Every check passed, and two of them were testing nothing
This one comes from Harness Kit, one of my open-source harnesses. A green test suite felt like proof, so I tried something blunter: delete each check, one at a time, and run the suite again. Two checks could be removed with every test still passing. One of them was the only thing stopping a file name from forging a record the harness trusts.
Two rounds of careful review had missed both. One deletion run found them in minutes. Now it’s a rule: for every check, delete it and confirm a test goes red. It’s the same lesson as looking at the real screen: a pass only means something if a failure would have been caught.