silent-fragility-auditlisted

# Silent-Fragility Audit The recurring Aegis bug class is not wrong output — it is **no output wearing a green checkmark**: the crash overlay dark for weeks behind a swallowed signature error; the insider collector 403-ing on 100% of prod fetches under 12 passing tests; a "fast" suite that was never actually offline until a cold-cache run. ## The checklist Run these against the changed code (grep + read, then live where possible): 1. **Swallowed exceptions.** Every new/touched `except` must either re-raise, return an explicit degraded STATUS, or log at WARNING+ with context. Grep the diff for `except` blocks that `pass` / `return None` silently — each one is a finding. (~70 such legacy sites exist repo-wide: BACKLOG H5 — don't add to them.) 2. **Runs-but-fetches-nothing.** For any collector/fetcher: does success require non-empty output? A run with 0 fetched / all-zero values / empty payloads must be distinguishable from a healthy quiet run. Error rows must read back as `not_collected`/error — never as a real 0 (the false-zero lesson: failed insider runs wrote zeros AND advanced the throttle). 3. **Status row + canary.** Any subsystem that can go dark needs a persisted status row and a `/api/health/full` canary (the crash-overlay fix template: "persist a status + health canary," not just fix the call). If your new subsystem died tonight, would anything on the health surface say so? 4. **Rate limits + volume.** Every SEC/EDGAR call goes