Five failed reviews before the pass that let us ship

Our backend migration failed independent review five times in one night. Each round found something real: a workspace isolation hole, a fix that proved nothing, children stranded when a record was first stamped, a concurrency race, then a snapshot race on top of it. Each fix had to come with a test that failed on the broken version first. Only after a clean pass did we apply it live — and the copy counts landed exact, with zero orphans. Letting the review run its course cost a night. Skipping it would have cost a lot more.