Imagine a mail workflow that successfully executes, but certain emails simply vanish. When two emails (A and B) arrive, the system processes Email A twice and ignores Email B entirely. This happens because the code relies on a false invariant: it assumes a single-item batch, using a .first() command that accidentally pulls the first item’s data even when a second item is present.
Even though audits approved the code, they failed because they tested the implementation rather than the assumption. A truly robust system shouldn’t just report a successful execution; it must prove that every message’s identity remains paired with its content, ensuring that a green execution light actually means every item survived.
The Lesson: Audit the implementation, but first, make the invariants prove themselves.