余量的消失：为什么最该留下的东西，总是最先被优化掉
Safety factors, spare capacity, cash buffers — these things only do their work on the days when nothing goes wrong, and a day when nothing goes wrong is exactly what makes them look superfluous. The real question is not whether to keep slack but whether slack can be seen, priced, and tested
1. A Thing That Never Appears on the Books
In 1954, two Comet airliners broke up in flight. This was the world's first jet airliner in commercial service, and the accident investigation — together with the full-scale pressure-cabin fatigue tests that followed — pointed to something the engineering profession had not yet taken seriously enough: the skin of a pressurized fuselage develops fatigue cracks under repeated pressurization cycles, and the cracks began near the square windows and rivet holes, where stress concentrates. Airliner windows became rounded.
The physical basis had been laid out in 1920, when A. A. Griffith published in the Philosophical Transactions of the Royal Society A (volume 221) an explanation of why glass breaks far below its theoretical strength. The gap comes from microscopic cracks that cannot be eliminated; at a crack tip, stress is multiplied many times over. Strength is not a property of a material. It is a property of the material plus its defects.
Engineering's response was not to eliminate defects — that is impossible — but to leave margin: multiply design loads by a factor greater than one, hold allowable stress below measured strength, and arrange for the structure to survive an unanticipated defect, an accidental overload, a mistaken assumption.
The striking thing is that a safety factor does nothing. It produces no thrust, carries no signal, performs no function. Its only job is to convert "failure" into "still working" on the day something goes wrong. Which raises the question this essay is about: if margin matters this much, why is it always the first thing cut?
2. Margin Exists Only in the Counterfactual
When a system runs well, the fact we observe is that nothing happened. And "nothing happened" cannot be attributed. It might mean the design was good, or that we were lucky, or that margin absorbed a deviation that would otherwise have become an accident. These three explanations are observationally identical.
Accounting handles this with precision: costs that do not occur are not recorded. What a standby generator is worth on the day the grid fails cannot be booked in advance; its only definite appearance in the accounts is purchase cost and depreciation. Redundancy therefore always enters the ledger with a minus sign, while the benefit it produces takes the form of nothing at all.
Three consequences follow, and none of them is a moral problem. They are problems of observation:
- The gains from cutting margin are immediately visible — lower cost, faster turnover, better metrics — while the gains from keeping it are invisible, because nothing happened.
- The costs of cutting margin arrive late, and they arrive unsigned: by the time the failure lands, the person who made the decision has usually left the table.
- Any evaluation system centred on efficiency will therefore systematically overprice margin and underprice its absence. Not because managers are short-sighted, but because half of what matters is structurally unobservable to them.
3. Three Routes by Which Margin Disappears
Route one: the language of efficiency reads idle capacity as waste
Lean production, zero inventory, capacity utilization, output per head — this vocabulary shares one hidden premise: a resource that is not being used is a resource being wasted. It has delivered enormous cost reductions, and it has also exposed real fragility. During the 2021 global chip shortage, several automakers halted entire assembly lines over components worth a few dollars. The problem was not that they could not afford the chips. It was that, under a zero-inventory rule, they never held the extra few.
Route two: success itself redefines what counts as normal
In Thinking in Systems, Donella Meadows describes a structure she calls "drift to low performance": the gap between actual and desired performance is closed not by raising performance but by lowering the target. The longer the safety record, the less margin counts as normal — because after ten years without an incident, that margin looks like something kept for nothing.
This is the most insidious route, because nobody has to cut anything. Every year without an accident supplies the argument for the next reduction.
Route three: the people who cut are not the people who bear the cost
If the benefit of cutting margin accrues now and to you, while the cost accrues later and to someone else, cutting is the rational choice. The countercyclical capital buffer introduced under Basel III is a direct answer to this structure: it requires banks to build capital during credit booms — that is, to hold margin precisely when margin looks least necessary. The design rests on a candid admission: in good times, no voluntary margin survives competitive pressure, so it has to be mandated.
4. The Counterargument: Margin Has Costs, and It Hides Problems
If the argument stopped here, it would collapse into the platitude that backups are always good. The counterargument is strong and has to be met.
First, buffers delay signals. Once fluctuations are absorbed by a buffer, managers see a smoothed curve rather than the actual disturbance. The thicker the buffer, the later the feedback; by the time it is exhausted, the problem has usually been accumulating for a long while. Meadows treats buffers and delays as the two most commonly misread features of systems for exactly this reason: a buffer does not remove volatility, it postpones the bill.
Second, redundancy degenerates into shifting the burden. When a system has a structural defect, adding a buffer is always cheaper than fixing the structure, so the buffer becomes concealment. Meadows calls this "shifting the burden": the symptom is relieved, the root cause is preserved, and because the symptom is gone, so is the motive to repair it. Inventory that hides a fragile supply chain, overtime that hides understaffing, a lender of last resort that hides a broken balance sheet — all one structure.
Third, redundancy has real resource costs and can rigidify an organization. Over-provisioning is not the same as safety; it merely converts one risk into another — slower response, locked-up resources, errors that never surface. Taleb defends redundancy in Antifragile, but his defence is conditional: redundancy is valuable because it preserves the capacity to act after a shock, not because accumulation is good in itself.
So the conclusion is not that more margin is better. Margin is insurance, not repair. Using insurance as repair trades money for a lesson that should have been learned.
5. The Judgement: Turn Margin from a Quantity Problem into an Observability Problem
If the core difficulty is that margin cannot be observed, the remedy has to start with observability. Three tests:
- Is the cost explicitly priced, and booked to the party that benefits? Whoever enjoys the stability should carry its cost. When cost and benefit are split across two parties or two fiscal years, margin will be cut — this is not a detail of incentive design but the decisive variable.
- Is it tested on a schedule? Margin that has never been tested is margin that does not exist. The N-1 criterion in power systems works because it is written as a testable rule: the loss of any single element must not destabilize the system. It is not advice to leave room; it is a check that can be applied again and again. Stress tests, fire drills, and fault injection belong to the same family.
- Is there an independent gatekeeper? The person who holds margin cannot also be the person measured on efficiency. This is the hardest test organizationally, because it requires a role outside the efficiency contest to hold a veto — and in good times that role always looks superfluous.
The limits must be stated too: margin buys time, not safety. Against genuinely unknown failure modes — the ones not in the model — any margin only raises the probability of survival and lengthens the window to react. It cannot guarantee survival. So the final question is not whether to hold margin, but this: when this system fails, does it degrade, or does it go to zero?
Where failure is zero-sum — nuclear plants, vaccines, flight control — the value of margin has nothing to do with cost, and no cost-benefit calculation applies. Where failure is degrading — a week's delay, a quarter of forgone profit, a different route — margin can be priced, and therefore argued about rationally.
Margin gets cut not because people are short-sighted but because in normal times it has no observable form. The only way to keep it is to give it one: a criterion written into procedure, a test that is actually run, a gatekeeper who is not measured on efficiency. Without that, every warning to leave room will lose, at the next budget meeting, to a prettier number.
