How a randomized invariant test found a billing bug none of my example tests could, and why the fix needed a lock.

An admin cancels a lesson, so the student's charge is reversed. Later a teacher tidies up the attendance journal and clears the mark, and the charge is reversed again. The student ends up credited for a lesson they never paid for.

Each of those three operations was correct on its own, and every example test I'd written passed. A test that threw random operations at a real database found the bug on its first run. Here's how.

The setup

I'm the sole engineer of the platform behind an online school with 300+ active students a month. Teachers and admins mark attendance, and every billable mark charges the student for the lesson. Lessons get re-marked, cleared and cancelled, often by different people at the same time.

I pulled the money-handling core out into a public repo, edtech-billing-core , rewritten on plain PostgreSQL so every lock and constraint is visible.…