Ordinary bugs announce themselves. The expensive ones on a recent client build did the opposite: every one of them reported success, and each cost time proportional to how convincing the false success was.
The site was architected so it renders perfectly with no CMS at all: seed content in plain TypeScript as the floor, CMS getters that fall back to seed on absence, error, or empty result. This is a pattern worth the discipline. You can demo before the client has an account, an outage degrades to yesterday's copy instead of a 500, and an editor who empties a list loses the list, not the page. But the cost is real: a completely broken CMS connection renders a perfect page. Nothing logs. You find out weeks later when the client asks why her edits never appear.
Then the seed script said "wrote 14 documents" and was telling the truth. The studio showed all fourteen. The public API returned one. The cause: a dot in a document ID marks the document private in Sanity, the same rule that hides drafts, and it generalises beyond the drafts prefix. The one ID without a dot came through, which made the failure look partial rather than systematic, which made it harder to find.
And the enquiry form, the single most important component on the site, emailed the raw values of its select fields to a human. She would have received in-person-uk, 50-150, under-2500. Nothing failed, so it shipped. A cousin of the same bug: a send failure swallowed silently is a lost booking presented as a successful one, the worst bug this kind of site can have.
The rule that fell out of all of this: a write is not verified until it has been read back through the same door the users use. Not the write client's success response, not the studio, not looking at the rendered site, because the seed copy is deliberately identical to the CMS copy. Query the public API unauthenticated, and check that an image resolves to the CMS CDN rather than a local path. Text proves nothing. Images are the tell.