The API was lying to me by being fine

Six suites passing in isolation did not mean the system worked. Executing every documented step, in order, surfaced seven defects. The most instructive were the ones no test had reached.

The flagship scenario, the one the whole architecture exists for, returned the wrong answer. The ownership check compared the current assignee against the caller before conflict detection ran, so a driver reassigned away while offline was rejected outright and never reached the resolver that should have ruled in his favour. Fixing that exposed a second defect immediately behind it: the transition-legality check validates against the row current status, which is what the office conflicting edit had just set. A second, independent check was silently reimposing administrative precedence one step after the resolver had ruled the opposite. Nothing had ever got far enough down the pipeline to hit it.

A multi-line order whose second line failed left the first line stock decrement applied. Root cause: the insufficient-stock branch used return rather than throw, and the transaction helper only rolls back on a thrown error. A plain return looked like success, so the transaction committed, permanently applying every earlier decrement while reporting the order as rejected. One keyword.

The signature metric was structurally unreachable: it was observed only inside a worker with its own private registry, no HTTP server, and no scrape target. Confirmed by pushing a real delivery through the pipeline and watching the number stay at zero on the endpoint being scraped. And a consumer had been dying roughly thirty seconds after every stack start on a transient broker race, with no restart policy, which means half the event pipeline had been offline in every session since the first one, with no crash loop and no failing healthcheck to indicate it.

The worst was self-inflicted. After adding distributed tracing, the API reported a mutation as applied with an incremented version while the row in Postgres never changed. Verified three times against a side-by-side uninstrumented container on a second port sharing the same database. That is worse than a crash, because a crash tells you: this was the API confidently reporting that a driver delivery was recorded when it was not, caused by the tooling added to make problems visible. Shipped with database instrumentation disabled and the incompatibility documented, rather than trading correctness for a nicer trace.