Tracing every model call: the rule only holds if a test holds it
"We trace everything" is an intention, not a guarantee: one new code path is enough to open a hole nobody sees. What holds the rule is a test that freezes the inventory of call sites — plus two traps that cost me time.