The PR was 14 lines.
The incident cost two days.
Tests passed. Code review approved. Production corrupted customer orders anyway.
Someone refactored OrderService. One method call moved outside DB::transaction().
The email notification failed mid-request.






