>In both cases some models were used to justify the decision, with wild extrapolations and fundamentally, a design that wasn't expected to fail in that mode /at all/.

Because, and it speaks volumes that nobody ever circles back around to this, that is absolutely f-ing normal. If everyone ran around like the sky was falling every time some widget made it into service and some unexpected thing was noticed nothing would get done.

"hey we disassembled this gearbox and there's a little rust from condensation + chemistry = cyclic usage, we better take a look at it"

"we've taken a look at it and the corrosion is forming because X, this is fine because the surfaces that can't rust see lubricant flow and the per our calculations the maximum amount of rust into the lube is Y and since the service interval is Z this is fine, tests confirm this."

^ the above happened for a multimillion dollar per hour of downtime gearbox. That was 40yr ago. It was in fact fine. I know it was fine because they added venting suggestions to the docs and the client balked because they bought another one in the 2010s and a bunch of "we went over this when it was installed and it was fine then and the building is even more tightly humidity controlled than it was in the 1980s" back and fourth whining ensued.

You don't know how many other things they noticed when they put the shuttles into service that did in fact turn out to be perfectly fine. It's real easy to be smug in hindsight but good luck trying to pick the needle out of the haystack in advance.

Now obviously the shuttle people flubbed it and much has been writtenn about it, but the point still sands.