still shipped silence.
What we changed
I added a deploy gate that walks catch braces and fails on empty bodies unless a SILENT-OK reason sits on the catch. The gate is strict on the ship path.
Result
Unjustified silent catches cannot ship. Legitimate swallows must name why next to the code.