Day one of having tests
Four years, zero automated tests. Now every economy guard is pinned by a suite that runs on every edit - and every test had to prove it could FAIL before we trusted it.
Confession: this project was four years old and had no automated tests. Every fix from the security work had been verified by hand, once, with nothing stopping a future change from quietly undoing it.
The first suite pins exactly the things that must never regress: currency can’t go negative under any barrage of concurrent spends, a match can only be completed once no matter how many requests race for it, and the child-safety red lines - nothing random purchasable for real money, ever - fail the build if any code path reopens them. A second layer runs against a real local copy of the production schema, because races only exist on a real database.
House rule, learned the hard way: before any test is trusted, we re-introduce the bug it guards against and watch it go red. A test that cannot fail is decoration. And the fast layer now runs automatically on every single edit to a service file, so a regression surfaces in the same breath as the mistake.