The PR was 14 lines.

The incident cost two days.

Tests passed. Code review approved. Production corrupted customer orders anyway.

Someone refactored OrderService. One method call moved outside DB::transaction().

The email notification failed mid-request.