We added a deterministic sort to stop a language model's ordering preference from deciding which questions our pipeline asked. The sort was correct and well tested. It ran on a list that had already been truncated by its own caller, so it only ever reordered a slice the model had chosen. Five unit tests passed throughout, because they tested the sort in isolation and the defect lived one function up.
The lesson generalises: a guarantee that sits downstream of a silent truncation is not a guarantee. Test the seam, not the function.